cursedbelt-server 3.0.1 → 4.0.0

package/dist/server/storage/files/index.d.ts

@@ -6,4 +6,4 @@ export { createFileUrls, type FileUrls, type MountFileRoutesOptions, mountFileRo
 export { FILE_CATALOGUE_MIGRATIONS } from './migrations';
 export { createFilesStack, type FilesStack, type FilesStackMountAuth, type FilesStackOptions, } from './stack';
 export { createLedgeredDeletes, createStorageOpsLedger, createStorageReconciler, type StorageAction, type StorageOpRow, type StorageOpsLedger, type StorageReconciler, } from './storageOps';
-export { type CollectionKind, type CollectionVisibility, classifyFileType, FILE_SORTS, type FileCatalogue, type FileCollection, type FilePage, type FileRecord, type FileSort, type FileToPlayable, type FileType, type ListFilesOptions, type PrivateFileCatalogue, type PrivateFileItem, type PrivateKeyMode, type TagFacet, } from './types';
+export { type CollectionKind, type CollectionVisibility, classifyFileType, FILE_SORTS, type FileCatalogue, type FileCollection, type FilePage, type FileRecord, type FileSort, type FileToPlayable, type FileType, type ListFilesOptions, type TagFacet, } from './types';

package/dist/server/storage/files/index.js

@@ -1,5 +1,5 @@
 // cursedbelt-server/storage FileCatalogue — a SQLite-backed tagged flat file system over the
-// MediaStore + media pipeline + private-media. One source of truth for a user's binaries; the
+// MediaStore + media pipeline. One source of truth for a user's binaries; the
 // video gallery is a video-filtered view over it.
 export { createCatalogueMediaSource, createCataloguePhotoSource, createCatalogueVideoSource, createFileToPlayable, } from './adapter';
 export { catalogueUploadKey, createSqliteFileCatalogue, fileBinaryKey, } from './catalogue';

package/dist/server/storage/files/migrations.js

@@ -3,6 +3,15 @@
 // (not re-derived per list), tags live in an indexed junction (fast facets, not a JSON scan),
 // processing state is typed columns (not an opaque blob), and a storage-operations ledger backs
 // durable cross-boundary (binary-server/S3) ops. Flat — no parent_id tree.
+//
+// 🔴 `0001` is edited IN PLACE rather than followed by a drop-column migration (2026-09-17,
+// removing private media). It is `CREATE TABLE IF NOT EXISTS` and is recorded in `_migrations`,
+// so an existing database never re-runs it and simply keeps three vestigial columns
+// (`is_private`, `enc_name`, `enc_dek`, `enc_key_type`, `file_tags.is_private`) that nothing
+// reads; every one of them had `NOT NULL DEFAULT`, so the leaner INSERTs below still satisfy
+// them. A fresh database gets the lean shape. That is safe here only because no app in the
+// fleet mounts `createFilesStack` — if one ever does, removing a column becomes a real
+// migration, not an edit.
 export const FILE_CATALOGUE_MIGRATIONS = [
     {
         name: '0001_file_catalogue',
@@ -15,7 +24,6 @@ export const FILE_CATALOGUE_MIGRATIONS = [
           mime                TEXT NOT NULL DEFAULT '',
           size                INTEGER NOT NULL DEFAULT 0,
           file_type           TEXT NOT NULL DEFAULT 'other',
-          is_private          INTEGER NOT NULL DEFAULT 0,
           has_thumbnail       INTEGER NOT NULL DEFAULT 0,
           has_hls             INTEGER NOT NULL DEFAULT 0,
           has_sprites         INTEGER NOT NULL DEFAULT 0,
@@ -23,9 +31,6 @@ export const FILE_CATALOGUE_MIGRATIONS = [
           processing_status   TEXT NOT NULL DEFAULT 'ready',
           processing_progress INTEGER NOT NULL DEFAULT 100,
           storage_backend     TEXT NOT NULL DEFAULT 'disk',
-          enc_name            TEXT NOT NULL DEFAULT '',
-          enc_dek             TEXT NOT NULL DEFAULT '',
-          enc_key_type        TEXT NOT NULL DEFAULT '',
           created_at          INTEGER NOT NULL,
           updated_at          INTEGER NOT NULL
         )
@@ -33,7 +38,6 @@ export const FILE_CATALOGUE_MIGRATIONS = [
             // Listing is cursor-keyed on (created_at, id); these cover the flat feed + smart-view filter.
             db.run(`CREATE INDEX IF NOT EXISTS idx_files_owner_created ON files(owner, created_at DESC, id DESC)`);
             db.run(`CREATE INDEX IF NOT EXISTS idx_files_owner_type_created ON files(owner, file_type, created_at DESC, id DESC)`);
-            db.run(`CREATE INDEX IF NOT EXISTS idx_files_owner_private ON files(owner, is_private)`);
             // Tags as a junction (indexed) — single-tag filter + facet counts are index lookups, not a
             // full-table JSON parse (ca's weakness). `owner` denormalized so facet queries stay covering.
             db.run(`
@@ -41,7 +45,6 @@ export const FILE_CATALOGUE_MIGRATIONS = [
           file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE,
           tag     TEXT NOT NULL,
           owner   TEXT NOT NULL,
-          is_private INTEGER NOT NULL DEFAULT 0,
           PRIMARY KEY (file_id, tag)
         )
       `);

package/dist/server/storage/files/stack.d.ts

@@ -1,13 +1,12 @@
 import type { Database } from 'bun:sqlite';
 import type { Context, Hono } from 'hono';
-import { type UnlockPasswordPolicy, type UnlockService } from '../../private-media/unlock';
 import { type MediaUrls, SourceRegistry } from '../sources';
 import { type StreamTokenService } from '../streamToken';
 import type { MediaCtx, MediaGallerySource, MediaSource, MediaStore, PhotoSource } from '../types';
 import { type SqliteFileCatalogueOptions } from './catalogue';
 import { type ChunkedUploadService, type MintChunkUpload } from './chunkedUpload';
 import { type FileUrls } from './fileRoutes';
-import type { FileCatalogue, PrivateFileCatalogue } from './types';
+import type { FileCatalogue } from './types';
 export interface FilesStackOptions {
     /** The catalogue database. The stack runs FILE_CATALOGUE_MIGRATIONS on it itself. */
     db: Database;
@@ -17,9 +16,9 @@ export interface FilesStackOptions {
     workDir: string;
     /** Secret for the stream-token service (path-embedded byte-route auth). */
     streamSecret: string;
-    /** Owner keyspace segment. Defaults to the userId (files + private are personal) — note the
-     * bare primitives default to tenantId; the stack picks the personal axis so every URL/route
-     * agrees with the private layer's per-user owner. */
+    /** Owner keyspace segment. Defaults to the userId (files are personal) — note the bare
+     * primitives default to tenantId; the stack picks the personal axis so every URL and route
+     * agrees on one owner. */
     owner?: (ctx: MediaCtx) => string;
     /** Registered video-source id (also the media-token sourceId). Default 'files'. */
     sourceId?: string;
@@ -40,8 +39,6 @@ export interface FilesStackOptions {
     mediaPublicBase?: string;
     /** PUBLIC base for browser file URLs (split-origin counterpart of `filesBasePath`). */
     filesPublicBase?: string;
-    /** Private (encrypted) route mount. Default '/_private'. */
-    privateBasePath?: string;
     /** HLS ladder heights for video ingest (createSqliteFileCatalogue passthrough). */
     ladderHeights?: SqliteFileCatalogueOptions['ladderHeights'];
     /** Cap on transcode kicks per file before it's marked failed (createSqliteFileCatalogue
@@ -56,15 +53,6 @@ export interface FilesStackOptions {
     /** Image thumbnail/display derivative implementation (createSqliteFileCatalogue passthrough).
      * Default: local sharp with ffmpeg fallback. */
     imageDerivatives?: SqliteFileCatalogueOptions['imageDerivatives'];
-    /** Enables the private (encrypted) stack: unlock service + /_private routes + private uploads.
-     * Omit ⇒ `unlock` is null and mount() wires only the public routes. `passwordPolicy` sets what
-     * a supplied password MEANS (derive = deniable sets, the default; gate = verify against the
-     * app's accounts + recoverable server-key sets — see UnlockPasswordPolicy). */
-    privateMedia?: {
-        serverSecret: string;
-        unlockSecret: string;
-        passwordPolicy?: UnlockPasswordPolicy;
-    };
     /** Re-kick transcodes a restart left stuck (catalogue.recoverProcessing) at build time.
      * Default true. */
     recoverProcessing?: boolean;
@@ -90,18 +78,8 @@ export interface FilesStackMountAuth {
     /** Session auth for uploads + listings (same guard mountMediaRoutes/mountFileRoutes take).
      * Return a MediaCtx to allow, null to reject. */
     authorizeUpload: (c: Context) => Promise<MediaCtx | null> | MediaCtx | null;
-    /** Session auth for the private layer → {userId, userSalt}. REQUIRED when `privateMedia` is
-     * configured (mount() throws otherwise); ignored when it isn't. */
-    authorizePrivate?: (c: Context) => Promise<{
-        userId: string;
-        userSalt: string;
-    } | null>;
     /** Wire large-file chunked uploads (mountFileRoutes' `chunked` passthrough). */
     mintChunkUpload?: ChunkedUploadService;
-    /** Private-upload password header (default 'x-private-password'). */
-    passwordHeader?: string;
-    /** Private-upload unlock-token header (default 'x-unlock-token'). */
-    tokenHeader?: string;
 }
 /**
  * The assembled stack. `catalogue` / `fileUrls` / `mediaUrls` / `videoSource` are intentionally
@@ -110,7 +88,7 @@ export interface FilesStackMountAuth {
  * not, layering) import cursedshell.
  */
 export interface FilesStack {
-    catalogue: FileCatalogue & PrivateFileCatalogue;
+    catalogue: FileCatalogue;
     token: StreamTokenService;
     mediaUrls: MediaUrls;
     fileUrls: FileUrls;
@@ -120,15 +98,12 @@ export interface FilesStack {
     /** The MIXED view — photos + videos in one feed (media gallery data source). */
     mediaSource: MediaGallerySource;
     registry: SourceRegistry;
-    /** Null unless `privateMedia` was configured. */
-    unlock: UnlockService | null;
     /** The large-file chunked-upload service, or null unless `chunkedUpload` was configured. mount()
      * auto-wires it into the file routes; exposed for observability (pending()) + tests. */
     chunked: ChunkedUploadService | null;
     /**
      * Mount every byte/upload route the stack owns onto a Hono app: mountMediaRoutes
-     * (mediaBasePath) + mountFileRoutes (filesBasePath, incl. privateUpload when unlock exists) +
-     * mountPrivateRoutes (privateBasePath, when unlock exists). Auth stays host-injected.
+     * (mediaBasePath) + mountFileRoutes (filesBasePath). Auth stays host-injected.
      */
     mount(app: Hono, auth: FilesStackMountAuth): void;
 }

package/dist/server/storage/files/stack.js

@@ -1,6 +1,4 @@
 import { runMigrations } from '../../migration/runner';
-import { mountPrivateRoutes } from '../../private-media/mountPrivateRoutes';
-import { createUnlockService, } from '../../private-media/unlock';
 import { mountMediaRoutes } from '../mountMediaRoutes';
 import { createMediaUrls, SourceRegistry } from '../sources';
 import { createStreamTokenService } from '../streamToken';
@@ -65,7 +63,6 @@ export function createFilesStack(opts) {
         videoSourceId: sourceId,
     });
     const registry = new SourceRegistry().register(videoSource);
-    const unlock = opts.privateMedia ? createUnlockService(opts.privateMedia) : null;
     const chunked = opts.chunkedUpload
         ? createChunkedUploadService({
             catalogue,
@@ -85,13 +82,8 @@ export function createFilesStack(opts) {
         photoSource,
         mediaSource,
         registry,
-        unlock,
         chunked,
         mount(app, auth) {
-            if (unlock && !auth.authorizePrivate) {
-                throw new Error('createFilesStack: privateMedia is configured but mount() got no authorizePrivate — ' +
-                    'the private routes need a session→{userId, userSalt} resolver.');
-            }
             mountMediaRoutes(app, {
                 store,
                 token,
@@ -107,26 +99,7 @@ export function createFilesStack(opts) {
                 authorizeUpload: auth.authorizeUpload,
                 // Prefer a mount-time override, else the service the stack built from `chunkedUpload` opts.
                 chunked: auth.mintChunkUpload ?? chunked ?? undefined,
-                privateUpload: unlock && auth.authorizePrivate
-                    ? {
-                        unlock,
-                        authorize: auth.authorizePrivate,
-                        passwordHeader: auth.passwordHeader,
-                        tokenHeader: auth.tokenHeader,
-                        passwordPolicy: opts.privateMedia?.passwordPolicy,
-                    }
-                    : undefined,
             });
-            if (unlock && auth.authorizePrivate) {
-                mountPrivateRoutes(app, {
-                    store,
-                    index: catalogue.asPrivateIndex(),
-                    unlock,
-                    basePath: opts.privateBasePath,
-                    authorize: auth.authorizePrivate,
-                    passwordPolicy: opts.privateMedia?.passwordPolicy,
-                });
-            }
         },
     };
 }

package/dist/server/storage/files/types.d.ts

@@ -1,5 +1,4 @@
 import type { PlayableVideo, ProcessingStatus } from 'cursedbelt-core/media';
-import type { PrivateIndex } from '../../private-media/index-store';
 import type { MediaCtx } from '../types';
 export type FileType = 'image' | 'video' | 'audio' | 'doc' | 'code' | 'other';
 /** User-defined groupings (Apple-Photos-style). `favorites` is a system singleton per owner;
@@ -26,7 +25,6 @@ export type FileRecord = {
     size: number;
     fileType: FileType;
     tags: string[];
-    isPrivate: boolean;
     hasThumbnail: boolean;
     hasHls: boolean;
     hasSprites: boolean;
@@ -67,11 +65,8 @@ export type ListFilesOptions = {
     type?: FileType;
     /** Single-tag filter (indexed via the join table). */
     tag?: string;
-    /** Name substring (public files only — private names are sealed). */
+    /** Name substring. */
     query?: string;
-    /** Include the caller's private files (requires an unlocked set — the caller resolves which
-     * ones actually open). Omitted ⇒ public only, matching ca's default listing. */
-    includePrivate?: boolean;
     /** Filter to members of a specific collection. An unlock-gated collection yields empty unless
      * `includeUnlockable` is also true. */
     collectionId?: string;
@@ -93,14 +88,11 @@ export declare function classifyFileType(mime: string, isText?: boolean): FileTy
 /** The catalogue contract. A SQLite implementation is the production default; the interface lets
  * an app swap it. All calls are owner-scoped via {@link MediaCtx} (one tenant never sees another). */
 /** Cheap owner-scoped aggregates (COUNT/SUM over the files table) — the admin
- * surface's "site stats" source. Private items report count + bytes only
- * (names/kinds stay sealed). */
+ * surface's "site stats" source. */
 export type CatalogueStats = {
     files: number;
     bytes: number;
     byType: Partial<Record<FileType, number>>;
-    privateItems: number;
-    privateBytes: number;
     processing: number;
     failed: number;
 };
@@ -109,9 +101,7 @@ export interface FileCatalogue {
     get(ctx: MediaCtx, id: string): Promise<FileRecord | null>;
     /** Owner-scoped aggregates for admin/stats surfaces. */
     stats(ctx: MediaCtx): Promise<CatalogueStats>;
-    tagFacets(ctx: MediaCtx, opts?: {
-        includePrivate?: boolean;
-    }): Promise<TagFacet[]>;
+    tagFacets(ctx: MediaCtx): Promise<TagFacet[]>;
     /** Ingest a public upload: persist bytes, classify, kick off processing (thumbnail/HLS). */
     ingest(ctx: MediaCtx, upload: {
         name: string;
@@ -137,9 +127,8 @@ export interface FileCatalogue {
     }): Promise<FileRecord | null>;
     /** Overwrite a file's BYTES in place — the identity (id, tags, collections, favorites, view
      * history) survives while mime/size/fileType re-derive, stale derivatives are wiped, and
-     * processing re-kicks (video transcode / image thumbnail). Public files only — replacing an
-     * encrypted private item throws (delete + re-upload instead). Returns the refreshed record,
-     * or null if the id is unknown/other-owner. */
+     * processing re-kicks (video transcode / image thumbnail). Returns the refreshed record, or
+     * null if the id is unknown/other-owner. */
     replaceContent(ctx: MediaCtx, id: string, upload: {
         mime: string;
         body: ReadableStream<Uint8Array>;
@@ -171,20 +160,20 @@ export interface FileCatalogue {
             reason: string;
         }[];
     }>;
-    /** Recover from a restart that lost in-flight transcodes: re-kick public video rows still marked
-     * pending/processing (their source persists), and mark stuck private rows failed. Call once at
-     * app startup. Returns how many were re-queued vs. failed. */
+    /** Recover from a restart that lost in-flight transcodes: re-kick video rows still marked
+     * pending/processing (their source persists), and mark rows that have exhausted their kick
+     * budget failed. Call once at app startup. Returns how many were re-queued vs. failed. */
     recoverProcessing(): {
         requeued: number;
         failed: number;
     };
-    /** Backfill grid thumbnails for finished public video rows that have no poster (landed while
+    /** Backfill grid thumbnails for finished video rows that have no poster (landed while
      * transcoding was off, or failed before the poster step). Re-kicks the poster pipeline for each.
      * Returns how many were re-queued. */
     backfillVideoPosters(): {
         requeued: number;
     };
-    /** Backfill grid thumbnails for public image rows with no poster (e.g. HEIC photos whose sharp
+    /** Backfill grid thumbnails for image rows with no poster (e.g. HEIC photos whose sharp
      * thumbnail failed before the ffmpeg fallback). Re-kicks the image pipeline. */
     backfillImageThumbnails(): {
         requeued: number;
@@ -220,42 +209,3 @@ export interface FileCatalogue {
 }
 /** Resolve a video FileRecord to a PlayableVideo (URLs baked server-side). Non-video ⇒ null. */
 export type FileToPlayable = (ctx: MediaCtx, file: FileRecord) => Promise<PlayableVideo | null>;
-/** How a private item's content key is wrapped: `standard` (server-recoverable) vs `deniable`
- * (password-derived; zero-knowledge). Mirrors private-media `KeyMode`. */
-export type PrivateKeyMode = 'standard' | 'deniable';
-/** The OPAQUE locked-index row — only non-sensitive metadata (so a user can prune media whose
- * password is lost). NEVER name/tags/thumbnail: those are sealed. No set identifier is exposed. */
-export type PrivateFileItem = {
-    id: string;
-    size: number;
-    createdAt: number;
-    processingStatus: ProcessingStatus;
-    processingProgress: number;
-    hasHls: boolean;
-};
-/** Private-media capability of a catalogue. `createSqliteFileCatalogue` implements this alongside
- * {@link FileCatalogue}, storing private items as sealed rows in the SAME table (one source of
- * truth). Membership is by decrypt-success — no stored password/set hash.
- *
- * Deliberately small: the catalogue owns only INGEST (the new private-upload path). Everything
- * else — the locked index, unlock, try-a-password reveal, the gated content-key route, and the
- * encrypted-HLS byte serving — is the existing `mountPrivateRoutes`, which operates through a
- * {@link PrivateIndex}. `asPrivateIndex()` is the view that lets those routes read/write the
- * catalogue's private rows, so there is exactly one store and one set of routes. */
-export interface PrivateFileCatalogue {
-    /** Ingest an encrypted video: stage plaintext (never persisted), transcode to AES-128 HLS, seal
-     * the descriptor + wrap the content key under `setKey`, and insert a private row. */
-    ingestPrivate(ctx: MediaCtx, upload: {
-        name: string;
-        mime: string;
-        body: ReadableStream<Uint8Array>;
-        size?: number;
-        tags?: string[];
-    }, opts: {
-        setKey: Buffer;
-        keyMode: PrivateKeyMode;
-    }): Promise<PrivateFileItem>;
-    /** A {@link PrivateIndex} view over this catalogue's private rows — pass to `mountPrivateRoutes`
-     * so unlock/index/reveal/key/HLS all operate on the catalogue. `remove` also drops the bytes. */
-    asPrivateIndex(): PrivateIndex;
-}

package/dist/server/storage/files/types.js

@@ -20,3 +20,12 @@ export function classifyFileType(mime, isText = false) {
         return 'doc';
     return 'other';
 }
+// ── There is no private half, deliberately (removed 2026-09-17) ───────────────────
+// A `PrivateFileCatalogue` used to sit here: sealed descriptors, wrapped content keys, a
+// `KeyMode: 'standard' | 'deniable'` and membership "by decrypt-success — no stored password".
+// It was 1,505 lines that no app ever mounted, over a byte store that encrypts nothing
+// (binary-server's `exportFiles.ts`: *"Objects are stored unencrypted"*), so there was never a
+// ciphertext behind it — and the owner chose to delete the whole module rather than carry a
+// second, unexercised confidentiality story alongside the master lock, which is the one that
+// actually guards these apps. This paragraph is the record; it is not an invitation to
+// reintroduce it. The wall that IS real is `../../master-lock`.

package/dist/server/storage/index.d.ts

@@ -4,12 +4,12 @@ export { createBinaryServerStore } from './binaryServerStore';
 export { type BinaryServerProcessingConfig, createBinaryServerProcessing, } from './binaryServerProcessing';
 export { createTranscodeJobClient, type TranscodeJobClient, type TranscodeJobClientConfig, type TranscodeJobResult, type TranscodeJobStatus, type TranscodeJobStatusBody, } from './transcodeJobs';
 export { createDiskStore } from './diskStore';
-export { type CatalogueStats, type ChunkedInit, type ChunkedUploadService, catalogueUploadKey, classifyFileType, createCatalogueMediaSource, createCataloguePhotoSource, createCatalogueVideoSource, createChunkedUploadService, createFilesStack, createFileToPlayable, createFileUrls, createLedgeredDeletes, createSqliteFileCatalogue, createStorageOpsLedger, createStorageReconciler, FILE_CATALOGUE_MIGRATIONS, type FileCatalogue, type FilePage, type FileRecord, type FilesStack, type FilesStackMountAuth, type FilesStackOptions, type FileToPlayable, type FileType, type FileUrls, fileBinaryKey, type ImageDerivatives, type ImageDerivativesOptions, type ListFilesOptions, type MintChunkUpload, type MountFileRoutesOptions, mountFileRoutes, type PrivateFileCatalogue, type PrivateFileItem, type PrivateKeyMode, type SqliteFileCatalogueOptions, type StorageAction, type StorageOpRow, type StorageOpsLedger, type StorageReconciler, type VideoProcessor, } from './files';
+export { type CatalogueStats, type ChunkedInit, type ChunkedUploadService, catalogueUploadKey, classifyFileType, createCatalogueMediaSource, createCataloguePhotoSource, createCatalogueVideoSource, createChunkedUploadService, createFilesStack, createFileToPlayable, createFileUrls, createLedgeredDeletes, createSqliteFileCatalogue, createStorageOpsLedger, createStorageReconciler, FILE_CATALOGUE_MIGRATIONS, type FileCatalogue, type FilePage, type FileRecord, type FilesStack, type FilesStackMountAuth, type FilesStackOptions, type FileToPlayable, type FileType, type FileUrls, fileBinaryKey, type ImageDerivatives, type ImageDerivativesOptions, type ListFilesOptions, type MintChunkUpload, type MountFileRoutesOptions, mountFileRoutes, type SqliteFileCatalogueOptions, type StorageAction, type StorageOpRow, type StorageOpsLedger, type StorageReconciler, type VideoProcessor, } from './files';
 export { type CorsResolver, type MountMediaOptions, mountMediaRoutes } from './mountMediaRoutes';
 export { createDiskSource, createMediaUrls, type DiskSource, type MediaUrls, SourceRegistry, } from './sources';
 export { createS3ObjectStore, type S3ClientLike, type S3ObjectHandle, type S3ObjectStoreOptions, type S3ObjectWriter, } from './s3ObjectStore';
 export { decodeRange, type RangeDecision, type ServeRangeOpts, serveRange } from './streamRange';
 export { createStreamTokenService, type StreamGrant, type StreamTokenService } from './streamToken';
-export { fsHlsFileKey, fsHlsMasterKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, type MediaCtx, type MediaGallerySource, type MediaSource, type MediaStore, type PhotoSource, privateFsKey, } from './types';
+export { fsHlsFileKey, fsHlsMasterKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, type MediaCtx, type MediaGallerySource, type MediaSource, type MediaStore, type PhotoSource, } from './types';
 export { type ProcessOptions, type ProcessResult, processVideo, } from './videoProcessor';
 export { objectStoreAsMediaStore } from './objectStoreMediaStore';

package/dist/server/storage/index.js

@@ -22,6 +22,6 @@ export { createDiskSource, createMediaUrls, SourceRegistry, } from './sources';
 export { createS3ObjectStore, } from './s3ObjectStore';
 export { decodeRange, serveRange } from './streamRange';
 export { createStreamTokenService } from './streamToken';
-export { fsHlsFileKey, fsHlsMasterKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, privateFsKey, } from './types';
+export { fsHlsFileKey, fsHlsMasterKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, } from './types';
 export { processVideo, } from './videoProcessor';
 export { objectStoreAsMediaStore } from './objectStoreMediaStore';

package/dist/server/storage/mountMediaRoutes.d.ts

@@ -1,6 +1,6 @@
 import type { Context, Hono } from 'hono';
 import type { SourceRegistry } from './sources';
-import type { StreamGrant, StreamTokenService } from './streamToken';
+import type { StreamTokenService } from './streamToken';
 import { type MediaCtx, type MediaStore } from './types';
 /** Resolves the Access-Control-Allow-Origin for a request origin: a fixed origin, an allowlist
  * (echoes the request origin when allowed), or a custom resolver (return null to deny). */
@@ -21,8 +21,5 @@ export type MountMediaOptions = {
     /** Authorizes an upload request (it CAN send the Bearer, unlike a media element). Return a
      * MediaCtx to allow, or null to reject. Omit ⇒ uploads are disabled on this mount. */
     authorizeUpload?: (c: Context) => Promise<MediaCtx | null> | MediaCtx | null;
-    /** Optional hook to decrypt bytes for the private (pfs/…) keyspace before serving. Wired by
-     * the private-media layer; omitted ⇒ all bytes served as stored. */
-    decryptStream?: (stream: ReadableStream<Uint8Array>, grant: StreamGrant) => ReadableStream<Uint8Array>;
 };
 export declare function mountMediaRoutes(app: Hono, opts: MountMediaOptions): void;

package/dist/server/storage/types.d.ts

@@ -182,12 +182,3 @@ export declare const fsPosterKey: (owner: string, id: string) => string;
 export declare const fsDisplayKey: (owner: string, id: string) => string;
 export declare const fsSpriteKey: (owner: string, id: string) => string;
 export declare const fsVttKey: (owner: string, id: string) => string;
-/** Private (encrypted) namespace — the private-media layer stores ciphertext here. The HLS
- * segments under it are AES-128-encrypted at rest (the player fetches the content key via the
- * gated key route and decrypts); a distinct keyspace from public `hls/` so the two never collide. */
-export declare const privateFsKey: (owner: string, id: string) => string;
-export declare const privateHlsPrefix: (owner: string, id: string) => string;
-export declare const privateHlsMasterKey: (owner: string, id: string) => string;
-export declare const privateHlsFileKey: (owner: string, id: string, rel: string) => string;
-export declare const privatePosterKey: (owner: string, id: string) => string;
-export declare const privateSourceKey: (owner: string, id: string) => string;

package/dist/server/storage/types.js

@@ -30,12 +30,5 @@ export const fsPosterKey = (owner, id) => `fs/${owner}/${id}-poster.jpg`;
 export const fsDisplayKey = (owner, id) => `fs/${owner}/${id}-display.jpg`;
 export const fsSpriteKey = (owner, id) => `fs/${owner}/${id}-sprites.jpg`;
 export const fsVttKey = (owner, id) => `fs/${owner}/${id}-sprites.vtt`;
-/** Private (encrypted) namespace — the private-media layer stores ciphertext here. The HLS
- * segments under it are AES-128-encrypted at rest (the player fetches the content key via the
- * gated key route and decrypts); a distinct keyspace from public `hls/` so the two never collide. */
-export const privateFsKey = (owner, id) => `pfs/${owner}/${id}`;
-export const privateHlsPrefix = (owner, id) => `pfs/${owner}/${id}/hls`;
-export const privateHlsMasterKey = (owner, id) => `pfs/${owner}/${id}/hls/master.m3u8`;
-export const privateHlsFileKey = (owner, id, rel) => `pfs/${owner}/${id}/hls/${rel}`;
-export const privatePosterKey = (owner, id) => `pfs/${owner}/${id}/poster.enc`;
-export const privateSourceKey = (owner, id) => `pfs/${owner}/${id}/source.enc`;
+// The `pfs/` (ciphertext) keyspace was deleted with private media on 2026-09-17 — nothing ever
+// wrote a byte to it on this fleet, and binary-server stores objects unencrypted regardless.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "3.0.1",
+	"version": "4.0.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -20,7 +20,7 @@
 		"typecheck": "tsc -p tsconfig.build.json --noEmit",
 		"test": "NODE_ENV=development bun test src",
 		"build": "bun run clean && tsc -p tsconfig.build.json",
-		"paths": "bun ../../tools/check-paths.ts .",
+		"paths": "bun run scripts/paths.ts",
 		"verify": "bun run paths && bun run typecheck && bun run build && bun run test",
 		"prepublishOnly": "bun run verify",
 		"test:pg": "bun run scripts/testPg.ts"

package/src/leafSubpathsImportNothing.spec.ts

@@ -85,8 +85,9 @@ import pkg from '../package.json';
  *     fixture stopped demonstrating that peers are unreachable
  *       → red on the control itself: "the fixture resolved 'otplib' … Every assertion below
  *         is vacuous until that is fixed". The vacuity guard fires.
- *   · `src/server/private-media/unlock.ts` put back to `import … from '../auth'` — the
- *     second, two-hop edge, which grep for `../auth` inside `src/server/storage` cannot see
+ *   · `src/server/private-media/unlock.ts` (deleted 2026-09-17) put back to
+ *     `import … from '../auth'` — the second, two-hop edge, which grep for `../auth` inside
+ *     `src/server/storage` cannot see
  *       → red: "importing cursedbelt/server/storage statically pulls these OPTIONAL peers
  *         … + otplib". This is the branch that found that edge in the first place.
  */
@@ -276,8 +277,9 @@ console.log(JSON.stringify(out));
 const NO_STATIC_OPTIONAL_PEERS = [
   {
     subpath: './storage',
-    /** Its `streamToken.ts` and (two hops out) `private-media/unlock.ts` both imported the
-     *  `../auth` index for two jose functions, so `otplib` was static in here until 2.6.0. */
+    /** Its `streamToken.ts` and (two hops out) the since-deleted `private-media/unlock.ts`
+     *  both imported the `../auth` index for two jose functions, so `otplib` was static in
+     *  here until 2.6.0. The edge this guards against is the import, not the file. */
     entry: 'src/server/storage/index.ts',
   },
 ] as const;

package/src/server/auth/jwt.ts

@@ -4,7 +4,7 @@ import type { AppJwtPayload } from './types';
 /**
  * JWT sign/verify on `jose` (Web Crypto HMAC — native on Bun + Node, no native
  * deps; replaces `jsonwebtoken`). Every token system in the apps — the access
- * token plus the short-lived vault/private-media/files/yt-oauth unlock tokens —
+ * token plus the short-lived vault/files/yt-oauth unlock tokens —
  * goes through these, so there is exactly ONE jose integration to reason about.
  *
  * jose verifies any standard HS256 JWT regardless of which library signed it, so a
@@ -57,7 +57,7 @@ export async function verifyToken<T extends JWTPayload = AppJwtPayload>(
 }
 
 /**
- * Verify a single-purpose token (vault/private-media/files/yt-oauth) AND assert its
+ * Verify a single-purpose token (vault/files/yt-oauth) AND assert its
  * `purpose` claim matches — so an access token (or a token for a *different*
  * feature) can never be replayed as, say, a vault-unlock token. Throws on a bad
  * signature, expiry, or a purpose mismatch.