cursedbelt 4.7.0 → 5.0.0

package/src/testing/_noBun.ts

@@ -0,0 +1,12 @@
+// Loaded only on non-Bun runtimes (task 2087). The `cursedbelt/testing` export map routes the
+// real module to Bun (the `bun` condition) and everything else here, so importing these helpers
+// from Node fails with a sentence instead of `Named export 'waitFor' not found` — which is what
+// Node said about `@testing-library/react`, a CommonJS module its ESM loader cannot name-import.
+// Same shape as `cwip/testing`'s `_noBun`, and `tools/proveInstall.ts` excuses exactly this: a
+// `bun` condition plus a plain `Error` of the package's own making.
+throw new Error(
+  'cursedbelt/testing requires the Bun runtime — it drives @testing-library/react under bun:test + happy-dom. ' +
+    'Import it only from specs run with `bun test`.',
+);
+
+export {};

package/src/verifyGraph.spec.ts

@@ -67,6 +67,17 @@ const MUST_RUN = [
 	// added, removing it argues with this list.
 	'typecheck:scripts',
 	'demo:check',
+	// 🔴 Added 2026-09-23 (task 102). `biome lint` was in no command at all — `done:serial`
+	// called a `lint` script that did not exist, so the 31 errors it would have shown sat
+	// unseen. They were cleared in the same landing (29 were in Tailwind's generated output,
+	// now excluded in `biome.jsonc`), so the stage landed green.
+	'lint',
+	// 🔴 Added 2026-09-23 with `no-raw-password` (task 077). This repo's own guardrails scan was
+	// in no command a gate ran, and it had been RED since task 269 gave every relative specifier
+	// its `.js`: `no-native-dialog` stopped recognising DeleteButton's `'../confirm.js'` import
+	// as the belt's own `confirm`. The rules this package ships to five apps were not being
+	// applied to the package itself.
+	'guardrails:report',
 	'styles',
 	'build',
 	'test',

package/dist/react/media/PrivateIndexView.d.ts

@@ -1,6 +0,0 @@
-import React from 'react';
-import type { PrivateUnlock } from './usePrivateUnlock.js';
-export declare function PrivateIndexView({ unlock }: {
-    unlock: PrivateUnlock;
-}): React.JSX.Element;
-//# sourceMappingURL=PrivateIndexView.d.ts.map

package/dist/react/media/PrivateIndexView.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PrivateIndexView.d.ts","sourceRoot":"","sources":["../../../src/react/media/PrivateIndexView.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAS5E,wBAAgB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,qBAmGrE"}

package/dist/react/media/PrivateIndexView.js

@@ -1,44 +0,0 @@
-import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
-import { formatBytes as fmtBytes } from 'cwip/format';
-import React from 'react';
-import { Button } from '../components/Button.js';
-import { Input } from '../components/Input.js';
-// The locked-index cleanup view: every private item's SIZE + created-date (never its title,
-// thumbnail, or notes), so a user can prune media whose password they've lost. A password field
-// runs "try-a-password" — items it decrypts light up with their revealed title; the rest stay
-// opaque. Themed off cursedbelt tokens (with fallbacks so it renders anywhere).
-const fmtDate = (ts) => new Date(ts).toISOString().slice(0, 10);
-export function PrivateIndexView({ unlock }) {
-    const [rows, setRows] = React.useState([]);
-    const [revealed, setRevealed] = React.useState(new Map());
-    const [password, setPassword] = React.useState('');
-    const [trying, setTrying] = React.useState(false);
-    React.useEffect(() => {
-        unlock.loadIndex().then(setRows);
-    }, [unlock]);
-    async function tryPassword() {
-        if (!password)
-            return;
-        setTrying(true);
-        try {
-            const items = await unlock.reveal(password);
-            setRevealed(new Map(items.map((i) => [i.id, i.meta])));
-        }
-        finally {
-            setTrying(false);
-        }
-    }
-    const totalBytes = rows.reduce((s, r) => s + r.sizeBytes, 0);
-    const matchCount = revealed.size;
-    return (_jsxs("div", { className: 'flex flex-col gap-3 text-sm', children: [_jsxs("div", { className: 'flex items-center justify-between gap-3', children: [_jsxs("div", { className: 'text-[color:var(--muted-foreground)]', children: [rows.length, " locked ", rows.length === 1 ? 'file' : 'files', " \u00B7 ", fmtBytes(totalBytes)] }), _jsxs("div", { className: 'flex items-center gap-2', children: [_jsx(Input, { type: 'password', value: password, onChange: (e) => setPassword(e.target.value), onEnter: () => tryPassword(), placeholder: 'Try a password\u2026', "aria-label": 'Try a password', className: 'h-auto w-auto bg-transparent px-2 py-1' }), _jsx(Button, { size: 'sm', onClick: tryPassword, disabled: trying || !password, loading: trying, tooltip: 'Try this password against every locked file', children: trying ? 'Trying…' : 'Reveal' })] })] }), matchCount > 0 ? (_jsxs("div", { className: 'text-[color:var(--accent)]', children: ["This password unlocks ", matchCount, " ", matchCount === 1 ? 'file' : 'files', "."] })) : null, _jsxs("div", { className: 'overflow-hidden rounded-lg border border-[color:var(--border-strong)]', children: [rows.map((r) => {
-                        const meta = revealed.get(r.id);
-                        const title = typeof meta?.title === 'string' ? meta.title : null;
-                        return (_jsxs("div", { className: `flex items-center justify-between gap-3 border-b border-[color:var(--border-strong)] px-3 py-2 last:border-b-0 ${
-                            // `--card-overlay` (white/navy per theme.css) isn't the tint this row wants —
-                            // the original rgba(16,185,129,0.08) fallback was an emerald-accent highlight,
-                            // not the neutral card-overlay token, so build the same tint from the real
-                            // accent token via color-mix instead of a literal fallback color.
-                            title ? 'bg-[color:color-mix(in_srgb,var(--accent-solid)_8%,transparent)]' : ''}`, children: [_jsx("div", { className: 'min-w-0 flex-1 truncate', children: title ? (_jsx("span", { className: 'font-medium text-[color:var(--accent)]', children: title })) : (_jsxs("span", { className: 'font-mono text-[color:var(--muted-foreground)]', children: ["\uD83D\uDD12 ", r.id.slice(0, 8), "\u2026"] })) }), _jsx("div", { className: 'shrink-0 tabular-nums text-[color:var(--muted-foreground)]', children: fmtBytes(r.sizeBytes) }), _jsx("div", { className: 'shrink-0 tabular-nums text-[color:var(--muted-foreground)]', children: fmtDate(r.createdAt) })] }, r.id));
-                    }), rows.length === 0 ? (_jsx("div", { className: 'px-3 py-6 text-center text-[color:var(--muted-foreground)]', children: "No private files." })) : null] })] }));
-}
-//# sourceMappingURL=PrivateIndexView.js.map

package/dist/react/media/PrivateIndexView.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PrivateIndexView.js","sourceRoot":"","sources":["../../../src/react/media/PrivateIndexView.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAG/C,4FAA4F;AAC5F,gGAAgG;AAChG,8FAA8F;AAC9F,gFAAgF;AAEhF,MAAM,OAAO,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEhF,MAAM,UAAU,gBAAgB,CAAC,EAAE,MAAM,EAA6B;IACpE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAoB,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAuC,IAAI,GAAG,EAAE,CAAC,CAAC;IAChG,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEb,KAAK,UAAU,WAAW;QACxB,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,WAAW,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;IAEjC,OAAO,CACL,eAAK,SAAS,EAAC,6BAA6B,aAC1C,eAAK,SAAS,EAAC,yCAAyC,aACtD,eAAK,SAAS,EAAC,sCAAsC,aAClD,IAAI,CAAC,MAAM,cAAU,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,cAAK,QAAQ,CAAC,UAAU,CAAC,IAC/E,EACN,eAAK,SAAS,EAAC,yBAAyB,aACtC,KAAC,KAAK,IACJ,IAAI,EAAC,UAAU,EACf,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAC5B,WAAW,EAAC,sBAAiB,gBAClB,gBAAgB,EAC3B,SAAS,EAAC,wCAAwC,GAClD,EACF,KAAC,MAAM,IACL,IAAI,EAAC,IAAI,EACT,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,EAC7B,OAAO,EAAE,MAAM,EACf,OAAO,EAAC,6CAA6C,YAEpD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GACvB,IACL,IACF,EAEL,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAChB,eAAK,SAAS,EAAC,4BAA4B,uCAClB,UAAU,OAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,SACnE,CACP,CAAC,CAAC,CAAC,IAAI,EAER,eAAK,SAAS,EAAC,uEAAuE,aACnF,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBACd,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAChC,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;wBAClE,OAAO,CACL,eAEE,SAAS,EAAE,kHAAkH;4BAC3H,8EAA8E;4BAC9E,+EAA+E;4BAC/E,2EAA2E;4BAC3E,kEAAkE;4BAClE,KAAK,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,EAC/E,EAAE,aAEF,cAAK,SAAS,EAAC,yBAAyB,YACrC,KAAK,CAAC,CAAC,CAAC,CACP,eAAM,SAAS,EAAC,wCAAwC,YAAE,KAAK,GAAQ,CACxE,CAAC,CAAC,CAAC,CACF,gBAAM,SAAS,EAAC,gDAAgD,8BAC1D,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cACf,CACR,GACG,EACN,cAAK,SAAS,EAAC,4DAA4D,YACxE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAClB,EACN,cAAK,SAAS,EAAC,4DAA4D,YACxE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,GACjB,KAvBD,CAAC,CAAC,EAAE,CAwBL,CACP,CAAC;oBACJ,CAAC,CAAC,EACD,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACnB,cAAK,SAAS,EAAC,4DAA4D,kCAErE,CACP,CAAC,CAAC,CAAC,IAAI,IACJ,IACF,CACP,CAAC;AACJ,CAAC"}

package/dist/react/media/PrivateModeBadge.d.ts

@@ -1,17 +0,0 @@
-export interface PrivateModeBadgeProps {
-    /** How many items are private (shown in the label). */
-    hiddenCount: number;
-    /** Whether the feed is currently filtered to private-only. */
-    active: boolean;
-    /** Toggle the private-only filter. */
-    onToggle: () => void;
-    className?: string;
-}
-/**
- * The "🔓 N private" toggle pill shown in a media gallery's header once private
- * mode is unlocked — click filters the feed to private-only items. One shared
- * implementation for every gallery (video/photo/media); it was previously
- * copy-pasted per plugin with per-plugin CSS classes.
- */
-export declare function PrivateModeBadge({ hiddenCount, active, onToggle, className }: PrivateModeBadgeProps): import("react").JSX.Element;
-//# sourceMappingURL=PrivateModeBadge.d.ts.map

package/dist/react/media/PrivateModeBadge.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PrivateModeBadge.d.ts","sourceRoot":"","sources":["../../../src/react/media/PrivateModeBadge.tsx"],"names":[],"mappings":"AAGA,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,qBAAqB,+BA8BnG"}

package/dist/react/media/PrivateModeBadge.js

@@ -1,24 +0,0 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { cn } from '../lib/cn.js';
-import { Tooltip } from '../components/Tooltip.js';
-/**
- * The "🔓 N private" toggle pill shown in a media gallery's header once private
- * mode is unlocked — click filters the feed to private-only items. One shared
- * implementation for every gallery (video/photo/media); it was previously
- * copy-pasted per plugin with per-plugin CSS classes.
- */
-export function PrivateModeBadge({ hiddenCount, active, onToggle, className }) {
-    return (_jsx(Tooltip, { content: 'Private mode unlocked \u2014 click to show only private items', children: _jsxs("button", { 
-            // guardrails-ignore no-raw-action-button: compact header pill with pressed
-            // state — Button's control-height/variant chrome doesn't fit a badge-sized
-            // toggle; this keeps the exact badge geometry the galleries share.
-            type: 'button', "data-cb-private-badge": '', "aria-pressed": active, onClick: onToggle, className: cn('inline-flex shrink-0 cursor-pointer items-center gap-1 rounded-full border border-border bg-surface px-2.5 py-0.5 text-xs font-medium text-muted-foreground transition-colors', 'hover:border-accent hover:text-foreground', 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring', 
-            // `text-accent-strong`, not plain `text-accent` — the /15 tint only clears
-            // 4.43:1 with the base accent hue, under AA (cbux-101). (Previously
-            // `text-accent-foreground`, a token this library never defines — an
-            // undefined Tailwind color utility compiles to no rule at all, so the
-            // pill silently fell back to inherited text color instead of an
-            // intentional one.)
-            active && 'border-accent bg-accent/15 text-accent-strong', className), children: [_jsx("span", { "aria-hidden": true, children: "\uD83D\uDD13" }), hiddenCount, " private"] }) }));
-}
-//# sourceMappingURL=PrivateModeBadge.js.map

package/dist/react/media/PrivateModeBadge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PrivateModeBadge.js","sourceRoot":"","sources":["../../../src/react/media/PrivateModeBadge.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAYnD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAyB;IAClG,OAAO,CACL,KAAC,OAAO,IAAC,OAAO,EAAC,+DAA0D,YACzE;YACE,2EAA2E;YAC3E,2EAA2E;YAC3E,mEAAmE;YACnE,IAAI,EAAC,QAAQ,2BACS,EAAE,kBACV,MAAM,EACpB,OAAO,EAAE,QAAQ,EACjB,SAAS,EAAE,EAAE,CACX,+KAA+K,EAC/K,2CAA2C,EAC3C,yEAAyE;YACzE,2EAA2E;YAC3E,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,IAAI,+CAA+C,EACzD,SAAS,CACV,aAED,+DAA2B,EAC1B,WAAW,gBACL,GACD,CACX,CAAC;AACJ,CAAC"}

package/dist/react/media/privateClient.d.ts

@@ -1,34 +0,0 @@
-/** A clear index row — non-sensitive facts only (matches the server's PrivateIndexRow). */
-export type PrivateIndexRow = {
-    id: string;
-    sizeBytes: number;
-    createdAt: number;
-    status: 'pending' | 'processing' | 'ready' | 'failed';
-};
-export type RevealedItem = {
-    id: string;
-    meta: Record<string, unknown>;
-};
-export interface PrivateClientConfig {
-    /** Origin+prefix for the private routes. '' = same-origin; an absolute API origin for a
-     * split-origin deploy. */
-    apiBase?: string;
-    /** Route mount prefix (must match mountPrivateRoutes basePath). Default '/_private'. */
-    basePath?: string;
-    /** Extra headers for the GUARDED calls (unlock/index/reveal) — e.g. the app's Bearer. The
-     * token-embedded byte/key URLs need no header. */
-    authHeaders?: () => Record<string, string>;
-}
-export declare const privateBaseUrl: (cfg: PrivateClientConfig) => string;
-/** Try `password` against every item; returns the ones it decrypts (with their metadata). */
-export declare const revealPrivateWithPassword: (cfg: PrivateClientConfig, password: string) => Promise<RevealedItem[]>;
-/** Reveal the items an UNLOCK TOKEN opens — no password re-entry. The token must belong to the
- * session caller (the server enforces it). */
-export declare const revealPrivateWithToken: (cfg: PrivateClientConfig, token: string) => Promise<RevealedItem[]>;
-/** The token-embedded HLS master URL for a private video — same shape usePrivateUnlock.hlsUrl
- * builds. Needs no auth header (the token IS the authorization). */
-export declare const privateHlsUrlWithToken: (cfg: PrivateClientConfig, token: string, sourceId: string, videoId: string) => string;
-/** The token-embedded URL for a private NON-video file (photo/doc) stored as an encrypted
- * blob — served decrypted by the gated blob route. Needs no auth header. */
-export declare const privateFileUrlWithToken: (cfg: PrivateClientConfig, token: string, fileId: string) => string;
-//# sourceMappingURL=privateClient.d.ts.map

package/dist/react/media/privateClient.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"privateClient.d.ts","sourceRoot":"","sources":["../../../src/react/media/privateClient.ts"],"names":[],"mappings":"AAOA,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC;8BAC0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;sDACkD;IAClD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,eAAO,MAAM,cAAc,GAAI,KAAK,mBAAmB,KAAG,MACJ,CAAC;AAwBvD,6FAA6F;AAC7F,eAAO,MAAM,yBAAyB,GACpC,KAAK,mBAAmB,EACxB,UAAU,MAAM,KACf,OAAO,CAAC,YAAY,EAAE,CAA+C,CAAC;AAEzE;8CAC8C;AAC9C,eAAO,MAAM,sBAAsB,GACjC,KAAK,mBAAmB,EACxB,OAAO,MAAM,KACZ,OAAO,CAAC,YAAY,EAAE,CAAqD,CAAC;AAE/E;oEACoE;AACpE,eAAO,MAAM,sBAAsB,GACjC,KAAK,mBAAmB,EACxB,OAAO,MAAM,EACb,UAAU,MAAM,EAChB,SAAS,MAAM,KACd,MAAoF,CAAC;AAExF;4EAC4E;AAC5E,eAAO,MAAM,uBAAuB,GAClC,KAAK,mBAAmB,EACxB,OAAO,MAAM,EACb,QAAQ,MAAM,KACb,MAA4D,CAAC"}

package/dist/react/media/privateClient.js

@@ -1,36 +0,0 @@
-// ── Private-media client helpers (hook-free) ────────────────────────────────────
-// The fetch/URL logic for the private-media routes, usable OUTSIDE React state — the unlock
-// token is held by one component (an unlock plugin) and handed to others (files/gallery
-// plugins) via a cross-plugin port, so consumers of a passed-in token need these standalone
-// helpers rather than their own usePrivateUnlock state. usePrivateUnlock delegates here:
-// one source of truth for the endpoints' shapes.
-export const privateBaseUrl = (cfg) => `${cfg.apiBase ?? ''}${cfg.basePath ?? '/_private'}`;
-const guardedHeaders = (cfg) => ({
-    'content-type': 'application/json',
-    ...(cfg.authHeaders?.() ?? {}),
-});
-const postForItems = async (cfg, path, body) => {
-    const res = await fetch(`${privateBaseUrl(cfg)}${path}`, {
-        method: 'POST',
-        headers: guardedHeaders(cfg),
-        body: JSON.stringify(body),
-        // Split-origin hosts (SPA on the apex, API on a subdomain) authenticate these
-        // guarded calls with the app's httpOnly session cookie.
-        credentials: 'include',
-    });
-    if (!res.ok)
-        return [];
-    return (await res.json()).items ?? [];
-};
-/** Try `password` against every item; returns the ones it decrypts (with their metadata). */
-export const revealPrivateWithPassword = (cfg, password) => postForItems(cfg, '/reveal', { password });
-/** Reveal the items an UNLOCK TOKEN opens — no password re-entry. The token must belong to the
- * session caller (the server enforces it). */
-export const revealPrivateWithToken = (cfg, token) => postForItems(cfg, '/reveal-unlocked', { token });
-/** The token-embedded HLS master URL for a private video — same shape usePrivateUnlock.hlsUrl
- * builds. Needs no auth header (the token IS the authorization). */
-export const privateHlsUrlWithToken = (cfg, token, sourceId, videoId) => `${privateBaseUrl(cfg)}/u/${token}/hls/${sourceId}/${videoId}/master.m3u8`;
-/** The token-embedded URL for a private NON-video file (photo/doc) stored as an encrypted
- * blob — served decrypted by the gated blob route. Needs no auth header. */
-export const privateFileUrlWithToken = (cfg, token, fileId) => `${privateBaseUrl(cfg)}/u/${token}/file/${fileId}`;
-//# sourceMappingURL=privateClient.js.map

package/dist/react/media/privateClient.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"privateClient.js","sourceRoot":"","sources":["../../../src/react/media/privateClient.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,4FAA4F;AAC5F,wFAAwF;AACxF,4FAA4F;AAC5F,yFAAyF;AACzF,iDAAiD;AAuBjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAwB,EAAU,EAAE,CACjE,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;AAEvD,MAAM,cAAc,GAAG,CAAC,GAAwB,EAA0B,EAAE,CAAC,CAAC;IAC5E,cAAc,EAAE,kBAAkB;IAClC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,KAAK,EACxB,GAAwB,EACxB,IAAY,EACZ,IAA6B,EACJ,EAAE;IAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,8EAA8E;QAC9E,wDAAwD;QACxD,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACvB,OAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC,KAAK,IAAI,EAAE,CAAC;AACvE,CAAC,CAAC;AAEF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAwB,EACxB,QAAgB,EACS,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEzE;8CAC8C;AAC9C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAwB,EACxB,KAAa,EACY,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAE/E;oEACoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAwB,EACxB,KAAa,EACb,QAAgB,EAChB,OAAe,EACP,EAAE,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,QAAQ,IAAI,OAAO,cAAc,CAAC;AAExF;4EAC4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,GAAwB,EACxB,KAAa,EACb,MAAc,EACN,EAAE,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC"}

package/dist/react/media/usePrivateUnlock.d.ts

@@ -1,25 +0,0 @@
-import { type PrivateClientConfig, type PrivateIndexRow, type RevealedItem } from './privateClient.js';
-export type { PrivateIndexRow, RevealedItem } from './privateClient.js';
-export type UsePrivateUnlockOptions = PrivateClientConfig;
-export type PrivateUnlock = {
-    token: string | null;
-    mode: 'standard' | 'deniable' | null;
-    busy: boolean;
-    error: string | null;
-    /** Unlock: pass a password for a deniable set, or omit for the standard (server-key) set.
-     * Returns true on success. */
-    unlock(password?: string): Promise<boolean>;
-    /** Drop the token (re-lock). */
-    lock(): void;
-    /** Fetch the clear index (sizes + created-at) for the cleanup view. */
-    loadIndex(): Promise<PrivateIndexRow[]>;
-    /** Try a password against every item; returns the ones it decrypts (with their metadata). */
-    reveal(password: string): Promise<RevealedItem[]>;
-    /** Reveal the items the CURRENT unlock token opens — no password re-entry. Throws when
-     * locked (no token). */
-    revealUnlocked(): Promise<RevealedItem[]>;
-    /** Build the token-embedded HLS master URL for a private video (null when locked). */
-    hlsUrl(sourceId: string, videoId: string): string | null;
-};
-export declare function usePrivateUnlock(opts?: UsePrivateUnlockOptions): PrivateUnlock;
-//# sourceMappingURL=usePrivateUnlock.d.ts.map

package/dist/react/media/usePrivateUnlock.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"usePrivateUnlock.d.ts","sourceRoot":"","sources":["../../../src/react/media/usePrivateUnlock.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAGpB,KAAK,YAAY,EAGlB,MAAM,oBAAoB,CAAC;AAU5B,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAExE,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;IACrC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;kCAC8B;IAC9B,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,gCAAgC;IAChC,IAAI,IAAI,IAAI,CAAC;IACb,uEAAuE;IACvE,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,6FAA6F;IAC7F,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAClD;4BACwB;IACxB,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1C,sFAAsF;IACtF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC1D,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,aAAa,CAuFlF"}

package/dist/react/media/usePrivateUnlock.js

@@ -1,68 +0,0 @@
-import React from 'react';
-import { privateBaseUrl, privateHlsUrlWithToken, revealPrivateWithPassword, revealPrivateWithToken, } from './privateClient.js';
-export function usePrivateUnlock(opts = {}) {
-    const { apiBase, basePath, authHeaders } = opts;
-    const cfg = React.useMemo(() => ({ apiBase, basePath, authHeaders }), [apiBase, basePath, authHeaders]);
-    const base = privateBaseUrl(cfg);
-    const [token, setToken] = React.useState(null);
-    const [mode, setMode] = React.useState(null);
-    const [busy, setBusy] = React.useState(false);
-    const [error, setError] = React.useState(null);
-    const guarded = React.useCallback((extra) => ({
-        'content-type': 'application/json',
-        ...(authHeaders?.() ?? {}),
-        ...extra,
-    }), [authHeaders]);
-    const unlock = React.useCallback(async (password) => {
-        setBusy(true);
-        setError(null);
-        try {
-            const res = await fetch(`${base}/unlock`, {
-                method: 'POST',
-                headers: guarded(),
-                body: JSON.stringify(password ? { password } : {}),
-                // Split-origin hosts authenticate via the app's httpOnly session cookie —
-                // matches postForItems in ./privateClient and createServiceClient.
-                credentials: 'include',
-            });
-            if (!res.ok) {
-                setError('Unlock failed');
-                return false;
-            }
-            const data = (await res.json());
-            setToken(data.token);
-            setMode(data.mode);
-            return true;
-        }
-        catch {
-            setError('Unlock failed');
-            return false;
-        }
-        finally {
-            setBusy(false);
-        }
-    }, [base, guarded]);
-    const lock = React.useCallback(() => {
-        setToken(null);
-        setMode(null);
-    }, []);
-    const loadIndex = React.useCallback(async () => {
-        const res = await fetch(`${base}/index`, { headers: guarded(), credentials: 'include' });
-        if (!res.ok)
-            return [];
-        return (await res.json()).items ?? [];
-    }, [base, guarded]);
-    const reveal = React.useCallback((password) => revealPrivateWithPassword(cfg, password), [cfg]);
-    const revealUnlocked = React.useCallback(() => {
-        if (!token)
-            return Promise.reject(new Error('locked — unlock first'));
-        return revealPrivateWithToken(cfg, token);
-    }, [cfg, token]);
-    const hlsUrl = React.useCallback((sourceId, videoId) => token ? privateHlsUrlWithToken(cfg, token, sourceId, videoId) : null, [cfg, token]);
-    // Memoise the returned object so it's a STABLE reference across renders (the callbacks are
-    // already useCallback-stable; only real state changes flip it). Without this, consumers doing
-    // `useEffect(() => { unlock.loadIndex()… }, [unlock])` would loop — a new object every render
-    // re-runs the effect → setState → re-render → "Maximum update depth exceeded".
-    return React.useMemo(() => ({ token, mode, busy, error, unlock, lock, loadIndex, reveal, revealUnlocked, hlsUrl }), [token, mode, busy, error, unlock, lock, loadIndex, reveal, revealUnlocked, hlsUrl]);
-}
-//# sourceMappingURL=usePrivateUnlock.js.map

package/dist/react/media/usePrivateUnlock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"usePrivateUnlock.js","sourceRoot":"","sources":["../../../src/react/media/usePrivateUnlock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAGL,cAAc,EACd,sBAAsB,EAEtB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAmC5B,MAAM,UAAU,gBAAgB,CAAC,OAAgC,EAAE;IACjE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACvB,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAC1C,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CACjC,CAAC;IACF,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAiC,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAC/B,CAAC,KAA8B,EAA0B,EAAE,CAAC,CAAC;QAC3D,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1B,GAAG,KAAK;KACT,CAAC,EACF,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,KAAK,EAAE,QAAiB,EAAoB,EAAE;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,SAAS,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,EAAE;gBAClB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,0EAA0E;gBAC1E,mEAAmE;gBACnE,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,eAAe,CAAC,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EACD,CAAC,IAAI,EAAE,OAAO,CAAC,CAChB,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAClC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAgC,EAAE;QACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,OAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC1E,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,CAAC,QAAgB,EAA2B,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,EACvF,CAAC,GAAG,CAAC,CACN,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC,GAA4B,EAAE;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACtE,OAAO,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,CAAC,QAAgB,EAAE,OAAe,EAAiB,EAAE,CACnD,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EACtE,CAAC,GAAG,EAAE,KAAK,CAAC,CACb,CAAC;IAEF,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,+EAA+E;IAC/E,OAAO,KAAK,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAC7F,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CACpF,CAAC;AACJ,CAAC"}

package/src/react/media/PrivateIndexView.tsx

@@ -1,113 +0,0 @@
-import { formatBytes as fmtBytes } from 'cwip/format';
-import React from 'react';
-import { Button } from '../components/Button.js';
-import { Input } from '../components/Input.js';
-import type { PrivateIndexRow, PrivateUnlock } from './usePrivateUnlock.js';
-
-// The locked-index cleanup view: every private item's SIZE + created-date (never its title,
-// thumbnail, or notes), so a user can prune media whose password they've lost. A password field
-// runs "try-a-password" — items it decrypts light up with their revealed title; the rest stay
-// opaque. Themed off cursedbelt tokens (with fallbacks so it renders anywhere).
-
-const fmtDate = (ts: number): string => new Date(ts).toISOString().slice(0, 10);
-
-export function PrivateIndexView({ unlock }: { unlock: PrivateUnlock }) {
-  const [rows, setRows] = React.useState<PrivateIndexRow[]>([]);
-  const [revealed, setRevealed] = React.useState<Map<string, Record<string, unknown>>>(new Map());
-  const [password, setPassword] = React.useState('');
-  const [trying, setTrying] = React.useState(false);
-
-  React.useEffect(() => {
-    unlock.loadIndex().then(setRows);
-  }, [unlock]);
-
-  async function tryPassword() {
-    if (!password) return;
-    setTrying(true);
-    try {
-      const items = await unlock.reveal(password);
-      setRevealed(new Map(items.map((i) => [i.id, i.meta])));
-    } finally {
-      setTrying(false);
-    }
-  }
-
-  const totalBytes = rows.reduce((s, r) => s + r.sizeBytes, 0);
-  const matchCount = revealed.size;
-
-  return (
-    <div className='flex flex-col gap-3 text-sm'>
-      <div className='flex items-center justify-between gap-3'>
-        <div className='text-[color:var(--muted-foreground)]'>
-          {rows.length} locked {rows.length === 1 ? 'file' : 'files'} · {fmtBytes(totalBytes)}
-        </div>
-        <div className='flex items-center gap-2'>
-          <Input
-            type='password'
-            value={password}
-            onChange={(e) => setPassword(e.target.value)}
-            onEnter={() => tryPassword()}
-            placeholder='Try a password…'
-            aria-label='Try a password'
-            className='h-auto w-auto bg-transparent px-2 py-1'
-          />
-          <Button
-            size='sm'
-            onClick={tryPassword}
-            disabled={trying || !password}
-            loading={trying}
-            tooltip='Try this password against every locked file'
-          >
-            {trying ? 'Trying…' : 'Reveal'}
-          </Button>
-        </div>
-      </div>
-
-      {matchCount > 0 ? (
-        <div className='text-[color:var(--accent)]'>
-          This password unlocks {matchCount} {matchCount === 1 ? 'file' : 'files'}.
-        </div>
-      ) : null}
-
-      <div className='overflow-hidden rounded-lg border border-[color:var(--border-strong)]'>
-        {rows.map((r) => {
-          const meta = revealed.get(r.id);
-          const title = typeof meta?.title === 'string' ? meta.title : null;
-          return (
-            <div
-              key={r.id}
-              className={`flex items-center justify-between gap-3 border-b border-[color:var(--border-strong)] px-3 py-2 last:border-b-0 ${
-                // `--card-overlay` (white/navy per theme.css) isn't the tint this row wants —
-                // the original rgba(16,185,129,0.08) fallback was an emerald-accent highlight,
-                // not the neutral card-overlay token, so build the same tint from the real
-                // accent token via color-mix instead of a literal fallback color.
-                title ? 'bg-[color:color-mix(in_srgb,var(--accent-solid)_8%,transparent)]' : ''
-              }`}
-            >
-              <div className='min-w-0 flex-1 truncate'>
-                {title ? (
-                  <span className='font-medium text-[color:var(--accent)]'>{title}</span>
-                ) : (
-                  <span className='font-mono text-[color:var(--muted-foreground)]'>
-                    🔒 {r.id.slice(0, 8)}…
-                  </span>
-                )}
-              </div>
-              <div className='shrink-0 tabular-nums text-[color:var(--muted-foreground)]'>
-                {fmtBytes(r.sizeBytes)}
-              </div>
-              <div className='shrink-0 tabular-nums text-[color:var(--muted-foreground)]'>
-                {fmtDate(r.createdAt)}
-              </div>
-            </div>
-          );
-        })}
-        {rows.length === 0 ? (
-          <div className='px-3 py-6 text-center text-[color:var(--muted-foreground)]'>
-            No private files.
-          </div>
-        ) : null}
-      </div>
-    </div>
-  );
-}

package/src/react/media/PrivateModeBadge.tsx

@@ -1,50 +0,0 @@
-import { cn } from '../lib/cn.js';
-import { Tooltip } from '../components/Tooltip.js';
-
-export interface PrivateModeBadgeProps {
-  /** How many items are private (shown in the label). */
-  hiddenCount: number;
-  /** Whether the feed is currently filtered to private-only. */
-  active: boolean;
-  /** Toggle the private-only filter. */
-  onToggle: () => void;
-  className?: string;
-}
-
-/**
- * The "🔓 N private" toggle pill shown in a media gallery's header once private
- * mode is unlocked — click filters the feed to private-only items. One shared
- * implementation for every gallery (video/photo/media); it was previously
- * copy-pasted per plugin with per-plugin CSS classes.
- */
-export function PrivateModeBadge({ hiddenCount, active, onToggle, className }: PrivateModeBadgeProps) {
-  return (
-    <Tooltip content='Private mode unlocked — click to show only private items'>
-      <button
-        // guardrails-ignore no-raw-action-button: compact header pill with pressed
-        // state — Button's control-height/variant chrome doesn't fit a badge-sized
-        // toggle; this keeps the exact badge geometry the galleries share.
-        type='button'
-        data-cb-private-badge=''
-        aria-pressed={active}
-        onClick={onToggle}
-        className={cn(
-          'inline-flex shrink-0 cursor-pointer items-center gap-1 rounded-full border border-border bg-surface px-2.5 py-0.5 text-xs font-medium text-muted-foreground transition-colors',
-          'hover:border-accent hover:text-foreground',
-          'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring',
-          // `text-accent-strong`, not plain `text-accent` — the /15 tint only clears
-          // 4.43:1 with the base accent hue, under AA (cbux-101). (Previously
-          // `text-accent-foreground`, a token this library never defines — an
-          // undefined Tailwind color utility compiles to no rule at all, so the
-          // pill silently fell back to inherited text color instead of an
-          // intentional one.)
-          active && 'border-accent bg-accent/15 text-accent-strong',
-          className,
-        )}
-      >
-        <span aria-hidden>🔓</span>
-        {hiddenCount} private
-      </button>
-    </Tooltip>
-  );
-}

package/src/react/media/privateClient.spec.ts

@@ -1,113 +0,0 @@
-import { afterEach, describe, expect, mock, test } from 'bun:test';
-import { act, renderHook } from '@testing-library/react';
-import {
-  privateHlsUrlWithToken,
-  revealPrivateWithPassword,
-  revealPrivateWithToken,
-} from './privateClient.js';
-import { usePrivateUnlock } from './usePrivateUnlock.js';
-
-// Mock fetch — the helpers are pure client plumbing; assert the request they build and the
-// response shape they return.
-const realFetch = globalThis.fetch;
-type FetchCall = { url: string; init?: RequestInit };
-const mockFetch = (status: number, body: unknown) => {
-  const calls: FetchCall[] = [];
-  globalThis.fetch = mock(async (url: string | URL | Request, init?: RequestInit) => {
-    calls.push({ url: String(url), init });
-    return new Response(JSON.stringify(body), {
-      status,
-      headers: { 'content-type': 'application/json' },
-    });
-  }) as unknown as typeof fetch;
-  return calls;
-};
-
-afterEach(() => {
-  globalThis.fetch = realFetch;
-});
-
-describe('private client helpers (hook-free)', () => {
-  test('revealPrivateWithToken POSTs the token to /reveal-unlocked and returns items', async () => {
-    const items = [{ id: 'a1', meta: { title: 'Alpha' } }];
-    const calls = mockFetch(200, { items });
-
-    const out = await revealPrivateWithToken(
-      { apiBase: 'https://api.example', authHeaders: () => ({ authorization: 'Bearer T' }) },
-      'tok123',
-    );
-    expect(out).toEqual(items);
-    expect(calls[0].url).toBe('https://api.example/_private/reveal-unlocked');
-    expect(calls[0].init?.method).toBe('POST');
-    expect(JSON.parse(calls[0].init?.body as string)).toEqual({ token: 'tok123' });
-    const headers = calls[0].init?.headers as Record<string, string>;
-    expect(headers.authorization).toBe('Bearer T');
-  });
-
-  test('revealPrivateWithPassword POSTs the password to /reveal', async () => {
-    const calls = mockFetch(200, { items: [] });
-    await revealPrivateWithPassword({ basePath: '/_pm' }, 'pw');
-    expect(calls[0].url).toBe('/_pm/reveal');
-    expect(JSON.parse(calls[0].init?.body as string)).toEqual({ password: 'pw' });
-  });
-
-  test('reveal helpers return [] on a non-OK response', async () => {
-    mockFetch(401, { error: 'unauthorized' });
-    expect(await revealPrivateWithToken({}, 'bad')).toEqual([]);
-    expect(await revealPrivateWithPassword({}, 'bad')).toEqual([]);
-  });
-
-  test('privateHlsUrlWithToken builds the token-embedded master URL', () => {
-    expect(privateHlsUrlWithToken({}, 'tok', 'gallery', 'v1')).toBe(
-      '/_private/u/tok/hls/gallery/v1/master.m3u8',
-    );
-    expect(
-      privateHlsUrlWithToken({ apiBase: 'https://api.example', basePath: '/_pm' }, 'tok', 'g', 'v'),
-    ).toBe('https://api.example/_pm/u/tok/hls/g/v/master.m3u8');
-  });
-});
-
-describe('usePrivateUnlock — revealUnlocked', () => {
-  test('rejects while locked (no token)', async () => {
-    const { result } = renderHook(() => usePrivateUnlock());
-    expect(result.current.token).toBeNull();
-    await expect(result.current.revealUnlocked()).rejects.toThrow('locked');
-  });
-
-  test('uses the stored token after unlock and hits /reveal-unlocked', async () => {
-    const items = [{ id: 'x', meta: { title: 'X' } }];
-    const calls: FetchCall[] = [];
-    globalThis.fetch = mock(async (url: string | URL | Request, init?: RequestInit) => {
-      calls.push({ url: String(url), init });
-      const u = String(url);
-      if (u.endsWith('/unlock')) {
-        return Response.json({ token: 'tok-777', mode: 'deniable' });
-      }
-      return Response.json({ items });
-    }) as unknown as typeof fetch;
-
-    const { result } = renderHook(() => usePrivateUnlock());
-    await act(async () => {
-      expect(await result.current.unlock('pw')).toBe(true);
-    });
-    expect(result.current.token).toBe('tok-777');
-
-    const out = await result.current.revealUnlocked();
-    expect(out).toEqual(items);
-    const revealCall = calls.find((c) => c.url.endsWith('/reveal-unlocked'));
-    expect(revealCall).toBeDefined();
-    expect(JSON.parse(revealCall?.init?.body as string)).toEqual({ token: 'tok-777' });
-  });
-
-  test('hlsUrl delegates to privateHlsUrlWithToken (same URL shape)', async () => {
-    globalThis.fetch = mock(async () =>
-      Response.json({ token: 'tok-9', mode: 'standard' }),
-    ) as unknown as typeof fetch;
-    const { result } = renderHook(() => usePrivateUnlock());
-    expect(result.current.hlsUrl('g', 'v')).toBeNull(); // locked
-    await act(async () => {
-      await result.current.unlock();
-    });
-    expect(result.current.hlsUrl('g', 'v')).toBe(privateHlsUrlWithToken({}, 'tok-9', 'g', 'v'));
-  });
-});