cursedbelt-server 3.0.0 → 4.0.0

package/src/server/private-media/pipeline.ts

@@ -1,170 +0,0 @@
-import { mkdir, readdir, rm, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import type { ProcessingStatus } from 'cursedbelt-core/media';
-import {
-  hlsLadderArgs,
-  isFfmpegAvailable,
-  LIBRARY_CRF,
-  probeVideoStream,
-  resolveLadder,
-  runFfmpegProgress,
-} from '../media-bun';
-import {
-  type MediaStore,
-  privateHlsFileKey,
-  privateHlsMasterKey,
-  privateSourceKey,
-} from '../storage/types';
-import { cryptBlobStream, generateContentKey, wrapContentKey } from './crypto';
-
-// ── Encrypted-HLS pipeline (private media) ──────────────────────────────────────
-// Transcodes a private upload into an AES-128-encrypted HLS ladder: ffmpeg encrypts every
-// segment with a per-item content key (via a key-info file), so the segments are ciphertext at
-// rest (Spotlight-safe, opaque names) AND safe to edge-cache — the player fetches the content
-// key from the gated key route and decrypts client-side (fast). The plaintext source is staged
-// only in the work dir and never persisted; only the encrypted segments + playlists are stored.
-// The content key is returned WRAPPED under the caller's set key (server-held or password-derived).
-
-const KEY_URI = 'enc.key'; // relative in the playlist → the gated key route serves it per-video
-
-export type PrivateProcessResult = {
-  status: ProcessingStatus;
-  durationSeconds: number;
-  hasHls: boolean;
-  /** The AES-128 content key + IV, wrapped under the caller's set key. Null if processing failed. */
-  wrappedContentKey: string | null;
-};
-
-export type PrivateProcessOptions = {
-  store: MediaStore;
-  /** Scratch dir for ffmpeg I/O + the transient key file (cleaned up afterwards). */
-  workDir: string;
-  owner: string;
-  id: string;
-  /** Local PLAINTEXT source, staged by the caller; never persisted (deleted with the job dir). */
-  sourcePath: string;
-  /** The mode key (server-held or password-derived) the content key is wrapped under. */
-  setKey: Buffer;
-  ladderHeights?: number[];
-  onProgress?: (status: ProcessingStatus, pct: number) => void;
-};
-
-async function uploadTree(store: MediaStore, dir: string, owner: string, id: string) {
-  const walk = async (rel: string): Promise<void> => {
-    const entries = await readdir(path.join(dir, rel), { withFileTypes: true });
-    for (const e of entries) {
-      const childRel = rel ? path.join(rel, e.name) : e.name;
-      if (e.isDirectory()) {
-        await walk(childRel);
-      } else {
-        const mime = e.name.endsWith('.m3u8') ? 'application/vnd.apple.mpegurl' : 'video/mp2t';
-        const file = Bun.file(path.join(dir, childRel));
-        await store.putStream(privateHlsFileKey(owner, id, childRel), file.stream(), mime, {
-          contentLength: file.size,
-        });
-      }
-    }
-  };
-  await walk('');
-}
-
-export async function processPrivateVideo(
-  opts: PrivateProcessOptions,
-): Promise<PrivateProcessResult> {
-  const { store, workDir, owner, id, sourcePath, setKey, onProgress } = opts;
-  const report = (s: ProcessingStatus, p: number) => onProgress?.(s, p);
-  const failed: PrivateProcessResult = {
-    status: 'failed',
-    durationSeconds: 0,
-    hasHls: false,
-    wrappedContentKey: null,
-  };
-
-  // Private media MUST be encrypted — unlike public it can't degrade to a plaintext fallback.
-  if (!(await isFfmpegAvailable())) return failed;
-
-  const jobDir = path.join(workDir, owner, id);
-  await mkdir(jobDir, { recursive: true });
-
-  try {
-    report('processing', 1);
-    const probe = await probeVideoStream(sourcePath);
-
-    // Mint the AES-128 content key + write the ffmpeg key-info file (key URI / key file / IV).
-    const content = generateContentKey();
-    const keyFile = path.join(jobDir, 'enc.key.bin');
-    await writeFile(keyFile, content.key);
-    const keyInfoFile = path.join(jobDir, 'enc.keyinfo');
-    await writeFile(keyInfoFile, `${KEY_URI}\n${keyFile}\n${content.iv.toString('hex')}\n`);
-
-    const heights = resolveLadder(opts.ladderHeights ?? [480, 720, 1080], probe.height);
-    const hlsDir = path.join(jobDir, 'hls');
-    await mkdir(hlsDir, { recursive: true });
-
-    const ok = await runFfmpegProgress(
-      hlsLadderArgs(sourcePath, hlsDir, {
-        heights,
-        crf: Number(LIBRARY_CRF),
-        hasAudio: probe.hasAudio,
-        keyInfoFile,
-      }),
-      probe.duration,
-      (pct) => report('processing', Math.max(1, Math.min(98, pct))),
-    );
-    if (!ok) return failed;
-
-    // Upload ONLY the encrypted segments + playlists — never the key file (served via the route).
-    await uploadTree(store, hlsDir, owner, id);
-
-    report('ready', 100);
-    return {
-      status: 'ready',
-      durationSeconds: probe.duration,
-      hasHls: (await store.stat(privateHlsMasterKey(owner, id))) !== null,
-      wrappedContentKey: wrapContentKey(setKey, content),
-    };
-  } catch {
-    report('failed', 0);
-    return failed;
-  } finally {
-    // Wipe the job dir — the plaintext source, the raw key file, and the outputs all vanish.
-    await rm(jobDir, { recursive: true, force: true }).catch(() => {});
-  }
-}
-
-// ── Encrypted-blob pipeline (private NON-video files: photos, docs, audio) ────────
-// A non-video private upload has no HLS ladder to build — it becomes ONE AES-128-CTR ciphertext
-// blob at privateSourceKey, under the same per-item content-key material the HLS path wraps.
-// Serving is the gated blob route in mountPrivateRoutes (decrypts server-side per request); the
-// plaintext staging file is the caller's to wipe, mirroring processPrivateVideo.
-
-export type PrivateBlobResult = {
-  status: ProcessingStatus;
-  sizeBytes: number;
-  /** The content key + IV, wrapped under the caller's set key. Null if processing failed. */
-  wrappedContentKey: string | null;
-};
-
-export async function processPrivateBlob(opts: {
-  store: MediaStore;
-  owner: string;
-  id: string;
-  /** Local PLAINTEXT source, staged by the caller; never persisted (caller deletes it). */
-  sourcePath: string;
-  setKey: Buffer;
-}): Promise<PrivateBlobResult> {
-  try {
-    const file = Bun.file(opts.sourcePath);
-    const sizeBytes = file.size; // CTR is length-preserving, so plaintext size == stored size
-    const content = generateContentKey();
-    await opts.store.putStream(
-      privateSourceKey(opts.owner, opts.id),
-      cryptBlobStream(content, file.stream()),
-      'application/octet-stream',
-      { contentLength: sizeBytes },
-    );
-    return { status: 'ready', sizeBytes, wrappedContentKey: wrapContentKey(opts.setKey, content) };
-  } catch {
-    return { status: 'failed', sizeBytes: 0, wrappedContentKey: null };
-  }
-}

package/src/server/private-media/routes.spec.ts

@@ -1,265 +0,0 @@
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { createDecipheriv } from 'node:crypto';
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { Hono } from 'hono';
-import { isFfmpegAvailable } from '../media-bun';
-import { createDiskStore } from '../storage/diskStore';
-import { generateUserSalt, sealMeta } from './crypto';
-import { createMemoryPrivateIndex, type PrivateItem } from './index-store';
-import { mountPrivateRoutes } from './mountPrivateRoutes';
-import { processPrivateVideo } from './pipeline';
-import { createUnlockService } from './unlock';
-
-const unlock = createUnlockService({ serverSecret: 'srv', unlockSecret: 'unlock' });
-
-describe('unlock service', () => {
-  test('round-trips a deniable set key through a token', async () => {
-    const { token, mode } = await unlock.unlock({ userId: 'u1', userSalt: 's', password: 'pw' });
-    expect(mode).toBe('deniable');
-    const grant = await unlock.verify(token);
-    expect(grant?.userId).toBe('u1');
-    expect(grant?.mode).toBe('deniable');
-    // The recovered key matches a fresh derivation from the same password.
-    expect(
-      grant?.setKey.equals(unlock.deriveSetKey({ userId: 'u1', userSalt: 's', password: 'pw' })),
-    ).toBe(true);
-  });
-  test('no password ⇒ standard (recoverable) mode', async () => {
-    const { mode } = await unlock.unlock({ userId: 'u1', userSalt: 's' });
-    expect(mode).toBe('standard');
-  });
-  test('a token from a different secret does not verify', async () => {
-    const other = createUnlockService({ serverSecret: 'srv', unlockSecret: 'DIFFERENT' });
-    const { token } = await other.unlock({ userId: 'u1', userSalt: 's', password: 'pw' });
-    expect(await unlock.verify(token)).toBeNull();
-  });
-});
-
-// Index + reveal need no ffmpeg — sealed metadata under two passwords, then the "try a password"
-// endpoint reveals only the matching set; the index endpoint leaks only size + createdAt.
-describe('index + reveal routes', () => {
-  const index = createMemoryPrivateIndex();
-  const salt = generateUserSalt();
-  const app = new Hono();
-  mountPrivateRoutes(app, {
-    store: createDiskStore('/tmp/unused-pm'),
-    index,
-    unlock,
-    authorize: async () => ({ userId: 'u1', userSalt: salt }),
-  });
-
-  beforeAll(async () => {
-    const keyA = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'alpha' });
-    const keyB = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'bravo' });
-    const mk = (id: string, key: Buffer, title: string): PrivateItem => ({
-      id,
-      owner: 'u1',
-      sizeBytes: 1234,
-      createdAt: Date.now(),
-      status: 'ready',
-      keyMode: 'deniable',
-      wrappedContentKey: 'x',
-      sealedMeta: sealMeta(key, { title, notes: 'secret' }),
-    });
-    await index.add(mk('a1', keyA, 'Alpha One'));
-    await index.add(mk('a2', keyA, 'Alpha Two'));
-    await index.add(mk('b1', keyB, 'Bravo One'));
-  });
-
-  test('index exposes only size/createdAt/status — no title/notes/mode', async () => {
-    const res = await app.request('/_private/index');
-    const body = (await res.json()) as { items: Array<Record<string, unknown>> };
-    expect(body.items.length).toBe(3);
-    for (const row of body.items) {
-      expect(row.sizeBytes).toBe(1234);
-      expect(row).not.toHaveProperty('title');
-      expect(row).not.toHaveProperty('sealedMeta');
-      expect(row).not.toHaveProperty('keyMode');
-      expect(row).not.toHaveProperty('wrappedContentKey');
-    }
-  });
-
-  test('reveal unlocks only the matching password set', async () => {
-    const res = await app.request('/_private/reveal', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ password: 'alpha' }),
-    });
-    const body = (await res.json()) as { items: Array<{ id: string; meta: { title: string } }> };
-    expect(body.items.map((i) => i.id).sort()).toEqual(['a1', 'a2']);
-    expect(body.items.find((i) => i.id === 'a1')?.meta.title).toBe('Alpha One');
-  });
-
-  test('a wrong password reveals nothing (no info leak)', async () => {
-    const res = await app.request('/_private/reveal', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ password: 'zzz' }),
-    });
-    expect(((await res.json()) as { items: unknown[] }).items).toEqual([]);
-  });
-
-  test('reveal-unlocked: an unlock token reveals the same set as its password', async () => {
-    const { token } = await unlock.unlock({ userId: 'u1', userSalt: salt, password: 'alpha' });
-    const res = await app.request('/_private/reveal-unlocked', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ token }),
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { items: Array<{ id: string; meta: { title: string } }> };
-    expect(body.items.map((i) => i.id).sort()).toEqual(['a1', 'a2']);
-    expect(body.items.find((i) => i.id === 'a1')?.meta.title).toBe('Alpha One');
-  });
-
-  test('reveal-unlocked: a token for a DIFFERENT set reveals only that set', async () => {
-    const { token } = await unlock.unlock({ userId: 'u1', userSalt: salt, password: 'bravo' });
-    const res = await app.request('/_private/reveal-unlocked', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ token }),
-    });
-    const body = (await res.json()) as { items: Array<{ id: string }> };
-    expect(body.items.map((i) => i.id)).toEqual(['b1']);
-  });
-
-  test('reveal-unlocked: missing / invalid / other-user tokens are rejected', async () => {
-    const missing = await app.request('/_private/reveal-unlocked', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({}),
-    });
-    expect(missing.status).toBe(400);
-
-    const bogus = await app.request('/_private/reveal-unlocked', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ token: 'not-a-token' }),
-    });
-    expect(bogus.status).toBe(401);
-
-    // A valid token minted for ANOTHER user must not open this session's items.
-    const { token: foreign } = await unlock.unlock({
-      userId: 'u2',
-      userSalt: salt,
-      password: 'alpha',
-    });
-    const cross = await app.request('/_private/reveal-unlocked', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ token: foreign }),
-    });
-    expect(cross.status).toBe(401);
-  });
-});
-
-// Full encrypted playback path — needs ffmpeg (no-ops without it).
-describe('encrypted playback routes', () => {
-  let root: string;
-  let work: string;
-  let hasFfmpeg = false;
-
-  beforeAll(async () => {
-    hasFfmpeg = await isFfmpegAvailable();
-    root = await mkdtemp(path.join(tmpdir(), 'pm-r-store-'));
-    work = await mkdtemp(path.join(tmpdir(), 'pm-r-work-'));
-  });
-  afterAll(async () => {
-    await rm(root, { recursive: true, force: true });
-    await rm(work, { recursive: true, force: true });
-  });
-
-  test('unlock → content key (gated) decrypts a served encrypted segment', async () => {
-    if (!hasFfmpeg) {
-      console.warn('[routes.spec] ffmpeg absent — skipping encrypted playback route test');
-      return;
-    }
-    const store = createDiskStore(root);
-    const index = createMemoryPrivateIndex();
-    const salt = generateUserSalt();
-    const setKey = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'pw' });
-
-    // Produce an encrypted item + register it in the index.
-    const clip = path.join(work, 'src.mp4');
-    const gen = Bun.spawn(
-      [
-        'ffmpeg',
-        '-y',
-        '-f',
-        'lavfi',
-        '-i',
-        'testsrc=size=854x480:rate=15:duration=3',
-        '-pix_fmt',
-        'yuv420p',
-        '-c:v',
-        'libx264',
-        '-preset',
-        'ultrafast',
-        '-t',
-        '3',
-        clip,
-      ],
-      { stdout: 'ignore', stderr: 'ignore' },
-    );
-    await gen.exited;
-    const res = await processPrivateVideo({
-      store,
-      workDir: work,
-      owner: 'u1',
-      id: 'v1',
-      sourcePath: clip,
-      setKey,
-    });
-    expect(res.status).toBe('ready');
-    await index.add({
-      id: 'v1',
-      owner: 'u1',
-      sizeBytes: 1000,
-      createdAt: Date.now(),
-      status: 'ready',
-      keyMode: 'deniable',
-      wrappedContentKey: res.wrappedContentKey as string,
-      sealedMeta: sealMeta(setKey, { title: 'Private Clip' }),
-    });
-
-    const app = new Hono();
-    mountPrivateRoutes(app, {
-      store,
-      index,
-      unlock,
-      authorize: async () => ({ userId: 'u1', userSalt: salt }),
-    });
-
-    // Unlock with the password → token.
-    const unlockRes = await app.request('/_private/unlock', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ password: 'pw' }),
-    });
-    const token = ((await unlockRes.json()) as { token: string }).token;
-
-    // The gated key route returns the 16-byte content key.
-    const keyRes = await app.request(`/_private/u/${token}/hls/gallery/v1/480/enc.key`);
-    expect(keyRes.status).toBe(200);
-    expect(keyRes.headers.get('cache-control')).toBe('no-store');
-    const contentKey = new Uint8Array(await keyRes.arrayBuffer());
-    expect(contentKey.length).toBe(16);
-
-    // The segment route serves the ENCRYPTED bytes; decrypting with the key → valid MPEG-TS.
-    const segRes = await app.request(`/_private/u/${token}/hls/gallery/v1/480/seg_00000.ts`);
-    expect([200, 206]).toContain(segRes.status);
-    const segBytes = new Uint8Array(await segRes.arrayBuffer());
-    // Recover the IV from the variant playlist (#EXT-X-KEY … IV=0x…).
-    const plRes = await app.request(`/_private/u/${token}/hls/gallery/v1/480/playlist.m3u8`);
-    const playlist = await plRes.text();
-    const iv = Buffer.from(/IV=0x([0-9a-fA-F]+)/.exec(playlist)?.[1] ?? '', 'hex');
-    const d = createDecipheriv('aes-128-cbc', Buffer.from(contentKey), iv);
-    const plain = Buffer.concat([d.update(Buffer.from(segBytes)), d.final()]);
-    expect(plain[0]).toBe(0x47);
-
-    // A bogus token is rejected.
-    expect((await app.request('/_private/u/bogus/hls/gallery/v1/480/enc.key')).status).toBe(401);
-  }, 30_000);
-});

package/src/server/private-media/unlock.ts

@@ -1,112 +0,0 @@
-import { decryptSecret, deriveKey, encryptSecret } from 'cwip/node';
-// 🔴 `../auth/jwt`, NOT `../auth` — same reason as `storage/streamToken.ts`, and this is the
-// SECOND edge of the pair: `cursedbelt-server/storage` reaches private-media, so the barrel
-// import here put `otplib` (via `auth/index` → `totp.ts`) back into the storage graph after
-// streamToken.ts had been fixed. Found by bundling the graph and reading the externals, not by
-// grep — a two-hop edge is invisible to the obvious search.
-import { signToken, verifyPurposeToken } from '../auth/jwt';
-import { derivePasswordSetKey, deriveServerSetKey, type KeyMode } from './crypto';
-
-// ── Unlock service ──────────────────────────────────────────────────────────────
-// Turns a private-mode unlock into a short-lived token that CARRIES the set key so later
-// requests (the HLS content-key route, reveal) can unwrap without re-deriving. Two modes:
-//   • deniable  — password given → setKey = scrypt(password, userSalt); the server holds no
-//     copy, so the token is the ONLY way back to that set key until it expires.
-//   • standard  — no password → setKey = scrypt(serverSecret, userId); recoverable, session-gated.
-// The set key is SEALED inside the token (AES-GCM under a server seal key), so the client can't
-// read it out; only this server can. The JWT is signed via cursedbelt's one jose integration
-// under the existing 'pm-unlock' purpose, so it can't be replayed as an access token.
-
-const PURPOSE = 'pm-unlock';
-
-export type UnlockGrant = { userId: string; setKey: Buffer; mode: KeyMode };
-
-/**
- * What a supplied password MEANS at the unlock/reveal/private-upload surfaces:
- *   • derive (default) — the password derives the set key (deniable sets; the
- *     historical behavior).
- *   • gate — the password is an ACCESS CHECK against the app's own accounts
- *     (verifyPassword, e.g. the login store's argon2id verify) and the set key
- *     stays the recoverable server-derived one. Password changes never orphan
- *     content, and a password is REQUIRED to unlock (no silent session unlock).
- */
-export type UnlockPasswordPolicy =
-  | { mode: 'derive' }
-  | {
-      mode: 'gate';
-      verifyPassword: (
-        who: { userId: string; userSalt: string },
-        password: string,
-      ) => Promise<boolean>;
-    };
-
-export interface UnlockService {
-  /** Mint an unlock token. Pass `password` for a deniable set; omit for the standard server-key
-   * set (the caller must already have authenticated the user). */
-  unlock(args: { userId: string; userSalt: string; password?: string }): Promise<{
-    token: string;
-    mode: KeyMode;
-  }>;
-  /** Verify a token and recover the sealed set key, or null if invalid/expired/tampered. */
-  verify(token: string): Promise<UnlockGrant | null>;
-  /** Derive a set key without minting a token (for the reveal endpoint's per-item trials). */
-  deriveSetKey(args: { userId: string; userSalt: string; password?: string }): Buffer;
-}
-
-export function createUnlockService(opts: {
-  /** Derives the recoverable (standard) set key. */
-  serverSecret: string;
-  /** Signs the unlock JWT AND (domain-separated) seals the set key inside it. */
-  unlockSecret: string;
-  /** Token lifetime — long enough to survive a paused-and-resumed private video. Default 6h. */
-  ttlSeconds?: number;
-}): UnlockService {
-  const ttl = opts.ttlSeconds ?? 6 * 60 * 60;
-  const sealKey = deriveKey(opts.unlockSecret, 'pm-unlock-seal');
-
-  const deriveSetKey = ({
-    userId,
-    userSalt,
-    password,
-  }: {
-    userId: string;
-    userSalt: string;
-    password?: string;
-  }): Buffer =>
-    password
-      ? derivePasswordSetKey(password, userSalt)
-      : deriveServerSetKey(opts.serverSecret, userId);
-
-  return {
-    deriveSetKey,
-    async unlock(args) {
-      const mode: KeyMode = args.password ? 'deniable' : 'standard';
-      const setKey = deriveSetKey(args);
-      const token = await signToken(
-        {
-          userId: args.userId,
-          sessionId: 'pm',
-          roles: [],
-          purpose: PURPOSE,
-          sk: encryptSecret(setKey.toString('base64'), sealKey),
-          m: mode,
-        },
-        opts.unlockSecret,
-        ttl,
-      );
-      return { token, mode };
-    },
-    async verify(token) {
-      try {
-        const p = await verifyPurposeToken(token, opts.unlockSecret, PURPOSE);
-        const sealed = (p as { sk?: unknown }).sk;
-        const mode = (p as { m?: unknown }).m;
-        if (typeof sealed !== 'string' || (mode !== 'standard' && mode !== 'deniable')) return null;
-        const setKey = Buffer.from(decryptSecret(sealed, sealKey), 'base64');
-        return { userId: p.userId, setKey, mode };
-      } catch {
-        return null;
-      }
-    },
-  };
-}

package/src/server/storage/files/catalogue.private.spec.ts

@@ -1,106 +0,0 @@
-import { Database } from 'bun:sqlite';
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { runMigrations } from '../../migration/runner';
-import { derivePasswordSetKey, generateUserSalt, openMeta } from '../../private-media/crypto';
-import type { PrivateIndex } from '../../private-media/index-store';
-import { createDiskStore } from '../diskStore';
-import type { MediaCtx } from '../types';
-import { createSqliteFileCatalogue } from './catalogue';
-import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { PrivateFileCatalogue } from './types';
-
-const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
-const stream = (s: string) =>
-  new Response(new TextEncoder().encode(s)).body as ReadableStream<Uint8Array>;
-const OWNER = CTX.userId; // private owner axis = userId (matches mountPrivateRoutes)
-
-// Seal/reveal/deniability is ffmpeg-independent: the descriptor is sealed regardless of transcode
-// success, so these run everywhere. (Content-key unwrap needs a real transcode → ffmpeg-gated e2e.)
-describe('FileCatalogue private media — ingest + PrivateIndex view + deniability', () => {
-  let db: Database;
-  let root: string;
-  let cat: PrivateFileCatalogue;
-  let index: PrivateIndex;
-  const salt = generateUserSalt();
-  const keyA = derivePasswordSetKey('alpha-pass', salt);
-  const keyB = derivePasswordSetKey('bravo-pass', salt);
-
-  beforeAll(async () => {
-    db = new Database(':memory:');
-    runMigrations(db, FILE_CATALOGUE_MIGRATIONS);
-    root = await mkdtemp(path.join(tmpdir(), 'fc-priv-'));
-    let clock = 1;
-    // owner = userId so private rows + mountPrivateRoutes agree on the scope.
-    cat = createSqliteFileCatalogue({
-      db,
-      store: createDiskStore(root),
-      workDir: path.join(root, 'w'),
-      owner: (c) => c.userId,
-      now: () => ++clock,
-    });
-    index = cat.asPrivateIndex();
-  });
-  afterAll(async () => {
-    db.close();
-    await rm(root, { recursive: true, force: true });
-  });
-
-  test('ingests private rows under two disjoint passwords', async () => {
-    await cat.ingestPrivate(
-      CTX,
-      { name: 'secret-a.mp4', mime: 'video/mp4', body: stream('a-bytes'), tags: ['setA'] },
-      { setKey: keyA, keyMode: 'deniable' },
-    );
-    await cat.ingestPrivate(
-      CTX,
-      { name: 'secret-b.mp4', mime: 'video/mp4', body: stream('b-bytes'), tags: ['setB'] },
-      { setKey: keyB, keyMode: 'deniable' },
-    );
-    expect((await index.list(OWNER)).length).toBe(2);
-  });
-
-  test('a set key reveals only its own items (deniability) via the index envelopes', () => {
-    const reveal = async (key: Buffer) => {
-      const names: string[] = [];
-      for (const item of await index.list(OWNER)) {
-        const meta = openMeta<{ name: string }>(key, item.sealedMeta);
-        if (meta) names.push(meta.name);
-      }
-      return names.sort();
-    };
-    return Promise.all([
-      reveal(keyA),
-      reveal(keyB),
-      reveal(derivePasswordSetKey('nope', salt)),
-    ]).then(([a, b, wrong]) => {
-      expect(a).toEqual(['secret-a.mp4']);
-      expect(b).toEqual(['secret-b.mp4']);
-      expect(wrong).toEqual([]); // an unused password shows nothing — no hint the sets exist
-    });
-  });
-
-  test('the clear index exposes no set identifier or key mode difference', async () => {
-    // Both rows are keyMode 'deniable' here; the public projection (toPublic) that the /index route
-    // returns strips keyMode entirely — asserted by mountPrivateRoutes' own tests. Here we just
-    // confirm the raw items carry the wrapped key + sealed meta (opaque without a key).
-    for (const item of await index.list(OWNER)) {
-      expect(item.sealedMeta.length).toBeGreaterThan(0);
-      expect(openMeta(Buffer.alloc(32), item.sealedMeta)).toBeNull(); // a random key opens nothing
-    }
-  });
-
-  test('index.remove drops the row', async () => {
-    const items = await index.list(OWNER);
-    await index.remove(OWNER, items[0].id);
-    expect((await index.list(OWNER)).length).toBe(1);
-    expect(await index.get(OWNER, items[0].id)).toBeNull();
-  });
-
-  test('private rows never appear in the public feed', async () => {
-    const publicCat = cat as unknown as { list: (c: MediaCtx) => Promise<{ items: unknown[] }> };
-    expect((await publicCat.list(CTX)).items).toEqual([]);
-  });
-});