cursedbelt-server 3.0.1 → 4.0.0

package/dist/server/master-lock/lockPage.d.ts

@@ -22,6 +22,15 @@ export interface LockPageOptions {
 export declare function lockPageHtml(options: LockPageOptions): string;
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
 export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n";
+/**
+ * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
+ * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the
+ * TypeScript one. Do not "tidy" it apart, and do not write a second copy — interpolate this.
+ *
+ * It ends by publishing the function on `globalThis`, which is the seam the spec pulls it
+ * out through and the seam the accounts page's script calls it back through.
+ */
+export declare const MASTER_LOCK_DERIVE_SOURCE = "function unb64u(text) {\n  const padded = text.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const binary = atob(padded + \"=\".repeat((4 - (padded.length % 4)) % 4));\n  const out = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n  return out;\n}\nfunction b64u(bytes) {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\nasync function pbkdf2(material, salt, iterations) {\n  const key = await crypto.subtle.importKey(\"raw\", material, \"PBKDF2\", false, [\"deriveBits\"]);\n  const bits = await crypto.subtle.deriveBits(\n    { name: \"PBKDF2\", salt: salt, iterations: iterations, hash: \"SHA-256\" }, key, 256);\n  return new Uint8Array(bits);\n}\nasync function deriveVerifier(password, kdf) {\n  const salt = unb64u(kdf.salt);\n  const bytes = new TextEncoder().encode(password);\n  const kek = await pbkdf2(bytes, salt, kdf.iter);\n  const joined = new Uint8Array(kek.length + bytes.length);\n  joined.set(kek, 0);\n  joined.set(bytes, kek.length);\n  return b64u(await pbkdf2(joined, salt, 1));\n}\nglobalThis.__masterLockDerive = deriveVerifier;";
 /**
  * The page's script.
  *

package/dist/server/master-lock/lockPage.js

@@ -12,13 +12,18 @@
  * keep a wall that strict. Two same-origin files cost one round trip each and let the page
  * ship under `script-src 'self'` with no nonce plumbing.
  *
- * ── 🔴 The derivation in `LOCK_SCRIPT` is a HAND COPY of `deriveMasterLockVerifier` ──────
+ * ── 🔴 The derivation in `MASTER_LOCK_DERIVE_SOURCE` is a HAND COPY of
+ *      `deriveMasterLockVerifier` ────────────────────────────────────────────
  * It cannot import it: this file is served to a browser as plain text, outside every build.
  * A copy that drifts derives a verifier that can never match, and the symptom would be "my
  * correct password is refused" — the same shape of bug that cost `apps/collections` a day.
- * So `lockPage.spec.ts` EVALUATES the script's function out of this source and asserts it
- * agrees with the TypeScript one on a fixed vector. Change one, the spec fails until you
- * change the other.
+ * So `lockPage.spec.ts` EVALUATES the function out of this source and asserts it agrees with
+ * the TypeScript one on a fixed vector. Change one, the spec fails until you change the other.
+ *
+ * 🔴 It is its OWN exported constant, and there is exactly ONE of it. `accountsPage.ts` serves
+ * a second browser script that has to derive the same way — a second hand copy would be a
+ * second thing to keep in step, and the pinning spec would only be watching one of them. Both
+ * scripts interpolate this string, and the spec asserts that they do.
  */
 import { MASTER_LOCK_PATHS } from "cursedbelt-core/master-lock";
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch] ?? ch);
@@ -125,35 +130,14 @@ button.quiet[disabled]{opacity:.5}
 .hints dd:last-child{margin-bottom:0}
 `;
 /**
- * The page's script.
+ * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
+ * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the
+ * TypeScript one. Do not "tidy" it apart, and do not write a second copy — interpolate this.
  *
- * Derives in the browser and sends only the verifier — the password itself never crosses
- * the network, which is what makes "saved nowhere" true rather than aspirational.
- *
- * 600,000 PBKDF2 rounds take a beat on a phone, so the button says so; a page that looks
- * frozen gets clicked again, and every extra click is another 600k rounds.
+ * It ends by publishing the function on `globalThis`, which is the seam the spec pulls it
+ * out through and the seam the accounts page's script calls it back through.
  */
-export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
-
-const form = document.getElementById("ml-form");
-const input = document.getElementById("ml-input");
-const confirmInput = document.getElementById("ml-confirm");
-const hintInput = document.getElementById("ml-hint");
-const submit = document.getElementById("ml-submit");
-const status = document.getElementById("ml-status");
-const forgot = document.getElementById("ml-forgot");
-const hints = document.getElementById("ml-hints");
-
-function say(message, tone) {
-  status.textContent = message;
-  if (tone) status.setAttribute("data-tone", tone);
-  else status.removeAttribute("data-tone");
-}
-
-// ── derivation ───────────────────────────────────────────────────────────────
-// 🔴 Byte-identical to deriveMasterLockVerifier in cursedbelt-core/master-lock. Pinned by
-// lockPage.spec.ts, which evaluates THIS function and compares. Do not "tidy" it apart.
-function unb64u(text) {
+export const MASTER_LOCK_DERIVE_SOURCE = `function unb64u(text) {
   const padded = text.replace(/-/g, "+").replace(/_/g, "/");
   const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
   const out = new Uint8Array(binary.length);
@@ -180,13 +164,37 @@ async function deriveVerifier(password, kdf) {
   joined.set(bytes, kek.length);
   return b64u(await pbkdf2(joined, salt, 1));
 }
-globalThis.__masterLockDerive = deriveVerifier;
+globalThis.__masterLockDerive = deriveVerifier;`;
+/**
+ * The page's script.
+ *
+ * Derives in the browser and sends only the verifier — the password itself never crosses
+ * the network, which is what makes "saved nowhere" true rather than aspirational.
+ *
+ * 600,000 PBKDF2 rounds take a beat on a phone, so the button says so; a page that looks
+ * frozen gets clicked again, and every extra click is another 600k rounds.
+ */
+export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
+
+// ── derivation ───────────────────────────────────────────────────────────────
+${MASTER_LOCK_DERIVE_SOURCE}
+
+const form = document.getElementById("ml-form");
+const input = document.getElementById("ml-input");
+const confirmInput = document.getElementById("ml-confirm");
+const hintInput = document.getElementById("ml-hint");
+const submit = document.getElementById("ml-submit");
+const status = document.getElementById("ml-status");
+const forgot = document.getElementById("ml-forgot");
+const hints = document.getElementById("ml-hints");
+
+function say(message, tone) {
+  status.textContent = message;
+  if (tone) status.setAttribute("data-tone", tone);
+  else status.removeAttribute("data-tone");
+}
 
 // ── the page ─────────────────────────────────────────────────────────────────
-// 🔴 Everything below this line touches \`document\` beyond \`getElementById\`, and
-// lockPage.spec.ts cuts the source at the marker above to evaluate the derivation with a
-// stub. Keep page state here, not in the prelude, or that test throws instead of running.
-//
 // Rendered by the server from THIS principal's own record. The server re-decides it on
 // every POST, so this only chooses which form to submit — it cannot grant anything.
 const enrolling = document.body.dataset.mode === "enroll";

package/dist/server/media-bun/streaming.d.ts

@@ -53,7 +53,6 @@ export declare const hlsLadderArgs: (inPath: string, outDir: string, opts: {
     heights: number[];
     crf: number;
     hasAudio: boolean;
-    keyInfoFile?: string;
 }) => string[];
 /** Poster: a frame `atSeconds` in (default ~1s, to skip black intros), scaled to the library
  *  width, as JPEG. Pass a smaller seek (or 0) for very short clips — seeking past EOF yields no

package/dist/server/media-bun/streaming.js

@@ -142,7 +142,7 @@ export const hlsLadderArgs = (inPath, outDir, opts) => {
     const varMap = hs
         .map((h, i) => (opts.hasAudio ? `v:${i},a:${i},name:${h}` : `v:${i},name:${h}`))
         .join(' ');
-    args.push('-f', 'hls', '-hls_time', '4', '-hls_playlist_type', 'vod', '-hls_segment_type', 'mpegts', ...(opts.keyInfoFile ? ['-hls_key_info_file', opts.keyInfoFile] : []), '-master_pl_name', 'master.m3u8', '-hls_segment_filename', path.join(outDir, '%v', 'seg_%05d.ts'), '-var_stream_map', varMap, path.join(outDir, '%v', 'playlist.m3u8'));
+    args.push('-f', 'hls', '-hls_time', '4', '-hls_playlist_type', 'vod', '-hls_segment_type', 'mpegts', '-master_pl_name', 'master.m3u8', '-hls_segment_filename', path.join(outDir, '%v', 'seg_%05d.ts'), '-var_stream_map', varMap, path.join(outDir, '%v', 'playlist.m3u8'));
     return args;
 };
 /** Poster: a frame `atSeconds` in (default ~1s, to skip black intros), scaled to the library

package/dist/server/storage/files/catalogue.d.ts

@@ -1,7 +1,7 @@
 import type { Database } from 'bun:sqlite';
 import { type MediaCtx, type MediaStore } from '../types';
 import { type ProcessOptions, type ProcessResult } from '../videoProcessor';
-import { type FileCatalogue, type PrivateFileCatalogue } from './types';
+import { type FileCatalogue } from './types';
 /** Swappable video ingest→derivatives implementation. The default runs ffmpeg
  * locally ({@link processVideo}); a remote backend (binary-server) delegates
  * the heavy work to the storage host instead — see binaryServerProcessing. */
@@ -69,4 +69,4 @@ export type SqliteFileCatalogueOptions = {
      * with ffmpeg fallback). Inject a remote one when the byte store is remote. */
     imageDerivatives?: ImageDerivatives;
 };
-export declare function createSqliteFileCatalogue(opts: SqliteFileCatalogueOptions): FileCatalogue & PrivateFileCatalogue;
+export declare function createSqliteFileCatalogue(opts: SqliteFileCatalogueOptions): FileCatalogue;

package/dist/server/storage/files/catalogue.js

@@ -1,34 +1,11 @@
-import { mkdir, readdir, rm, stat as fsStat } from 'node:fs/promises';
+import { readdir, stat as fsStat } from 'node:fs/promises';
 import path from 'node:path';
 import { renderImage } from '../../media-bun/image';
-import { sealMeta } from '../../private-media/crypto';
-import { processPrivateBlob, processPrivateVideo } from '../../private-media/pipeline';
 import { ffmpegImageThumbnail, isBrowserRenderableImage } from '../imageThumbnail';
-import { fsDisplayKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, privateFsKey, } from '../types';
+import { fsDisplayKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, } from '../types';
 import { processVideo } from '../videoProcessor';
 import { mimeByExt } from './mimeByExt';
 import { classifyFileType, } from './types';
-// Stream an upload body to a local plaintext file (staged for the private pipeline; wiped after).
-// Bun.write(dest, new Response(stream)) hangs in Bun 1.3.x — pump via a FileSink instead.
-async function streamToFile(body, dest) {
-    await mkdir(path.dirname(dest), { recursive: true });
-    const sink = Bun.file(dest).writer();
-    const reader = body.getReader();
-    let size = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            size += value.byteLength;
-            sink.write(value);
-        }
-    }
-    finally {
-        await sink.end();
-    }
-    return size;
-}
 // The general primary binary for a NON-video file (images/docs/…) lives here; video files store a
 // raw source (fsSourceKey) + derived mp4/HLS/poster/sprite via the shared video keyspace.
 export const fileBinaryKey = (owner, id) => `fs/${owner}/${id}`;
@@ -120,9 +97,9 @@ export function createSqliteFileCatalogue(opts) {
     const rand31 = () => Math.floor(Math.random() * RANDOM_MOD);
     const randKey = opts.randKey ?? rand31;
     const randomSeed = opts.randomSeed ?? rand31;
-    const insertFile = db.query(`INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, rand_key, created_at, updated_at)
-     VALUES ($id, $owner, $name, $mime, $size, $type, 0, $status, $progress, 'disk', $rand, $now, $now)`);
-    const insertTag = db.query(`INSERT OR IGNORE INTO file_tags (file_id, tag, owner, is_private) VALUES ($file, $tag, $owner, 0)`);
+    const insertFile = db.query(`INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, rand_key, created_at, updated_at)
+     VALUES ($id, $owner, $name, $mime, $size, $type, $status, $progress, 'disk', $rand, $now, $now)`);
+    const insertTag = db.query(`INSERT OR IGNORE INTO file_tags (file_id, tag, owner) VALUES ($file, $tag, $owner)`);
     const deleteTags = db.query(`DELETE FROM file_tags WHERE file_id = $file`);
     const getRow = db.query(`SELECT * FROM files WHERE id = $id AND owner = $owner`);
     const deleteFile = db.query(`DELETE FROM files WHERE id = $id AND owner = $owner`);
@@ -140,20 +117,7 @@ export function createSqliteFileCatalogue(opts) {
     const replaceMeta = db.query(`UPDATE files SET name = $name, mime = $mime, size = $size, file_type = $type,
        processing_status = $status, processing_progress = $progress,
        has_hls = 0, has_thumbnail = 0, has_sprites = 0, duration = NULL, updated_at = $now
-     WHERE id = $id AND owner = $owner AND is_private = 0`);
-    // Private (encrypted) rows: name/tags are sealed in enc_name (sealedMeta); the wrapped AES-128
-    // content key is in enc_dek; enc_key_type records the wrap mode. is_private = 1 keeps them out of
-    // the public feed. These rows are surfaced to `mountPrivateRoutes` via `asPrivateIndex()`.
-    const insertPrivate = db.query(`INSERT INTO files (id, owner, name, mime, size, file_type, is_private, has_hls, duration,
-       processing_status, processing_progress, storage_backend, enc_name, enc_dek, enc_key_type, rand_key, created_at, updated_at)
-     VALUES ($id, $owner, '', '', $size, $type, 1, 0, NULL, $status, $progress, 'disk', $sealed, $wrapped, $mode, $rand, $now, $now)`);
-    const finishPrivate = db.query(`UPDATE files SET processing_status = $status, processing_progress = $progress, has_hls = $hls,
-       duration = $duration, size = $size, enc_name = $sealed, enc_dek = $wrapped, updated_at = $now WHERE id = $id`);
-    const getPrivateRow = db.query(`SELECT * FROM files WHERE id = $id AND owner = $owner AND is_private = 1`);
-    const listPrivateFullRows = db.query(`SELECT * FROM files WHERE owner = $owner AND is_private = 1 ORDER BY created_at DESC, id DESC`);
-    const updatePrivateRow = db.query(`UPDATE files SET size = $size, processing_status = $status, enc_name = $sealed, enc_dek = $wrapped,
-       enc_key_type = $mode, updated_at = $now WHERE id = $id AND owner = $owner AND is_private = 1`);
-    const deletePrivateRow = db.query(`DELETE FROM files WHERE id = $id AND owner = $owner AND is_private = 1`);
+     WHERE id = $id AND owner = $owner`);
     // ── Collection prepared statements ───────────────────────────────────────────────
     const insertCollection = db.query(`INSERT INTO file_collections (id, owner, name, kind, visibility, created_at, updated_at)
      VALUES ($id, $owner, $name, $kind, $visibility, $now, $now)
@@ -180,16 +144,6 @@ export function createSqliteFileCatalogue(opts) {
      SELECT f.id, f.owner, $now, 1 FROM files f WHERE f.id = $id AND f.owner = $owner
      ON CONFLICT(file_id) DO UPDATE SET viewed_at = excluded.viewed_at, view_count = view_count + 1`);
     const deleteFileViews = db.query(`DELETE FROM file_views WHERE file_id = $file`);
-    const rowToPrivateItem = (r, owner) => ({
-        id: r.id,
-        owner,
-        sizeBytes: r.size,
-        createdAt: r.created_at,
-        status: r.processing_status,
-        keyMode: (r.enc_key_type || 'deniable'),
-        wrappedContentKey: r.enc_dek,
-        sealedMeta: r.enc_name,
-    });
     const tagsFor = (ids) => {
         const map = new Map();
         if (ids.length === 0)
@@ -235,7 +189,6 @@ export function createSqliteFileCatalogue(opts) {
         size: row.size,
         fileType: row.file_type,
         tags,
-        isPrivate: row.is_private === 1,
         hasThumbnail: row.has_thumbnail === 1,
         hasHls: row.has_hls === 1,
         hasSprites: row.has_sprites === 1,
@@ -416,8 +369,7 @@ export function createSqliteFileCatalogue(opts) {
         return rows[0];
     };
     const statsByType = db.query(`SELECT file_type, COUNT(*) AS n, SUM(size) AS bytes FROM files
-     WHERE owner = $owner AND is_private = 0 GROUP BY file_type`);
-    const statsPrivate = db.query(`SELECT COUNT(*) AS n, SUM(size) AS bytes FROM files WHERE owner = $owner AND is_private = 1`);
+     WHERE owner = $owner GROUP BY file_type`);
     const statsStatus = db.query(`SELECT processing_status, COUNT(*) AS n FROM files
      WHERE owner = $owner GROUP BY processing_status`);
     return {
@@ -431,7 +383,6 @@ export function createSqliteFileCatalogue(opts) {
                 files += row.n;
                 bytes += row.bytes ?? 0;
             }
-            const priv = statsPrivate.get({ $owner: owner });
             let processing = 0;
             let failed = 0;
             for (const row of statsStatus.all({ $owner: owner })) {
@@ -444,8 +395,6 @@ export function createSqliteFileCatalogue(opts) {
                 files,
                 bytes,
                 byType,
-                privateItems: priv?.n ?? 0,
-                privateBytes: priv?.bytes ?? 0,
                 processing,
                 failed,
             };
@@ -456,7 +405,6 @@ export function createSqliteFileCatalogue(opts) {
             const params = { $owner: owner, $limit: limit + 1 };
             const where = [
                 'f.owner = $owner',
-                'f.is_private = 0',
                 options.trashedOnly ? 'f.trashed_at IS NOT NULL' : 'f.trashed_at IS NULL',
             ];
             let from = 'files f';
@@ -547,7 +495,7 @@ export function createSqliteFileCatalogue(opts) {
         },
         async tagFacets(ctx) {
             const rows = db
-                .query(`SELECT tag, COUNT(*) as count FROM file_tags WHERE owner = $owner AND is_private = 0
+                .query(`SELECT tag, COUNT(*) as count FROM file_tags WHERE owner = $owner
            GROUP BY tag ORDER BY count DESC, tag ASC`)
                 .all({ $owner: ownerOf(ctx) });
             return rows;
@@ -591,9 +539,6 @@ export function createSqliteFileCatalogue(opts) {
             const row = getRow.get({ $id: id, $owner: owner });
             if (!row)
                 return null;
-            if (row.is_private === 1) {
-                throw new Error('replaceContent: private files cannot be replaced in place');
-            }
             const isVideo = upload.mime.startsWith('video/');
             // Store the new bytes FIRST — a failed write leaves the old row + bytes fully intact.
             const key = isVideo ? fsSourceKey(owner, id) : fileBinaryKey(owner, id);
@@ -728,24 +673,21 @@ export function createSqliteFileCatalogue(opts) {
         },
         recoverProcessing() {
             // A restart mid-transcode leaves a row stuck in `processing`/`pending` — the in-process
-            // job is gone. For PUBLIC videos the source still sits at fsSourceKey, so re-kick the pipeline.
-            // PRIVATE rows can't be re-kicked at boot (the set key isn't available) — video or blob alike,
-            // mark them failed; the user re-unlocks + re-uploads. Public non-video rows are `ready` at
-            // insert and never appear here. (Ported from ca's recoverOnBoot; our jobs are in-process,
-            // so recovery is app-invoked at startup rather than a persistent queue.)
+            // job is gone. The source still sits at fsSourceKey, so re-kick the pipeline. Non-video rows
+            // are `ready` at insert and never appear here. (Ported from ca's recoverOnBoot; our jobs are
+            // in-process, so recovery is app-invoked at startup rather than a persistent queue.)
             // Re-kicks are CAPPED at maxProcessingAttempts total kicks: if the transcode itself is what
             // keeps killing the process (2026-07-04 prod outage: ffmpeg OOM on a 1GB host → systemd
             // restart → unconditional re-kick → OOM again, forever), the row must land on `failed`
             // instead of holding the whole service down.
             const stuck = db
-                .query(`SELECT id, owner, is_private, processing_attempts FROM files
-           WHERE (file_type = 'video' OR is_private = 1)
-             AND processing_status IN ('pending', 'processing')`)
+                .query(`SELECT id, owner, processing_attempts FROM files
+           WHERE file_type = 'video' AND processing_status IN ('pending', 'processing')`)
                 .all();
             let requeued = 0;
             let failed = 0;
             for (const r of stuck) {
-                if (r.is_private === 1 || r.processing_attempts >= maxProcessingAttempts) {
+                if (r.processing_attempts >= maxProcessingAttempts) {
                     setProcessing.run({ $id: r.id, $status: 'failed', $progress: 0, $now: now() });
                     failed++;
                 }
@@ -756,14 +698,14 @@ export function createSqliteFileCatalogue(opts) {
             }
             return { requeued, failed };
         },
-        // Backfill grid thumbnails for PUBLIC video rows that finished (ready/failed) without a poster —
+        // Backfill grid thumbnails for video rows that finished (ready/failed) without a poster —
         // e.g. rows that landed while transcodeVideos was off entirely, or that failed a full transcode
         // before the poster step. Re-kicks the (now poster-capable) pipeline; the attempts counter is
         // reset first so the maxProcessingAttempts cap doesn't pre-empt a fresh, cheaper poster-only run.
         backfillVideoPosters() {
             const missing = db
                 .query(`SELECT id, owner FROM files
-           WHERE file_type = 'video' AND is_private = 0 AND has_thumbnail = 0
+           WHERE file_type = 'video' AND has_thumbnail = 0
              AND processing_status IN ('ready', 'failed')`)
                 .all();
             // Serialize: on the memory-constrained hosts this exists for, running every poster extract
@@ -775,7 +717,7 @@ export function createSqliteFileCatalogue(opts) {
             }, Promise.resolve());
             return { requeued: missing.length };
         },
-        // Backfill grid thumbnails for PUBLIC image rows with no poster — e.g. HEIC/HEVC iPhone photos
+        // Backfill grid thumbnails for image rows with no poster — e.g. HEIC/HEVC iPhone photos
         // whose sharp thumbnail silently failed before the ffmpeg fallback existed. Re-kicks the (now
         // HEIC-capable) image pipeline, serialized so at most one ffmpeg decode runs at a time.
         backfillImageThumbnails() {
@@ -785,7 +727,7 @@ export function createSqliteFileCatalogue(opts) {
             // present, so a warm boot re-runs nothing.
             const candidates = db
                 .query(`SELECT id, owner, mime, has_thumbnail FROM files
-           WHERE file_type = 'image' AND is_private = 0
+           WHERE file_type = 'image'
              AND (has_thumbnail = 0 OR mime IN ('image/heic', 'image/heif'))`)
                 .all();
             void candidates.reduce(async (prev, r) => {
@@ -897,137 +839,5 @@ export function createSqliteFileCatalogue(opts) {
             // Upsert-gated to the caller's own files; unknown/other-owner ids record nothing.
             recordViewStmt.run({ $id: fileId, $owner: ownerOf(ctx), $now: now() });
         },
-        async ingestPrivate(ctx, upload, cfg) {
-            const owner = ownerOf(ctx);
-            const id = crypto.randomUUID();
-            const ts = now();
-            // Seal the descriptor NOW — sealing is independent of the transcode (only the wrapped content
-            // KEY needs the pipeline). Storing enc_name at insert means a try-a-password reveal matches the
-            // item immediately, before its HLS finishes encrypting (no seal race).
-            const descriptor = {
-                name: upload.name,
-                mime: upload.mime,
-                tags: upload.tags ?? [],
-            };
-            const sealed = sealMeta(cfg.setKey, descriptor);
-            const isVideo = upload.mime.startsWith('video/');
-            insertPrivate.run({
-                $id: id,
-                $owner: owner,
-                $size: 0,
-                $type: classifyFileType(upload.mime),
-                $mode: cfg.keyMode,
-                $status: 'processing',
-                $progress: 0,
-                $sealed: sealed,
-                $wrapped: '',
-                $rand: randKey(),
-                $now: ts,
-            });
-            // Stage plaintext to a scratch file, then encrypt: video → AES-128 HLS ladder; anything
-            // else (photo/doc/audio) → one AES-128-CTR blob at privateSourceKey. Plaintext is never
-            // persisted either way. We MUST await: the wrapped key is produced by the pipeline and
-            // there is nothing to serve without it.
-            const srcPath = path.join(workDir, 'ingest', `${owner}-${id}.src`);
-            let size = 0;
-            try {
-                size = await streamToFile(upload.body, srcPath);
-                const res = isVideo
-                    ? await processPrivateVideo({
-                        store,
-                        workDir,
-                        owner,
-                        id,
-                        sourcePath: srcPath,
-                        setKey: cfg.setKey,
-                        ladderHeights: opts.ladderHeights,
-                        onProgress: (status, pct) => setProcessing.run({ $id: id, $status: status, $progress: pct, $now: now() }),
-                    })
-                    : {
-                        ...(await processPrivateBlob({
-                            store,
-                            owner,
-                            id,
-                            sourcePath: srcPath,
-                            setKey: cfg.setKey,
-                        })),
-                        durationSeconds: 0,
-                        hasHls: false,
-                    };
-                finishPrivate.run({
-                    $id: id,
-                    $status: res.status,
-                    $progress: res.status === 'ready' ? 100 : 0,
-                    $hls: res.hasHls ? 1 : 0,
-                    $duration: res.durationSeconds || null,
-                    $size: size,
-                    $sealed: sealed,
-                    $wrapped: res.wrappedContentKey ?? '',
-                    $now: now(),
-                });
-            }
-            finally {
-                await rm(srcPath, { force: true }).catch(() => { });
-            }
-            const row = getRow.get({ $id: id, $owner: owner });
-            return {
-                id,
-                size,
-                createdAt: ts,
-                processingStatus: row.processing_status,
-                processingProgress: row.processing_progress,
-                hasHls: row.has_hls === 1,
-            };
-        },
-        asPrivateIndex() {
-            // A PrivateIndex view over the catalogue's private rows — the seam mountPrivateRoutes reads.
-            // `owner` here is the private owner axis the routes pass (a userId), matching how ingestPrivate
-            // stored the row (both go through the files.owner column).
-            return {
-                async add(item) {
-                    insertPrivate.run({
-                        $id: item.id,
-                        $owner: item.owner,
-                        $size: item.sizeBytes,
-                        // External index writers predate blob items and only ever added videos.
-                        $type: 'video',
-                        $mode: item.keyMode,
-                        $status: item.status,
-                        $progress: item.status === 'ready' ? 100 : 0,
-                        $sealed: item.sealedMeta,
-                        $wrapped: item.wrappedContentKey,
-                        $rand: randKey(),
-                        $now: now(),
-                    });
-                },
-                async get(owner, id) {
-                    const row = getPrivateRow.get({ $id: id, $owner: owner });
-                    return row ? rowToPrivateItem(row, owner) : null;
-                },
-                async list(owner) {
-                    return listPrivateFullRows.all({ $owner: owner }).map((r) => rowToPrivateItem(r, owner));
-                },
-                async update(owner, id, patch) {
-                    const cur = getPrivateRow.get({ $id: id, $owner: owner });
-                    if (!cur)
-                        return;
-                    const merged = { ...rowToPrivateItem(cur, owner), ...patch };
-                    updatePrivateRow.run({
-                        $id: id,
-                        $owner: owner,
-                        $size: merged.sizeBytes,
-                        $status: merged.status,
-                        $sealed: merged.sealedMeta,
-                        $wrapped: merged.wrappedContentKey,
-                        $mode: merged.keyMode,
-                        $now: now(),
-                    });
-                },
-                async remove(owner, id) {
-                    await store.removePrefix(privateFsKey(owner, id));
-                    deletePrivateRow.run({ $id: id, $owner: owner });
-                },
-            };
-        },
     };
 }

package/dist/server/storage/files/fileRoutes.d.ts

@@ -1,9 +1,8 @@
 import type { Context, Hono } from 'hono';
-import type { UnlockPasswordPolicy, UnlockService } from '../../private-media/unlock';
 import type { StreamTokenService } from '../streamToken';
 import type { MediaCtx, MediaStore } from '../types';
 import type { ChunkedUploadService } from './chunkedUpload';
-import { type FileCatalogue, type PrivateFileCatalogue } from './types';
+import { type FileCatalogue } from './types';
 /** The 413 message a single-PUT over the cap returns — the client treats it as a hard error. */
 export declare const SINGLE_UPLOAD_TOO_LARGE = "file too large for a single request \u2014 use chunked upload";
 export interface FileUrls {
@@ -26,24 +25,7 @@ export type MountFileRoutesOptions = {
     /** Session auth for the upload PUTs (a fetch CAN send the Bearer). Return a ctx or null. */
     authorizeUpload?: (c: Context) => Promise<MediaCtx | null> | MediaCtx | null;
     /** The catalogue uploads land in. Required for the upload routes to be mounted. */
-    catalogue?: FileCatalogue & PrivateFileCatalogue;
-    /** Wire private uploads: derive a per-user set key from the request (password header ⇒ deniable,
-     * absent ⇒ standard server key). Omit ⇒ the private-upload route is disabled. */
-    privateUpload?: {
-        unlock: UnlockService;
-        authorize: (c: Context) => Promise<{
-            userId: string;
-            userSalt: string;
-        } | null>;
-        /** Header carrying the plaintext password for a deniable set (default 'x-private-password'). */
-        passwordHeader?: string;
-        /** Header carrying an UNLOCK TOKEN (an already-unlocked session) — takes precedence over the
-         * password header; setKey + keyMode come from the verified grant (default 'x-unlock-token'). */
-        tokenHeader?: string;
-        /** What a supplied password means (default derive — deniable set). `gate` verifies it
-         * against the app's accounts and wraps under the recoverable server key instead. */
-        passwordPolicy?: UnlockPasswordPolicy;
-    };
+    catalogue?: FileCatalogue;
     /** Wire large-file chunked uploads (direct-to-backend). Omit ⇒ init/complete routes are absent
      * and clients use the streamed `PUT /upload`. Uses the same `authorizeUpload` guard. */
     chunked?: ChunkedUploadService;

package/dist/server/storage/files/fileRoutes.js

@@ -1,7 +1,7 @@
 import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
 import { serveRange } from '../streamRange';
 import { fileBinaryKey } from './catalogue';
-import { FILE_SORTS, } from './types';
+import { FILE_SORTS } from './types';
 // ── File binary + upload routes ─────────────────────────────────────────────────
 // The FileCatalogue's byte edge for GENERAL files (images/docs/audio/any) — the piece
 // mountMediaRoutes (video-only: mp4/hls/poster/sprite) doesn't cover. A file's primary binary
@@ -144,79 +144,6 @@ export function mountFileRoutes(app, opts) {
             }
         });
     }
-    // PUT a PRIVATE upload → catalogue.ingestPrivate under a set key derived from the request:
-    // either an UNLOCK TOKEN (an already-unlocked session — same mechanism the content-key route
-    // uses) or a password header (deniable) / neither (standard server key).
-    const pv = opts.privateUpload;
-    if (pv && catalogue) {
-        const passwordHeader = pv.passwordHeader ?? 'x-private-password';
-        const tokenHeader = pv.tokenHeader ?? 'x-unlock-token';
-        app.put(`${base}/upload-private`, async (c) => {
-            const who = await pv.authorize(c);
-            if (!who)
-                return c.json({ error: 'unauthorized' }, 401);
-            const raw = c.req.raw.body;
-            if (!raw)
-                return c.json({ error: 'empty body' }, 400);
-            const body = guardSingleUpload(c, raw);
-            if (body instanceof Response)
-                return body;
-            let setKey;
-            let keyMode;
-            const unlockToken = c.req.header(tokenHeader) || undefined;
-            if (unlockToken) {
-                // Token path: recover the sealed set key + mode from the grant. The token must belong
-                // to the session caller.
-                const grant = await pv.unlock.verify(unlockToken);
-                if (!grant || grant.userId !== who.userId) {
-                    return c.json({ error: 'invalid unlock token' }, 401);
-                }
-                setKey = grant.setKey;
-                keyMode = grant.mode;
-            }
-            else {
-                // Password path: derive fresh from the header (deniable) or the server key. Under the
-                // gate policy the password is an access check only — verify, then wrap standard.
-                const password = c.req.header(passwordHeader) || undefined;
-                const policy = pv.passwordPolicy ?? { mode: 'derive' };
-                let derivePassword = password;
-                if (policy.mode === 'gate' && password) {
-                    if (!(await policy.verifyPassword(who, password))) {
-                        return c.json({ error: 'invalid password' }, 401);
-                    }
-                    derivePassword = undefined;
-                }
-                setKey = pv.unlock.deriveSetKey({
-                    userId: who.userId,
-                    userSalt: who.userSalt,
-                    password: derivePassword,
-                });
-                keyMode = derivePassword ? 'deniable' : 'standard';
-            }
-            // The private owner axis is the userId (deniability is personal), matching mountPrivateRoutes.
-            const ctx = { userId: who.userId, tenantId: who.userId };
-            const tags = c.req.header('x-tags');
-            try {
-                const item = await catalogue.ingestPrivate(ctx, {
-                    name: c.req.header('x-filename') ?? 'upload',
-                    mime: c.req.header('content-type') ?? 'application/octet-stream',
-                    body,
-                    tags: tags
-                        ? tags
-                            .split(',')
-                            .map((t) => t.trim())
-                            .filter(Boolean)
-                        : undefined,
-                }, { setKey, keyMode });
-                return c.json({ item });
-            }
-            catch (e) {
-                if (isUploadTooLarge(e))
-                    return c.json({ error: SINGLE_UPLOAD_TOO_LARGE }, 413);
-                throw e;
-            }
-        });
-    }
     // Chunked upload (large files, direct-to-backend). init → the client PUTs each chunk straight to
     // the backend (URLs the app minted) → complete registers the row over the assembled bytes. The
     // bytes never traverse this origin.