cursedbelt-server 3.0.0 → 4.0.0

package/src/server/storage/files/fileRoutes.ts

@@ -1,17 +1,11 @@
 import type { Context, Hono } from 'hono';
 import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
-import type { UnlockPasswordPolicy, UnlockService } from '../../private-media/unlock';
 import { serveRange } from '../streamRange';
 import type { StreamTokenService } from '../streamToken';
 import type { MediaCtx, MediaStore } from '../types';
 import { fileBinaryKey } from './catalogue';
 import type { ChunkedUploadService } from './chunkedUpload';
-import {
-  FILE_SORTS,
-  type FileCatalogue,
-  type ListFilesOptions,
-  type PrivateFileCatalogue,
-} from './types';
+import { FILE_SORTS, type FileCatalogue, type ListFilesOptions } from './types';
 
 // ── File binary + upload routes ─────────────────────────────────────────────────
 // The FileCatalogue's byte edge for GENERAL files (images/docs/audio/any) — the piece
@@ -106,21 +100,7 @@ export type MountFileRoutesOptions = {
   /** Session auth for the upload PUTs (a fetch CAN send the Bearer). Return a ctx or null. */
   authorizeUpload?: (c: Context) => Promise<MediaCtx | null> | MediaCtx | null;
   /** The catalogue uploads land in. Required for the upload routes to be mounted. */
-  catalogue?: FileCatalogue & PrivateFileCatalogue;
-  /** Wire private uploads: derive a per-user set key from the request (password header ⇒ deniable,
-   * absent ⇒ standard server key). Omit ⇒ the private-upload route is disabled. */
-  privateUpload?: {
-    unlock: UnlockService;
-    authorize: (c: Context) => Promise<{ userId: string; userSalt: string } | null>;
-    /** Header carrying the plaintext password for a deniable set (default 'x-private-password'). */
-    passwordHeader?: string;
-    /** Header carrying an UNLOCK TOKEN (an already-unlocked session) — takes precedence over the
-     * password header; setKey + keyMode come from the verified grant (default 'x-unlock-token'). */
-    tokenHeader?: string;
-    /** What a supplied password means (default derive — deniable set). `gate` verifies it
-     * against the app's accounts and wraps under the recoverable server key instead. */
-    passwordPolicy?: UnlockPasswordPolicy;
-  };
+  catalogue?: FileCatalogue;
   /** Wire large-file chunked uploads (direct-to-backend). Omit ⇒ init/complete routes are absent
    * and clients use the streamed `PUT /upload`. Uses the same `authorizeUpload` guard. */
   chunked?: ChunkedUploadService;
@@ -197,80 +177,6 @@ export function mountFileRoutes(app: Hono, opts: MountFileRoutesOptions): void {
     });
   }
 
-  // PUT a PRIVATE upload → catalogue.ingestPrivate under a set key derived from the request:
-  // either an UNLOCK TOKEN (an already-unlocked session — same mechanism the content-key route
-  // uses) or a password header (deniable) / neither (standard server key).
-  const pv = opts.privateUpload;
-  if (pv && catalogue) {
-    const passwordHeader = pv.passwordHeader ?? 'x-private-password';
-    const tokenHeader = pv.tokenHeader ?? 'x-unlock-token';
-    app.put(`${base}/upload-private`, async (c) => {
-      const who = await pv.authorize(c);
-      if (!who) return c.json({ error: 'unauthorized' }, 401);
-      const raw = c.req.raw.body;
-      if (!raw) return c.json({ error: 'empty body' }, 400);
-      const body = guardSingleUpload(c, raw);
-      if (body instanceof Response) return body;
-
-      let setKey: Buffer;
-      let keyMode: 'standard' | 'deniable';
-      const unlockToken = c.req.header(tokenHeader) || undefined;
-      if (unlockToken) {
-        // Token path: recover the sealed set key + mode from the grant. The token must belong
-        // to the session caller.
-        const grant = await pv.unlock.verify(unlockToken);
-        if (!grant || grant.userId !== who.userId) {
-          return c.json({ error: 'invalid unlock token' }, 401);
-        }
-        setKey = grant.setKey;
-        keyMode = grant.mode;
-      } else {
-        // Password path: derive fresh from the header (deniable) or the server key. Under the
-        // gate policy the password is an access check only — verify, then wrap standard.
-        const password = c.req.header(passwordHeader) || undefined;
-        const policy = pv.passwordPolicy ?? { mode: 'derive' as const };
-        let derivePassword = password;
-        if (policy.mode === 'gate' && password) {
-          if (!(await policy.verifyPassword(who, password))) {
-            return c.json({ error: 'invalid password' }, 401);
-          }
-          derivePassword = undefined;
-        }
-        setKey = pv.unlock.deriveSetKey({
-          userId: who.userId,
-          userSalt: who.userSalt,
-          password: derivePassword,
-        });
-        keyMode = derivePassword ? 'deniable' : 'standard';
-      }
-
-      // The private owner axis is the userId (deniability is personal), matching mountPrivateRoutes.
-      const ctx: MediaCtx = { userId: who.userId, tenantId: who.userId };
-      const tags = c.req.header('x-tags');
-      try {
-        const item = await catalogue.ingestPrivate(
-          ctx,
-          {
-            name: c.req.header('x-filename') ?? 'upload',
-            mime: c.req.header('content-type') ?? 'application/octet-stream',
-            body,
-            tags: tags
-              ? tags
-                  .split(',')
-                  .map((t) => t.trim())
-                  .filter(Boolean)
-              : undefined,
-          },
-          { setKey, keyMode },
-        );
-        return c.json({ item });
-      } catch (e) {
-        if (isUploadTooLarge(e)) return c.json({ error: SINGLE_UPLOAD_TOO_LARGE }, 413);
-        throw e;
-      }
-    });
-  }
-
   // Chunked upload (large files, direct-to-backend). init → the client PUTs each chunk straight to
   // the backend (URLs the app minted) → complete registers the row over the assembled bytes. The
   // bytes never traverse this origin.

package/src/server/storage/files/index.ts

@@ -1,5 +1,5 @@
 // cursedbelt-server/storage FileCatalogue — a SQLite-backed tagged flat file system over the
-// MediaStore + media pipeline + private-media. One source of truth for a user's binaries; the
+// MediaStore + media pipeline. One source of truth for a user's binaries; the
 // video gallery is a video-filtered view over it.
 export {
   createCatalogueMediaSource,
@@ -59,8 +59,5 @@ export {
   type FileToPlayable,
   type FileType,
   type ListFilesOptions,
-  type PrivateFileCatalogue,
-  type PrivateFileItem,
-  type PrivateKeyMode,
   type TagFacet,
 } from './types';

package/src/server/storage/files/migrations.ts

@@ -6,6 +6,15 @@ import type { Migration } from '../../migration/types';
 // (not re-derived per list), tags live in an indexed junction (fast facets, not a JSON scan),
 // processing state is typed columns (not an opaque blob), and a storage-operations ledger backs
 // durable cross-boundary (binary-server/S3) ops. Flat — no parent_id tree.
+//
+// 🔴 `0001` is edited IN PLACE rather than followed by a drop-column migration (2026-09-17,
+// removing private media). It is `CREATE TABLE IF NOT EXISTS` and is recorded in `_migrations`,
+// so an existing database never re-runs it and simply keeps three vestigial columns
+// (`is_private`, `enc_name`, `enc_dek`, `enc_key_type`, `file_tags.is_private`) that nothing
+// reads; every one of them had `NOT NULL DEFAULT`, so the leaner INSERTs below still satisfy
+// them. A fresh database gets the lean shape. That is safe here only because no app in the
+// fleet mounts `createFilesStack` — if one ever does, removing a column becomes a real
+// migration, not an edit.
 
 export const FILE_CATALOGUE_MIGRATIONS: readonly Migration[] = [
   {
@@ -19,7 +28,6 @@ export const FILE_CATALOGUE_MIGRATIONS: readonly Migration[] = [
           mime                TEXT NOT NULL DEFAULT '',
           size                INTEGER NOT NULL DEFAULT 0,
           file_type           TEXT NOT NULL DEFAULT 'other',
-          is_private          INTEGER NOT NULL DEFAULT 0,
           has_thumbnail       INTEGER NOT NULL DEFAULT 0,
           has_hls             INTEGER NOT NULL DEFAULT 0,
           has_sprites         INTEGER NOT NULL DEFAULT 0,
@@ -27,9 +35,6 @@ export const FILE_CATALOGUE_MIGRATIONS: readonly Migration[] = [
           processing_status   TEXT NOT NULL DEFAULT 'ready',
           processing_progress INTEGER NOT NULL DEFAULT 100,
           storage_backend     TEXT NOT NULL DEFAULT 'disk',
-          enc_name            TEXT NOT NULL DEFAULT '',
-          enc_dek             TEXT NOT NULL DEFAULT '',
-          enc_key_type        TEXT NOT NULL DEFAULT '',
           created_at          INTEGER NOT NULL,
           updated_at          INTEGER NOT NULL
         )
@@ -41,8 +46,6 @@ export const FILE_CATALOGUE_MIGRATIONS: readonly Migration[] = [
       db.run(
         `CREATE INDEX IF NOT EXISTS idx_files_owner_type_created ON files(owner, file_type, created_at DESC, id DESC)`,
       );
-      db.run(`CREATE INDEX IF NOT EXISTS idx_files_owner_private ON files(owner, is_private)`);
-
       // Tags as a junction (indexed) — single-tag filter + facet counts are index lookups, not a
       // full-table JSON parse (ca's weakness). `owner` denormalized so facet queries stay covering.
       db.run(`
@@ -50,7 +53,6 @@ export const FILE_CATALOGUE_MIGRATIONS: readonly Migration[] = [
           file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE,
           tag     TEXT NOT NULL,
           owner   TEXT NOT NULL,
-          is_private INTEGER NOT NULL DEFAULT 0,
           PRIMARY KEY (file_id, tag)
         )
       `);

package/src/server/storage/files/stack.spec.ts

@@ -5,23 +5,23 @@ import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { Hono } from 'hono';
 import { runMigrations } from '../../migration/runner';
-import { generateUserSalt } from '../../private-media/crypto';
 import { createDiskStore } from '../diskStore';
 import type { MediaCtx } from '../types';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
 import { createFilesStack, type FilesStack } from './stack';
 
 const CTX: MediaCtx = { userId: 'u1', tenantId: 't1' };
-const salt = generateUserSalt();
 
-// Seed a row recoverProcessing acts on WITHOUT ffmpeg: a private video stuck in `processing`
-// is marked failed synchronously (its set key isn't available at boot).
-function seedStuckPrivateRow(db: Database, id: string): void {
+// Seed a row recoverProcessing acts on WITHOUT ffmpeg: a video stuck in `processing` that has
+// already burned its kick budget is marked failed synchronously, no re-kick. (Before 2026-09-17
+// this seeded a stuck PRIVATE row, which took the same branch for a different reason; the
+// attempts cap is the branch that still exists, and the one the 2026-07-04 OOM outage bought.)
+function seedExhaustedVideoRow(db: Database, id: string): void {
   runMigrations(db, FILE_CATALOGUE_MIGRATIONS); // idempotent — the stack re-runs it harmlessly
   db.run(
-    `INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status,
-       processing_progress, storage_backend, enc_name, enc_dek, enc_key_type, created_at, updated_at)
-     VALUES (?, 'u1', '', '', 1, 'video', 1, 'processing', 40, 'disk', 'x', 'x', 'deniable', 1, 1)`,
+    `INSERT INTO files (id, owner, name, mime, size, file_type, processing_status,
+       processing_progress, storage_backend, processing_attempts, created_at, updated_at)
+     VALUES (?, 'u1', 'v.mp4', 'video/mp4', 1, 'video', 'processing', 40, 'disk', 3, 1, 1)`,
     [id],
   );
 }
@@ -60,10 +60,6 @@ describe('createFilesStack — public stack', () => {
     expect(page.items).toEqual([]);
   });
 
-  test('no private layer configured ⇒ unlock is null', () => {
-    expect(stack.unlock).toBeNull();
-  });
-
   test('URL builders are wired to the default bases', async () => {
     const f = await stack.fileUrls.build(CTX, 'fid', 'image/png');
     expect(f.url).toStartWith('/_files/s/');
@@ -144,9 +140,9 @@ describe('createFilesStack — recoverProcessing', () => {
       recoverProcessing,
     });
 
-  test('runs by default — a stuck private row is marked failed at build', () => {
+  test('runs by default — a stuck row past its kick budget is marked failed at build', () => {
     const db = new Database(':memory:');
-    seedStuckPrivateRow(db, 'stuck1');
+    seedExhaustedVideoRow(db, 'stuck1');
     build(db);
     expect(statusOf(db, 'stuck1')).toBe('failed');
     db.close();
@@ -154,105 +150,9 @@ describe('createFilesStack — recoverProcessing', () => {
 
   test('recoverProcessing: false skips it', () => {
     const db = new Database(':memory:');
-    seedStuckPrivateRow(db, 'stuck2');
+    seedExhaustedVideoRow(db, 'stuck2');
     build(db, false);
     expect(statusOf(db, 'stuck2')).toBe('processing');
     db.close();
   });
 });
-
-describe('createFilesStack — private stack', () => {
-  let db: Database;
-  let root: string;
-  let stack: FilesStack;
-  const app = new Hono();
-
-  beforeAll(async () => {
-    db = new Database(':memory:');
-    root = await mkdtemp(path.join(tmpdir(), 'stack-priv-'));
-    stack = createFilesStack({
-      db,
-      store: createDiskStore(root),
-      workDir: path.join(root, 'work'),
-      streamSecret: 'stream-secret',
-      privateMedia: { serverSecret: 'srv', unlockSecret: 'unl' },
-    });
-    stack.mount(app, {
-      authorizeUpload: () => CTX,
-      authorizePrivate: async () => ({ userId: CTX.userId, userSalt: salt }),
-    });
-  });
-  afterAll(async () => {
-    db.close();
-    await rm(root, { recursive: true, force: true });
-  });
-
-  test('unlock service exists and its tokens verify', async () => {
-    expect(stack.unlock).not.toBeNull();
-    const { token, mode } = await stack.unlock!.unlock({
-      userId: CTX.userId,
-      userSalt: salt,
-      password: 'pw',
-    });
-    expect(mode).toBe('deniable');
-    expect((await stack.unlock!.verify(token))?.userId).toBe(CTX.userId);
-  });
-
-  test('POST /_private/unlock with a password mints a deniable token', async () => {
-    const res = await app.request('/_private/unlock', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ password: 'hunter2' }),
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { token: string; mode: string };
-    expect(body.mode).toBe('deniable');
-    expect((await stack.unlock!.verify(body.token))?.mode).toBe('deniable');
-  });
-
-  test('reveal route is mounted (password reveal over an empty set)', async () => {
-    const res = await app.request('/_private/reveal', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ password: 'hunter2' }),
-    });
-    expect(res.status).toBe(200);
-    expect((await res.json()) as { items: unknown[] }).toEqual({ items: [] });
-  });
-
-  test('private upload route is mounted and session-guarded', async () => {
-    const denied = new Hono();
-    stack.mount(denied, {
-      authorizeUpload: () => CTX,
-      authorizePrivate: async () => null,
-    });
-    const res = await denied.request('/_files/upload-private', { method: 'PUT', body: 'x' });
-    expect(res.status).toBe(401); // mounted (not 404) but rejected by the host auth
-  });
-
-  test('mount() throws without authorizePrivate when privateMedia is configured', () => {
-    expect(() => stack.mount(new Hono(), { authorizeUpload: () => CTX })).toThrow(
-      /authorizePrivate/,
-    );
-  });
-
-  test('privateBasePath flows through to the private mount', async () => {
-    const db2 = new Database(':memory:');
-    const s = createFilesStack({
-      db: db2,
-      store: createDiskStore(root),
-      workDir: path.join(root, 'work2'),
-      streamSecret: 's',
-      privateBasePath: '/vault',
-      privateMedia: { serverSecret: 'srv', unlockSecret: 'unl' },
-    });
-    const a = new Hono();
-    s.mount(a, {
-      authorizeUpload: () => CTX,
-      authorizePrivate: async () => ({ userId: CTX.userId, userSalt: salt }),
-    });
-    const res = await a.request('/vault/unlock', { method: 'POST', body: '{}' });
-    expect(res.status).toBe(200);
-    db2.close();
-  });
-});

package/src/server/storage/files/stack.ts

@@ -1,12 +1,6 @@
 import type { Database } from 'bun:sqlite';
 import type { Context, Hono } from 'hono';
 import { runMigrations } from '../../migration/runner';
-import { mountPrivateRoutes } from '../../private-media/mountPrivateRoutes';
-import {
-  createUnlockService,
-  type UnlockPasswordPolicy,
-  type UnlockService,
-} from '../../private-media/unlock';
 import { mountMediaRoutes } from '../mountMediaRoutes';
 import { createMediaUrls, type MediaUrls, SourceRegistry } from '../sources';
 import { createStreamTokenService, type StreamTokenService } from '../streamToken';
@@ -25,14 +19,14 @@ import {
 import { createFileUrls, type FileUrls, mountFileRoutes } from './fileRoutes';
 import { FILE_CATALOGUE_MIGRATIONS } from './migrations';
 import { createStorageOpsLedger } from './storageOps';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 
 // ── Files stack — the host recipe ───────────────────────────────────────────────
 // One call that assembles the whole files/media server stack a host would otherwise hand-wire:
 // migrations + SQLite catalogue over a MediaStore, the stream-token service, the media/file URL
-// builders, the catalogue-as-video-source registered in a SourceRegistry, the optional private
-// (encrypted) layer, and a `mount()` that wires every byte/upload route onto a Hono app. The auth
-// seams (session → MediaCtx / {userId, userSalt}) stay host-injected — the stack owns no auth.
+// builders, the catalogue-as-video-source registered in a SourceRegistry, and a `mount()` that
+// wires every byte/upload route onto a Hono app. The auth seam (session → MediaCtx) stays
+// host-injected — the stack owns no auth.
 
 export interface FilesStackOptions {
   /** The catalogue database. The stack runs FILE_CATALOGUE_MIGRATIONS on it itself. */
@@ -43,9 +37,9 @@ export interface FilesStackOptions {
   workDir: string;
   /** Secret for the stream-token service (path-embedded byte-route auth). */
   streamSecret: string;
-  /** Owner keyspace segment. Defaults to the userId (files + private are personal) — note the
-   * bare primitives default to tenantId; the stack picks the personal axis so every URL/route
-   * agrees with the private layer's per-user owner. */
+  /** Owner keyspace segment. Defaults to the userId (files are personal) — note the bare
+   * primitives default to tenantId; the stack picks the personal axis so every URL and route
+   * agrees on one owner. */
   owner?: (ctx: MediaCtx) => string;
   /** Registered video-source id (also the media-token sourceId). Default 'files'. */
   sourceId?: string;
@@ -66,8 +60,6 @@ export interface FilesStackOptions {
   mediaPublicBase?: string;
   /** PUBLIC base for browser file URLs (split-origin counterpart of `filesBasePath`). */
   filesPublicBase?: string;
-  /** Private (encrypted) route mount. Default '/_private'. */
-  privateBasePath?: string;
   /** HLS ladder heights for video ingest (createSqliteFileCatalogue passthrough). */
   ladderHeights?: SqliteFileCatalogueOptions['ladderHeights'];
   /** Cap on transcode kicks per file before it's marked failed (createSqliteFileCatalogue
@@ -82,11 +74,6 @@ export interface FilesStackOptions {
   /** Image thumbnail/display derivative implementation (createSqliteFileCatalogue passthrough).
    * Default: local sharp with ffmpeg fallback. */
   imageDerivatives?: SqliteFileCatalogueOptions['imageDerivatives'];
-  /** Enables the private (encrypted) stack: unlock service + /_private routes + private uploads.
-   * Omit ⇒ `unlock` is null and mount() wires only the public routes. `passwordPolicy` sets what
-   * a supplied password MEANS (derive = deniable sets, the default; gate = verify against the
-   * app's accounts + recoverable server-key sets — see UnlockPasswordPolicy). */
-  privateMedia?: { serverSecret: string; unlockSecret: string; passwordPolicy?: UnlockPasswordPolicy };
   /** Re-kick transcodes a restart left stuck (catalogue.recoverProcessing) at build time.
    * Default true. */
   recoverProcessing?: boolean;
@@ -113,15 +100,8 @@ export interface FilesStackMountAuth {
   /** Session auth for uploads + listings (same guard mountMediaRoutes/mountFileRoutes take).
    * Return a MediaCtx to allow, null to reject. */
   authorizeUpload: (c: Context) => Promise<MediaCtx | null> | MediaCtx | null;
-  /** Session auth for the private layer → {userId, userSalt}. REQUIRED when `privateMedia` is
-   * configured (mount() throws otherwise); ignored when it isn't. */
-  authorizePrivate?: (c: Context) => Promise<{ userId: string; userSalt: string } | null>;
   /** Wire large-file chunked uploads (mountFileRoutes' `chunked` passthrough). */
   mintChunkUpload?: ChunkedUploadService;
-  /** Private-upload password header (default 'x-private-password'). */
-  passwordHeader?: string;
-  /** Private-upload unlock-token header (default 'x-unlock-token'). */
-  tokenHeader?: string;
 }
 
 /**
@@ -131,7 +111,7 @@ export interface FilesStackMountAuth {
  * not, layering) import cursedshell.
  */
 export interface FilesStack {
-  catalogue: FileCatalogue & PrivateFileCatalogue;
+  catalogue: FileCatalogue;
   token: StreamTokenService;
   mediaUrls: MediaUrls;
   fileUrls: FileUrls;
@@ -141,15 +121,12 @@ export interface FilesStack {
   /** The MIXED view — photos + videos in one feed (media gallery data source). */
   mediaSource: MediaGallerySource;
   registry: SourceRegistry;
-  /** Null unless `privateMedia` was configured. */
-  unlock: UnlockService | null;
   /** The large-file chunked-upload service, or null unless `chunkedUpload` was configured. mount()
    * auto-wires it into the file routes; exposed for observability (pending()) + tests. */
   chunked: ChunkedUploadService | null;
   /**
    * Mount every byte/upload route the stack owns onto a Hono app: mountMediaRoutes
-   * (mediaBasePath) + mountFileRoutes (filesBasePath, incl. privateUpload when unlock exists) +
-   * mountPrivateRoutes (privateBasePath, when unlock exists). Auth stays host-injected.
+   * (mediaBasePath) + mountFileRoutes (filesBasePath). Auth stays host-injected.
    */
   mount(app: Hono, auth: FilesStackMountAuth): void;
 }
@@ -212,8 +189,6 @@ export function createFilesStack(opts: FilesStackOptions): FilesStack {
   });
   const registry = new SourceRegistry().register(videoSource);
 
-  const unlock = opts.privateMedia ? createUnlockService(opts.privateMedia) : null;
-
   const chunked = opts.chunkedUpload
     ? createChunkedUploadService({
         catalogue,
@@ -234,15 +209,8 @@ export function createFilesStack(opts: FilesStackOptions): FilesStack {
     photoSource,
     mediaSource,
     registry,
-    unlock,
     chunked,
     mount(app, auth) {
-      if (unlock && !auth.authorizePrivate) {
-        throw new Error(
-          'createFilesStack: privateMedia is configured but mount() got no authorizePrivate — ' +
-            'the private routes need a session→{userId, userSalt} resolver.',
-        );
-      }
       mountMediaRoutes(app, {
         store,
         token,
@@ -258,27 +226,7 @@ export function createFilesStack(opts: FilesStackOptions): FilesStack {
         authorizeUpload: auth.authorizeUpload,
         // Prefer a mount-time override, else the service the stack built from `chunkedUpload` opts.
         chunked: auth.mintChunkUpload ?? chunked ?? undefined,
-        privateUpload:
-          unlock && auth.authorizePrivate
-            ? {
-                unlock,
-                authorize: auth.authorizePrivate,
-                passwordHeader: auth.passwordHeader,
-                tokenHeader: auth.tokenHeader,
-                passwordPolicy: opts.privateMedia?.passwordPolicy,
-              }
-            : undefined,
       });
-      if (unlock && auth.authorizePrivate) {
-        mountPrivateRoutes(app, {
-          store,
-          index: catalogue.asPrivateIndex(),
-          unlock,
-          basePath: opts.privateBasePath,
-          authorize: auth.authorizePrivate,
-          passwordPolicy: opts.privateMedia?.passwordPolicy,
-        });
-      }
     },
   };
 }

package/src/server/storage/files/types.ts

@@ -1,5 +1,4 @@
 import type { PlayableVideo, ProcessingStatus } from 'cursedbelt-core/media';
-import type { PrivateIndex } from '../../private-media/index-store';
 import type { MediaCtx } from '../types';
 
 // ── FileCatalogue: a tagged flat file system over the storage layer ──────────────
@@ -8,7 +7,7 @@ import type { MediaCtx } from '../types';
 // becomes a video-filtered view over it. Improves on ca's fs_nodes: FLAT (no folder tree), the
 // smart-view `fileType` is STORED at write (not re-derived per request), tags are a JOIN table
 // (indexed facets, not a JSON scan), listing is CURSOR-paginated, and processing state is typed
-// columns — not an opaque JSON blob. Reuses MediaStore, the media pipeline, and private-media.
+// columns — not an opaque JSON blob. Reuses MediaStore and the media pipeline.
 
 export type FileType = 'image' | 'video' | 'audio' | 'doc' | 'code' | 'other';
 
@@ -39,7 +38,6 @@ export type FileRecord = {
   size: number;
   fileType: FileType;
   tags: string[];
-  isPrivate: boolean;
   hasThumbnail: boolean;
   hasHls: boolean;
   hasSprites: boolean;
@@ -79,11 +77,8 @@ export type ListFilesOptions = {
   type?: FileType;
   /** Single-tag filter (indexed via the join table). */
   tag?: string;
-  /** Name substring (public files only — private names are sealed). */
+  /** Name substring. */
   query?: string;
-  /** Include the caller's private files (requires an unlocked set — the caller resolves which
-   * ones actually open). Omitted ⇒ public only, matching ca's default listing. */
-  includePrivate?: boolean;
   /** Filter to members of a specific collection. An unlock-gated collection yields empty unless
    * `includeUnlockable` is also true. */
   collectionId?: string;
@@ -116,14 +111,11 @@ export function classifyFileType(mime: string, isText = false): FileType {
 /** The catalogue contract. A SQLite implementation is the production default; the interface lets
  * an app swap it. All calls are owner-scoped via {@link MediaCtx} (one tenant never sees another). */
 /** Cheap owner-scoped aggregates (COUNT/SUM over the files table) — the admin
- * surface's "site stats" source. Private items report count + bytes only
- * (names/kinds stay sealed). */
+ * surface's "site stats" source. */
 export type CatalogueStats = {
   files: number;
   bytes: number;
   byType: Partial<Record<FileType, number>>;
-  privateItems: number;
-  privateBytes: number;
   processing: number;
   failed: number;
 };
@@ -133,7 +125,7 @@ export interface FileCatalogue {
   get(ctx: MediaCtx, id: string): Promise<FileRecord | null>;
   /** Owner-scoped aggregates for admin/stats surfaces. */
   stats(ctx: MediaCtx): Promise<CatalogueStats>;
-  tagFacets(ctx: MediaCtx, opts?: { includePrivate?: boolean }): Promise<TagFacet[]>;
+  tagFacets(ctx: MediaCtx): Promise<TagFacet[]>;
   /** Ingest a public upload: persist bytes, classify, kick off processing (thumbnail/HLS). */
   ingest(
     ctx: MediaCtx,
@@ -160,9 +152,8 @@ export interface FileCatalogue {
   ): Promise<FileRecord | null>;
   /** Overwrite a file's BYTES in place — the identity (id, tags, collections, favorites, view
    * history) survives while mime/size/fileType re-derive, stale derivatives are wiped, and
-   * processing re-kicks (video transcode / image thumbnail). Public files only — replacing an
-   * encrypted private item throws (delete + re-upload instead). Returns the refreshed record,
-   * or null if the id is unknown/other-owner. */
+   * processing re-kicks (video transcode / image thumbnail). Returns the refreshed record, or
+   * null if the id is unknown/other-owner. */
   replaceContent(
     ctx: MediaCtx,
     id: string,
@@ -189,15 +180,15 @@ export interface FileCatalogue {
     absPath: string,
     opts?: { tags?: string[] },
   ): Promise<{ imported: FileRecord[]; skipped: { path: string; reason: string }[] }>;
-  /** Recover from a restart that lost in-flight transcodes: re-kick public video rows still marked
-   * pending/processing (their source persists), and mark stuck private rows failed. Call once at
-   * app startup. Returns how many were re-queued vs. failed. */
+  /** Recover from a restart that lost in-flight transcodes: re-kick video rows still marked
+   * pending/processing (their source persists), and mark rows that have exhausted their kick
+   * budget failed. Call once at app startup. Returns how many were re-queued vs. failed. */
   recoverProcessing(): { requeued: number; failed: number };
-  /** Backfill grid thumbnails for finished public video rows that have no poster (landed while
+  /** Backfill grid thumbnails for finished video rows that have no poster (landed while
    * transcoding was off, or failed before the poster step). Re-kicks the poster pipeline for each.
    * Returns how many were re-queued. */
   backfillVideoPosters(): { requeued: number };
-  /** Backfill grid thumbnails for public image rows with no poster (e.g. HEIC photos whose sharp
+  /** Backfill grid thumbnails for image rows with no poster (e.g. HEIC photos whose sharp
    * thumbnail failed before the ffmpeg fallback). Re-kicks the image pipeline. */
   backfillImageThumbnails(): { requeued: number };
 
@@ -235,51 +226,12 @@ export interface FileCatalogue {
 /** Resolve a video FileRecord to a PlayableVideo (URLs baked server-side). Non-video ⇒ null. */
 export type FileToPlayable = (ctx: MediaCtx, file: FileRecord) => Promise<PlayableVideo | null>;
 
-// ── Private (encrypted) files ─────────────────────────────────────────────────────
-// Private items live in the SAME catalogue (one source of truth), flagged is_private and holding
-// a SEALED descriptor + WRAPPED content key instead of plaintext name/tags. The crypto plumbing
-// (deriving the set key from a password/unlock token vs the server secret) stays at the route
-// layer — the catalogue takes an already-derived `setKey: Buffer`. See private-media/crypto.
-
-/** How a private item's content key is wrapped: `standard` (server-recoverable) vs `deniable`
- * (password-derived; zero-knowledge). Mirrors private-media `KeyMode`. */
-export type PrivateKeyMode = 'standard' | 'deniable';
-
-/** The OPAQUE locked-index row — only non-sensitive metadata (so a user can prune media whose
- * password is lost). NEVER name/tags/thumbnail: those are sealed. No set identifier is exposed. */
-export type PrivateFileItem = {
-  id: string;
-  size: number;
-  createdAt: number;
-  processingStatus: ProcessingStatus;
-  processingProgress: number;
-  hasHls: boolean;
-};
-
-/** Private-media capability of a catalogue. `createSqliteFileCatalogue` implements this alongside
- * {@link FileCatalogue}, storing private items as sealed rows in the SAME table (one source of
- * truth). Membership is by decrypt-success — no stored password/set hash.
- *
- * Deliberately small: the catalogue owns only INGEST (the new private-upload path). Everything
- * else — the locked index, unlock, try-a-password reveal, the gated content-key route, and the
- * encrypted-HLS byte serving — is the existing `mountPrivateRoutes`, which operates through a
- * {@link PrivateIndex}. `asPrivateIndex()` is the view that lets those routes read/write the
- * catalogue's private rows, so there is exactly one store and one set of routes. */
-export interface PrivateFileCatalogue {
-  /** Ingest an encrypted video: stage plaintext (never persisted), transcode to AES-128 HLS, seal
-   * the descriptor + wrap the content key under `setKey`, and insert a private row. */
-  ingestPrivate(
-    ctx: MediaCtx,
-    upload: {
-      name: string;
-      mime: string;
-      body: ReadableStream<Uint8Array>;
-      size?: number;
-      tags?: string[];
-    },
-    opts: { setKey: Buffer; keyMode: PrivateKeyMode },
-  ): Promise<PrivateFileItem>;
-  /** A {@link PrivateIndex} view over this catalogue's private rows — pass to `mountPrivateRoutes`
-   * so unlock/index/reveal/key/HLS all operate on the catalogue. `remove` also drops the bytes. */
-  asPrivateIndex(): PrivateIndex;
-}
+// ── There is no private half, deliberately (removed 2026-09-17) ───────────────────
+// A `PrivateFileCatalogue` used to sit here: sealed descriptors, wrapped content keys, a
+// `KeyMode: 'standard' | 'deniable'` and membership "by decrypt-success — no stored password".
+// It was 1,505 lines that no app ever mounted, over a byte store that encrypts nothing
+// (binary-server's `exportFiles.ts`: *"Objects are stored unencrypted"*), so there was never a
+// ciphertext behind it — and the owner chose to delete the whole module rather than carry a
+// second, unexercised confidentiality story alongside the master lock, which is the one that
+// actually guards these apps. This paragraph is the record; it is not an invitation to
+// reintroduce it. The wall that IS real is `../../master-lock`.