cursedbelt 4.7.0 → 5.0.1

package/src/react/lib/zodResolver.spec.ts

@@ -0,0 +1,82 @@
+/**
+ * 🔴 `./zodResolver.ts` must answer EXACTLY what `@hookform/resolvers/zod` answers — it replaced
+ * that package in 5.0.1 so that no consumer has to install it (see the module header for why
+ * every way of depending on it broke somebody). `@hookform/resolvers` stays a devDependency for
+ * one reason: to be the oracle here. Each case runs both resolvers over one schema and one input
+ * and compares the whole result, `ref`s and all.
+ */
+import { describe, expect, test } from 'bun:test';
+import { zodResolver as upstream } from '@hookform/resolvers/zod';
+import type { FieldValues, ResolverOptions } from 'react-hook-form';
+import { z } from 'zod';
+import { zodResolver } from './zodResolver.js';
+
+const options = (over: Partial<ResolverOptions<FieldValues>> = {}): ResolverOptions<FieldValues> =>
+  ({ fields: {}, shouldUseNativeValidation: false, ...over }) as ResolverOptions<FieldValues>;
+
+async function both(schema: z.ZodType, values: FieldValues, opts = options()) {
+  const ours = await zodResolver(schema)(values, undefined, opts);
+  const theirs = await (upstream as unknown as (s: z.ZodType) => typeof zodResolver extends (s: z.ZodType) => infer R ? R : never)(schema)(values, undefined, opts);
+  return { ours, theirs };
+}
+
+const account = z.object({
+  name: z.string().min(2, 'too short'),
+  email: z.email('not an email'),
+  age: z.number().int().min(18, 'adults only'),
+  address: z.object({ city: z.string().min(1, 'city required'), zip: z.string().regex(/^\d{5}$/, 'five digits') }),
+  tags: z.array(z.string().min(1, 'empty tag')).min(1, 'at least one tag'),
+  contact: z.union([z.object({ kind: z.literal('phone'), phone: z.string().min(7, 'phone too short') }), z.object({ kind: z.literal('mail'), mail: z.email('bad mail') })]),
+});
+
+describe('zodResolver matches @hookform/resolvers/zod', () => {
+  test('valid input: parsed output as values, no errors', async () => {
+    const schema = z.object({ n: z.coerce.number(), s: z.string().trim() });
+    const { ours, theirs } = await both(schema, { n: '42', s: '  x  ' });
+    expect(ours).toEqual(theirs);
+    expect(ours.values).toEqual({ n: 42, s: 'x' });
+  });
+
+  test('flat errors', async () => {
+    const { ours, theirs } = await both(account, { name: 'a', email: 'nope', age: 12, address: { city: '', zip: '1' }, tags: [], contact: { kind: 'phone', phone: '1' } });
+    expect(ours).toEqual(theirs);
+    expect(Object.keys(ours.errors).sort()).toEqual(['address', 'age', 'contact', 'email', 'name', 'tags']);
+  });
+
+  test('nested paths and array items nest, not dot-join', async () => {
+    const { ours, theirs } = await both(account, { name: 'ok', email: 'a@b.co', age: 30, address: { city: 'x', zip: 'abc' }, tags: ['a', ''], contact: { kind: 'mail', mail: 'x' } });
+    expect(ours).toEqual(theirs);
+    expect((ours.errors as Record<string, Record<string, unknown>>).address?.zip).toBeDefined();
+  });
+
+  test('criteriaMode "all" collects every failing rule per field', async () => {
+    const schema = z.object({ pw: z.string().min(8, 'eight').regex(/\d/, 'a digit').regex(/[A-Z]/, 'a capital') });
+    const { ours, theirs } = await both(schema, { pw: 'abc' }, options({ criteriaMode: 'all' }));
+    expect(ours).toEqual(theirs);
+    expect(Object.keys((ours.errors as Record<string, { types: object }>).pw?.types ?? {}).length).toBeGreaterThan(0);
+  });
+
+  test('a field-array ROOT error lands on `.root` when its items are registered', async () => {
+    const schema = z.object({ items: z.array(z.object({ v: z.string() })).min(2, 'two please') });
+    const opts = options({ names: ['items.0.v'] });
+    const { ours, theirs } = await both(schema, { items: [{ v: 'a' }] }, opts);
+    expect(ours).toEqual(theirs);
+    expect((ours.errors as Record<string, { root?: unknown }>).items?.root).toBeDefined();
+  });
+
+  test('a field ref is carried onto its error, as react-hook-form focuses it', async () => {
+    const ref = { name: 'name' };
+    const opts = options({ fields: { name: { ref, name: 'name' } } as unknown as ResolverOptions<FieldValues>['fields'] });
+    const { ours, theirs } = await both(account.pick({ name: true }), { name: '' }, opts);
+    expect(ours).toEqual(theirs);
+    expect((ours.errors as Record<string, { ref?: unknown }>).name?.ref).toBe(ref);
+  });
+
+  test('a non-zod throw from the schema is rethrown, by both', async () => {
+    const schema = z.string().transform(() => {
+      throw new TypeError('boom');
+    });
+    await expect(zodResolver(schema)('x' as unknown as FieldValues, undefined, options())).rejects.toThrow('boom');
+    await expect((upstream as unknown as (s: z.ZodType) => ReturnType<typeof zodResolver>)(schema)('x' as unknown as FieldValues, undefined, options())).rejects.toThrow('boom');
+  });
+});

package/src/react/lib/zodResolver.ts

@@ -0,0 +1,136 @@
+import { appendErrors, type FieldError, type FieldErrors, type FieldValues, get, type Resolver, type ResolverOptions, set } from 'react-hook-form';
+import type { z } from 'zod';
+
+/**
+ * 🔴 react-hook-form's zod resolver, owned here instead of imported from `@hookform/resolvers`
+ * (cursedbelt 5.0.1). What that package cost, and why neither way of depending on it worked:
+ *
+ *  · As an optional PEER, `npm install cursedbelt` failed ERESOLVE (task 2087): npm checks an
+ *    optional peer's own peer ranges, and `@hookform/resolvers@5` declares ~25 of them.
+ *  · As `unpeered` (5.0.0), every consumer's clean-install `vite build` failed:
+ *    `Rollup failed to resolve import "@hookform/resolvers/zod"`. Vite stubs a missing import
+ *    only when it is a DECLARED optional peer, and a `import()` with a literal specifier is
+ *    still resolved at build time. Primary checkouts hid it because their `node_modules` still
+ *    held the 4.x copy.
+ *  · A variable specifier (`import(/* @vite-ignore *\/ spec)`) builds, and then fails in the
+ *    BROWSER for every app that does install the package — a bare specifier has nothing to
+ *    resolve it at run time.
+ *
+ * So this is the zod-4 half of `@hookform/resolvers/zod` 5.9.1 and its `toNestErrors` /
+ * `validateFieldsNatively` (MIT, © 2019-present Beier (Bill) Luo), reduced to the one schema
+ * library this package peers on (`zod ^4.4.0`) and the one call shape {@link makeFormConfig}
+ * makes. `react-hook-form` is already a dependency, and supplies `get`, `set` and
+ * `appendErrors`. `zodResolver.spec.ts` pins the behaviours that matter: nested paths, the
+ * closest union branch, `criteriaMode: 'all'`, a field-array root error, and parsed output.
+ */
+
+type Issue = z.core.$ZodIssue;
+
+/** zod 4 marks its errors with a trait, not a prototype chain a bundler could duplicate. */
+function isZodError(error: unknown): error is { issues: Issue[] } {
+  return !!(error as { _zod?: { traits?: Set<string> } } | null)?._zod?.traits?.has('$ZodError');
+}
+
+function parseIssues(input: Issue[], validateAllFieldCriteria: boolean): Record<string, FieldError> {
+  const issues = [...input];
+  // A null prototype, so a field named `toString` or `constructor` is not already "set".
+  const errors: Record<string, FieldError> = Object.create(null);
+  while (issues.length > 0) {
+    const issue = issues[0] as Issue;
+    const { code, message, path } = issue;
+    const key = path.join('.');
+    if (!errors[key]) {
+      if (issue.code === 'invalid_union' && issue.errors.length > 0) {
+        // The branch that came CLOSEST to matching speaks for the union, not the first one.
+        const closest = issue.errors.reduce((best, branch) => (branch.length < best.length ? branch : best));
+        const first = closest[0];
+        errors[key] = { message: first?.message ?? message, type: first?.code ?? code };
+      } else {
+        errors[key] = { message, type: code };
+      }
+    }
+    if (issue.code === 'invalid_union') {
+      for (const branch of issue.errors) for (const nested of branch) issues.push({ ...nested, path: [...issue.path, ...nested.path] } as Issue);
+    }
+    if (validateAllFieldCriteria) {
+      const types = (errors[key] as FieldError).types;
+      const messages = types?.[issue.code];
+      errors[key] = appendErrors(
+        key,
+        validateAllFieldCriteria,
+        errors as Parameters<typeof appendErrors>[2],
+        code,
+        messages ? ([] as string[]).concat(messages as string[], issue.message) : issue.message,
+      ) as FieldError;
+    }
+    issues.shift();
+  }
+  return errors;
+}
+
+type Fields = ResolverOptions<FieldValues>['fields'];
+type NativeRef = { reportValidity?: () => void; setCustomValidity?: (m: string) => void };
+
+function reportNative(ref: unknown, name: string, errors: FieldErrors): void {
+  const el = ref as NativeRef | undefined;
+  if (el && typeof el.reportValidity === 'function' && typeof el.setCustomValidity === 'function') {
+    const error = get(errors, name) as FieldError | undefined;
+    el.setCustomValidity(error?.message || '');
+    el.reportValidity();
+  }
+}
+
+function validateFieldsNatively(errors: FieldErrors, fields: Fields): void {
+  for (const name in fields) {
+    const field = fields[name] as { ref?: unknown; refs?: unknown[] } | undefined;
+    if (field?.ref && typeof (field.ref as NativeRef).reportValidity === 'function') reportNative(field.ref, name, errors);
+    else for (const ref of field?.refs ?? []) reportNative(ref, name, errors);
+  }
+}
+
+/** `a[0].b` and `a.0.b` are one path. */
+const dotted = (name: string): string => name.replace(/\[(\d+)]/g, '.$1').replace(/[[\]]/g, '');
+
+/** Is `name` the ROOT of a field array — some registered name is `name.<index>…`? */
+function isFieldArrayRoot(names: readonly string[], name: string): boolean {
+  const escaped = dotted(name).replace(/[.*+?^${}()|\\]/g, '\\$&');
+  return names.some((n) => new RegExp(`^${escaped}\\.\\d+`).test(dotted(n)));
+}
+
+function toNestErrors<T extends FieldValues>(flat: Record<string, FieldError>, options: ResolverOptions<T>): FieldErrors<T> {
+  if (options.shouldUseNativeValidation) validateFieldsNatively(flat as FieldErrors, options.fields);
+  const nested: Record<string, unknown> = {};
+  for (const path in flat) {
+    const field = get(options.fields, path) as { ref?: unknown; refs?: unknown[] } | undefined;
+    const error = Object.assign(flat[path] || {}, { ref: field?.refs ? field.refs[0] : field?.ref });
+    if (isFieldArrayRoot((options.names as string[] | undefined) ?? Object.keys(flat), path)) {
+      const existing = Object.assign({}, get(nested, path));
+      set(existing, 'root', error);
+      set(nested, path, existing);
+    } else {
+      set(nested, path, error);
+    }
+  }
+  return nested as FieldErrors<T>;
+}
+
+/**
+ * A react-hook-form {@link Resolver} for a zod 4 schema: `parseAsync`, parsed output as the
+ * form's values on success, react-hook-form's nested error shape on a `ZodError`. Anything
+ * else a schema throws is not a validation result and is rethrown.
+ */
+export function zodResolver<TFieldValues extends FieldValues>(schema: z.ZodType): Resolver<TFieldValues> {
+  return async (values, _context, options) => {
+    try {
+      const data = await schema.parseAsync(values);
+      if (options.shouldUseNativeValidation) validateFieldsNatively({}, options.fields);
+      return { errors: {}, values: data as TFieldValues };
+    } catch (error) {
+      if (!isZodError(error)) throw error;
+      return {
+        values: {},
+        errors: toNestErrors(parseIssues(error.issues, !options.shouldUseNativeValidation && options.criteriaMode === 'all'), options),
+      };
+    }
+  };
+}

package/src/react/master-lock/MasterLockDialog.tsx

@@ -28,6 +28,7 @@ import { Button } from "../components/Button.js";
 import { FieldLabel } from "../components/FieldLabel.js";
 import { Input } from "../components/Input.js";
 import { Modal } from "../components/Modal.js";
+import { SecretInput } from "../components/SecretInput.js";
 
 export interface MasterLockDialogProps {
 	open: boolean;
@@ -201,39 +202,42 @@ export function MasterLockDialog({
 					<label htmlFor="ml-current">
 						<FieldLabel>Current master password</FieldLabel>
 					</label>
-					<Input
+					<SecretInput
 						id="ml-current"
-						type="password"
+						label="current master password"
 						autoComplete="current-password"
+						showCopy={false}
 						value={current}
 						disabled={busy}
-						onChange={(event) => setCurrent(event.target.value)}
+						onChange={setCurrent}
 					/>
 				</div>
 				<div className="flex flex-col gap-1.5">
 					<label htmlFor="ml-next">
 						<FieldLabel>New master password</FieldLabel>
 					</label>
-					<Input
+					<SecretInput
 						id="ml-next"
-						type="password"
+						label="new master password"
 						autoComplete="new-password"
+						showCopy={false}
 						value={next}
 						disabled={busy}
-						onChange={(event) => setNext(event.target.value)}
+						onChange={setNext}
 					/>
 				</div>
 				<div className="flex flex-col gap-1.5">
 					<label htmlFor="ml-confirm">
 						<FieldLabel>Repeat the new one</FieldLabel>
 					</label>
-					<Input
+					<SecretInput
 						id="ml-confirm"
-						type="password"
+						label="repeated new master password"
 						autoComplete="new-password"
+						showCopy={false}
 						value={confirm}
 						disabled={busy}
-						onChange={(event) => setConfirm(event.target.value)}
+						onChange={setConfirm}
 						onEnter={() => void changePassword()}
 					/>
 				</div>

package/src/react/master-lock/MasterLockProvider.spec.tsx

@@ -126,3 +126,20 @@ describe("🔴 the rotation never mints a KDF", () => {
 		expect(code).toContain("kdf: MasterLockKdfParams;");
 	});
 });
+
+describe("the account-menu entries (task 106)", () => {
+	test("🔴 'Master passwords…' is a LINK to the accounts page, from the wire, not a string here", async () => {
+		const { MasterLockMenuItems } = await import("./MasterLockProvider.js");
+		const { findByText, getByText } = render(
+			<MasterLockProvider onLocked={() => {}}>
+				<MasterLockMenuItems itemClassName="sam-item" />
+			</MasterLockProvider>,
+		);
+		const link = await findByText("Master passwords…");
+		expect(link.tagName).toBe("A");
+		expect(link.getAttribute("href")).toBe(MASTER_LOCK_PATHS.accounts);
+		expect(link.className).toBe("sam-item");
+		// The idle timeout lives only in the dialog, so its entry stays.
+		expect(getByText("Lock settings…").tagName).toBe("BUTTON");
+	});
+});

package/src/react/master-lock/MasterLockProvider.tsx

@@ -237,31 +237,25 @@ export interface MasterLockMenuItemsProps {
 }
 
 /**
- * The two entries for the account menu — *"a new option in the user dropdown … which is
+ * The entries for the account menu — *"a new option in the user dropdown … which is
  * located near the sign out and switch user options"*. The owner chose that placement
  * deliberately: *"this placement will help make sure it isn't confused with the private
  * collections lock or other locks like that."*
  *
  * Renders nothing when no master password is configured for the app.
  *
- * ── 🔴 The second entry is a LINK now, not a dialog (2026-09-17) ─────────────────────────
- * It used to call {@link MasterLockControl.openSettings}, and that dialog minted a FRESH `kdf`
- * salt on every rotation — the shape the wire had before accounts existed. Every account on an
- * app now derives under ONE shared descriptor, so honouring that salt would store a verifier
- * hash nothing could ever match: the owner sets a new password, the rotation logs him out, and
- * neither the old nor the new one opens the app. `cursedbelt-server`'s guard therefore answers
- * that shape `409 {"error":"stale-client"}` — deliberately distinguishable from a wrong
- * password, because it describes a broken CLIENT. So the entry did not merely look wrong; it
- * refused, and the owner could lock a site and enroll a first password but could not CHANGE one.
+ * ── The second entry is a LINK to the accounts page (task 106, 2026-09-23) ─────────────────
+ * `cursedbelt-server` serves `GET /__lock/accounts` from the same guard that serves the lock
+ * page: server-rendered, listing the accounts and adding, renaming and rotating them. So the
+ * entry is an `<a href>`, not a button — the target is a same-origin page, so there is nothing
+ * for this bundle to open and nothing for it to keep in step — and the path is
+ * `MASTER_LOCK_PATHS.accounts` from `cursedbelt-core`'s wire, never a string here, because a
+ * second copy of the wire in the design system is what `wire.ts`'s header exists to prevent.
  *
- * `cursedbelt-server` serves a richer replacement at `GET /__lock/accounts`, from the same guard
- * that serves the lock page: server-rendered, content-negotiated, listing the accounts and
- * adding/renaming them as well as rotating. This package does NOT link to it yet — the path
- * constant lives in `cursedbelt-core@2`'s wire and this package is still on `^1.1.0`, so the
- * link is a task, not a one-liner (`tasks/Not_Started`, filed 2026-09-17). What IS fixed here
- * is the dialog itself: `MasterLockDialog` no longer mints a salt, so this entry works again
- * rather than 409ing. `apps/collections` links to the page directly from its own rail in the
- * meantime, and says why in a comment there.
+ * The THIRD entry keeps the dialog, because the dialog also owns the idle timeout, which the
+ * accounts page does not. (History: until 2026-09-17 the dialog minted a fresh `kdf` salt on
+ * every rotation and the server refused it `409 stale-client`; it derives under the app's
+ * existing descriptor now, so both surfaces rotate correctly.)
  */
 export function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItemsProps) {
 	const lock = useMasterLock();
@@ -283,6 +277,9 @@ export function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItem
 			>
 				🔒 Lock this site
 			</button>
+			<a href={MASTER_LOCK_PATHS.accounts} className={cls} onClick={() => close?.()}>
+				Master passwords…
+			</a>
 			<button
 				// guardrails-ignore no-raw-action-button: see the sibling above — it must match
 				// the host menu's own rows, not this design system's buttons.
@@ -293,7 +290,7 @@ export function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItem
 					lock.openSettings();
 				}}
 			>
-				Master password…
+				Lock settings…
 			</button>
 		</>
 	);

package/src/react/media/MediaUploadControl.tsx

@@ -1,7 +1,6 @@
 import { Upload } from 'lucide-react';
 import { type ReactNode, useMemo, useRef, useState } from 'react';
 import { Button } from '../components/Button.js';
-import { Checkbox } from '../components/Checkbox.js';
 import { Input } from '../components/Input.js';
 import { cn } from '../lib/cn.js';
 import { createFileUploadClient } from './fileUploadClient.js';
@@ -12,8 +11,8 @@ import { createFileUploadClient } from './fileUploadClient.js';
 // no ENGINE-model consumer, but three shipping plugins render it
 // (`plugin-photo-gallery`, `plugin-video-gallery`, `plugin-media-gallery`), so
 // deleting it would break them. It speaks the legacy chunked `/_files` protocol
-// (`createFileUploadClient` + `createFilesStack`), including the tag list and the
-// X-Unlock-Token private mode that protocol supports.
+// (`createFileUploadClient` + `createFilesStack`), including the tag list. (Its private
+// mode went with the server's private-media module — task 108.)
 //
 // The ENGINE model uploads through `POST /api/asset/vault/upload` — raw bytes,
 // `x-cc-filename`, checksum computed while streaming, content-addressed dedupe —
@@ -25,19 +24,16 @@ import { createFileUploadClient } from './fileUploadClient.js';
 //
 // ── Media upload control ─────────────────────────────────────────────────────────
 // The one "⬆ Upload" affordance media galleries share: a disclosure button opening a
-// compact form — comma-separated tags, a Private toggle (only while an unlock token is
-// present), and a file picker — feeding the shared upload client (chunked-aware, private
-// via X-Unlock-Token). Consumers own only WHERE it sits and what happens after.
+// compact form — comma-separated tags and a file picker — feeding the shared upload client
+// (chunked-aware). Consumers own only WHERE it sits and what happens after.
 
 export interface MediaUploadControlProps {
   /** File-picker accept filter, e.g. "video/*" or "image/*". */
   accept: string;
   /** Mount prefix of the host's file routes (createFilesStack filesBasePath). */
   basePath: string;
-  /** Unlock token while private mode is on — reveals the Private toggle. */
-  privateToken?: string | null;
-  /** After every successful batch: `wasPrivate` says which list to refresh. */
-  onUploaded: (result: { wasPrivate: boolean }) => void;
+  /** After every successful batch. */
+  onUploaded: () => void;
   label?: ReactNode;
   className?: string;
 }
@@ -45,14 +41,12 @@ export interface MediaUploadControlProps {
 export function MediaUploadControl({
   accept,
   basePath,
-  privateToken = null,
   onUploaded,
   label = 'Upload',
   className,
 }: MediaUploadControlProps) {
   const [open, setOpen] = useState(false);
   const [tags, setTags] = useState('');
-  const [asPrivate, setAsPrivate] = useState(false);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const inputRef = useRef<HTMLInputElement>(null);
@@ -62,19 +56,13 @@ export function MediaUploadControl({
   const uploadFiles = async (list: FileList) => {
     setBusy(true);
     setError(null);
-    const wantPrivate = asPrivate && !!privateToken;
     const parsedTags = tags
       .split(',')
       .map((t) => t.trim())
       .filter(Boolean);
     try {
       for (const file of Array.from(list)) {
-        const res = wantPrivate
-          ? await client.uploadPrivate(file, {
-              tags: parsedTags,
-              unlockToken: privateToken,
-            })
-          : await client.uploadAuto(file, { tags: parsedTags });
+        const res = await client.uploadAuto(file, { tags: parsedTags });
         if (!res.ok) {
           setError(res.error);
           return;
@@ -82,8 +70,7 @@ export function MediaUploadControl({
       }
       setOpen(false);
       setTags('');
-      setAsPrivate(false);
-      onUploaded({ wasPrivate: wantPrivate });
+      onUploaded();
     } finally {
       setBusy(false);
     }
@@ -113,14 +100,6 @@ export function MediaUploadControl({
             className='max-w-[200px]'
             aria-label='Upload tags'
           />
-          {privateToken ? (
-            <Checkbox
-              checked={asPrivate}
-              onCheckedChange={(checked) => setAsPrivate(checked === true)}
-              disabled={busy}
-              label='Private'
-            />
-          ) : null}
           <Button
             size='sm'
             disabled={busy}

package/src/react/media/fileUploadClient.ts

@@ -4,8 +4,13 @@ import { sessionAuthHeaders } from '../sessionAuth.js';
 // ── File-upload client (hook-free) ───────────────────────────────────────────────
 // The one client for mountFileRoutes' upload edge, shared by every consumer (the files
 // plugin, gallery upload buttons, the video editor's save-back) so the header protocol
-// (X-Filename / X-Tags / X-Unlock-Token) and the chunked-vs-streamed decision live in
-// exactly one place. Hook-free like privateClient: plugins hold no upload state.
+// (X-Filename / X-Tags) and the chunked-vs-streamed decision live in exactly one place.
+// Hook-free: plugins hold no upload state.
+//
+// 🔴 There is no private upload any more (task 108, 2026-09-23). `uploadPrivate` PUT to
+// `/_files/upload-private`, a route `cursedbelt-server` deleted with its private-media module
+// (task 00-urgent-24), so the method was a 404 waiting for a caller. It went, with the rest of
+// the private-media client tier, rather than staying as a method that cannot succeed.
 
 /** The FileRecord subset consumers act on after an upload (full shape: server files/types). */
 export type UploadedFile = {
@@ -35,12 +40,6 @@ export interface FileUploadClientConfig {
 export interface FileUploadClient {
   /** Streamed single-PUT public upload. */
   upload(file: File | Blob, opts?: { name?: string; tags?: string[] }): Promise<UploadOutcome>;
-  /** Private (encrypted) upload — pass the unlock token of the already-unlocked session, or a
-   * password for a deniable set; neither ⇒ the standard server-key set. */
-  uploadPrivate(
-    file: File | Blob,
-    opts?: { name?: string; tags?: string[]; unlockToken?: string | null; password?: string },
-  ): Promise<UploadOutcome>;
   /** Overwrite an existing file's bytes in place (same id; tags/collections survive). */
   replace(
     fileId: string,
@@ -163,15 +162,6 @@ export function createFileUploadClient(cfg: FileUploadClientConfig = {}): FileUp
   return {
     upload,
 
-    async uploadPrivate(file, opts) {
-      const headers = commonHeaders(file, opts);
-      if (opts?.unlockToken) headers['X-Unlock-Token'] = opts.unlockToken;
-      else if (opts?.password) headers['X-Private-Password'] = opts.password;
-      return outcome(
-        await doFetch(`${base}/upload-private`, { method: 'PUT', headers, body: file }),
-      );
-    },
-
     async replace(fileId, file, opts) {
       return outcome(
         await doFetch(`${base}/replace/${fileId}`, {

package/src/react/media/hlsSource.ts

@@ -339,7 +339,10 @@ export function attachHlsSource(
             // guidance: calling `recoverMediaError()` twice for the same stall recovers
             // nothing, and the audio-codec swap is what clears the case that keeps recurring.
             if (attempt === 0) hls.recoverMediaError();
-            else hls.swapAudioCodec?.(), hls.recoverMediaError();
+            else {
+              hls.swapAudioCodec?.();
+              hls.recoverMediaError();
+            }
             return;
           }
           if (data.type === Hls.ErrorTypes.NETWORK_ERROR) {

package/src/react/media/index.ts

@@ -145,15 +145,6 @@ export {
   probeMediaDurationFromUrl,
   useMediaDuration,
 } from './mediaProbe.js';
-export { PrivateIndexView } from './PrivateIndexView.js';
-export { PrivateModeBadge, type PrivateModeBadgeProps } from './PrivateModeBadge.js';
-export {
-  type PrivateClientConfig,
-  privateFileUrlWithToken,
-  privateHlsUrlWithToken,
-  revealPrivateWithPassword,
-  revealPrivateWithToken,
-} from './privateClient.js';
 export type {
   ImageEditorMode,
   ImageEditorOperation,
@@ -168,13 +159,6 @@ export type {
 export { type UseAudioPeaksOptions, useAudioPeaks } from './useAudioPeaks.js';
 export { useIntersectionObserver } from './useIntersectionObserver.js';
 export { useObjectUrl } from './useObjectUrl.js';
-export {
-  type PrivateIndexRow,
-  type PrivateUnlock,
-  type RevealedItem,
-  type UsePrivateUnlockOptions,
-  usePrivateUnlock,
-} from './usePrivateUnlock.js';
 // Attaching an adaptive ladder to a bare `<video>` — native HLS first, hls.js second, the
 // progressive remux always. Exported because three surfaces in the fleet drive a plain
 // element rather than Vidstack and each was carrying its own copy of the decision.

package/src/react/sessionAuth.ts

@@ -1,6 +1,6 @@
 // ── Session auth headers (hook-free) ────────────────────────────────────────
 // One source of truth for "turn the browser session into a Bearer header". Plugins
-// that call guarded endpoints (uploads, the private-media client, RPC over fetch)
+// that call guarded endpoints (uploads, RPC over fetch)
 // all need the same header shape; before this they each re-rolled the cookie read.
 //
 // NOTE (genapp-34): a generated app's `session` cookie is now `HttpOnly`, so this
@@ -19,8 +19,7 @@
  *
  * Shaped as a plain function (not a hook) so it can be passed straight to helpers
  * that expect an `authHeaders: () => Record<string, string>` callback
- * (`revealPrivateWithToken`, `privateHlsUrlWithToken`, …) and spread into a
- * `fetch` init's headers.
+ * (`createFileUploadClient`'s, for one) and spread into a `fetch` init's headers.
  */
 export function sessionAuthHeaders(): Record<string, string> {
   const token =

package/src/scriptsResolve.spec.ts

@@ -0,0 +1,66 @@
+/**
+ * Every `bun run <x>` a script calls, and every command the app manifest names, is a script
+ * that EXISTS in this `package.json`.
+ *
+ * 🔴 Task 102, 2026-09-18: `done:serial` was `typecheck && lint && test && build`, and there was
+ * no `lint` script — so it had never once reached `test` or `build`, and the 31 lint errors a
+ * `lint` would have shown sat unseen. `format` was named in `cursed.app.extraCommands` too.
+ * Neither was in the gate, which is exactly why nobody noticed; this spec is in the gate.
+ */
+import { describe, expect, it } from 'bun:test';
+import pkg from '../package.json';
+
+const scripts = (pkg as { scripts: Record<string, string> }).scripts;
+
+/** The script names a command line invokes through `bun run` / `npm run`. */
+export function calledScripts(command: string): string[] {
+	const out: string[] = [];
+	for (const m of command.matchAll(/\b(?:bun|npm|pnpm|yarn) run\s+([A-Za-z0-9:_./-]+)/g)) {
+		// A path (`bun run scripts/x.ts`) is a file, not a script name.
+		if (m[1] && !m[1].includes('/') && !/\.[cm]?[jt]sx?$/.test(m[1])) out.push(m[1]);
+	}
+	return out;
+}
+
+describe('package.json scripts resolve', () => {
+	it('reads `bun run <name>` and skips `bun run <file>`', () => {
+		expect(calledScripts('bun run typecheck && bun run lint && bun run scripts/gate.ts')).toEqual([
+			'typecheck',
+			'lint',
+		]);
+	});
+
+	it('🔴 fails on a script that calls one that is not there — the task-102 shape', () => {
+		const fake = { 'done:serial': 'bun run typecheck && bun run lint', typecheck: 'tsc' };
+		const dangling = Object.values(fake)
+			.flatMap(calledScripts)
+			.filter((name) => !(name in fake));
+		expect(dangling).toEqual(['lint']);
+	});
+
+	it('every `bun run <script>` inside a script names a script that exists', () => {
+		const dangling: string[] = [];
+		for (const [name, command] of Object.entries(scripts)) {
+			for (const called of calledScripts(command)) {
+				if (!(called in scripts)) dangling.push(`${name} → ${called}`);
+			}
+		}
+		expect(dangling).toEqual([]);
+	});
+
+	it('every command the `cursed.app` manifest names is a script', () => {
+		const app = (pkg as { cursed?: { app?: Record<string, unknown> } }).cursed?.app ?? {};
+		const named: string[] = [];
+		for (const key of ['commands', 'extraCommands']) {
+			const block = app[key] as Record<string, string> | undefined;
+			if (block) named.push(...Object.values(block));
+		}
+		expect(named.length).toBeGreaterThan(0);
+		expect(named.filter((n) => !(n in scripts))).toEqual([]);
+	});
+
+	it('every gate stage is a script', () => {
+		const stages = (pkg as { gate?: { stages?: { script: string }[] } }).gate?.stages ?? [];
+		expect(stages.map((s) => s.script).filter((n) => !(n in scripts))).toEqual([]);
+	});
+});

package/src/styles-areas/activity-bar.css

@@ -15,7 +15,7 @@
  *
  * An app that imports every area gets exactly what `cursedbelt/styles-utilities.css`
  * emits — proved rule by rule in src/stylesAreas.spec.ts, which is also what fails
- * when this file is stale. 72 candidate(s) scanned.
+ * when this file is stale. 71 candidate(s) scanned.
  *
  * Written by scripts/generateAreaStyles.ts (`bun run styles:areas`), which
  * `bun run build` runs. The map of what is in which area, and why the areas are