cursedbelt 4.6.0 → 5.0.0

package/dist/react/media/privateClient.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"privateClient.d.ts","sourceRoot":"","sources":["../../../src/react/media/privateClient.ts"],"names":[],"mappings":"AAOA,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC;8BAC0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;sDACkD;IAClD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,eAAO,MAAM,cAAc,GAAI,KAAK,mBAAmB,KAAG,MACJ,CAAC;AAwBvD,6FAA6F;AAC7F,eAAO,MAAM,yBAAyB,GACpC,KAAK,mBAAmB,EACxB,UAAU,MAAM,KACf,OAAO,CAAC,YAAY,EAAE,CAA+C,CAAC;AAEzE;8CAC8C;AAC9C,eAAO,MAAM,sBAAsB,GACjC,KAAK,mBAAmB,EACxB,OAAO,MAAM,KACZ,OAAO,CAAC,YAAY,EAAE,CAAqD,CAAC;AAE/E;oEACoE;AACpE,eAAO,MAAM,sBAAsB,GACjC,KAAK,mBAAmB,EACxB,OAAO,MAAM,EACb,UAAU,MAAM,EAChB,SAAS,MAAM,KACd,MAAoF,CAAC;AAExF;4EAC4E;AAC5E,eAAO,MAAM,uBAAuB,GAClC,KAAK,mBAAmB,EACxB,OAAO,MAAM,EACb,QAAQ,MAAM,KACb,MAA4D,CAAC"}

package/dist/react/media/privateClient.js

@@ -1,36 +0,0 @@
-// ── Private-media client helpers (hook-free) ────────────────────────────────────
-// The fetch/URL logic for the private-media routes, usable OUTSIDE React state — the unlock
-// token is held by one component (an unlock plugin) and handed to others (files/gallery
-// plugins) via a cross-plugin port, so consumers of a passed-in token need these standalone
-// helpers rather than their own usePrivateUnlock state. usePrivateUnlock delegates here:
-// one source of truth for the endpoints' shapes.
-export const privateBaseUrl = (cfg) => `${cfg.apiBase ?? ''}${cfg.basePath ?? '/_private'}`;
-const guardedHeaders = (cfg) => ({
-    'content-type': 'application/json',
-    ...(cfg.authHeaders?.() ?? {}),
-});
-const postForItems = async (cfg, path, body) => {
-    const res = await fetch(`${privateBaseUrl(cfg)}${path}`, {
-        method: 'POST',
-        headers: guardedHeaders(cfg),
-        body: JSON.stringify(body),
-        // Split-origin hosts (SPA on the apex, API on a subdomain) authenticate these
-        // guarded calls with the app's httpOnly session cookie.
-        credentials: 'include',
-    });
-    if (!res.ok)
-        return [];
-    return (await res.json()).items ?? [];
-};
-/** Try `password` against every item; returns the ones it decrypts (with their metadata). */
-export const revealPrivateWithPassword = (cfg, password) => postForItems(cfg, '/reveal', { password });
-/** Reveal the items an UNLOCK TOKEN opens — no password re-entry. The token must belong to the
- * session caller (the server enforces it). */
-export const revealPrivateWithToken = (cfg, token) => postForItems(cfg, '/reveal-unlocked', { token });
-/** The token-embedded HLS master URL for a private video — same shape usePrivateUnlock.hlsUrl
- * builds. Needs no auth header (the token IS the authorization). */
-export const privateHlsUrlWithToken = (cfg, token, sourceId, videoId) => `${privateBaseUrl(cfg)}/u/${token}/hls/${sourceId}/${videoId}/master.m3u8`;
-/** The token-embedded URL for a private NON-video file (photo/doc) stored as an encrypted
- * blob — served decrypted by the gated blob route. Needs no auth header. */
-export const privateFileUrlWithToken = (cfg, token, fileId) => `${privateBaseUrl(cfg)}/u/${token}/file/${fileId}`;
-//# sourceMappingURL=privateClient.js.map

package/dist/react/media/privateClient.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"privateClient.js","sourceRoot":"","sources":["../../../src/react/media/privateClient.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,yFAAyF;AACzF,iDAAiD;AAuBjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAwB,EAAU,EAAE,CACjE,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;AAEvD,MAAM,cAAc,GAAG,CAAC,GAAwB,EAA0B,EAAE,CAAC,CAAC;IAC5E,cAAc,EAAE,kBAAkB;IAClC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,KAAK,EACxB,GAAwB,EACxB,IAAY,EACZ,IAA6B,EACJ,EAAE;IAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,8EAA8E;QAC9E,wDAAwD;QACxD,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACvB,OAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC,KAAK,IAAI,EAAE,CAAC;AACvE,CAAC,CAAC;AAEF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAwB,EACxB,QAAgB,EACS,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEzE;8CAC8C;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAwB,EACxB,KAAa,EACY,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAE/E;oEACoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAwB,EACxB,KAAa,EACb,QAAgB,EAChB,OAAe,EACP,EAAE,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,QAAQ,IAAI,OAAO,cAAc,CAAC;AAExF;4EAC4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,GAAwB,EACxB,KAAa,EACb,MAAc,EACN,EAAE,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC"}

package/dist/react/media/usePrivateUnlock.d.ts

@@ -1,25 +0,0 @@
-import { type PrivateClientConfig, type PrivateIndexRow, type RevealedItem } from './privateClient.js';
-export type { PrivateIndexRow, RevealedItem } from './privateClient.js';
-export type UsePrivateUnlockOptions = PrivateClientConfig;
-export type PrivateUnlock = {
-    token: string | null;
-    mode: 'standard' | 'deniable' | null;
-    busy: boolean;
-    error: string | null;
-    /** Unlock: pass a password for a deniable set, or omit for the standard (server-key) set.
-     * Returns true on success. */
-    unlock(password?: string): Promise<boolean>;
-    /** Drop the token (re-lock). */
-    lock(): void;
-    /** Fetch the clear index (sizes + created-at) for the cleanup view. */
-    loadIndex(): Promise<PrivateIndexRow[]>;
-    /** Try a password against every item; returns the ones it decrypts (with their metadata). */
-    reveal(password: string): Promise<RevealedItem[]>;
-    /** Reveal the items the CURRENT unlock token opens — no password re-entry. Throws when
-     * locked (no token). */
-    revealUnlocked(): Promise<RevealedItem[]>;
-    /** Build the token-embedded HLS master URL for a private video (null when locked). */
-    hlsUrl(sourceId: string, videoId: string): string | null;
-};
-export declare function usePrivateUnlock(opts?: UsePrivateUnlockOptions): PrivateUnlock;
-//# sourceMappingURL=usePrivateUnlock.d.ts.map

package/dist/react/media/usePrivateUnlock.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"usePrivateUnlock.d.ts","sourceRoot":"","sources":["../../../src/react/media/usePrivateUnlock.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAGpB,KAAK,YAAY,EAGlB,MAAM,oBAAoB,CAAC;AAU5B,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAExE,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;IACrC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;kCAC8B;IAC9B,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,gCAAgC;IAChC,IAAI,IAAI,IAAI,CAAC;IACb,uEAAuE;IACvE,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,6FAA6F;IAC7F,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAClD;4BACwB;IACxB,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1C,sFAAsF;IACtF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC1D,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,aAAa,CAuFlF"}

package/dist/react/media/usePrivateUnlock.js

@@ -1,68 +0,0 @@
-import React from 'react';
-import { privateBaseUrl, privateHlsUrlWithToken, revealPrivateWithPassword, revealPrivateWithToken, } from './privateClient.js';
-export function usePrivateUnlock(opts = {}) {
-    const { apiBase, basePath, authHeaders } = opts;
-    const cfg = React.useMemo(() => ({ apiBase, basePath, authHeaders }), [apiBase, basePath, authHeaders]);
-    const base = privateBaseUrl(cfg);
-    const [token, setToken] = React.useState(null);
-    const [mode, setMode] = React.useState(null);
-    const [busy, setBusy] = React.useState(false);
-    const [error, setError] = React.useState(null);
-    const guarded = React.useCallback((extra) => ({
-        'content-type': 'application/json',
-        ...(authHeaders?.() ?? {}),
-        ...extra,
-    }), [authHeaders]);
-    const unlock = React.useCallback(async (password) => {
-        setBusy(true);
-        setError(null);
-        try {
-            const res = await fetch(`${base}/unlock`, {
-                method: 'POST',
-                headers: guarded(),
-                body: JSON.stringify(password ? { password } : {}),
-                // Split-origin hosts authenticate via the app's httpOnly session cookie —
-                // matches postForItems in ./privateClient and createServiceClient.
-                credentials: 'include',
-            });
-            if (!res.ok) {
-                setError('Unlock failed');
-                return false;
-            }
-            const data = (await res.json());
-            setToken(data.token);
-            setMode(data.mode);
-            return true;
-        }
-        catch {
-            setError('Unlock failed');
-            return false;
-        }
-        finally {
-            setBusy(false);
-        }
-    }, [base, guarded]);
-    const lock = React.useCallback(() => {
-        setToken(null);
-        setMode(null);
-    }, []);
-    const loadIndex = React.useCallback(async () => {
-        const res = await fetch(`${base}/index`, { headers: guarded(), credentials: 'include' });
-        if (!res.ok)
-            return [];
-        return (await res.json()).items ?? [];
-    }, [base, guarded]);
-    const reveal = React.useCallback((password) => revealPrivateWithPassword(cfg, password), [cfg]);
-    const revealUnlocked = React.useCallback(() => {
-        if (!token)
-            return Promise.reject(new Error('locked — unlock first'));
-        return revealPrivateWithToken(cfg, token);
-    }, [cfg, token]);
-    const hlsUrl = React.useCallback((sourceId, videoId) => token ? privateHlsUrlWithToken(cfg, token, sourceId, videoId) : null, [cfg, token]);
-    // Memoise the returned object so it's a STABLE reference across renders (the callbacks are
-    // already useCallback-stable; only real state changes flip it). Without this, consumers doing
-    // `useEffect(() => { unlock.loadIndex()… }, [unlock])` would loop — a new object every render
-    // re-runs the effect → setState → re-render → "Maximum update depth exceeded".
-    return React.useMemo(() => ({ token, mode, busy, error, unlock, lock, loadIndex, reveal, revealUnlocked, hlsUrl }), [token, mode, busy, error, unlock, lock, loadIndex, reveal, revealUnlocked, hlsUrl]);
-}
-//# sourceMappingURL=usePrivateUnlock.js.map

package/dist/react/media/usePrivateUnlock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"usePrivateUnlock.js","sourceRoot":"","sources":["../../../src/react/media/usePrivateUnlock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAGL,cAAc,EACd,sBAAsB,EAEtB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAmC5B,MAAM,UAAU,gBAAgB,CAAC,OAAgC,EAAE;IACjE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACvB,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAC1C,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CACjC,CAAC;IACF,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAiC,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAC/B,CAAC,KAA8B,EAA0B,EAAE,CAAC,CAAC;QAC3D,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1B,GAAG,KAAK;KACT,CAAC,EACF,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,KAAK,EAAE,QAAiB,EAAoB,EAAE;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,SAAS,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,EAAE;gBAClB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,0EAA0E;gBAC1E,mEAAmE;gBACnE,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,eAAe,CAAC,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EACD,CAAC,IAAI,EAAE,OAAO,CAAC,CAChB,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAClC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAgC,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,OAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC1E,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,CAAC,QAAgB,EAA2B,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,EACvF,CAAC,GAAG,CAAC,CACN,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC,GAA4B,EAAE;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACtE,OAAO,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,CAAC,QAAgB,EAAE,OAAe,EAAiB,EAAE,CACnD,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EACtE,CAAC,GAAG,EAAE,KAAK,CAAC,CACb,CAAC;IAEF,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,+EAA+E;IAC/E,OAAO,KAAK,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAC7F,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CACpF,CAAC;AACJ,CAAC"}

package/src/react/media/PrivateIndexView.tsx

@@ -1,113 +0,0 @@
-import { formatBytes as fmtBytes } from 'cwip/format';
-import React from 'react';
-import { Button } from '../components/Button.js';
-import { Input } from '../components/Input.js';
-import type { PrivateIndexRow, PrivateUnlock } from './usePrivateUnlock.js';
-
-// The locked-index cleanup view: every private item's SIZE + created-date (never its title,
-// thumbnail, or notes), so a user can prune media whose password they've lost. A password field
-// runs "try-a-password" — items it decrypts light up with their revealed title; the rest stay
-// opaque. Themed off cursedbelt tokens (with fallbacks so it renders anywhere).
-
-const fmtDate = (ts: number): string => new Date(ts).toISOString().slice(0, 10);
-
-export function PrivateIndexView({ unlock }: { unlock: PrivateUnlock }) {
-  const [rows, setRows] = React.useState<PrivateIndexRow[]>([]);
-  const [revealed, setRevealed] = React.useState<Map<string, Record<string, unknown>>>(new Map());
-  const [password, setPassword] = React.useState('');
-  const [trying, setTrying] = React.useState(false);
-
-  React.useEffect(() => {
-    unlock.loadIndex().then(setRows);
-  }, [unlock]);
-
-  async function tryPassword() {
-    if (!password) return;
-    setTrying(true);
-    try {
-      const items = await unlock.reveal(password);
-      setRevealed(new Map(items.map((i) => [i.id, i.meta])));
-    } finally {
-      setTrying(false);
-    }
-  }
-
-  const totalBytes = rows.reduce((s, r) => s + r.sizeBytes, 0);
-  const matchCount = revealed.size;
-
-  return (
-    <div className='flex flex-col gap-3 text-sm'>
-      <div className='flex items-center justify-between gap-3'>
-        <div className='text-[color:var(--muted-foreground)]'>
-          {rows.length} locked {rows.length === 1 ? 'file' : 'files'} · {fmtBytes(totalBytes)}
-        </div>
-        <div className='flex items-center gap-2'>
-          <Input
-            type='password'
-            value={password}
-            onChange={(e) => setPassword(e.target.value)}
-            onEnter={() => tryPassword()}
-            placeholder='Try a password…'
-            aria-label='Try a password'
-            className='h-auto w-auto bg-transparent px-2 py-1'
-          />
-          <Button
-            size='sm'
-            onClick={tryPassword}
-            disabled={trying || !password}
-            loading={trying}
-            tooltip='Try this password against every locked file'
-          >
-            {trying ? 'Trying…' : 'Reveal'}
-          </Button>
-        </div>
-      </div>
-
-      {matchCount > 0 ? (
-        <div className='text-[color:var(--accent)]'>
-          This password unlocks {matchCount} {matchCount === 1 ? 'file' : 'files'}.
-        </div>
-      ) : null}
-
-      <div className='overflow-hidden rounded-lg border border-[color:var(--border-strong)]'>
-        {rows.map((r) => {
-          const meta = revealed.get(r.id);
-          const title = typeof meta?.title === 'string' ? meta.title : null;
-          return (
-            <div
-              key={r.id}
-              className={`flex items-center justify-between gap-3 border-b border-[color:var(--border-strong)] px-3 py-2 last:border-b-0 ${
-                // `--card-overlay` (white/navy per theme.css) isn't the tint this row wants —
-                // the original rgba(16,185,129,0.08) fallback was an emerald-accent highlight,
-                // not the neutral card-overlay token, so build the same tint from the real
-                // accent token via color-mix instead of a literal fallback color.
-                title ? 'bg-[color:color-mix(in_srgb,var(--accent-solid)_8%,transparent)]' : ''
-              }`}
-            >
-              <div className='min-w-0 flex-1 truncate'>
-                {title ? (
-                  <span className='font-medium text-[color:var(--accent)]'>{title}</span>
-                ) : (
-                  <span className='font-mono text-[color:var(--muted-foreground)]'>
-                    🔒 {r.id.slice(0, 8)}…
-                  </span>
-                )}
-              </div>
-              <div className='shrink-0 tabular-nums text-[color:var(--muted-foreground)]'>
-                {fmtBytes(r.sizeBytes)}
-              </div>
-              <div className='shrink-0 tabular-nums text-[color:var(--muted-foreground)]'>
-                {fmtDate(r.createdAt)}
-              </div>
-            </div>
-          );
-        })}
-        {rows.length === 0 ? (
-          <div className='px-3 py-6 text-center text-[color:var(--muted-foreground)]'>
-            No private files.
-          </div>
-        ) : null}
-      </div>
-    </div>
-  );
-}

package/src/react/media/PrivateModeBadge.tsx

@@ -1,50 +0,0 @@
-import { cn } from '../lib/cn.js';
-import { Tooltip } from '../components/Tooltip.js';
-
-export interface PrivateModeBadgeProps {
-  /** How many items are private (shown in the label). */
-  hiddenCount: number;
-  /** Whether the feed is currently filtered to private-only. */
-  active: boolean;
-  /** Toggle the private-only filter. */
-  onToggle: () => void;
-  className?: string;
-}
-
-/**
- * The "🔓 N private" toggle pill shown in a media gallery's header once private
- * mode is unlocked — click filters the feed to private-only items. One shared
- * implementation for every gallery (video/photo/media); it was previously
- * copy-pasted per plugin with per-plugin CSS classes.
- */
-export function PrivateModeBadge({ hiddenCount, active, onToggle, className }: PrivateModeBadgeProps) {
-  return (
-    <Tooltip content='Private mode unlocked — click to show only private items'>
-      <button
-        // guardrails-ignore no-raw-action-button: compact header pill with pressed
-        // state — Button's control-height/variant chrome doesn't fit a badge-sized
-        // toggle; this keeps the exact badge geometry the galleries share.
-        type='button'
-        data-cb-private-badge=''
-        aria-pressed={active}
-        onClick={onToggle}
-        className={cn(
-          'inline-flex shrink-0 cursor-pointer items-center gap-1 rounded-full border border-border bg-surface px-2.5 py-0.5 text-xs font-medium text-muted-foreground transition-colors',
-          'hover:border-accent hover:text-foreground',
-          'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring',
-          // `text-accent-strong`, not plain `text-accent` — the /15 tint only clears
-          // 4.43:1 with the base accent hue, under AA (cbux-101). (Previously
-          // `text-accent-foreground`, a token this library never defines — an
-          // undefined Tailwind color utility compiles to no rule at all, so the
-          // pill silently fell back to inherited text color instead of an
-          // intentional one.)
-          active && 'border-accent bg-accent/15 text-accent-strong',
-          className,
-        )}
-      >
-        <span aria-hidden>🔓</span>
-        {hiddenCount} private
-      </button>
-    </Tooltip>
-  );
-}

package/src/react/media/privateClient.spec.ts

@@ -1,113 +0,0 @@
-import { afterEach, describe, expect, mock, test } from 'bun:test';
-import { act, renderHook } from '@testing-library/react';
-import {
-  privateHlsUrlWithToken,
-  revealPrivateWithPassword,
-  revealPrivateWithToken,
-} from './privateClient.js';
-import { usePrivateUnlock } from './usePrivateUnlock.js';
-
-// Mock fetch — the helpers are pure client plumbing; assert the request they build and the
-// response shape they return.
-const realFetch = globalThis.fetch;
-type FetchCall = { url: string; init?: RequestInit };
-const mockFetch = (status: number, body: unknown) => {
-  const calls: FetchCall[] = [];
-  globalThis.fetch = mock(async (url: string | URL | Request, init?: RequestInit) => {
-    calls.push({ url: String(url), init });
-    return new Response(JSON.stringify(body), {
-      status,
-      headers: { 'content-type': 'application/json' },
-    });
-  }) as unknown as typeof fetch;
-  return calls;
-};
-
-afterEach(() => {
-  globalThis.fetch = realFetch;
-});
-
-describe('private client helpers (hook-free)', () => {
-  test('revealPrivateWithToken POSTs the token to /reveal-unlocked and returns items', async () => {
-    const items = [{ id: 'a1', meta: { title: 'Alpha' } }];
-    const calls = mockFetch(200, { items });
-
-    const out = await revealPrivateWithToken(
-      { apiBase: 'https://api.example', authHeaders: () => ({ authorization: 'Bearer T' }) },
-      'tok123',
-    );
-    expect(out).toEqual(items);
-    expect(calls[0].url).toBe('https://api.example/_private/reveal-unlocked');
-    expect(calls[0].init?.method).toBe('POST');
-    expect(JSON.parse(calls[0].init?.body as string)).toEqual({ token: 'tok123' });
-    const headers = calls[0].init?.headers as Record<string, string>;
-    expect(headers.authorization).toBe('Bearer T');
-  });
-
-  test('revealPrivateWithPassword POSTs the password to /reveal', async () => {
-    const calls = mockFetch(200, { items: [] });
-    await revealPrivateWithPassword({ basePath: '/_pm' }, 'pw');
-    expect(calls[0].url).toBe('/_pm/reveal');
-    expect(JSON.parse(calls[0].init?.body as string)).toEqual({ password: 'pw' });
-  });
-
-  test('reveal helpers return [] on a non-OK response', async () => {
-    mockFetch(401, { error: 'unauthorized' });
-    expect(await revealPrivateWithToken({}, 'bad')).toEqual([]);
-    expect(await revealPrivateWithPassword({}, 'bad')).toEqual([]);
-  });
-
-  test('privateHlsUrlWithToken builds the token-embedded master URL', () => {
-    expect(privateHlsUrlWithToken({}, 'tok', 'gallery', 'v1')).toBe(
-      '/_private/u/tok/hls/gallery/v1/master.m3u8',
-    );
-    expect(
-      privateHlsUrlWithToken({ apiBase: 'https://api.example', basePath: '/_pm' }, 'tok', 'g', 'v'),
-    ).toBe('https://api.example/_pm/u/tok/hls/g/v/master.m3u8');
-  });
-});
-
-describe('usePrivateUnlock — revealUnlocked', () => {
-  test('rejects while locked (no token)', async () => {
-    const { result } = renderHook(() => usePrivateUnlock());
-    expect(result.current.token).toBeNull();
-    await expect(result.current.revealUnlocked()).rejects.toThrow('locked');
-  });
-
-  test('uses the stored token after unlock and hits /reveal-unlocked', async () => {
-    const items = [{ id: 'x', meta: { title: 'X' } }];
-    const calls: FetchCall[] = [];
-    globalThis.fetch = mock(async (url: string | URL | Request, init?: RequestInit) => {
-      calls.push({ url: String(url), init });
-      const u = String(url);
-      if (u.endsWith('/unlock')) {
-        return Response.json({ token: 'tok-777', mode: 'deniable' });
-      }
-      return Response.json({ items });
-    }) as unknown as typeof fetch;
-
-    const { result } = renderHook(() => usePrivateUnlock());
-    await act(async () => {
-      expect(await result.current.unlock('pw')).toBe(true);
-    });
-    expect(result.current.token).toBe('tok-777');
-
-    const out = await result.current.revealUnlocked();
-    expect(out).toEqual(items);
-    const revealCall = calls.find((c) => c.url.endsWith('/reveal-unlocked'));
-    expect(revealCall).toBeDefined();
-    expect(JSON.parse(revealCall?.init?.body as string)).toEqual({ token: 'tok-777' });
-  });
-
-  test('hlsUrl delegates to privateHlsUrlWithToken (same URL shape)', async () => {
-    globalThis.fetch = mock(async () =>
-      Response.json({ token: 'tok-9', mode: 'standard' }),
-    ) as unknown as typeof fetch;
-    const { result } = renderHook(() => usePrivateUnlock());
-    expect(result.current.hlsUrl('g', 'v')).toBeNull(); // locked
-    await act(async () => {
-      await result.current.unlock();
-    });
-    expect(result.current.hlsUrl('g', 'v')).toBe(privateHlsUrlWithToken({}, 'tok-9', 'g', 'v'));
-  });
-});

package/src/react/media/privateClient.ts

@@ -1,82 +0,0 @@
-// ── Private-media client helpers (hook-free) ────────────────────────────────────
-// The fetch/URL logic for the private-media routes, usable OUTSIDE React state — the unlock
-// token is held by one component (an unlock plugin) and handed to others (files/gallery
-// plugins) via a cross-plugin port, so consumers of a passed-in token need these standalone
-// helpers rather than their own usePrivateUnlock state. usePrivateUnlock delegates here:
-// one source of truth for the endpoints' shapes.
-
-/** A clear index row — non-sensitive facts only (matches the server's PrivateIndexRow). */
-export type PrivateIndexRow = {
-  id: string;
-  sizeBytes: number;
-  createdAt: number;
-  status: 'pending' | 'processing' | 'ready' | 'failed';
-};
-
-export type RevealedItem = { id: string; meta: Record<string, unknown> };
-
-export interface PrivateClientConfig {
-  /** Origin+prefix for the private routes. '' = same-origin; an absolute API origin for a
-   * split-origin deploy. */
-  apiBase?: string;
-  /** Route mount prefix (must match mountPrivateRoutes basePath). Default '/_private'. */
-  basePath?: string;
-  /** Extra headers for the GUARDED calls (unlock/index/reveal) — e.g. the app's Bearer. The
-   * token-embedded byte/key URLs need no header. */
-  authHeaders?: () => Record<string, string>;
-}
-
-export const privateBaseUrl = (cfg: PrivateClientConfig): string =>
-  `${cfg.apiBase ?? ''}${cfg.basePath ?? '/_private'}`;
-
-const guardedHeaders = (cfg: PrivateClientConfig): Record<string, string> => ({
-  'content-type': 'application/json',
-  ...(cfg.authHeaders?.() ?? {}),
-});
-
-const postForItems = async (
-  cfg: PrivateClientConfig,
-  path: string,
-  body: Record<string, unknown>,
-): Promise<RevealedItem[]> => {
-  const res = await fetch(`${privateBaseUrl(cfg)}${path}`, {
-    method: 'POST',
-    headers: guardedHeaders(cfg),
-    body: JSON.stringify(body),
-    // Split-origin hosts (SPA on the apex, API on a subdomain) authenticate these
-    // guarded calls with the app's httpOnly session cookie.
-    credentials: 'include',
-  });
-  if (!res.ok) return [];
-  return ((await res.json()) as { items: RevealedItem[] }).items ?? [];
-};
-
-/** Try `password` against every item; returns the ones it decrypts (with their metadata). */
-export const revealPrivateWithPassword = (
-  cfg: PrivateClientConfig,
-  password: string,
-): Promise<RevealedItem[]> => postForItems(cfg, '/reveal', { password });
-
-/** Reveal the items an UNLOCK TOKEN opens — no password re-entry. The token must belong to the
- * session caller (the server enforces it). */
-export const revealPrivateWithToken = (
-  cfg: PrivateClientConfig,
-  token: string,
-): Promise<RevealedItem[]> => postForItems(cfg, '/reveal-unlocked', { token });
-
-/** The token-embedded HLS master URL for a private video — same shape usePrivateUnlock.hlsUrl
- * builds. Needs no auth header (the token IS the authorization). */
-export const privateHlsUrlWithToken = (
-  cfg: PrivateClientConfig,
-  token: string,
-  sourceId: string,
-  videoId: string,
-): string => `${privateBaseUrl(cfg)}/u/${token}/hls/${sourceId}/${videoId}/master.m3u8`;
-
-/** The token-embedded URL for a private NON-video file (photo/doc) stored as an encrypted
- * blob — served decrypted by the gated blob route. Needs no auth header. */
-export const privateFileUrlWithToken = (
-  cfg: PrivateClientConfig,
-  token: string,
-  fileId: string,
-): string => `${privateBaseUrl(cfg)}/u/${token}/file/${fileId}`;

package/src/react/media/usePrivateUnlock.ts

@@ -1,132 +0,0 @@
-import React from 'react';
-import {
-  type PrivateClientConfig,
-  type PrivateIndexRow,
-  privateBaseUrl,
-  privateHlsUrlWithToken,
-  type RevealedItem,
-  revealPrivateWithPassword,
-  revealPrivateWithToken,
-} from './privateClient.js';
-
-// ── usePrivateUnlock ────────────────────────────────────────────────────────────
-// The client state machine for encrypted private media. It drives the cursedbelt-server
-// private-media routes: unlock (get a token sealing the set key), the clear index (sizes only,
-// for cleanup), try-a-password reveal, and building the token-embedded HLS URL a player loads.
-// UI-agnostic — a modal / index view / gallery toggle all consume this one hook. The fetch/URL
-// shapes live in ./privateClient (hook-free) so a component holding a PASSED-IN token (via a
-// cross-plugin port) can call the same endpoints without this hook's state.
-
-export type { PrivateIndexRow, RevealedItem } from './privateClient.js';
-
-export type UsePrivateUnlockOptions = PrivateClientConfig;
-
-export type PrivateUnlock = {
-  token: string | null;
-  mode: 'standard' | 'deniable' | null;
-  busy: boolean;
-  error: string | null;
-  /** Unlock: pass a password for a deniable set, or omit for the standard (server-key) set.
-   * Returns true on success. */
-  unlock(password?: string): Promise<boolean>;
-  /** Drop the token (re-lock). */
-  lock(): void;
-  /** Fetch the clear index (sizes + created-at) for the cleanup view. */
-  loadIndex(): Promise<PrivateIndexRow[]>;
-  /** Try a password against every item; returns the ones it decrypts (with their metadata). */
-  reveal(password: string): Promise<RevealedItem[]>;
-  /** Reveal the items the CURRENT unlock token opens — no password re-entry. Throws when
-   * locked (no token). */
-  revealUnlocked(): Promise<RevealedItem[]>;
-  /** Build the token-embedded HLS master URL for a private video (null when locked). */
-  hlsUrl(sourceId: string, videoId: string): string | null;
-};
-
-export function usePrivateUnlock(opts: UsePrivateUnlockOptions = {}): PrivateUnlock {
-  const { apiBase, basePath, authHeaders } = opts;
-  const cfg = React.useMemo<PrivateClientConfig>(
-    () => ({ apiBase, basePath, authHeaders }),
-    [apiBase, basePath, authHeaders],
-  );
-  const base = privateBaseUrl(cfg);
-  const [token, setToken] = React.useState<string | null>(null);
-  const [mode, setMode] = React.useState<'standard' | 'deniable' | null>(null);
-  const [busy, setBusy] = React.useState(false);
-  const [error, setError] = React.useState<string | null>(null);
-
-  const guarded = React.useCallback(
-    (extra?: Record<string, string>): Record<string, string> => ({
-      'content-type': 'application/json',
-      ...(authHeaders?.() ?? {}),
-      ...extra,
-    }),
-    [authHeaders],
-  );
-
-  const unlock = React.useCallback(
-    async (password?: string): Promise<boolean> => {
-      setBusy(true);
-      setError(null);
-      try {
-        const res = await fetch(`${base}/unlock`, {
-          method: 'POST',
-          headers: guarded(),
-          body: JSON.stringify(password ? { password } : {}),
-          // Split-origin hosts authenticate via the app's httpOnly session cookie —
-          // matches postForItems in ./privateClient and createServiceClient.
-          credentials: 'include',
-        });
-        if (!res.ok) {
-          setError('Unlock failed');
-          return false;
-        }
-        const data = (await res.json()) as { token: string; mode: 'standard' | 'deniable' };
-        setToken(data.token);
-        setMode(data.mode);
-        return true;
-      } catch {
-        setError('Unlock failed');
-        return false;
-      } finally {
-        setBusy(false);
-      }
-    },
-    [base, guarded],
-  );
-
-  const lock = React.useCallback(() => {
-    setToken(null);
-    setMode(null);
-  }, []);
-
-  const loadIndex = React.useCallback(async (): Promise<PrivateIndexRow[]> => {
-    const res = await fetch(`${base}/index`, { headers: guarded(), credentials: 'include' });
-    if (!res.ok) return [];
-    return ((await res.json()) as { items: PrivateIndexRow[] }).items ?? [];
-  }, [base, guarded]);
-
-  const reveal = React.useCallback(
-    (password: string): Promise<RevealedItem[]> => revealPrivateWithPassword(cfg, password),
-    [cfg],
-  );
-
-  const revealUnlocked = React.useCallback((): Promise<RevealedItem[]> => {
-    if (!token) return Promise.reject(new Error('locked — unlock first'));
-    return revealPrivateWithToken(cfg, token);
-  }, [cfg, token]);
-
-  const hlsUrl = React.useCallback(
-    (sourceId: string, videoId: string): string | null =>
-      token ? privateHlsUrlWithToken(cfg, token, sourceId, videoId) : null,
-    [cfg, token],
-  );
-
-  // Memoise the returned object so it's a STABLE reference across renders (the callbacks are
-  // already useCallback-stable; only real state changes flip it). Without this, consumers doing
-  // `useEffect(() => { unlock.loadIndex()… }, [unlock])` would loop — a new object every render
-  // re-runs the effect → setState → re-render → "Maximum update depth exceeded".
-  return React.useMemo(
-    () => ({ token, mode, busy, error, unlock, lock, loadIndex, reveal, revealUnlocked, hlsUrl }),
-    [token, mode, busy, error, unlock, lock, loadIndex, reveal, revealUnlocked, hlsUrl],
-  );
-}