cursedbelt-server 3.0.0 → 4.0.0

package/src/server/storage/files/catalogue.ts

@@ -1,12 +1,9 @@
 import type { Database } from 'bun:sqlite';
 import type { Dirent } from 'node:fs';
-import { mkdir, readdir, rm, stat as fsStat } from 'node:fs/promises';
+import { readdir, stat as fsStat } from 'node:fs/promises';
 import path from 'node:path';
 import type { ProcessingStatus } from 'cursedbelt-core/media';
 import { renderImage } from '../../media-bun/image';
-import { sealMeta } from '../../private-media/crypto';
-import type { PrivateIndex, PrivateItem } from '../../private-media/index-store';
-import { processPrivateBlob, processPrivateVideo } from '../../private-media/pipeline';
 import { ffmpegImageThumbnail, isBrowserRenderableImage } from '../imageThumbnail';
 import {
   fsDisplayKey,
@@ -18,7 +15,6 @@ import {
   fsVttKey,
   type MediaCtx,
   type MediaStore,
-  privateFsKey,
 } from '../types';
 import { type ProcessOptions, type ProcessResult, processVideo } from '../videoProcessor';
 import { mimeByExt } from './mimeByExt';
@@ -31,7 +27,6 @@ import {
   type FileRecord,
   type FileType,
   type ListFilesOptions,
-  type PrivateFileCatalogue,
   type TagFacet,
 } from './types';
 
@@ -63,30 +58,6 @@ export type ImageDerivativesOptions = {
  * ffmpeg by default; remote binary-server job when the bytes live there). */
 export type ImageDerivatives = (opts: ImageDerivativesOptions) => Promise<{ hasThumbnail: boolean }>;
 
-/** Sealed descriptor payload (encrypted under the set key) — the private counterpart to the
- * plaintext name/tags a public row stores in the clear. */
-type SealedDescriptor = { name: string; mime: string; tags: string[] };
-
-// Stream an upload body to a local plaintext file (staged for the private pipeline; wiped after).
-// Bun.write(dest, new Response(stream)) hangs in Bun 1.3.x — pump via a FileSink instead.
-async function streamToFile(body: ReadableStream<Uint8Array>, dest: string): Promise<number> {
-  await mkdir(path.dirname(dest), { recursive: true });
-  const sink = Bun.file(dest).writer();
-  const reader = body.getReader();
-  let size = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      size += value.byteLength;
-      sink.write(value);
-    }
-  } finally {
-    await sink.end();
-  }
-  return size;
-}
-
 // The general primary binary for a NON-video file (images/docs/…) lives here; video files store a
 // raw source (fsSourceKey) + derived mp4/HLS/poster/sprite via the shared video keyspace.
 export const fileBinaryKey = (owner: string, id: string) => `fs/${owner}/${id}`;
@@ -104,7 +75,6 @@ type Row = {
   mime: string;
   size: number;
   file_type: string;
-  is_private: number;
   has_thumbnail: number;
   has_hls: number;
   has_sprites: number;
@@ -120,9 +90,6 @@ type Row = {
   view_key?: number;
 };
 
-/** A private row carries the sealed envelope + wrapped key + wrap mode alongside the base row. */
-type PrivateRow = Row & { enc_name: string; enc_dek: string; enc_key_type: string };
-
 type CollectionRow = {
   id: string;
   owner: string;
@@ -267,9 +234,7 @@ export type SqliteFileCatalogueOptions = {
   imageDerivatives?: ImageDerivatives;
 };
 
-export function createSqliteFileCatalogue(
-  opts: SqliteFileCatalogueOptions,
-): FileCatalogue & PrivateFileCatalogue {
+export function createSqliteFileCatalogue(opts: SqliteFileCatalogueOptions): FileCatalogue {
   const { db, store, workDir } = opts;
   const ownerOf = opts.owner ?? ((c: MediaCtx) => c.tenantId);
   const now = opts.now ?? (() => Date.now());
@@ -278,11 +243,11 @@ export function createSqliteFileCatalogue(
   const randomSeed = opts.randomSeed ?? rand31;
 
   const insertFile = db.query(
-    `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, rand_key, created_at, updated_at)
-     VALUES ($id, $owner, $name, $mime, $size, $type, 0, $status, $progress, 'disk', $rand, $now, $now)`,
+    `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, rand_key, created_at, updated_at)
+     VALUES ($id, $owner, $name, $mime, $size, $type, $status, $progress, 'disk', $rand, $now, $now)`,
   );
   const insertTag = db.query(
-    `INSERT OR IGNORE INTO file_tags (file_id, tag, owner, is_private) VALUES ($file, $tag, $owner, 0)`,
+    `INSERT OR IGNORE INTO file_tags (file_id, tag, owner) VALUES ($file, $tag, $owner)`,
   );
   const deleteTags = db.query(`DELETE FROM file_tags WHERE file_id = $file`);
   const getRow = db.query<Row, { $id: string; $owner: string }>(
@@ -318,33 +283,7 @@ export function createSqliteFileCatalogue(
     `UPDATE files SET name = $name, mime = $mime, size = $size, file_type = $type,
        processing_status = $status, processing_progress = $progress,
        has_hls = 0, has_thumbnail = 0, has_sprites = 0, duration = NULL, updated_at = $now
-     WHERE id = $id AND owner = $owner AND is_private = 0`,
-  );
-
-  // Private (encrypted) rows: name/tags are sealed in enc_name (sealedMeta); the wrapped AES-128
-  // content key is in enc_dek; enc_key_type records the wrap mode. is_private = 1 keeps them out of
-  // the public feed. These rows are surfaced to `mountPrivateRoutes` via `asPrivateIndex()`.
-  const insertPrivate = db.query(
-    `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, has_hls, duration,
-       processing_status, processing_progress, storage_backend, enc_name, enc_dek, enc_key_type, rand_key, created_at, updated_at)
-     VALUES ($id, $owner, '', '', $size, $type, 1, 0, NULL, $status, $progress, 'disk', $sealed, $wrapped, $mode, $rand, $now, $now)`,
-  );
-  const finishPrivate = db.query(
-    `UPDATE files SET processing_status = $status, processing_progress = $progress, has_hls = $hls,
-       duration = $duration, size = $size, enc_name = $sealed, enc_dek = $wrapped, updated_at = $now WHERE id = $id`,
-  );
-  const getPrivateRow = db.query<PrivateRow, { $id: string; $owner: string }>(
-    `SELECT * FROM files WHERE id = $id AND owner = $owner AND is_private = 1`,
-  );
-  const listPrivateFullRows = db.query<PrivateRow, { $owner: string }>(
-    `SELECT * FROM files WHERE owner = $owner AND is_private = 1 ORDER BY created_at DESC, id DESC`,
-  );
-  const updatePrivateRow = db.query(
-    `UPDATE files SET size = $size, processing_status = $status, enc_name = $sealed, enc_dek = $wrapped,
-       enc_key_type = $mode, updated_at = $now WHERE id = $id AND owner = $owner AND is_private = 1`,
-  );
-  const deletePrivateRow = db.query(
-    `DELETE FROM files WHERE id = $id AND owner = $owner AND is_private = 1`,
+     WHERE id = $id AND owner = $owner`,
   );
 
   // ── Collection prepared statements ───────────────────────────────────────────────
@@ -405,17 +344,6 @@ export function createSqliteFileCatalogue(
   );
   const deleteFileViews = db.query(`DELETE FROM file_views WHERE file_id = $file`);
 
-  const rowToPrivateItem = (r: PrivateRow, owner: string): PrivateItem => ({
-    id: r.id,
-    owner,
-    sizeBytes: r.size,
-    createdAt: r.created_at,
-    status: r.processing_status as ProcessingStatus,
-    keyMode: (r.enc_key_type || 'deniable') as PrivateItem['keyMode'],
-    wrappedContentKey: r.enc_dek,
-    sealedMeta: r.enc_name,
-  });
-
   const tagsFor = (ids: string[]): Map<string, string[]> => {
     const map = new Map<string, string[]>();
     if (ids.length === 0) return map;
@@ -472,7 +400,6 @@ export function createSqliteFileCatalogue(
     size: row.size,
     fileType: row.file_type as FileType,
     tags,
-    isPrivate: row.is_private === 1,
     hasThumbnail: row.has_thumbnail === 1,
     hasHls: row.has_hls === 1,
     hasSprites: row.has_sprites === 1,
@@ -665,10 +592,7 @@ export function createSqliteFileCatalogue(
 
   const statsByType = db.query<{ file_type: string; n: number; bytes: number | null }, { $owner: string }>(
     `SELECT file_type, COUNT(*) AS n, SUM(size) AS bytes FROM files
-     WHERE owner = $owner AND is_private = 0 GROUP BY file_type`,
-  );
-  const statsPrivate = db.query<{ n: number; bytes: number | null }, { $owner: string }>(
-    `SELECT COUNT(*) AS n, SUM(size) AS bytes FROM files WHERE owner = $owner AND is_private = 1`,
+     WHERE owner = $owner GROUP BY file_type`,
   );
   const statsStatus = db.query<{ processing_status: string; n: number }, { $owner: string }>(
     `SELECT processing_status, COUNT(*) AS n FROM files
@@ -686,7 +610,6 @@ export function createSqliteFileCatalogue(
         files += row.n;
         bytes += row.bytes ?? 0;
       }
-      const priv = statsPrivate.get({ $owner: owner });
       let processing = 0;
       let failed = 0;
       for (const row of statsStatus.all({ $owner: owner })) {
@@ -698,8 +621,6 @@ export function createSqliteFileCatalogue(
         files,
         bytes,
         byType,
-        privateItems: priv?.n ?? 0,
-        privateBytes: priv?.bytes ?? 0,
         processing,
         failed,
       };
@@ -710,7 +631,6 @@ export function createSqliteFileCatalogue(
       const params: Record<string, string | number> = { $owner: owner, $limit: limit + 1 };
       const where: string[] = [
         'f.owner = $owner',
-        'f.is_private = 0',
         options.trashedOnly ? 'f.trashed_at IS NOT NULL' : 'f.trashed_at IS NULL',
       ];
       let from = 'files f';
@@ -808,7 +728,7 @@ export function createSqliteFileCatalogue(
     async tagFacets(ctx) {
       const rows = db
         .query<TagFacet, { $owner: string }>(
-          `SELECT tag, COUNT(*) as count FROM file_tags WHERE owner = $owner AND is_private = 0
+          `SELECT tag, COUNT(*) as count FROM file_tags WHERE owner = $owner
            GROUP BY tag ORDER BY count DESC, tag ASC`,
         )
         .all({ $owner: ownerOf(ctx) });
@@ -859,9 +779,6 @@ export function createSqliteFileCatalogue(
       const owner = ownerOf(ctx);
       const row = getRow.get({ $id: id, $owner: owner });
       if (!row) return null;
-      if (row.is_private === 1) {
-        throw new Error('replaceContent: private files cannot be replaced in place');
-      }
       const isVideo = upload.mime.startsWith('video/');
       // Store the new bytes FIRST — a failed write leaves the old row + bytes fully intact.
       const key = isVideo ? fsSourceKey(owner, id) : fileBinaryKey(owner, id);
@@ -1001,26 +918,23 @@ export function createSqliteFileCatalogue(
 
     recoverProcessing() {
       // A restart mid-transcode leaves a row stuck in `processing`/`pending` — the in-process
-      // job is gone. For PUBLIC videos the source still sits at fsSourceKey, so re-kick the pipeline.
-      // PRIVATE rows can't be re-kicked at boot (the set key isn't available) — video or blob alike,
-      // mark them failed; the user re-unlocks + re-uploads. Public non-video rows are `ready` at
-      // insert and never appear here. (Ported from ca's recoverOnBoot; our jobs are in-process,
-      // so recovery is app-invoked at startup rather than a persistent queue.)
+      // job is gone. The source still sits at fsSourceKey, so re-kick the pipeline. Non-video rows
+      // are `ready` at insert and never appear here. (Ported from ca's recoverOnBoot; our jobs are
+      // in-process, so recovery is app-invoked at startup rather than a persistent queue.)
       // Re-kicks are CAPPED at maxProcessingAttempts total kicks: if the transcode itself is what
       // keeps killing the process (2026-07-04 prod outage: ffmpeg OOM on a 1GB host → systemd
       // restart → unconditional re-kick → OOM again, forever), the row must land on `failed`
       // instead of holding the whole service down.
       const stuck = db
-        .query<{ id: string; owner: string; is_private: number; processing_attempts: number }, []>(
-          `SELECT id, owner, is_private, processing_attempts FROM files
-           WHERE (file_type = 'video' OR is_private = 1)
-             AND processing_status IN ('pending', 'processing')`,
+        .query<{ id: string; owner: string; processing_attempts: number }, []>(
+          `SELECT id, owner, processing_attempts FROM files
+           WHERE file_type = 'video' AND processing_status IN ('pending', 'processing')`,
         )
         .all();
       let requeued = 0;
       let failed = 0;
       for (const r of stuck) {
-        if (r.is_private === 1 || r.processing_attempts >= maxProcessingAttempts) {
+        if (r.processing_attempts >= maxProcessingAttempts) {
           setProcessing.run({ $id: r.id, $status: 'failed', $progress: 0, $now: now() });
           failed++;
         } else {
@@ -1031,7 +945,7 @@ export function createSqliteFileCatalogue(
       return { requeued, failed };
     },
 
-    // Backfill grid thumbnails for PUBLIC video rows that finished (ready/failed) without a poster —
+    // Backfill grid thumbnails for video rows that finished (ready/failed) without a poster —
     // e.g. rows that landed while transcodeVideos was off entirely, or that failed a full transcode
     // before the poster step. Re-kicks the (now poster-capable) pipeline; the attempts counter is
     // reset first so the maxProcessingAttempts cap doesn't pre-empt a fresh, cheaper poster-only run.
@@ -1039,7 +953,7 @@ export function createSqliteFileCatalogue(
       const missing = db
         .query<{ id: string; owner: string }, []>(
           `SELECT id, owner FROM files
-           WHERE file_type = 'video' AND is_private = 0 AND has_thumbnail = 0
+           WHERE file_type = 'video' AND has_thumbnail = 0
              AND processing_status IN ('ready', 'failed')`,
         )
         .all();
@@ -1053,7 +967,7 @@ export function createSqliteFileCatalogue(
       return { requeued: missing.length };
     },
 
-    // Backfill grid thumbnails for PUBLIC image rows with no poster — e.g. HEIC/HEVC iPhone photos
+    // Backfill grid thumbnails for image rows with no poster — e.g. HEIC/HEVC iPhone photos
     // whose sharp thumbnail silently failed before the ffmpeg fallback existed. Re-kicks the (now
     // HEIC-capable) image pipeline, serialized so at most one ffmpeg decode runs at a time.
     backfillImageThumbnails(): { requeued: number } {
@@ -1064,7 +978,7 @@ export function createSqliteFileCatalogue(
       const candidates = db
         .query<{ id: string; owner: string; mime: string; has_thumbnail: number }, []>(
           `SELECT id, owner, mime, has_thumbnail FROM files
-           WHERE file_type = 'image' AND is_private = 0
+           WHERE file_type = 'image'
              AND (has_thumbnail = 0 OR mime IN ('image/heic', 'image/heif'))`,
         )
         .all();
@@ -1187,140 +1101,5 @@ export function createSqliteFileCatalogue(
       // Upsert-gated to the caller's own files; unknown/other-owner ids record nothing.
       recordViewStmt.run({ $id: fileId, $owner: ownerOf(ctx), $now: now() });
     },
-
-    async ingestPrivate(ctx, upload, cfg) {
-      const owner = ownerOf(ctx);
-      const id = crypto.randomUUID();
-      const ts = now();
-      // Seal the descriptor NOW — sealing is independent of the transcode (only the wrapped content
-      // KEY needs the pipeline). Storing enc_name at insert means a try-a-password reveal matches the
-      // item immediately, before its HLS finishes encrypting (no seal race).
-      const descriptor: SealedDescriptor = {
-        name: upload.name,
-        mime: upload.mime,
-        tags: upload.tags ?? [],
-      };
-      const sealed = sealMeta(cfg.setKey, descriptor);
-      const isVideo = upload.mime.startsWith('video/');
-      insertPrivate.run({
-        $id: id,
-        $owner: owner,
-        $size: 0,
-        $type: classifyFileType(upload.mime),
-        $mode: cfg.keyMode,
-        $status: 'processing',
-        $progress: 0,
-        $sealed: sealed,
-        $wrapped: '',
-        $rand: randKey(),
-        $now: ts,
-      });
-
-      // Stage plaintext to a scratch file, then encrypt: video → AES-128 HLS ladder; anything
-      // else (photo/doc/audio) → one AES-128-CTR blob at privateSourceKey. Plaintext is never
-      // persisted either way. We MUST await: the wrapped key is produced by the pipeline and
-      // there is nothing to serve without it.
-      const srcPath = path.join(workDir, 'ingest', `${owner}-${id}.src`);
-      let size = 0;
-      try {
-        size = await streamToFile(upload.body, srcPath);
-        const res = isVideo
-          ? await processPrivateVideo({
-              store,
-              workDir,
-              owner,
-              id,
-              sourcePath: srcPath,
-              setKey: cfg.setKey,
-              ladderHeights: opts.ladderHeights,
-              onProgress: (status, pct) =>
-                setProcessing.run({ $id: id, $status: status, $progress: pct, $now: now() }),
-            })
-          : {
-              ...(await processPrivateBlob({
-                store,
-                owner,
-                id,
-                sourcePath: srcPath,
-                setKey: cfg.setKey,
-              })),
-              durationSeconds: 0,
-              hasHls: false,
-            };
-        finishPrivate.run({
-          $id: id,
-          $status: res.status,
-          $progress: res.status === 'ready' ? 100 : 0,
-          $hls: res.hasHls ? 1 : 0,
-          $duration: res.durationSeconds || null,
-          $size: size,
-          $sealed: sealed,
-          $wrapped: res.wrappedContentKey ?? '',
-          $now: now(),
-        });
-      } finally {
-        await rm(srcPath, { force: true }).catch(() => {});
-      }
-
-      const row = getRow.get({ $id: id, $owner: owner }) as Row;
-      return {
-        id,
-        size,
-        createdAt: ts,
-        processingStatus: row.processing_status as ProcessingStatus,
-        processingProgress: row.processing_progress,
-        hasHls: row.has_hls === 1,
-      };
-    },
-
-    asPrivateIndex(): PrivateIndex {
-      // A PrivateIndex view over the catalogue's private rows — the seam mountPrivateRoutes reads.
-      // `owner` here is the private owner axis the routes pass (a userId), matching how ingestPrivate
-      // stored the row (both go through the files.owner column).
-      return {
-        async add(item) {
-          insertPrivate.run({
-            $id: item.id,
-            $owner: item.owner,
-            $size: item.sizeBytes,
-            // External index writers predate blob items and only ever added videos.
-            $type: 'video',
-            $mode: item.keyMode,
-            $status: item.status,
-            $progress: item.status === 'ready' ? 100 : 0,
-            $sealed: item.sealedMeta,
-            $wrapped: item.wrappedContentKey,
-            $rand: randKey(),
-            $now: now(),
-          });
-        },
-        async get(owner, id) {
-          const row = getPrivateRow.get({ $id: id, $owner: owner });
-          return row ? rowToPrivateItem(row, owner) : null;
-        },
-        async list(owner) {
-          return listPrivateFullRows.all({ $owner: owner }).map((r) => rowToPrivateItem(r, owner));
-        },
-        async update(owner, id, patch) {
-          const cur = getPrivateRow.get({ $id: id, $owner: owner });
-          if (!cur) return;
-          const merged = { ...rowToPrivateItem(cur, owner), ...patch };
-          updatePrivateRow.run({
-            $id: id,
-            $owner: owner,
-            $size: merged.sizeBytes,
-            $status: merged.status,
-            $sealed: merged.sealedMeta,
-            $wrapped: merged.wrappedContentKey,
-            $mode: merged.keyMode,
-            $now: now(),
-          });
-        },
-        async remove(owner, id) {
-          await store.removePrefix(privateFsKey(owner, id));
-          deletePrivateRow.run({ $id: id, $owner: owner });
-        },
-      };
-    },
   };
 }

package/src/server/storage/files/fileRoutes.replace.spec.ts

@@ -11,7 +11,7 @@ import type { MediaCtx, MediaStore } from '../types';
 import { createSqliteFileCatalogue, fileBinaryKey } from './catalogue';
 import { mountFileRoutes } from './fileRoutes';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 
 // PUT /_files/replace/:id — the editor's "overwrite original" byte edge.
 
@@ -24,7 +24,7 @@ describe('fileRoutes — replace', () => {
   let db: Database;
   let root: string;
   let store: MediaStore;
-  let cat: FileCatalogue & PrivateFileCatalogue;
+  let cat: FileCatalogue;
   let authed = true;
   const app = new Hono();
   let fileId: string;

package/src/server/storage/files/fileRoutes.spec.ts

@@ -6,115 +6,21 @@ import path from 'node:path';
 import { Hono } from 'hono';
 import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
 import { runMigrations } from '../../migration/runner';
-import { generateUserSalt } from '../../private-media/crypto';
-import { createUnlockService } from '../../private-media/unlock';
 import { createDiskStore } from '../diskStore';
 import { createStreamTokenService } from '../streamToken';
 import type { MediaCtx } from '../types';
 import { createSqliteFileCatalogue } from './catalogue';
 import { mountFileRoutes, SINGLE_UPLOAD_TOO_LARGE } from './fileRoutes';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
-import type { FileCatalogue, FilePage, PrivateFileCatalogue, PrivateKeyMode } from './types';
+import type { FileCatalogue, FilePage } from './types';
 
 const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
-const unlock = createUnlockService({ serverSecret: 'srv', unlockSecret: 'unl' });
 const streamToken = createStreamTokenService({ secret: 'stream' });
-const salt = generateUserSalt();
-
-describe('fileRoutes — private upload key derivation (password vs unlock token)', () => {
-  // ingestPrivate runs the ffmpeg pipeline — fake the catalogue and capture the key/mode the
-  // route derived. The derivation logic IS what this route owns.
-  let captured: { setKey: Buffer; keyMode: PrivateKeyMode } | null = null;
-  /*
-   * Read through a function, not the variable.
-   *
-   * Each test opens with `captured = null`, which narrows the binding to `null`
-   * for the rest of the block — TypeScript cannot see the assignment inside
-   * `fakeCatalogue.ingestPrivate`, so `captured?.keyMode` had type `never` and
-   * every assertion below was unchecked. A call boundary resets the narrowing,
-   * so the descriptor's fields are type-checked again.
-   */
-  const derived = (): { setKey: Buffer; keyMode: PrivateKeyMode } | null => captured;
-  const fakeCatalogue = {
-    async ingestPrivate(_ctx: MediaCtx, _upload: unknown, cfg: unknown) {
-      captured = cfg as { setKey: Buffer; keyMode: PrivateKeyMode };
-      return {
-        id: 'p1',
-        size: 1,
-        createdAt: 1,
-        processingStatus: 'ready',
-        processingProgress: 100,
-        hasHls: false,
-      };
-    },
-  } as unknown as FileCatalogue & PrivateFileCatalogue;
-
-  const app = new Hono();
-  mountFileRoutes(app, {
-    store: createDiskStore('/tmp/unused-fr'),
-    token: streamToken,
-    catalogue: fakeCatalogue,
-    privateUpload: {
-      unlock,
-      authorize: async () => ({ userId: 'u1', userSalt: salt }),
-    },
-  });
-
-  const put = (headers: Record<string, string>) =>
-    app.request('/_files/upload-private', {
-      method: 'PUT',
-      headers: { 'content-type': 'video/mp4', 'x-filename': 'clip.mp4', ...headers },
-      body: 'bytes',
-    });
-
-  test('password header → deniable key derived from the password', async () => {
-    captured = null;
-    const res = await put({ 'x-private-password': 'pw1' });
-    expect(res.status).toBe(200);
-    expect(derived()?.keyMode).toBe('deniable');
-    const expected = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'pw1' });
-    expect(derived()?.setKey.equals(expected)).toBe(true);
-  });
-
-  test('no password, no token → standard server key', async () => {
-    captured = null;
-    const res = await put({});
-    expect(res.status).toBe(200);
-    expect(derived()?.keyMode).toBe('standard');
-    const expected = unlock.deriveSetKey({ userId: 'u1', userSalt: salt });
-    expect(derived()?.setKey.equals(expected)).toBe(true);
-  });
-
-  test('x-unlock-token → setKey + keyMode recovered from the grant', async () => {
-    captured = null;
-    const { token } = await unlock.unlock({ userId: 'u1', userSalt: salt, password: 'pw2' });
-    const res = await put({ 'x-unlock-token': token });
-    expect(res.status).toBe(200);
-    expect(derived()?.keyMode).toBe('deniable');
-    const expected = unlock.deriveSetKey({ userId: 'u1', userSalt: salt, password: 'pw2' });
-    expect(derived()?.setKey.equals(expected)).toBe(true);
-  });
-
-  test('a standard-mode token carries keyMode standard', async () => {
-    captured = null;
-    const { token } = await unlock.unlock({ userId: 'u1', userSalt: salt });
-    await put({ 'x-unlock-token': token });
-    expect(derived()?.keyMode).toBe('standard');
-  });
-
-  test('invalid or other-user tokens are rejected (401), password path unaffected', async () => {
-    expect((await put({ 'x-unlock-token': 'garbage' })).status).toBe(401);
-    const { token: foreign } = await unlock.unlock({ userId: 'u2', userSalt: salt });
-    expect((await put({ 'x-unlock-token': foreign })).status).toBe(401);
-    // Password path still works after token rejections.
-    expect((await put({ 'x-private-password': 'pw1' })).status).toBe(200);
-  });
-});
 
 describe('fileRoutes — GET list route (filters + sort passthrough)', () => {
   let db: Database;
   let root: string;
-  let cat: FileCatalogue & PrivateFileCatalogue;
+  let cat: FileCatalogue;
   const app = new Hono();
   let clock = 9000;
 
@@ -262,7 +168,7 @@ describe('fileRoutes — single-PUT upload cap (MAX_SINGLE_UPLOAD_BYTES → 413)
         processingStatus: 'ready',
       };
     },
-  } as unknown as FileCatalogue & PrivateFileCatalogue;
+  } as unknown as FileCatalogue;
 
   const app = new Hono();
   mountFileRoutes(app, {