@pellux/goodvibes-tui 0.25.0 → 0.26.0

package/src/daemon/{channels → handlers}/drafts/draft-store.ts

@@ -1,9 +1,9 @@
-import { OperatorSqliteStore } from '../../operator/index.ts';
-import type { AtRestCipher } from '../../operator/index.ts';
-import { redactWebhook, sha256First } from '../../operator/index.ts';
+import { createHash } from 'node:crypto';
+import type { AtRestCipher } from '../credentials.ts';
+import { HandlerSqliteStore } from '../sqlite-store.ts';
 
 // ---------------------------------------------------------------------------
-// Draft Sync Backend store.
+// Draft Sync Backend store (rebased onto the daemon handler foundation).
 //
 // Mirrors the agent's local draft store (channels/drafts.json) server-side so
 // drafts are visible across surfaces. The agent's local file remains the source
@@ -13,15 +13,27 @@ import { redactWebhook, sha256First } from '../../operator/index.ts';
 //
 // SECURITY POSTURE:
 //   - The plaintext message body is NEVER persisted. It is encrypted at rest
-//     via the daemon at-rest cipher (AES-256-GCM) and stored as `bodyEnc`.
+//     via the daemon at-rest cipher (AES-256-GCM) as `bodyEnc`.
 //   - The webhook URL is encrypted at rest (`webhookEnc`) and is ALWAYS
 //     redacted ('[redacted]') in every list/get response — the raw URL never
 //     leaves the store.
 //   - `messageDigest` (sha256First(body, 12)) is computed at save time and
-//     stored alongside, so reads never need to decrypt the body. The raw body
-//     is never included in any response — only the digest.
+//     stored alongside, so reads never need to decrypt the body. The required
+//     `message` field of every emitted record carries the DIGEST, never the
+//     plaintext body.
 // ---------------------------------------------------------------------------
 
+/** SHA-256 of `input`, truncated to the first `hexChars` hex characters. */
+export function sha256First(input: string, hexChars: number): string {
+  const digest = createHash('sha256').update(input, 'utf-8').digest('hex');
+  return digest.slice(0, Math.max(0, hexChars));
+}
+
+/** Redact a stored webhook for responses: present → '[redacted]', else undefined. */
+export function redactWebhook(value?: string | null): string | undefined {
+  return value === undefined || value === null || value === '' ? undefined : '[redacted]';
+}
+
 export type DraftStatus = 'draft' | 'queued' | 'sent' | 'failed';
 
 /** Statuses callers are permitted to write via save(). */
@@ -36,21 +48,25 @@ export const ALL_DRAFT_STATUSES: readonly DraftStatus[] = [
 ];
 
 export const DRAFT_MESSAGE_DIGEST_HEX = 12;
-
+export const DEFAULT_DRAFT_VERSION = 1;
 export const DEFAULT_DRAFT_LIST_LIMIT = 50;
 export const MAX_DRAFT_LIST_LIMIT = 200;
 
 /**
- * Public draft record returned by list/get. The plaintext body is NEVER
- * present — only `messageDigest`. `webhook` is always '[redacted]' when set.
+ * Public draft record returned by list/get/save. Matches the SDK
+ * CHANNEL_DRAFT_SCHEMA: the required `message` field carries the message
+ * DIGEST (never the plaintext body). `webhook` is always '[redacted]' when set.
+ * `messageDigest` is emitted ONLY by `get` (whose output schema permits
+ * additional properties); strict list/save records omit it.
  */
 export interface DraftRecord {
+  version: number;
   id: string;
   createdAt: string; // ISO-8601
   updatedAt: string; // ISO-8601
   status: DraftStatus;
+  message: string; // sha256First(body, 12) digest — plaintext body is NEVER transmitted
   title?: string;
-  messageDigest: string; // sha256First(body, 12) — body is NOT transmitted
   channel?: string;
   route?: string;
   webhook?: string; // '[redacted]' when a webhook is stored, else omitted
@@ -60,9 +76,10 @@ export interface DraftRecord {
   sendError?: string;
 }
 
-/** Normalized input accepted by upsert(). */
+/** Normalized input accepted by upsert(). `message` is the FULL plaintext body. */
 export interface DraftSaveInput {
   id?: string;
+  version?: number;
   title?: string;
   message: string;
   channel?: string;
@@ -71,13 +88,11 @@ export interface DraftSaveInput {
   link?: string;
   tags?: string[];
   status?: DraftStatus;
+  createdAt?: string;
   /**
    * Caller-supplied last-modified timestamp (ISO-8601). When provided it is
-   * persisted verbatim, enabling the sync contract's conflict model ('on
-   * conflict, most recent updatedAt wins') to be expressed through this store:
-   * an integrator can push the agent's authoritative updatedAt rather than
-   * having it overwritten by daemon-local time. When omitted, the store stamps
-   * updatedAt = now().
+   * persisted verbatim, enabling the sync contract's 'most recent updatedAt
+   * wins' conflict model; when omitted the store stamps updatedAt = now().
    */
   updatedAt?: string;
 }
@@ -88,7 +103,7 @@ export interface DraftListQuery {
 }
 
 export interface DraftSaveResult {
-  id: string;
+  draft: DraftRecord;
   created: boolean;
 }
 
@@ -106,6 +121,7 @@ export interface DraftSyncStoreOptions {
 const SCHEMA: string[] = [
   `CREATE TABLE IF NOT EXISTS drafts (
      id TEXT PRIMARY KEY,
+     version INTEGER NOT NULL,
      createdAt TEXT NOT NULL,
      updatedAt TEXT NOT NULL,
      status TEXT NOT NULL,
@@ -126,6 +142,7 @@ const SCHEMA: string[] = [
 
 interface DraftRow {
   id: string;
+  version: number;
   createdAt: string;
   updatedAt: string;
   status: string;
@@ -162,19 +179,25 @@ function normalizeStatus(status: DraftStatus | undefined): DraftStatus {
   return status ?? 'draft';
 }
 
+function normalizeVersion(version: number | undefined): number {
+  if (version === undefined || !Number.isFinite(version)) return DEFAULT_DRAFT_VERSION;
+  const floored = Math.floor(version);
+  return floored < 1 ? DEFAULT_DRAFT_VERSION : floored;
+}
+
 /**
- * Server-side mirror of agent drafts. Wraps OperatorSqliteStore; all body and
+ * Server-side mirror of agent drafts. Wraps HandlerSqliteStore; all body and
  * webhook material is encrypted at rest via the injected AtRestCipher.
  */
 export class DraftSyncStore {
-  private readonly store: OperatorSqliteStore;
+  private readonly store: HandlerSqliteStore;
   private readonly cipher: AtRestCipher;
   private readonly generateId: () => string;
   private readonly now: () => string;
   private initialized = false;
 
   constructor(options: DraftSyncStoreOptions) {
-    this.store = new OperatorSqliteStore({
+    this.store = new HandlerSqliteStore({
       workingDirectory: options.workingDirectory,
       fileName: options.fileName ?? 'drafts.sqlite',
       schema: SCHEMA,
@@ -206,34 +229,26 @@ export class DraftSyncStore {
 
   /**
    * Create (no id) or update (id present) a draft. Encrypts the body and
-   * webhook at rest, computes messageDigest, and sets updatedAt to the
-   * caller-supplied input.updatedAt when present (enabling the 'most recent
-   * updatedAt wins' conflict model) or now() otherwise. On update, createdAt is
-   * preserved from the existing row.
+   * webhook at rest, computes messageDigest, preserves createdAt on update, and
+   * sets updatedAt to input.updatedAt when present (enabling 'most recent
+   * updatedAt wins') or now() otherwise.
    *
    * FULL-REPLACE SEMANTICS (intentional, per the full-snapshot sync contract):
-   * every caller-supplied field is treated as a complete snapshot, NOT a partial
-   * patch. The ON CONFLICT UPDATE SET clause below assigns each column from the
-   * incoming row (excluded.*), so on update an OMITTED optional field is cleared,
-   * not preserved. Concretely: omitting `webhook` clears any previously-stored
-   * webhook (webhookEnc -> NULL); omitting `tags` removes them (tags -> NULL);
-   * the same applies to title/channel/route/link. Callers performing a partial
-   * edit MUST re-supply every field they want to keep. The ONLY exceptions are
-   * sentResponseId/sendError, which are owned by the send pipeline and are
-   * deliberately omitted from the UPDATE SET clause so they survive a save().
-   *
-   * NOTE: caller is responsible for store.save() after a batch of mutations,
-   * or this can be invoked through DraftSyncStore.save(). The register layer
-   * saves after every mutation.
+   * every caller-supplied field is a complete snapshot, NOT a partial patch.
+   * The ON CONFLICT UPDATE SET clause assigns each column from the incoming row,
+   * so an OMITTED optional field is CLEARED on update (webhookEnc/tags/title/
+   * channel/route/link → NULL). The ONLY exceptions are sentResponseId/
+   * sendError, which are owned by the send pipeline and survive a save().
    */
   async upsert(input: DraftSaveInput): Promise<DraftSaveResult> {
     const existing = input.id !== undefined ? this.getRow(input.id) : null;
     const created = existing === null;
     const id = existing?.id ?? input.id ?? this.generateId();
     const timestamp = this.now();
-    const createdAt = existing?.createdAt ?? timestamp;
+    const createdAt = existing?.createdAt ?? input.createdAt ?? timestamp;
     const updatedAt = input.updatedAt ?? timestamp;
     const status = normalizeStatus(input.status);
+    const version = normalizeVersion(input.version);
 
     const bodyEnc = await this.cipher.encrypt(input.message);
     const messageDigest = sha256First(input.message, DRAFT_MESSAGE_DIGEST_HEX);
@@ -248,10 +263,11 @@ export class DraftSyncStore {
 
     this.store.run(
       `INSERT INTO drafts (
-         id, createdAt, updatedAt, status, title, bodyEnc, messageDigest,
+         id, version, createdAt, updatedAt, status, title, bodyEnc, messageDigest,
          channel, route, webhookEnc, link, tags, sentResponseId, sendError
-       ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+       ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
        ON CONFLICT(id) DO UPDATE SET
+         version = excluded.version,
          updatedAt = excluded.updatedAt,
          status = excluded.status,
          title = excluded.title,
@@ -264,6 +280,7 @@ export class DraftSyncStore {
          tags = excluded.tags`,
       [
         id,
+        version,
         createdAt,
         updatedAt,
         status,
@@ -276,14 +293,14 @@ export class DraftSyncStore {
         nullable(input.link),
         tagsJson,
         // sentResponseId / sendError are owned by the send pipeline, not save().
-        // On update they are preserved (omitted from the UPDATE SET clause); on
-        // insert they default to NULL.
+        // On update they are preserved (omitted from UPDATE SET); on insert NULL.
         null,
         null,
       ],
     );
 
-    return { id, created };
+    const row = this.getRow(id);
+    return { draft: toRecord(row ?? this.fallbackRow(id, version, createdAt, updatedAt, status, messageDigest, webhookEnc, input)), created };
   }
 
   /** List drafts, newest-updated first, optionally filtered by status. */
@@ -292,13 +309,13 @@ export class DraftSyncStore {
     const rows =
       query.status !== undefined
         ? this.store.all<DraftRow>(
-            `SELECT id, createdAt, updatedAt, status, title, messageDigest,
+            `SELECT id, version, createdAt, updatedAt, status, title, messageDigest,
                     channel, route, webhookEnc, link, tags, sentResponseId, sendError
              FROM drafts WHERE status = ? ORDER BY updatedAt DESC, id ASC LIMIT ?`,
             [query.status, limit],
           )
         : this.store.all<DraftRow>(
-            `SELECT id, createdAt, updatedAt, status, title, messageDigest,
+            `SELECT id, version, createdAt, updatedAt, status, title, messageDigest,
                     channel, route, webhookEnc, link, tags, sentResponseId, sendError
              FROM drafts ORDER BY updatedAt DESC, id ASC LIMIT ?`,
             [limit],
@@ -306,6 +323,15 @@ export class DraftSyncStore {
     return rows.map((row) => toRecord(row));
   }
 
+  /** Total number of stored drafts (optionally status-filtered). */
+  count(status?: DraftStatus): number {
+    const row =
+      status !== undefined
+        ? this.store.get<{ n: number }>('SELECT COUNT(*) AS n FROM drafts WHERE status = ?', [status])
+        : this.store.get<{ n: number }>('SELECT COUNT(*) AS n FROM drafts');
+    return row?.n ?? 0;
+  }
+
   /** Fetch a single draft as a redacted record, or null when absent. */
   get(id: string): DraftRecord | null {
     const row = this.getRow(id);
@@ -323,12 +349,45 @@ export class DraftSyncStore {
 
   private getRow(id: string): DraftRow | null {
     return this.store.get<DraftRow>(
-      `SELECT id, createdAt, updatedAt, status, title, messageDigest,
+      `SELECT id, version, createdAt, updatedAt, status, title, messageDigest,
               channel, route, webhookEnc, link, tags, sentResponseId, sendError
        FROM drafts WHERE id = ?`,
       [id],
     );
   }
+
+  // Defensive synthesis if a read-back ever returns null (should not happen for
+  // the row we just wrote); keeps upsert total even under a degraded backend.
+  private fallbackRow(
+    id: string,
+    version: number,
+    createdAt: string,
+    updatedAt: string,
+    status: DraftStatus,
+    messageDigest: string,
+    webhookEnc: string | null,
+    input: DraftSaveInput,
+  ): DraftRow {
+    return {
+      id,
+      version,
+      createdAt,
+      updatedAt,
+      status,
+      title: nullable(input.title),
+      messageDigest,
+      channel: nullable(input.channel),
+      route: nullable(input.route),
+      webhookEnc,
+      link: nullable(input.link),
+      tags:
+        input.tags !== undefined && input.tags.length > 0
+          ? JSON.stringify(input.tags)
+          : null,
+      sentResponseId: null,
+      sendError: null,
+    };
+  }
 }
 
 function clampLimit(limit: number | undefined): number {
@@ -339,20 +398,25 @@ function clampLimit(limit: number | undefined): number {
   return floored;
 }
 
-function toRecord(row: DraftRow): DraftRecord {
+/**
+ * Map a stored row to a wire record. The required `message` field carries the
+ * DIGEST (never plaintext); the webhook is redacted; tags are parsed.
+ */
+export function toRecord(row: DraftRow): DraftRecord {
   const record: DraftRecord = {
+    version: row.version,
     id: row.id,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
     status: row.status as DraftStatus,
-    messageDigest: row.messageDigest,
+    message: row.messageDigest,
   };
   if (row.title !== null) record.title = row.title;
   if (row.channel !== null) record.channel = row.channel;
   if (row.route !== null) record.route = row.route;
   // Webhook is encrypted at rest; reads ALWAYS redact. Presence of webhookEnc
   // means a webhook exists → emit '[redacted]'; the raw URL never leaves here.
-  const redacted = redactWebhook(row.webhookEnc ?? undefined);
+  const redacted = redactWebhook(row.webhookEnc);
   if (redacted !== undefined) record.webhook = redacted;
   if (row.link !== null) record.link = row.link;
   const tags = parseTags(row.tags);

package/src/daemon/handlers/drafts/index.ts

@@ -0,0 +1,17 @@
+/**
+ * channels.drafts.* handler surface barrel.
+ *
+ * Re-exports only the concrete register entrypoint and the store/types other
+ * code may need. It imports concrete submodules (no project index barrels), so
+ * it introduces no import cycle.
+ */
+export { registerDraftMethods } from './register.ts';
+export type { RegisterDraftsOptions } from './register.ts';
+export { DraftSyncStore, sha256First, redactWebhook } from './draft-store.ts';
+export type {
+  DraftListQuery,
+  DraftRecord,
+  DraftSaveInput,
+  DraftSaveResult,
+  DraftStatus,
+} from './draft-store.ts';