cursedbelt 4.6.0 → 5.0.0

package/src/react/components/TooltipImpl.tsx

@@ -44,6 +44,10 @@ export default function TooltipImpl({
   const resolvedSide = placement ?? side ?? 'top';
   const triggerRef = useRef<HTMLElement | null>(null);
   const wasFocusedRef = useRef(false);
+  /** The node a TOUCH disclosure's taps land on — the ⓘ, or the `tap` branch's span. */
+  const touchTriggerRef = useRef<HTMLButtonElement | null>(null);
+  /** True while one of that trigger's own events is being dispatched — see `onTouchOpenChange`. */
+  const inTriggerEventRef = useRef(false);
 
   // Replay the arming gesture. Radix opens on `pointermove` over the trigger and on
   // focus; both already happened before this module existed, so re-dispatch one on
@@ -215,7 +219,16 @@ export default function TooltipImpl({
         sideOffset={6}
         collisionPadding={FLOATING_COLLISION_PADDING}
         style={maxWidth != null ? { maxWidth } : undefined}
-        onPointerDownOutside={() => setOpen(false)}
+        onPointerDownOutside={(e) => {
+          // A touch disclosure's OWN trigger is outside the bubble, but a tap on it is the
+          // toggle's business (it closes an open bubble on its click). Letting the layer
+          // dismiss here as well would close on this pointerdown and re-open on the click.
+          if (!hasHover && touchTriggerRef.current?.contains(e.target as Node)) {
+            e.preventDefault();
+            return;
+          }
+          setOpen(false);
+        }}
         className={cn(
           // NOTE: the bubble is a transient hint and must NEVER be a click target —
           // a focus-opened tooltip (e.g. a prompt auto-focusing its safe default
@@ -276,6 +289,42 @@ export default function TooltipImpl({
 
   const toggle = () => setOpen((o) => !o);
 
+  /*
+   * 🔴 On touch, the TAP owns `open`, and Radix's trigger handlers are told nothing they say.
+   *
+   * Tasks 2082 + 2093, measured in a Pixel 7 context on station's Console: the first tap on
+   * every ⓘ did nothing and the second opened it. A real tap fires `pointerdown → pointerup →
+   * focus → click`. Radix's Trigger clears its pointer-down flag on `pointerup`, so the
+   * `focus` that follows reads as KEYBOARD focus and opens; then this branch's click `toggle`
+   * flips that fresh `true` back to `false`. (Radix also composes `onClose` onto every click
+   * and every `pointerdown` on an open trigger, which is the half the tasks first suspected.)
+   *
+   * So while one of the trigger's own events is being dispatched, `onOpenChange` from Radix
+   * is ignored — the flag is set by the handlers below, which `composeEventHandlers` runs
+   * BEFORE Radix's, and cleared in a microtask, which runs once the whole dispatch returns.
+   * Nothing is `preventDefault`ed, so a `mobile="tap"` trigger that is a link still
+   * navigates. Every OTHER close Radix makes still lands: Escape, scroll, and another
+   * tooltip opening. `e2e/tooltip-tap.spec.ts` is the proof, in the `touch` project — it
+   * cannot be a happy-dom case, because happy-dom fires whatever order a spec writes.
+   */
+  const markTriggerEvent = () => {
+    inTriggerEventRef.current = true;
+    queueMicrotask(() => {
+      inTriggerEventRef.current = false;
+    });
+  };
+  const onTouchOpenChange = (next: boolean) => {
+    if (inTriggerEventRef.current) return;
+    setOpen(next);
+  };
+  const touchTriggerProps = {
+    ref: touchTriggerRef,
+    onPointerDown: markTriggerEvent,
+    onFocus: markTriggerEvent,
+    onBlur: markTriggerEvent,
+    onClick: markTriggerEvent,
+  };
+
   // `icon`: render the trigger as-is plus a tappable ⓘ disclosure that owns the
   // tooltip (so a tap on the trigger still does its own action).
   if (mobile === 'icon') {
@@ -287,8 +336,8 @@ export default function TooltipImpl({
             accidental hover to protect against on a touch device — see
             `lib/hoverIntent.ts`, "delay the accident, never the request". */}
         <RTooltip.Provider delayDuration={HOVER_HINT_INSTANT_MS}>
-          <RTooltip.Root open={open} onOpenChange={setOpen}>
-            <RTooltip.Trigger asChild>
+          <RTooltip.Root open={open} onOpenChange={onTouchOpenChange}>
+            <RTooltip.Trigger asChild {...touchTriggerProps}>
               <button
                 // guardrails-ignore no-raw-action-button: this IS the Tooltip primitive's
                 // own mobile disclosure trigger — Button/IconButton wrap every button in a
@@ -321,8 +370,8 @@ export default function TooltipImpl({
   // as the `icon` branch above — the tap IS the request.
   return (
     <RTooltip.Provider delayDuration={HOVER_HINT_INSTANT_MS}>
-      <RTooltip.Root open={open} onOpenChange={setOpen}>
-        <RTooltip.Trigger asChild>
+      <RTooltip.Root open={open} onOpenChange={onTouchOpenChange}>
+        <RTooltip.Trigger asChild {...touchTriggerProps}>
           {/* On touch, tapping the trigger toggles the tooltip. Radix's Trigger
               (asChild) merges the real keyboard + ARIA interaction onto this element;
               the bare onClick here is only the tap affordance. */}

package/src/react/file-tree/FileTree.tsx

@@ -189,6 +189,7 @@ import {
   toggleSelected,
   topmostSelected,
 } from './fileTreeSelection.js';
+import { useInView } from '../media/previewGate.js';
 import './fileTree.css';
 
 /** How far a press travels before it stops being a click and becomes a drag. */
@@ -597,6 +598,16 @@ function DefaultIcon({ node, open }: { node: FileTreeNode; open: boolean }): Rea
  *
  * `loading='lazy'` and `decoding='async'` because the consumer hands over a URL per row and a
  * 2,000-row tree must not open 2,000 connections to draw the twelve rows on screen.
+ *
+ * 🔴 …and `src` is withheld until the row has actually been ON SCREEN, because `lazy` alone
+ * does not bound it. A browser's lazy threshold is thousands of pixels past the viewport, and
+ * rows are ~24 px: measured 2026-09-22 in `apps/collections`' browser check, a 240-row folder
+ * in the rail had **174** thumbnail loads open at once under `loading='lazy'` — the whole of
+ * the owner's "I could not close the dev tools" peak, from sixteen-pixel pictures. `useInView`
+ * reports true only while the row is visible inside its scrolling ancestors; the first time it
+ * does, the picture is latched and the row stops being observed. The `<img>` itself stays in
+ * place meanwhile, so the row keeps its one glyph box — an off-screen row is blank, which
+ * nobody is looking at. No reporting observer (jsdom, happy-dom) means visible at once.
  */
 function RowGlyph({
   node,
@@ -610,12 +621,19 @@ function RowGlyph({
   const [failed, setFailed] = useState<string | null>(null);
   const icon = renderIcon ? renderIcon(node) : <DefaultIcon node={node} open={open} />;
   const src = node.thumbnailUrl;
+  const ref = useRef<HTMLImageElement>(null);
+  const [seen, setSeen] = useState(false);
+  const inView = useInView(ref, Boolean(src) && failed !== src && !seen);
+  useEffect(() => {
+    if (inView) setSeen(true);
+  }, [inView]);
   if (!src || failed === src) return icon;
   return (
     <img
+      ref={ref}
       key={src}
       className='cbft-thumb'
-      src={src}
+      src={seen || inView ? src : undefined}
       alt=''
       aria-hidden='true'
       loading='lazy'

package/src/react/file-tree/fileTreeThumbs.spec.tsx

@@ -0,0 +1,90 @@
+/**
+ * The rail's row thumbnails load only once their row has been ON SCREEN — `RowGlyph` in
+ * `FileTree.tsx`. `loading='lazy'` alone let a 240-row folder open 174 thumbnail loads at once
+ * (measured 2026-09-22 in `apps/collections`' browser check), because a browser's lazy threshold
+ * is thousands of pixels and a row is ~24.
+ *
+ * happy-dom's `IntersectionObserver` never reports, so this installs one it can drive, the way
+ * `media/previewGate.spec.tsx` does.
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { act, cleanup, render } from '@testing-library/react';
+import { FileTree } from './FileTree.js';
+
+type Callback = (entries: Array<{ target: Element; isIntersecting: boolean }>) => void;
+let observers: FakeObserver[] = [];
+
+class FakeObserver {
+  targets = new Set<Element>();
+  constructor(private readonly callback: Callback) {
+    observers.push(this);
+  }
+  observe(el: Element) {
+    this.targets.add(el);
+  }
+  unobserve(el: Element) {
+    this.targets.delete(el);
+  }
+  disconnect() {
+    this.targets.clear();
+  }
+  takeRecords() {
+    return [];
+  }
+  get thresholds(): number[] {
+    return [0];
+  }
+  fire(el: Element, isIntersecting: boolean) {
+    this.callback([{ target: el, isIntersecting }]);
+  }
+}
+
+const g = globalThis as { IntersectionObserver?: unknown };
+const original = g.IntersectionObserver;
+
+beforeEach(() => {
+  observers = [];
+  g.IntersectionObserver = class extends FakeObserver {};
+});
+
+afterEach(() => {
+  cleanup();
+  if (original === undefined) delete g.IntersectionObserver;
+  else g.IntersectionObserver = original;
+});
+
+const rows = Array.from({ length: 3 }, (_, i) => ({
+  id: `p${i}`,
+  name: `photo${i}.jpg`,
+  kind: 'file' as const,
+  thumbnailUrl: `/t/p${i}.jpg`,
+}));
+
+describe('a row thumbnail waits for its row to be seen', () => {
+  test('🔴 an off-screen row asks for nothing; the first sight loads it, and it stays loaded', () => {
+    const { container } = render(<FileTree nodes={rows} selectedId={null} onSelect={() => undefined} />);
+    const imgs = [...container.querySelectorAll('img.cbft-thumb')] as HTMLImageElement[];
+    expect(imgs).toHaveLength(3);
+    // Nothing reported yet: no row has a src, so no request has gone out.
+    expect(imgs.map((img) => img.getAttribute('src'))).toEqual([null, null, null]);
+
+    const observer = observers.find((o) => o.targets.size > 0) as FakeObserver;
+    const [first] = imgs;
+    act(() => observer.fire(first as Element, true));
+    expect(first?.getAttribute('src')).toBe('/t/p0.jpg');
+    expect(imgs[1]?.getAttribute('src')).toBeNull();
+
+    // Scrolled away again: the picture is kept, and the row is no longer observed.
+    act(() => observer.fire(first as Element, false));
+    expect(first?.getAttribute('src')).toBe('/t/p0.jpg');
+    expect(observer.targets.has(first as Element)).toBe(false);
+    expect(observer.targets.size).toBe(2);
+  });
+
+  test('with no reporting observer every thumbnail loads at once — the old behavior, never none', () => {
+    delete g.IntersectionObserver;
+    const { container } = render(<FileTree nodes={rows} selectedId={null} onSelect={() => undefined} />);
+    const srcs = [...container.querySelectorAll('img.cbft-thumb')].map((img) => img.getAttribute('src'));
+    expect(srcs).toEqual(['/t/p0.jpg', '/t/p1.jpg', '/t/p2.jpg']);
+  });
+});

package/src/react/index.ts

@@ -47,6 +47,14 @@ export { MessageScroller, type MessageScrollerProps } from './chat/MessageScroll
 export { MessageThread, type MessageThreadProps } from './chat/MessageThread.js';
 export { PresenceRoster, type PresenceRosterProps } from './chat/PresenceRoster.js';
 export { StatusMarker, type StatusMarkerProps } from './chat/StatusMarker.js';
+export {
+  PRESENCE_RETRY_MS,
+  type PresenceEntryLike,
+  type PresenceSubscription,
+  presenceUsers,
+  type UsePresenceOptions,
+  usePresence,
+} from './chat/usePresence.js';
 export { Markdown, type MarkdownProps } from './markdown/Markdown.js';
 export type {
   ChatAttachment,

package/src/react/master-lock/MasterLockDialog.tsx

@@ -28,6 +28,7 @@ import { Button } from "../components/Button.js";
 import { FieldLabel } from "../components/FieldLabel.js";
 import { Input } from "../components/Input.js";
 import { Modal } from "../components/Modal.js";
+import { SecretInput } from "../components/SecretInput.js";
 
 export interface MasterLockDialogProps {
 	open: boolean;
@@ -201,39 +202,42 @@ export function MasterLockDialog({
 					<label htmlFor="ml-current">
 						<FieldLabel>Current master password</FieldLabel>
 					</label>
-					<Input
+					<SecretInput
 						id="ml-current"
-						type="password"
+						label="current master password"
 						autoComplete="current-password"
+						showCopy={false}
 						value={current}
 						disabled={busy}
-						onChange={(event) => setCurrent(event.target.value)}
+						onChange={setCurrent}
 					/>
 				</div>
 				<div className="flex flex-col gap-1.5">
 					<label htmlFor="ml-next">
 						<FieldLabel>New master password</FieldLabel>
 					</label>
-					<Input
+					<SecretInput
 						id="ml-next"
-						type="password"
+						label="new master password"
 						autoComplete="new-password"
+						showCopy={false}
 						value={next}
 						disabled={busy}
-						onChange={(event) => setNext(event.target.value)}
+						onChange={setNext}
 					/>
 				</div>
 				<div className="flex flex-col gap-1.5">
 					<label htmlFor="ml-confirm">
 						<FieldLabel>Repeat the new one</FieldLabel>
 					</label>
-					<Input
+					<SecretInput
 						id="ml-confirm"
-						type="password"
+						label="repeated new master password"
 						autoComplete="new-password"
+						showCopy={false}
 						value={confirm}
 						disabled={busy}
-						onChange={(event) => setConfirm(event.target.value)}
+						onChange={setConfirm}
 						onEnter={() => void changePassword()}
 					/>
 				</div>

package/src/react/master-lock/MasterLockProvider.spec.tsx

@@ -126,3 +126,20 @@ describe("🔴 the rotation never mints a KDF", () => {
 		expect(code).toContain("kdf: MasterLockKdfParams;");
 	});
 });
+
+describe("the account-menu entries (task 106)", () => {
+	test("🔴 'Master passwords…' is a LINK to the accounts page, from the wire, not a string here", async () => {
+		const { MasterLockMenuItems } = await import("./MasterLockProvider.js");
+		const { findByText, getByText } = render(
+			<MasterLockProvider onLocked={() => {}}>
+				<MasterLockMenuItems itemClassName="sam-item" />
+			</MasterLockProvider>,
+		);
+		const link = await findByText("Master passwords…");
+		expect(link.tagName).toBe("A");
+		expect(link.getAttribute("href")).toBe(MASTER_LOCK_PATHS.accounts);
+		expect(link.className).toBe("sam-item");
+		// The idle timeout lives only in the dialog, so its entry stays.
+		expect(getByText("Lock settings…").tagName).toBe("BUTTON");
+	});
+});

package/src/react/master-lock/MasterLockProvider.tsx

@@ -237,31 +237,25 @@ export interface MasterLockMenuItemsProps {
 }
 
 /**
- * The two entries for the account menu — *"a new option in the user dropdown … which is
+ * The entries for the account menu — *"a new option in the user dropdown … which is
  * located near the sign out and switch user options"*. The owner chose that placement
  * deliberately: *"this placement will help make sure it isn't confused with the private
  * collections lock or other locks like that."*
  *
  * Renders nothing when no master password is configured for the app.
  *
- * ── 🔴 The second entry is a LINK now, not a dialog (2026-09-17) ─────────────────────────
- * It used to call {@link MasterLockControl.openSettings}, and that dialog minted a FRESH `kdf`
- * salt on every rotation — the shape the wire had before accounts existed. Every account on an
- * app now derives under ONE shared descriptor, so honouring that salt would store a verifier
- * hash nothing could ever match: the owner sets a new password, the rotation logs him out, and
- * neither the old nor the new one opens the app. `cursedbelt-server`'s guard therefore answers
- * that shape `409 {"error":"stale-client"}` — deliberately distinguishable from a wrong
- * password, because it describes a broken CLIENT. So the entry did not merely look wrong; it
- * refused, and the owner could lock a site and enroll a first password but could not CHANGE one.
+ * ── The second entry is a LINK to the accounts page (task 106, 2026-09-23) ─────────────────
+ * `cursedbelt-server` serves `GET /__lock/accounts` from the same guard that serves the lock
+ * page: server-rendered, listing the accounts and adding, renaming and rotating them. So the
+ * entry is an `<a href>`, not a button — the target is a same-origin page, so there is nothing
+ * for this bundle to open and nothing for it to keep in step — and the path is
+ * `MASTER_LOCK_PATHS.accounts` from `cursedbelt-core`'s wire, never a string here, because a
+ * second copy of the wire in the design system is what `wire.ts`'s header exists to prevent.
  *
- * `cursedbelt-server` serves a richer replacement at `GET /__lock/accounts`, from the same guard
- * that serves the lock page: server-rendered, content-negotiated, listing the accounts and
- * adding/renaming them as well as rotating. This package does NOT link to it yet — the path
- * constant lives in `cursedbelt-core@2`'s wire and this package is still on `^1.1.0`, so the
- * link is a task, not a one-liner (`tasks/Not_Started`, filed 2026-09-17). What IS fixed here
- * is the dialog itself: `MasterLockDialog` no longer mints a salt, so this entry works again
- * rather than 409ing. `apps/collections` links to the page directly from its own rail in the
- * meantime, and says why in a comment there.
+ * The THIRD entry keeps the dialog, because the dialog also owns the idle timeout, which the
+ * accounts page does not. (History: until 2026-09-17 the dialog minted a fresh `kdf` salt on
+ * every rotation and the server refused it `409 stale-client`; it derives under the app's
+ * existing descriptor now, so both surfaces rotate correctly.)
  */
 export function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItemsProps) {
 	const lock = useMasterLock();
@@ -283,6 +277,9 @@ export function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItem
 			>
 				🔒 Lock this site
 			</button>
+			<a href={MASTER_LOCK_PATHS.accounts} className={cls} onClick={() => close?.()}>
+				Master passwords…
+			</a>
 			<button
 				// guardrails-ignore no-raw-action-button: see the sibling above — it must match
 				// the host menu's own rows, not this design system's buttons.
@@ -293,7 +290,7 @@ export function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItem
 					lock.openSettings();
 				}}
 			>
-				Master password…
+				Lock settings…
 			</button>
 		</>
 	);

package/src/react/media/MediaUploadControl.tsx

@@ -1,7 +1,6 @@
 import { Upload } from 'lucide-react';
 import { type ReactNode, useMemo, useRef, useState } from 'react';
 import { Button } from '../components/Button.js';
-import { Checkbox } from '../components/Checkbox.js';
 import { Input } from '../components/Input.js';
 import { cn } from '../lib/cn.js';
 import { createFileUploadClient } from './fileUploadClient.js';
@@ -12,8 +11,8 @@ import { createFileUploadClient } from './fileUploadClient.js';
 // no ENGINE-model consumer, but three shipping plugins render it
 // (`plugin-photo-gallery`, `plugin-video-gallery`, `plugin-media-gallery`), so
 // deleting it would break them. It speaks the legacy chunked `/_files` protocol
-// (`createFileUploadClient` + `createFilesStack`), including the tag list and the
-// X-Unlock-Token private mode that protocol supports.
+// (`createFileUploadClient` + `createFilesStack`), including the tag list. (Its private
+// mode went with the server's private-media module — task 108.)
 //
 // The ENGINE model uploads through `POST /api/asset/vault/upload` — raw bytes,
 // `x-cc-filename`, checksum computed while streaming, content-addressed dedupe —
@@ -25,19 +24,16 @@ import { createFileUploadClient } from './fileUploadClient.js';
 //
 // ── Media upload control ─────────────────────────────────────────────────────────
 // The one "⬆ Upload" affordance media galleries share: a disclosure button opening a
-// compact form — comma-separated tags, a Private toggle (only while an unlock token is
-// present), and a file picker — feeding the shared upload client (chunked-aware, private
-// via X-Unlock-Token). Consumers own only WHERE it sits and what happens after.
+// compact form — comma-separated tags and a file picker — feeding the shared upload client
+// (chunked-aware). Consumers own only WHERE it sits and what happens after.
 
 export interface MediaUploadControlProps {
   /** File-picker accept filter, e.g. "video/*" or "image/*". */
   accept: string;
   /** Mount prefix of the host's file routes (createFilesStack filesBasePath). */
   basePath: string;
-  /** Unlock token while private mode is on — reveals the Private toggle. */
-  privateToken?: string | null;
-  /** After every successful batch: `wasPrivate` says which list to refresh. */
-  onUploaded: (result: { wasPrivate: boolean }) => void;
+  /** After every successful batch. */
+  onUploaded: () => void;
   label?: ReactNode;
   className?: string;
 }
@@ -45,14 +41,12 @@ export interface MediaUploadControlProps {
 export function MediaUploadControl({
   accept,
   basePath,
-  privateToken = null,
   onUploaded,
   label = 'Upload',
   className,
 }: MediaUploadControlProps) {
   const [open, setOpen] = useState(false);
   const [tags, setTags] = useState('');
-  const [asPrivate, setAsPrivate] = useState(false);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const inputRef = useRef<HTMLInputElement>(null);
@@ -62,19 +56,13 @@ export function MediaUploadControl({
   const uploadFiles = async (list: FileList) => {
     setBusy(true);
     setError(null);
-    const wantPrivate = asPrivate && !!privateToken;
     const parsedTags = tags
       .split(',')
       .map((t) => t.trim())
       .filter(Boolean);
     try {
       for (const file of Array.from(list)) {
-        const res = wantPrivate
-          ? await client.uploadPrivate(file, {
-              tags: parsedTags,
-              unlockToken: privateToken,
-            })
-          : await client.uploadAuto(file, { tags: parsedTags });
+        const res = await client.uploadAuto(file, { tags: parsedTags });
         if (!res.ok) {
           setError(res.error);
           return;
@@ -82,8 +70,7 @@ export function MediaUploadControl({
       }
       setOpen(false);
       setTags('');
-      setAsPrivate(false);
-      onUploaded({ wasPrivate: wantPrivate });
+      onUploaded();
     } finally {
       setBusy(false);
     }
@@ -113,14 +100,6 @@ export function MediaUploadControl({
             className='max-w-[200px]'
             aria-label='Upload tags'
           />
-          {privateToken ? (
-            <Checkbox
-              checked={asPrivate}
-              onCheckedChange={(checked) => setAsPrivate(checked === true)}
-              disabled={busy}
-              label='Private'
-            />
-          ) : null}
           <Button
             size='sm'
             disabled={busy}

package/src/react/media/fileUploadClient.ts

@@ -4,8 +4,13 @@ import { sessionAuthHeaders } from '../sessionAuth.js';
 // ── File-upload client (hook-free) ───────────────────────────────────────────────
 // The one client for mountFileRoutes' upload edge, shared by every consumer (the files
 // plugin, gallery upload buttons, the video editor's save-back) so the header protocol
-// (X-Filename / X-Tags / X-Unlock-Token) and the chunked-vs-streamed decision live in
-// exactly one place. Hook-free like privateClient: plugins hold no upload state.
+// (X-Filename / X-Tags) and the chunked-vs-streamed decision live in exactly one place.
+// Hook-free: plugins hold no upload state.
+//
+// 🔴 There is no private upload any more (task 108, 2026-09-23). `uploadPrivate` PUT to
+// `/_files/upload-private`, a route `cursedbelt-server` deleted with its private-media module
+// (task 00-urgent-24), so the method was a 404 waiting for a caller. It went, with the rest of
+// the private-media client tier, rather than staying as a method that cannot succeed.
 
 /** The FileRecord subset consumers act on after an upload (full shape: server files/types). */
 export type UploadedFile = {
@@ -35,12 +40,6 @@ export interface FileUploadClientConfig {
 export interface FileUploadClient {
   /** Streamed single-PUT public upload. */
   upload(file: File | Blob, opts?: { name?: string; tags?: string[] }): Promise<UploadOutcome>;
-  /** Private (encrypted) upload — pass the unlock token of the already-unlocked session, or a
-   * password for a deniable set; neither ⇒ the standard server-key set. */
-  uploadPrivate(
-    file: File | Blob,
-    opts?: { name?: string; tags?: string[]; unlockToken?: string | null; password?: string },
-  ): Promise<UploadOutcome>;
   /** Overwrite an existing file's bytes in place (same id; tags/collections survive). */
   replace(
     fileId: string,
@@ -163,15 +162,6 @@ export function createFileUploadClient(cfg: FileUploadClientConfig = {}): FileUp
   return {
     upload,
 
-    async uploadPrivate(file, opts) {
-      const headers = commonHeaders(file, opts);
-      if (opts?.unlockToken) headers['X-Unlock-Token'] = opts.unlockToken;
-      else if (opts?.password) headers['X-Private-Password'] = opts.password;
-      return outcome(
-        await doFetch(`${base}/upload-private`, { method: 'PUT', headers, body: file }),
-      );
-    },
-
     async replace(fileId, file, opts) {
       return outcome(
         await doFetch(`${base}/replace/${fileId}`, {

package/src/react/media/hlsSource.ts

@@ -339,7 +339,10 @@ export function attachHlsSource(
             // guidance: calling `recoverMediaError()` twice for the same stall recovers
             // nothing, and the audio-codec swap is what clears the case that keeps recurring.
             if (attempt === 0) hls.recoverMediaError();
-            else hls.swapAudioCodec?.(), hls.recoverMediaError();
+            else {
+              hls.swapAudioCodec?.();
+              hls.recoverMediaError();
+            }
             return;
           }
           if (data.type === Hls.ErrorTypes.NETWORK_ERROR) {

package/src/react/media/index.ts

@@ -145,15 +145,6 @@ export {
   probeMediaDurationFromUrl,
   useMediaDuration,
 } from './mediaProbe.js';
-export { PrivateIndexView } from './PrivateIndexView.js';
-export { PrivateModeBadge, type PrivateModeBadgeProps } from './PrivateModeBadge.js';
-export {
-  type PrivateClientConfig,
-  privateFileUrlWithToken,
-  privateHlsUrlWithToken,
-  revealPrivateWithPassword,
-  revealPrivateWithToken,
-} from './privateClient.js';
 export type {
   ImageEditorMode,
   ImageEditorOperation,
@@ -168,13 +159,6 @@ export type {
 export { type UseAudioPeaksOptions, useAudioPeaks } from './useAudioPeaks.js';
 export { useIntersectionObserver } from './useIntersectionObserver.js';
 export { useObjectUrl } from './useObjectUrl.js';
-export {
-  type PrivateIndexRow,
-  type PrivateUnlock,
-  type RevealedItem,
-  type UsePrivateUnlockOptions,
-  usePrivateUnlock,
-} from './usePrivateUnlock.js';
 // Attaching an adaptive ladder to a bare `<video>` — native HLS first, hls.js second, the
 // progressive remux always. Exported because three surfaces in the fleet drive a plain
 // element rather than Vidstack and each was carrying its own copy of the decision.

package/src/react/sessionAuth.ts

@@ -1,6 +1,6 @@
 // ── Session auth headers (hook-free) ────────────────────────────────────────
 // One source of truth for "turn the browser session into a Bearer header". Plugins
-// that call guarded endpoints (uploads, the private-media client, RPC over fetch)
+// that call guarded endpoints (uploads, RPC over fetch)
 // all need the same header shape; before this they each re-rolled the cookie read.
 //
 // NOTE (genapp-34): a generated app's `session` cookie is now `HttpOnly`, so this
@@ -19,8 +19,7 @@
  *
  * Shaped as a plain function (not a hook) so it can be passed straight to helpers
  * that expect an `authHeaders: () => Record<string, string>` callback
- * (`revealPrivateWithToken`, `privateHlsUrlWithToken`, …) and spread into a
- * `fetch` init's headers.
+ * (`createFileUploadClient`'s, for one) and spread into a `fetch` init's headers.
  */
 export function sessionAuthHeaders(): Record<string, string> {
   const token =