cursedbelt-server 3.0.1 → 4.1.0

package/dist/server/storage/binaryStoreFake.d.ts

@@ -0,0 +1,56 @@
+/**
+ * A `BinaryStore` that does nothing, so adding a method to the interface stops
+ * breaking twenty-two test files in apps nobody touched.
+ *
+ * ── The measurement (2026-09-08) ────────────────────────────────────────────
+ * `BinaryStore.fetchMedia` was added to serve audio off this Mac while
+ * Cloudflare's daily Worker quota was spent — a good change, landed on `main`,
+ * with apps/music green. It also broke **apps/collections and apps/roms**, four
+ * test files each, with `Property 'fetchMedia' is missing in type`. Both apps
+ * were left unable to typecheck, and therefore unable to gate or deploy, by a
+ * commit neither of them appears in. Nobody noticed for hours: a worker's
+ * `verify:scoped` only typechecks the workspaces its own diff touches, which is
+ * exactly the property that makes it fast.
+ *
+ * The owner's rule, in his words: *"a change to roms for example cannot block
+ * family tree app from passing its tests."* This is that rule for the one
+ * interface twenty-two suites all fake by hand.
+ *
+ * 🔴 **This is why the fake travels WITH the interface, into this package.** An
+ * interface whose change can break two other apps from a third app's commit is a
+ * shared interface already; a fake living in a different repo from the interface it
+ * fakes cannot do the job it exists for, because the two can be changed
+ * independently. Published as `cursedbelt-server/binary-store/testing`, beside
+ * `cursedbelt-server/binary-store` — the same split as `./d1` and `./d1/testing`, and
+ * for the same reason: a consumer's PRODUCTION graph must not be able to reach a
+ * fake.
+ *
+ * ── 🔴 Why defaults and not optional members ────────────────────────────────
+ * The obvious alternative is to mark each new capability `fetchMedia?:` on the
+ * interface. That moves the cost to every REAL consumer — each one then has to
+ * narrow before calling, for a method the production store always has — and it
+ * makes "did we implement this?" unanswerable by the typechecker, which is the
+ * one question the interface exists to answer. The fakes are the side that
+ * should absorb the change, so the defaults live here.
+ *
+ * ── What a default may do ───────────────────────────────────────────────────
+ * As little as possible, and never something a test could mistake for a result.
+ * `get` and `meta` answer "not here"; `fetchMedia` answers 404; the mutators do
+ * nothing. A suite that cares about any of them overrides it — spread this first
+ * and the file's own members win:
+ *
+ *     const store: BinaryStore = {
+ *       ...binaryStoreFakeDefaults("collections"),
+ *       async meta(key) { … what this suite is actually about … },
+ *     };
+ */
+import type { BinaryStore } from './binaryStore';
+/**
+ * Every member of {@link BinaryStore}, inert.
+ *
+ * @param appId the tenant the fake claims to be. Required, and deliberately so —
+ *        a blank tenant is the mistake `binaryStoreTenant` exists to catch, and a
+ *        fake that quietly defaults it would hide a test written against the
+ *        wrong app.
+ */
+export declare function binaryStoreFakeDefaults(appId: string): BinaryStore;

package/dist/server/storage/binaryStoreFake.js

@@ -0,0 +1,63 @@
+/**
+ * Every member of {@link BinaryStore}, inert.
+ *
+ * @param appId the tenant the fake claims to be. Required, and deliberately so —
+ *        a blank tenant is the mistake `binaryStoreTenant` exists to catch, and a
+ *        fake that quietly defaults it would hide a test written against the
+ *        wrong app.
+ */
+export function binaryStoreFakeDefaults(appId) {
+    return {
+        appId,
+        async put() { },
+        async putLarge() { },
+        async get() {
+            return null;
+        },
+        async meta() {
+            return null;
+        },
+        async stat() {
+            return null;
+        },
+        async has() {
+            return false;
+        },
+        // 🔴 `"unknown"`, never `"absent"`. A fake that claimed to know a key is missing
+        // would let a listing route's "answer only from the memo" branch look exercised
+        // when nothing was ever memoized — the one thing a test of that branch is for.
+        known() {
+            return 'unknown';
+        },
+        // 🔴 `0`, and never a lie about work done. The real one returns how many
+        // negative memos it dropped, and an app's repair route reports that number to
+        // the owner — a fake that invented one would make a broken repair read as a
+        // working one in the only test that could catch it.
+        forgetMisses() {
+            return 0;
+        },
+        cacheStats() {
+            return { present: 0, absent: 0 };
+        },
+        async remove() { },
+        async removePrefix() { },
+        async mediaUrl(key) {
+            // Carries the key, so an assertion on "which object was linked" reads.
+            return `https://binary-server.test/media/${appId}/${key}`;
+        },
+        async mediaPrefixUrl(prefix, master) {
+            // Carries BOTH, because the bug this shape exists to prevent is signing the wrong
+            // one of them — a URL pointing at the master but scoped to the wrong prefix 403s
+            // every segment while the master itself loads fine.
+            return `https://binary-server.test/media/${appId}/${master}?p=${encodeURIComponent(prefix)}`;
+        },
+        async fetchMedia() {
+            // 🔴 404, not an empty 200. A fake that answers "here are zero bytes" makes a
+            // streaming route look like it worked on an object that does not exist.
+            return new Response(null, { status: 404 });
+        },
+        async signToken(_claims, _ttlSeconds) {
+            return 'fake-token';
+        },
+    };
+}

package/dist/server/storage/files/catalogue.d.ts

@@ -1,7 +1,7 @@
 import type { Database } from 'bun:sqlite';
 import { type MediaCtx, type MediaStore } from '../types';
 import { type ProcessOptions, type ProcessResult } from '../videoProcessor';
-import { type FileCatalogue, type PrivateFileCatalogue } from './types';
+import { type FileCatalogue } from './types';
 /** Swappable video ingest→derivatives implementation. The default runs ffmpeg
  * locally ({@link processVideo}); a remote backend (binary-server) delegates
  * the heavy work to the storage host instead — see binaryServerProcessing. */
@@ -69,4 +69,4 @@ export type SqliteFileCatalogueOptions = {
      * with ffmpeg fallback). Inject a remote one when the byte store is remote. */
     imageDerivatives?: ImageDerivatives;
 };
-export declare function createSqliteFileCatalogue(opts: SqliteFileCatalogueOptions): FileCatalogue & PrivateFileCatalogue;
+export declare function createSqliteFileCatalogue(opts: SqliteFileCatalogueOptions): FileCatalogue;

package/dist/server/storage/files/catalogue.js

@@ -1,34 +1,11 @@
-import { mkdir, readdir, rm, stat as fsStat } from 'node:fs/promises';
+import { readdir, stat as fsStat } from 'node:fs/promises';
 import path from 'node:path';
 import { renderImage } from '../../media-bun/image';
-import { sealMeta } from '../../private-media/crypto';
-import { processPrivateBlob, processPrivateVideo } from '../../private-media/pipeline';
 import { ffmpegImageThumbnail, isBrowserRenderableImage } from '../imageThumbnail';
-import { fsDisplayKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, privateFsKey, } from '../types';
+import { fsDisplayKey, fsHlsPrefix, fsMp4Key, fsPosterKey, fsSourceKey, fsSpriteKey, fsVttKey, } from '../types';
 import { processVideo } from '../videoProcessor';
 import { mimeByExt } from './mimeByExt';
 import { classifyFileType, } from './types';
-// Stream an upload body to a local plaintext file (staged for the private pipeline; wiped after).
-// Bun.write(dest, new Response(stream)) hangs in Bun 1.3.x — pump via a FileSink instead.
-async function streamToFile(body, dest) {
-    await mkdir(path.dirname(dest), { recursive: true });
-    const sink = Bun.file(dest).writer();
-    const reader = body.getReader();
-    let size = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            size += value.byteLength;
-            sink.write(value);
-        }
-    }
-    finally {
-        await sink.end();
-    }
-    return size;
-}
 // The general primary binary for a NON-video file (images/docs/…) lives here; video files store a
 // raw source (fsSourceKey) + derived mp4/HLS/poster/sprite via the shared video keyspace.
 export const fileBinaryKey = (owner, id) => `fs/${owner}/${id}`;
@@ -120,9 +97,9 @@ export function createSqliteFileCatalogue(opts) {
     const rand31 = () => Math.floor(Math.random() * RANDOM_MOD);
     const randKey = opts.randKey ?? rand31;
     const randomSeed = opts.randomSeed ?? rand31;
-    const insertFile = db.query(`INSERT INTO files (id, owner, name, mime, size, file_type, is_private, processing_status, processing_progress, storage_backend, rand_key, created_at, updated_at)
-     VALUES ($id, $owner, $name, $mime, $size, $type, 0, $status, $progress, 'disk', $rand, $now, $now)`);
-    const insertTag = db.query(`INSERT OR IGNORE INTO file_tags (file_id, tag, owner, is_private) VALUES ($file, $tag, $owner, 0)`);
+    const insertFile = db.query(`INSERT INTO files (id, owner, name, mime, size, file_type, processing_status, processing_progress, storage_backend, rand_key, created_at, updated_at)
+     VALUES ($id, $owner, $name, $mime, $size, $type, $status, $progress, 'disk', $rand, $now, $now)`);
+    const insertTag = db.query(`INSERT OR IGNORE INTO file_tags (file_id, tag, owner) VALUES ($file, $tag, $owner)`);
     const deleteTags = db.query(`DELETE FROM file_tags WHERE file_id = $file`);
     const getRow = db.query(`SELECT * FROM files WHERE id = $id AND owner = $owner`);
     const deleteFile = db.query(`DELETE FROM files WHERE id = $id AND owner = $owner`);
@@ -140,20 +117,7 @@ export function createSqliteFileCatalogue(opts) {
     const replaceMeta = db.query(`UPDATE files SET name = $name, mime = $mime, size = $size, file_type = $type,
        processing_status = $status, processing_progress = $progress,
        has_hls = 0, has_thumbnail = 0, has_sprites = 0, duration = NULL, updated_at = $now
-     WHERE id = $id AND owner = $owner AND is_private = 0`);
-    // Private (encrypted) rows: name/tags are sealed in enc_name (sealedMeta); the wrapped AES-128
-    // content key is in enc_dek; enc_key_type records the wrap mode. is_private = 1 keeps them out of
-    // the public feed. These rows are surfaced to `mountPrivateRoutes` via `asPrivateIndex()`.
-    const insertPrivate = db.query(`INSERT INTO files (id, owner, name, mime, size, file_type, is_private, has_hls, duration,
-       processing_status, processing_progress, storage_backend, enc_name, enc_dek, enc_key_type, rand_key, created_at, updated_at)
-     VALUES ($id, $owner, '', '', $size, $type, 1, 0, NULL, $status, $progress, 'disk', $sealed, $wrapped, $mode, $rand, $now, $now)`);
-    const finishPrivate = db.query(`UPDATE files SET processing_status = $status, processing_progress = $progress, has_hls = $hls,
-       duration = $duration, size = $size, enc_name = $sealed, enc_dek = $wrapped, updated_at = $now WHERE id = $id`);
-    const getPrivateRow = db.query(`SELECT * FROM files WHERE id = $id AND owner = $owner AND is_private = 1`);
-    const listPrivateFullRows = db.query(`SELECT * FROM files WHERE owner = $owner AND is_private = 1 ORDER BY created_at DESC, id DESC`);
-    const updatePrivateRow = db.query(`UPDATE files SET size = $size, processing_status = $status, enc_name = $sealed, enc_dek = $wrapped,
-       enc_key_type = $mode, updated_at = $now WHERE id = $id AND owner = $owner AND is_private = 1`);
-    const deletePrivateRow = db.query(`DELETE FROM files WHERE id = $id AND owner = $owner AND is_private = 1`);
+     WHERE id = $id AND owner = $owner`);
     // ── Collection prepared statements ───────────────────────────────────────────────
     const insertCollection = db.query(`INSERT INTO file_collections (id, owner, name, kind, visibility, created_at, updated_at)
      VALUES ($id, $owner, $name, $kind, $visibility, $now, $now)
@@ -180,16 +144,6 @@ export function createSqliteFileCatalogue(opts) {
      SELECT f.id, f.owner, $now, 1 FROM files f WHERE f.id = $id AND f.owner = $owner
      ON CONFLICT(file_id) DO UPDATE SET viewed_at = excluded.viewed_at, view_count = view_count + 1`);
     const deleteFileViews = db.query(`DELETE FROM file_views WHERE file_id = $file`);
-    const rowToPrivateItem = (r, owner) => ({
-        id: r.id,
-        owner,
-        sizeBytes: r.size,
-        createdAt: r.created_at,
-        status: r.processing_status,
-        keyMode: (r.enc_key_type || 'deniable'),
-        wrappedContentKey: r.enc_dek,
-        sealedMeta: r.enc_name,
-    });
     const tagsFor = (ids) => {
         const map = new Map();
         if (ids.length === 0)
@@ -235,7 +189,6 @@ export function createSqliteFileCatalogue(opts) {
         size: row.size,
         fileType: row.file_type,
         tags,
-        isPrivate: row.is_private === 1,
         hasThumbnail: row.has_thumbnail === 1,
         hasHls: row.has_hls === 1,
         hasSprites: row.has_sprites === 1,
@@ -416,8 +369,7 @@ export function createSqliteFileCatalogue(opts) {
         return rows[0];
     };
     const statsByType = db.query(`SELECT file_type, COUNT(*) AS n, SUM(size) AS bytes FROM files
-     WHERE owner = $owner AND is_private = 0 GROUP BY file_type`);
-    const statsPrivate = db.query(`SELECT COUNT(*) AS n, SUM(size) AS bytes FROM files WHERE owner = $owner AND is_private = 1`);
+     WHERE owner = $owner GROUP BY file_type`);
     const statsStatus = db.query(`SELECT processing_status, COUNT(*) AS n FROM files
      WHERE owner = $owner GROUP BY processing_status`);
     return {
@@ -431,7 +383,6 @@ export function createSqliteFileCatalogue(opts) {
                 files += row.n;
                 bytes += row.bytes ?? 0;
             }
-            const priv = statsPrivate.get({ $owner: owner });
             let processing = 0;
             let failed = 0;
             for (const row of statsStatus.all({ $owner: owner })) {
@@ -444,8 +395,6 @@ export function createSqliteFileCatalogue(opts) {
                 files,
                 bytes,
                 byType,
-                privateItems: priv?.n ?? 0,
-                privateBytes: priv?.bytes ?? 0,
                 processing,
                 failed,
             };
@@ -456,7 +405,6 @@ export function createSqliteFileCatalogue(opts) {
             const params = { $owner: owner, $limit: limit + 1 };
             const where = [
                 'f.owner = $owner',
-                'f.is_private = 0',
                 options.trashedOnly ? 'f.trashed_at IS NOT NULL' : 'f.trashed_at IS NULL',
             ];
             let from = 'files f';
@@ -547,7 +495,7 @@ export function createSqliteFileCatalogue(opts) {
         },
         async tagFacets(ctx) {
             const rows = db
-                .query(`SELECT tag, COUNT(*) as count FROM file_tags WHERE owner = $owner AND is_private = 0
+                .query(`SELECT tag, COUNT(*) as count FROM file_tags WHERE owner = $owner
            GROUP BY tag ORDER BY count DESC, tag ASC`)
                 .all({ $owner: ownerOf(ctx) });
             return rows;
@@ -591,9 +539,6 @@ export function createSqliteFileCatalogue(opts) {
             const row = getRow.get({ $id: id, $owner: owner });
             if (!row)
                 return null;
-            if (row.is_private === 1) {
-                throw new Error('replaceContent: private files cannot be replaced in place');
-            }
             const isVideo = upload.mime.startsWith('video/');
             // Store the new bytes FIRST — a failed write leaves the old row + bytes fully intact.
             const key = isVideo ? fsSourceKey(owner, id) : fileBinaryKey(owner, id);
@@ -728,24 +673,21 @@ export function createSqliteFileCatalogue(opts) {
         },
         recoverProcessing() {
             // A restart mid-transcode leaves a row stuck in `processing`/`pending` — the in-process
-            // job is gone. For PUBLIC videos the source still sits at fsSourceKey, so re-kick the pipeline.
-            // PRIVATE rows can't be re-kicked at boot (the set key isn't available) — video or blob alike,
-            // mark them failed; the user re-unlocks + re-uploads. Public non-video rows are `ready` at
-            // insert and never appear here. (Ported from ca's recoverOnBoot; our jobs are in-process,
-            // so recovery is app-invoked at startup rather than a persistent queue.)
+            // job is gone. The source still sits at fsSourceKey, so re-kick the pipeline. Non-video rows
+            // are `ready` at insert and never appear here. (Ported from ca's recoverOnBoot; our jobs are
+            // in-process, so recovery is app-invoked at startup rather than a persistent queue.)
             // Re-kicks are CAPPED at maxProcessingAttempts total kicks: if the transcode itself is what
             // keeps killing the process (2026-07-04 prod outage: ffmpeg OOM on a 1GB host → systemd
             // restart → unconditional re-kick → OOM again, forever), the row must land on `failed`
             // instead of holding the whole service down.
             const stuck = db
-                .query(`SELECT id, owner, is_private, processing_attempts FROM files
-           WHERE (file_type = 'video' OR is_private = 1)
-             AND processing_status IN ('pending', 'processing')`)
+                .query(`SELECT id, owner, processing_attempts FROM files
+           WHERE file_type = 'video' AND processing_status IN ('pending', 'processing')`)
                 .all();
             let requeued = 0;
             let failed = 0;
             for (const r of stuck) {
-                if (r.is_private === 1 || r.processing_attempts >= maxProcessingAttempts) {
+                if (r.processing_attempts >= maxProcessingAttempts) {
                     setProcessing.run({ $id: r.id, $status: 'failed', $progress: 0, $now: now() });
                     failed++;
                 }
@@ -756,14 +698,14 @@ export function createSqliteFileCatalogue(opts) {
             }
             return { requeued, failed };
         },
-        // Backfill grid thumbnails for PUBLIC video rows that finished (ready/failed) without a poster —
+        // Backfill grid thumbnails for video rows that finished (ready/failed) without a poster —
         // e.g. rows that landed while transcodeVideos was off entirely, or that failed a full transcode
         // before the poster step. Re-kicks the (now poster-capable) pipeline; the attempts counter is
         // reset first so the maxProcessingAttempts cap doesn't pre-empt a fresh, cheaper poster-only run.
         backfillVideoPosters() {
             const missing = db
                 .query(`SELECT id, owner FROM files
-           WHERE file_type = 'video' AND is_private = 0 AND has_thumbnail = 0
+           WHERE file_type = 'video' AND has_thumbnail = 0
              AND processing_status IN ('ready', 'failed')`)
                 .all();
             // Serialize: on the memory-constrained hosts this exists for, running every poster extract
@@ -775,7 +717,7 @@ export function createSqliteFileCatalogue(opts) {
             }, Promise.resolve());
             return { requeued: missing.length };
         },
-        // Backfill grid thumbnails for PUBLIC image rows with no poster — e.g. HEIC/HEVC iPhone photos
+        // Backfill grid thumbnails for image rows with no poster — e.g. HEIC/HEVC iPhone photos
         // whose sharp thumbnail silently failed before the ffmpeg fallback existed. Re-kicks the (now
         // HEIC-capable) image pipeline, serialized so at most one ffmpeg decode runs at a time.
         backfillImageThumbnails() {
@@ -785,7 +727,7 @@ export function createSqliteFileCatalogue(opts) {
             // present, so a warm boot re-runs nothing.
             const candidates = db
                 .query(`SELECT id, owner, mime, has_thumbnail FROM files
-           WHERE file_type = 'image' AND is_private = 0
+           WHERE file_type = 'image'
              AND (has_thumbnail = 0 OR mime IN ('image/heic', 'image/heif'))`)
                 .all();
             void candidates.reduce(async (prev, r) => {
@@ -897,137 +839,5 @@ export function createSqliteFileCatalogue(opts) {
             // Upsert-gated to the caller's own files; unknown/other-owner ids record nothing.
             recordViewStmt.run({ $id: fileId, $owner: ownerOf(ctx), $now: now() });
         },
-        async ingestPrivate(ctx, upload, cfg) {
-            const owner = ownerOf(ctx);
-            const id = crypto.randomUUID();
-            const ts = now();
-            // Seal the descriptor NOW — sealing is independent of the transcode (only the wrapped content
-            // KEY needs the pipeline). Storing enc_name at insert means a try-a-password reveal matches the
-            // item immediately, before its HLS finishes encrypting (no seal race).
-            const descriptor = {
-                name: upload.name,
-                mime: upload.mime,
-                tags: upload.tags ?? [],
-            };
-            const sealed = sealMeta(cfg.setKey, descriptor);
-            const isVideo = upload.mime.startsWith('video/');
-            insertPrivate.run({
-                $id: id,
-                $owner: owner,
-                $size: 0,
-                $type: classifyFileType(upload.mime),
-                $mode: cfg.keyMode,
-                $status: 'processing',
-                $progress: 0,
-                $sealed: sealed,
-                $wrapped: '',
-                $rand: randKey(),
-                $now: ts,
-            });
-            // Stage plaintext to a scratch file, then encrypt: video → AES-128 HLS ladder; anything
-            // else (photo/doc/audio) → one AES-128-CTR blob at privateSourceKey. Plaintext is never
-            // persisted either way. We MUST await: the wrapped key is produced by the pipeline and
-            // there is nothing to serve without it.
-            const srcPath = path.join(workDir, 'ingest', `${owner}-${id}.src`);
-            let size = 0;
-            try {
-                size = await streamToFile(upload.body, srcPath);
-                const res = isVideo
-                    ? await processPrivateVideo({
-                        store,
-                        workDir,
-                        owner,
-                        id,
-                        sourcePath: srcPath,
-                        setKey: cfg.setKey,
-                        ladderHeights: opts.ladderHeights,
-                        onProgress: (status, pct) => setProcessing.run({ $id: id, $status: status, $progress: pct, $now: now() }),
-                    })
-                    : {
-                        ...(await processPrivateBlob({
-                            store,
-                            owner,
-                            id,
-                            sourcePath: srcPath,
-                            setKey: cfg.setKey,
-                        })),
-                        durationSeconds: 0,
-                        hasHls: false,
-                    };
-                finishPrivate.run({
-                    $id: id,
-                    $status: res.status,
-                    $progress: res.status === 'ready' ? 100 : 0,
-                    $hls: res.hasHls ? 1 : 0,
-                    $duration: res.durationSeconds || null,
-                    $size: size,
-                    $sealed: sealed,
-                    $wrapped: res.wrappedContentKey ?? '',
-                    $now: now(),
-                });
-            }
-            finally {
-                await rm(srcPath, { force: true }).catch(() => { });
-            }
-            const row = getRow.get({ $id: id, $owner: owner });
-            return {
-                id,
-                size,
-                createdAt: ts,
-                processingStatus: row.processing_status,
-                processingProgress: row.processing_progress,
-                hasHls: row.has_hls === 1,
-            };
-        },
-        asPrivateIndex() {
-            // A PrivateIndex view over the catalogue's private rows — the seam mountPrivateRoutes reads.
-            // `owner` here is the private owner axis the routes pass (a userId), matching how ingestPrivate
-            // stored the row (both go through the files.owner column).
-            return {
-                async add(item) {
-                    insertPrivate.run({
-                        $id: item.id,
-                        $owner: item.owner,
-                        $size: item.sizeBytes,
-                        // External index writers predate blob items and only ever added videos.
-                        $type: 'video',
-                        $mode: item.keyMode,
-                        $status: item.status,
-                        $progress: item.status === 'ready' ? 100 : 0,
-                        $sealed: item.sealedMeta,
-                        $wrapped: item.wrappedContentKey,
-                        $rand: randKey(),
-                        $now: now(),
-                    });
-                },
-                async get(owner, id) {
-                    const row = getPrivateRow.get({ $id: id, $owner: owner });
-                    return row ? rowToPrivateItem(row, owner) : null;
-                },
-                async list(owner) {
-                    return listPrivateFullRows.all({ $owner: owner }).map((r) => rowToPrivateItem(r, owner));
-                },
-                async update(owner, id, patch) {
-                    const cur = getPrivateRow.get({ $id: id, $owner: owner });
-                    if (!cur)
-                        return;
-                    const merged = { ...rowToPrivateItem(cur, owner), ...patch };
-                    updatePrivateRow.run({
-                        $id: id,
-                        $owner: owner,
-                        $size: merged.sizeBytes,
-                        $status: merged.status,
-                        $sealed: merged.sealedMeta,
-                        $wrapped: merged.wrappedContentKey,
-                        $mode: merged.keyMode,
-                        $now: now(),
-                    });
-                },
-                async remove(owner, id) {
-                    await store.removePrefix(privateFsKey(owner, id));
-                    deletePrivateRow.run({ $id: id, $owner: owner });
-                },
-            };
-        },
     };
 }

package/dist/server/storage/files/fileRoutes.d.ts

@@ -1,9 +1,8 @@
 import type { Context, Hono } from 'hono';
-import type { UnlockPasswordPolicy, UnlockService } from '../../private-media/unlock';
 import type { StreamTokenService } from '../streamToken';
 import type { MediaCtx, MediaStore } from '../types';
 import type { ChunkedUploadService } from './chunkedUpload';
-import { type FileCatalogue, type PrivateFileCatalogue } from './types';
+import { type FileCatalogue } from './types';
 /** The 413 message a single-PUT over the cap returns — the client treats it as a hard error. */
 export declare const SINGLE_UPLOAD_TOO_LARGE = "file too large for a single request \u2014 use chunked upload";
 export interface FileUrls {
@@ -26,24 +25,7 @@ export type MountFileRoutesOptions = {
     /** Session auth for the upload PUTs (a fetch CAN send the Bearer). Return a ctx or null. */
     authorizeUpload?: (c: Context) => Promise<MediaCtx | null> | MediaCtx | null;
     /** The catalogue uploads land in. Required for the upload routes to be mounted. */
-    catalogue?: FileCatalogue & PrivateFileCatalogue;
-    /** Wire private uploads: derive a per-user set key from the request (password header ⇒ deniable,
-     * absent ⇒ standard server key). Omit ⇒ the private-upload route is disabled. */
-    privateUpload?: {
-        unlock: UnlockService;
-        authorize: (c: Context) => Promise<{
-            userId: string;
-            userSalt: string;
-        } | null>;
-        /** Header carrying the plaintext password for a deniable set (default 'x-private-password'). */
-        passwordHeader?: string;
-        /** Header carrying an UNLOCK TOKEN (an already-unlocked session) — takes precedence over the
-         * password header; setKey + keyMode come from the verified grant (default 'x-unlock-token'). */
-        tokenHeader?: string;
-        /** What a supplied password means (default derive — deniable set). `gate` verifies it
-         * against the app's accounts and wraps under the recoverable server key instead. */
-        passwordPolicy?: UnlockPasswordPolicy;
-    };
+    catalogue?: FileCatalogue;
     /** Wire large-file chunked uploads (direct-to-backend). Omit ⇒ init/complete routes are absent
      * and clients use the streamed `PUT /upload`. Uses the same `authorizeUpload` guard. */
     chunked?: ChunkedUploadService;

package/dist/server/storage/files/fileRoutes.js

@@ -1,7 +1,7 @@
 import { MAX_SINGLE_UPLOAD_BYTES } from 'cursedbelt-core/media/upload-limits';
 import { serveRange } from '../streamRange';
 import { fileBinaryKey } from './catalogue';
-import { FILE_SORTS, } from './types';
+import { FILE_SORTS } from './types';
 // ── File binary + upload routes ─────────────────────────────────────────────────
 // The FileCatalogue's byte edge for GENERAL files (images/docs/audio/any) — the piece
 // mountMediaRoutes (video-only: mp4/hls/poster/sprite) doesn't cover. A file's primary binary
@@ -144,79 +144,6 @@ export function mountFileRoutes(app, opts) {
             }
         });
     }
-    // PUT a PRIVATE upload → catalogue.ingestPrivate under a set key derived from the request:
-    // either an UNLOCK TOKEN (an already-unlocked session — same mechanism the content-key route
-    // uses) or a password header (deniable) / neither (standard server key).
-    const pv = opts.privateUpload;
-    if (pv && catalogue) {
-        const passwordHeader = pv.passwordHeader ?? 'x-private-password';
-        const tokenHeader = pv.tokenHeader ?? 'x-unlock-token';
-        app.put(`${base}/upload-private`, async (c) => {
-            const who = await pv.authorize(c);
-            if (!who)
-                return c.json({ error: 'unauthorized' }, 401);
-            const raw = c.req.raw.body;
-            if (!raw)
-                return c.json({ error: 'empty body' }, 400);
-            const body = guardSingleUpload(c, raw);
-            if (body instanceof Response)
-                return body;
-            let setKey;
-            let keyMode;
-            const unlockToken = c.req.header(tokenHeader) || undefined;
-            if (unlockToken) {
-                // Token path: recover the sealed set key + mode from the grant. The token must belong
-                // to the session caller.
-                const grant = await pv.unlock.verify(unlockToken);
-                if (!grant || grant.userId !== who.userId) {
-                    return c.json({ error: 'invalid unlock token' }, 401);
-                }
-                setKey = grant.setKey;
-                keyMode = grant.mode;
-            }
-            else {
-                // Password path: derive fresh from the header (deniable) or the server key. Under the
-                // gate policy the password is an access check only — verify, then wrap standard.
-                const password = c.req.header(passwordHeader) || undefined;
-                const policy = pv.passwordPolicy ?? { mode: 'derive' };
-                let derivePassword = password;
-                if (policy.mode === 'gate' && password) {
-                    if (!(await policy.verifyPassword(who, password))) {
-                        return c.json({ error: 'invalid password' }, 401);
-                    }
-                    derivePassword = undefined;
-                }
-                setKey = pv.unlock.deriveSetKey({
-                    userId: who.userId,
-                    userSalt: who.userSalt,
-                    password: derivePassword,
-                });
-                keyMode = derivePassword ? 'deniable' : 'standard';
-            }
-            // The private owner axis is the userId (deniability is personal), matching mountPrivateRoutes.
-            const ctx = { userId: who.userId, tenantId: who.userId };
-            const tags = c.req.header('x-tags');
-            try {
-                const item = await catalogue.ingestPrivate(ctx, {
-                    name: c.req.header('x-filename') ?? 'upload',
-                    mime: c.req.header('content-type') ?? 'application/octet-stream',
-                    body,
-                    tags: tags
-                        ? tags
-                            .split(',')
-                            .map((t) => t.trim())
-                            .filter(Boolean)
-                        : undefined,
-                }, { setKey, keyMode });
-                return c.json({ item });
-            }
-            catch (e) {
-                if (isUploadTooLarge(e))
-                    return c.json({ error: SINGLE_UPLOAD_TOO_LARGE }, 413);
-                throw e;
-            }
-        });
-    }
     // Chunked upload (large files, direct-to-backend). init → the client PUTs each chunk straight to
     // the backend (URLs the app minted) → complete registers the row over the assembled bytes. The
     // bytes never traverse this origin.

package/dist/server/storage/files/index.d.ts

@@ -6,4 +6,4 @@ export { createFileUrls, type FileUrls, type MountFileRoutesOptions, mountFileRo
 export { FILE_CATALOGUE_MIGRATIONS } from './migrations';
 export { createFilesStack, type FilesStack, type FilesStackMountAuth, type FilesStackOptions, } from './stack';
 export { createLedgeredDeletes, createStorageOpsLedger, createStorageReconciler, type StorageAction, type StorageOpRow, type StorageOpsLedger, type StorageReconciler, } from './storageOps';
-export { type CollectionKind, type CollectionVisibility, classifyFileType, FILE_SORTS, type FileCatalogue, type FileCollection, type FilePage, type FileRecord, type FileSort, type FileToPlayable, type FileType, type ListFilesOptions, type PrivateFileCatalogue, type PrivateFileItem, type PrivateKeyMode, type TagFacet, } from './types';
+export { type CollectionKind, type CollectionVisibility, classifyFileType, FILE_SORTS, type FileCatalogue, type FileCollection, type FilePage, type FileRecord, type FileSort, type FileToPlayable, type FileType, type ListFilesOptions, type TagFacet, } from './types';

package/dist/server/storage/files/index.js

@@ -1,5 +1,5 @@
 // cursedbelt-server/storage FileCatalogue — a SQLite-backed tagged flat file system over the
-// MediaStore + media pipeline + private-media. One source of truth for a user's binaries; the
+// MediaStore + media pipeline. One source of truth for a user's binaries; the
 // video gallery is a video-filtered view over it.
 export { createCatalogueMediaSource, createCataloguePhotoSource, createCatalogueVideoSource, createFileToPlayable, } from './adapter';
 export { catalogueUploadKey, createSqliteFileCatalogue, fileBinaryKey, } from './catalogue';