@pellux/goodvibes-tui 0.25.0 → 0.26.0

package/src/daemon/{remote → handlers/remote}/peer-registry.ts

@@ -1,5 +1,8 @@
-import { OperatorSqliteStore } from '../operator/index.ts';
-import { isSecretReferenceValue } from '../../config/secret-config.ts';
+import { HandlerSqliteStore } from '../sqlite-store.ts';
+import {
+  isSecretReferenceValue,
+  isMalformedGoodVibesSecretReferenceValue,
+} from '../../../config/secret-config.ts';
 
 // ---------------------------------------------------------------------------
 // Backend vocabulary + per-backend config shapes
@@ -105,15 +108,48 @@ function requireSecretRef(value: unknown, field: string): string {
   return ref;
 }
 
-function assertSecretRefIfPresent(value: string | undefined, field: string): void {
-  // A dockerHost may legitimately be a non-credential socket/tcp address, but if
-  // it looks like it embeds credentials (userinfo segment) it must be a ref.
+function assertDockerHostSafe(value: string | undefined, field: string): void {
+  // A dockerHost is accepted in exactly two shapes, mirroring how docker.ts
+  // resolves it (docker.ts: `startsWith('goodvibes://') ? resolveRef(...) : raw`):
+  //   1. A goodvibes://secrets/ reference — resolved from the credential store.
+  //   2. A credential-free local/plain address (unix:// socket, or a bare
+  //      tcp/host with no embedded userinfo) — used verbatim.
+  // Enforcement here must match that resolution so no credential-bearing or
+  // unresolvable value slips through to docker.ts.
   if (value === undefined) return;
-  if (value.includes('@') && !isSecretReferenceValue(value)) {
+
+  // A valid secret ref is always allowed: docker.ts resolves it from the store.
+  if (isSecretReferenceValue(value)) return;
+
+  // A `goodvibes://` value that is NOT a well-formed secret ref would be handed
+  // to credentials.resolveRef() and fail opaquely (REMOTE_BACKEND_CREDENTIAL_MISSING)
+  // — or, worse, a near-miss could be treated as a literal host. Reject it at
+  // registration so the misconfiguration surfaces immediately.
+  if (isMalformedGoodVibesSecretReferenceValue(value)) {
+    throw new PeerRegistryValidationError(
+      `Field '${field}' looks like a goodvibes:// reference but is malformed; use a valid goodvibes://secrets/ reference.`,
+    );
+  }
+
+  // Embedded userinfo credentials (e.g. tcp://user:pass@host) must never be
+  // stored raw — docker.ts would pass them verbatim as DOCKER_HOST.
+  if (value.includes('@')) {
     throw new PeerRegistryValidationError(
       `Field '${field}' appears to embed credentials; pass a goodvibes://secrets/ reference instead.`,
     );
   }
+
+  // A remote daemon reached over TLS carries its credentials out-of-band and
+  // MUST be referenced through the credential store, never pinned as a raw
+  // host string the daemon would use unauthenticated. docker.ts only treats a
+  // goodvibes:// value as a secret, so a raw `https://`/`tcp+tls://` endpoint
+  // here would bypass credential resolution entirely.
+  const lowered = value.toLowerCase();
+  if (lowered.startsWith('https://') || lowered.startsWith('tcp+tls://')) {
+    throw new PeerRegistryValidationError(
+      `Field '${field}' points at a TLS Docker daemon; pass a goodvibes://secrets/ reference instead of a raw URL.`,
+    );
+  }
 }
 
 /** Normalize + validate raw backendConfig into a typed, ref-only BackendConfig. */
@@ -124,7 +160,7 @@ export function normalizeBackendConfig(
   switch (backendKind) {
     case 'docker': {
       const dockerHost = optionalString(raw.dockerHost, 'dockerHost');
-      assertSecretRefIfPresent(dockerHost, 'dockerHost');
+      assertDockerHostSafe(dockerHost, 'dockerHost');
       return {
         kind: 'docker',
         containerName: requireString(raw.containerName, 'containerName'),
@@ -190,10 +226,10 @@ export function normalizeBackendConfig(
 }
 
 // ---------------------------------------------------------------------------
-// Peer registry — persisted via OperatorSqliteStore
+// Peer registry — persisted via HandlerSqliteStore (peer-registry.sqlite)
 // ---------------------------------------------------------------------------
 
-const PEER_REGISTRY_FILE = 'remote-peers.sqlite';
+const PEER_REGISTRY_FILE = 'peer-registry.sqlite';
 
 const SCHEMA = [
   `CREATE TABLE IF NOT EXISTS peers (
@@ -230,11 +266,11 @@ function rowToRecord(row: PeerRow): PeerRecord {
 }
 
 export class PeerRegistry {
-  private readonly store: OperatorSqliteStore;
+  private readonly store: HandlerSqliteStore;
   private initialized = false;
 
   constructor(workingDirectory: string) {
-    this.store = new OperatorSqliteStore({
+    this.store = new HandlerSqliteStore({
       workingDirectory,
       fileName: PEER_REGISTRY_FILE,
       schema: SCHEMA,

package/src/daemon/handlers/remote/service.ts

@@ -0,0 +1,191 @@
+/**
+ * Host implementation of the daemon-sdk `DistributedRuntimeRouteService` (17
+ * methods). The SDK ships NO docker/ssh/cloud backend, so the host owns it:
+ *
+ *  - `invokePeer` executes against the host's own remote backends through the
+ *    `RemoteDispatcher` (docker / ssh / cloud-terminal / local-process). This is
+ *    the only method that performs real command execution.
+ *  - The 16 peer / pairing / work-queue methods are backed by the SDK's
+ *    `DistributedRuntimeManager` (constructed by the surface), which owns peer
+ *    records, pairing challenges, token rotation, and the work queue.
+ *
+ * The SDK injects this instance into `DaemonRemoteRouteContext.distributedRuntime`
+ * so the published `remote.peers.*` HTTP routes dispatch to it. No catalog
+ * descriptor or schema is authored here.
+ */
+import { operations } from '@pellux/goodvibes-sdk/platform/runtime';
+import type {
+  DistributedRuntimeRouteService,
+  RemotePeerAuth,
+} from '../contracts.ts';
+import { RemoteDispatcher } from './dispatcher.ts';
+import type { DispatchPayload } from './backends/index.ts';
+
+type DistributedRuntimeManager = operations.DistributedRuntimeManager;
+type DistributedPeerAuth = operations.DistributedPeerAuth;
+
+/** Coerce an injected `RemotePeerAuth` (typed `unknown` by the SDK) to the manager's auth shape. */
+function asPeerAuth(auth: RemotePeerAuth): DistributedPeerAuth {
+  return auth as DistributedPeerAuth;
+}
+
+/** Narrow an arbitrary route-supplied input bag to a typed manager input. */
+function asInput<T>(input: Record<string, unknown>): T {
+  return input as unknown as T;
+}
+
+function readString(input: Record<string, unknown>, key: string): string {
+  const value = input[key];
+  return typeof value === 'string' ? value : '';
+}
+
+function readPrincipal(input: Record<string, unknown>): string {
+  const actor = input.actor ?? input.principalId ?? input.queuedBy;
+  return typeof actor === 'string' && actor.length > 0 ? actor : 'remote';
+}
+
+function readPayload(input: Record<string, unknown>): DispatchPayload | undefined {
+  const payload = input.payload;
+  if (payload && typeof payload === 'object') {
+    return payload as DispatchPayload;
+  }
+  return undefined;
+}
+
+export class HostDistributedRuntime implements DistributedRuntimeRouteService {
+  private readonly manager: DistributedRuntimeManager;
+  private readonly dispatcher: RemoteDispatcher;
+
+  constructor(manager: DistributedRuntimeManager, dispatcher: RemoteDispatcher) {
+    this.manager = manager;
+    this.dispatcher = dispatcher;
+  }
+
+  // --- Pairing -------------------------------------------------------------
+
+  listPairRequests(): unknown {
+    return this.manager.listPairRequests();
+  }
+
+  requestPairing(input: Record<string, unknown>): Promise<unknown> {
+    return this.manager.requestPairing(
+      asInput<Parameters<DistributedRuntimeManager['requestPairing']>[0]>(input),
+    );
+  }
+
+  approvePairRequest(requestId: string, input: Record<string, unknown>): Promise<unknown | null> {
+    return this.manager.approvePairRequest(
+      requestId,
+      asInput<Parameters<DistributedRuntimeManager['approvePairRequest']>[1]>(input),
+    );
+  }
+
+  rejectPairRequest(requestId: string, input: Record<string, unknown>): Promise<unknown | null> {
+    return this.manager.rejectPairRequest(
+      requestId,
+      asInput<Parameters<DistributedRuntimeManager['rejectPairRequest']>[1]>(input),
+    );
+  }
+
+  verifyPairRequest(
+    requestId: string,
+    challenge: string,
+    input: Record<string, unknown>,
+  ): Promise<unknown | null> {
+    return this.manager.verifyPairRequest(
+      requestId,
+      challenge,
+      asInput<Parameters<DistributedRuntimeManager['verifyPairRequest']>[2]>(input),
+    );
+  }
+
+  // --- Peer management -----------------------------------------------------
+
+  listPeers(): unknown {
+    return this.manager.listPeers();
+  }
+
+  rotatePeerToken(peerId: string, input: Record<string, unknown>): Promise<unknown | null> {
+    return this.manager.rotatePeerToken(
+      peerId,
+      asInput<Parameters<DistributedRuntimeManager['rotatePeerToken']>[1]>(input),
+    );
+  }
+
+  revokePeerToken(peerId: string, input: Record<string, unknown>): Promise<unknown | null> {
+    return this.manager.revokePeerToken(
+      peerId,
+      asInput<Parameters<DistributedRuntimeManager['revokePeerToken']>[1]>(input),
+    );
+  }
+
+  disconnectPeer(peerId: string, input: Record<string, unknown>): Promise<unknown | null> {
+    return this.manager.disconnectPeer(
+      peerId,
+      asInput<Parameters<DistributedRuntimeManager['disconnectPeer']>[1]>(input),
+    );
+  }
+
+  getNodeHostContract(): unknown {
+    return this.manager.getNodeHostContract();
+  }
+
+  // --- Peer-authenticated heartbeat + work claim ---------------------------
+
+  heartbeatPeer(auth: RemotePeerAuth, input: Record<string, unknown>): Promise<unknown> {
+    return this.manager.heartbeatPeer(
+      asPeerAuth(auth),
+      asInput<Parameters<DistributedRuntimeManager['heartbeatPeer']>[1]>(input),
+    );
+  }
+
+  claimWork(auth: RemotePeerAuth, input: Record<string, unknown>): Promise<unknown> {
+    return this.manager.claimWork(
+      asPeerAuth(auth),
+      asInput<Parameters<DistributedRuntimeManager['claimWork']>[1]>(input),
+    );
+  }
+
+  completeWork(
+    auth: RemotePeerAuth,
+    workId: string,
+    input: Record<string, unknown>,
+  ): Promise<unknown | null> {
+    return this.manager.completeWork(
+      asPeerAuth(auth),
+      workId,
+      asInput<Parameters<DistributedRuntimeManager['completeWork']>[2]>(input),
+    );
+  }
+
+  // --- Work queue ----------------------------------------------------------
+
+  listWork(): unknown {
+    return this.manager.listWork();
+  }
+
+  cancelWork(workId: string, input: Record<string, unknown>): Promise<unknown | null> {
+    return this.manager.cancelWork(
+      workId,
+      asInput<Parameters<DistributedRuntimeManager['cancelWork']>[1]>(input),
+    );
+  }
+
+  // --- Command execution (host-owned backends) -----------------------------
+
+  /**
+   * Execute a command on a registered peer through the host backends. Unlike the
+   * manager's enqueue-only `invokePeer`, this performs real docker/ssh/cloud/
+   * local-process execution and returns a receipt with a full-stdout digest.
+   */
+  async invokePeer(input: Record<string, unknown>): Promise<unknown> {
+    const payload = readPayload(input);
+    return this.dispatcher.dispatch({
+      peerId: readString(input, 'peerId'),
+      command: readString(input, 'command'),
+      principalId: readPrincipal(input),
+      async: input.async === true,
+      ...(payload !== undefined ? { payload } : {}),
+    });
+  }
+}

package/src/daemon/{channels → handlers}/routing/inbox-bridge.ts

@@ -1,13 +1,13 @@
 // ---------------------------------------------------------------------------
 // Inbox <-> Routing resolver bridge.
 //
-// The inbox provider adapters expose a best-effort `RouteResolver` seam
-// (provider-adapter.ts): given an inbound item's `{ provider, fromDigest, kind }`
-// they ask "which daemon route binding handles this item?" and stamp the answer
-// onto `item.routeId` when one resolves. The routing control plane owns the
+// The inbox provider adapters expose a best-effort route-resolution seam: given
+// an inbound item's `{ provider, fromDigest, kind, routeId? }` they ask "which
+// daemon route binding handles this item?" and stamp the answer onto
+// `item.routeId` when one resolves. The routing control plane owns the
 // channel<->profile bindings and exposes a `RoutingResolver` whose
-// `getProfileForChannel(surfaceKind, routeId?)` applies the canonical resolution
-// order:
+// `getProfileForChannel(surfaceKind, routeId?)` applies the canonical
+// resolution order:
 //
 //   1. exact     — surfaceKind AND routeId both match
 //   2. surface   — surfaceKind matches, route has no routeId
@@ -20,36 +20,49 @@
 // or message kind — see RoutingChannelRoute). When no binding matches the
 // resolver returns null and the bridge yields `undefined`, so the adapter falls
 // back to leaving the item unrouted (offline/default behaviour intact). The
-// bridge NEVER throws: route-util.ts already swallows resolver errors, and the
-// underlying resolver is a pure in-memory lookup.
+// bridge NEVER throws: the underlying resolver is a pure in-memory lookup.
+//
+// The inbox surface is a separate follow-up module, so this bridge declares the
+// minimal `RouteResolver` seam locally rather than importing a sibling that the
+// routing slice does not own — keeping the routing handler layer free of any
+// cross-surface import edge.
 // ---------------------------------------------------------------------------
 
-import type { RouteResolver } from '../inbox/provider-adapter.ts';
 import type { RoutingResolver } from './routing-resolver.ts';
 
 /**
- * Optional input fields the bridge consults for routeId refinement. The
- * published {@link RouteResolver} input does not currently carry a routeId, so
- * surface-only / wildcard resolution is the effective path today; should the
- * inbox seam grow a routeId (e.g. a Slack channel id or email mailbox tag) the
- * bridge will pass it through to enable exact (surfaceKind+routeId) matches
- * without any further change here.
+ * Fields the bridge consults on an inbound item. `provider` maps to the routing
+ * `surfaceKind`; an optional `routeId` (e.g. a Slack channel id or email
+ * mailbox tag) enables exact (surfaceKind+routeId) matches. Additional inbound
+ * fields are ignored for routing purposes.
+ */
+export interface RouteResolverInput {
+  readonly provider?: unknown;
+  readonly routeId?: unknown;
+  readonly [key: string]: unknown;
+}
+
+/**
+ * Best-effort seam the inbox provider adapters invoke per inbound item. Returns
+ * the resolved profile-route binding id, or `undefined` when nothing matches.
  */
-type RouteResolverInput = Parameters<RouteResolver>[0] & { routeId?: unknown };
+export type RouteResolver = (input: RouteResolverInput) => string | undefined;
 
 /**
  * Build a {@link RouteResolver} backed by the routing surface's
  * {@link RoutingResolver}. Maps `provider -> surfaceKind` and forwards an
  * optional `routeId` refinement, then applies the canonical
- * exact > surface-only > wildcard resolution order via
- * `getProfileForChannel`. Returns the resolved profileId (the daemon route
- * binding) or `undefined` when nothing matches.
+ * exact > surface-only > wildcard resolution order via `getProfileForChannel`.
+ * Returns the resolved profileId (the daemon route binding) or `undefined` when
+ * nothing matches.
  */
 export function createInboxRouteResolver(resolver: RoutingResolver): RouteResolver {
   return (input: RouteResolverInput): string | undefined => {
     const surfaceKind = typeof input.provider === 'string' ? input.provider : '';
     if (surfaceKind.length === 0) return undefined;
-    const routeId = typeof input.routeId === 'string' && input.routeId.length > 0 ? input.routeId : undefined;
+    const routeId = typeof input.routeId === 'string' && input.routeId.length > 0
+      ? input.routeId
+      : undefined;
     // getProfileForChannel applies exact (surfaceKind+routeId) > surface-only >
     // wildcard ('any') and returns null when no assignment matches.
     const profileId = resolver.getProfileForChannel(surfaceKind, routeId);

package/src/daemon/handlers/routing/index.ts

@@ -0,0 +1,261 @@
+// ---------------------------------------------------------------------------
+// Channel routing surface — HANDLERS for the SDK-defined methods
+//   - channels.routing.list   (read-only)
+//   - channels.routing.assign (admin, confirmation-gated)
+//   - channels.routing.delete (admin, dangerous, confirmation-gated)
+//
+// The SDK's GatewayMethodCatalog already registered the canonical descriptors
+// (id, input/output schema, access, scopes, dangerous) for these three method
+// ids with `handler: undefined`. This module NEVER re-declares an id, schema,
+// or descriptor: it looks each one up by id and attaches a typed handler via
+// `registerCatalogHandlers`, flipping the builtin method from HTTP-fallback to
+// in-process execution. Handler outputs match the SDK output schemas exactly.
+//
+// Confirmation posture (per the daemon handoff, Responsibility 2): assign and
+// delete are control-plane mutations that require explicit user confirmation
+// (the SDK marks assign access:admin + 'Requires explicit confirmation', and
+// delete dangerous:true). Both pass `{ confirm: true }` so the register wrapper
+// enforces `body.confirm === true` AND `context.explicitUserRequest === true`.
+// list is read-only and ungated.
+// ---------------------------------------------------------------------------
+
+import type { HandlerContext } from '../context.ts';
+import type { RoutingRegistration as FoundationRoutingRegistration } from '../index.ts';
+import {
+  registerCatalogHandlers,
+  type CatalogHandlerEntry,
+  type TypedHandler,
+  type Unregister,
+} from '../register.ts';
+import {
+  buildChannelId,
+  parseChannelId,
+  RouteStore,
+  toRouteListItem,
+  type RoutingChannelRoute,
+  type RoutingRouteListItem,
+} from './route-store.ts';
+import { createRoutingResolver, type RoutingResolver } from './routing-resolver.ts';
+
+export { createInboxRouteResolver, type RouteResolver, type RouteResolverInput } from './inbox-bridge.ts';
+export {
+  buildChannelId,
+  parseChannelId,
+  RouteStore,
+  toRouteListItem,
+  type RoutingChannelRoute,
+  type RoutingRouteListItem,
+} from './route-store.ts';
+export {
+  createRoutingResolver,
+  resolveProfile,
+  WILDCARD_SURFACE,
+  type RoutingResolver,
+} from './routing-resolver.ts';
+
+// ---------------------------------------------------------------------------
+// Wire shapes (derived from the SDK contracts; NOT re-declared schemas).
+//
+// list   in : { profileId?, surfaceKind?, limit? }
+//         out: { routes: [{ id, createdAt, updatedAt, surfaceKind, routeId?,
+//                           profileId, label? }], total }   (SDK route-item shape)
+// assign in : { channelId?, surfaceKind, routeId?, profileId, label? }
+//             out: { assignmentId, channelId?, surfaceKind, routeId?, profileId, label?, createdAt, updatedAt }
+// delete in : { assignmentId }                        out: { deleted, assignmentId }
+// ---------------------------------------------------------------------------
+
+interface RoutingListBody {
+  profileId?: unknown;
+  surfaceKind?: unknown;
+  limit?: unknown;
+}
+interface RoutingListResult {
+  routes: RoutingRouteListItem[];
+  total: number;
+}
+
+interface RoutingAssignBody {
+  channelId?: unknown;
+  surfaceKind?: unknown;
+  routeId?: unknown;
+  profileId?: unknown;
+  label?: unknown;
+}
+interface RoutingAssignResult {
+  assignmentId: string;
+  channelId: string;
+  surfaceKind: string;
+  routeId?: string;
+  profileId: string;
+  label?: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+interface RoutingDeleteBody {
+  assignmentId?: unknown;
+}
+interface RoutingDeleteResult {
+  deleted: boolean;
+  assignmentId: string;
+}
+
+const LIST_METHOD = 'channels.routing.list';
+const ASSIGN_METHOD = 'channels.routing.assign';
+const DELETE_METHOD = 'channels.routing.delete';
+
+function optionalString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+}
+
+function clampLimit(value: unknown): number | undefined {
+  if (value === undefined || value === null || value === '') return undefined;
+  const n = typeof value === 'number' ? value : Number(value);
+  if (!Number.isFinite(n)) return undefined;
+  return Math.max(1, Math.floor(n));
+}
+
+/**
+ * Routing surface handle. Satisfies the foundation `RoutingRegistration`
+ * (`{ unregister, resolveProfileId }`) and additionally exposes the live
+ * {@link RoutingResolver} and {@link RouteStore} so the inbox surface and tests
+ * can reuse routing resolution without going through the catalog.
+ */
+export interface RoutingRegistration extends FoundationRoutingRegistration {
+  readonly resolver: RoutingResolver;
+  readonly store: RouteStore;
+}
+
+/**
+ * Attach the channel-routing handlers to the SDK gateway catalog held by `ctx`.
+ *
+ * The {@link RouteStore} is lazily initialized on first invocation (the
+ * register contract is synchronous) so registration never blocks on disk I/O.
+ * Returns the teardown plus the resolver/store handles.
+ */
+export function registerRoutingMethods(ctx: HandlerContext): RoutingRegistration {
+  const store = new RouteStore({ workingDirectory: ctx.workingDirectory });
+  const resolver = createRoutingResolver(store);
+
+  let initPromise: Promise<void> | null = null;
+  const ensureInit = async (): Promise<void> => {
+    if (!initPromise) {
+      initPromise = store.init().catch((error) => {
+        // Allow a later invocation to retry initialization.
+        initPromise = null;
+        throw error;
+      });
+    }
+    await initPromise;
+  };
+
+  const listHandler: TypedHandler<RoutingListBody, RoutingListResult> = async ({ body }) => {
+    await ensureInit();
+    const routes = store.list({
+      profileId: optionalString(body.profileId),
+      surfaceKind: optionalString(body.surfaceKind),
+    });
+    const limit = clampLimit(body.limit);
+    const limited = limit !== undefined ? routes.slice(0, limit) : routes;
+    // Project to the SDK `channels.routing.list` item shape: emit `id`
+    // (= assignmentId) and drop the daemon-internal `channelId`/`assignmentId`,
+    // which additionalProperties:false forbids.
+    const items = limited.map(toRouteListItem);
+    return { routes: items, total: items.length };
+  };
+
+  const assignHandler: TypedHandler<RoutingAssignBody, RoutingAssignResult> = async ({ body, context }) => {
+    await ensureInit();
+    const profileId = optionalString(body.profileId);
+    if (profileId === undefined) {
+      throw new Error('profileId is required');
+    }
+    // The SDK contract accepts either a composite `channelId` or the
+    // `surfaceKind` (+ optional `routeId`) parts. Prefer an explicit
+    // channelId; otherwise build one from the parts.
+    const explicitChannelId = optionalString(body.channelId);
+    const surfaceKind = optionalString(body.surfaceKind);
+    const routeId = optionalString(body.routeId);
+    const channelId = explicitChannelId ?? (
+      surfaceKind !== undefined ? buildChannelId(surfaceKind, routeId) : undefined
+    );
+    if (channelId === undefined) {
+      throw new Error('surfaceKind (or channelId) is required');
+    }
+    const { route, created } = await store.upsert({
+      channelId,
+      profileId,
+      label: optionalString(body.label),
+    });
+    ctx.logger.info('channels.routing.assign', {
+      assignmentId: route.assignmentId,
+      channelId: route.channelId,
+      surfaceKind: route.surfaceKind,
+      profileId: route.profileId,
+      created,
+      principalId: context.principalId,
+    });
+    const result: RoutingAssignResult = {
+      assignmentId: route.assignmentId,
+      channelId: route.channelId,
+      surfaceKind: route.surfaceKind,
+      profileId: route.profileId,
+      createdAt: route.createdAt,
+      updatedAt: route.updatedAt,
+    };
+    if (route.routeId !== undefined) result.routeId = route.routeId;
+    if (route.label !== undefined) result.label = route.label;
+    return result;
+  };
+
+  const deleteHandler: TypedHandler<RoutingDeleteBody, RoutingDeleteResult> = async ({ body, context }) => {
+    await ensureInit();
+    const assignmentId = optionalString(body.assignmentId);
+    if (assignmentId === undefined) {
+      throw new Error('assignmentId is required');
+    }
+    const deleted = await store.delete(assignmentId);
+    ctx.logger.info('channels.routing.delete', {
+      assignmentId,
+      deleted,
+      principalId: context.principalId,
+    });
+    return { deleted, assignmentId };
+  };
+
+  const entries: CatalogHandlerEntry[] = [
+    { id: LIST_METHOD, handler: listHandler as TypedHandler<unknown, unknown> },
+    {
+      id: ASSIGN_METHOD,
+      handler: assignHandler as TypedHandler<unknown, unknown>,
+      options: { confirm: true },
+    },
+    {
+      id: DELETE_METHOD,
+      handler: deleteHandler as TypedHandler<unknown, unknown>,
+      options: { confirm: true },
+    },
+  ];
+
+  const teardownHandlers = registerCatalogHandlers(ctx.catalog, entries);
+
+  const unregister: Unregister = () => {
+    teardownHandlers();
+    store.close();
+  };
+
+  return {
+    unregister,
+    resolveProfileId: (surfaceKind: string, routeId?: string) =>
+      resolver.getProfileForChannel(surfaceKind, routeId),
+    resolver,
+    store,
+  };
+}
+
+/**
+ * Provider entry point consumed by `registerDaemonHandlers`
+ * (`DaemonHandlerSurfaceProviders.registerRouting`).
+ */
+export const registerRouting = (ctx: HandlerContext): RoutingRegistration =>
+  registerRoutingMethods(ctx);