@pellux/goodvibes-tui 1.27.0 → 2.0.1

package/src/daemon/handlers/contracts.ts

@@ -1,77 +0,0 @@
-/**
- * Single SDK-contract import seam for the daemon handler layer.
- *
- * Every other module under `src/daemon/handlers/` imports SDK contract
- * identifiers from HERE and nowhere else. Concentrating the SDK imports in one
- * concrete-submodule module keeps the rest of the layer free of barrel cycles
- * and guarantees the host NEVER re-declares an SDK id, descriptor, or schema —
- * it only attaches handlers to the descriptors the SDK already registered.
- */
-
-// Catalog + invocation contract types (concrete control-plane subpath, not a project barrel).
-export type {
-  GatewayMethodCatalog,
-  GatewayMethodDescriptor,
-  GatewayMethodInvocation,
-  GatewayMethodInvocationContext,
-  GatewayMethodHandler,
-} from '@pellux/goodvibes-sdk/platform/control-plane';
-
-// Channel domain types reused in handler signatures (read-only SDK interfaces; never re-declared).
-export type {
-  ChannelIdentity,
-  ChannelResolvedTarget,
-  ChannelAccountRecord,
-} from '@pellux/goodvibes-sdk/platform/channels';
-
-/**
- * Per-peer authentication envelope passed to peer-scoped remote routes.
- *
- * The daemon-sdk ships `RemotePeerAuth` only as an UNEXPORTED local alias
- * inside `@pellux/goodvibes-daemon-sdk/remote-routes` (it is `unknown` there),
- * so it cannot be re-exported. We mirror that exact shape here for the host
- * implementation. This is an implementable runtime contract, not a method
- * descriptor or schema — declaring it does not violate the no-re-declaration
- * rule for catalog methods.
- */
-export type RemotePeerAuth = unknown;
-
-/**
- * Remote distributed-runtime route service the HOST must implement and supply
- * as `RuntimeServices.distributedRuntime`. The SDK facade injects the instance
- * into `DaemonRemoteRouteContext.distributedRuntime` so the published
- * `remote.peers.*` HTTP routes can dispatch to it.
- *
- * The daemon-sdk declares this interface locally in
- * `@pellux/goodvibes-daemon-sdk/remote-routes` but does NOT export it (the
- * module ends with `export {}`), so it cannot be imported. This declaration
- * mirrors the SDK's exact structural shape (17 methods, verbatim signatures)
- * so a host implementation is assignable to the SDK's context field. The SDK
- * ships no docker/ssh/cloud backend — the host owns the implementation.
- */
-export interface DistributedRuntimeRouteService {
-  listPairRequests(): unknown;
-  approvePairRequest(requestId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  rejectPairRequest(requestId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  listPeers(): unknown;
-  rotatePeerToken(peerId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  revokePeerToken(peerId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  disconnectPeer(peerId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  listWork(): unknown;
-  invokePeer(input: Record<string, unknown>): Promise<unknown>;
-  cancelWork(workId: string, input: Record<string, unknown>): Promise<unknown | null>;
-  getNodeHostContract(): unknown;
-  requestPairing(input: Record<string, unknown>): Promise<unknown>;
-  verifyPairRequest(
-    requestId: string,
-    challenge: string,
-    input: Record<string, unknown>,
-  ): Promise<unknown | null>;
-  heartbeatPeer(auth: RemotePeerAuth, input: Record<string, unknown>): Promise<unknown>;
-  claimWork(auth: RemotePeerAuth, input: Record<string, unknown>): Promise<unknown>;
-  completeWork(
-    auth: RemotePeerAuth,
-    workId: string,
-    input: Record<string, unknown>,
-  ): Promise<unknown | null>;
-}

package/src/daemon/handlers/credentials.ts

@@ -1,139 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-import type { SecretsManager, SecretScope } from '../../config/secrets.ts';
-import {
-  buildGoodVibesSecretKey,
-  isSecretReferenceValue,
-} from '../../config/secret-config.ts';
-
-export interface DaemonCredentialStore {
-  /**
-   * Resolve a goodvibes://secrets/ reference OR a raw secret key to its
-   * plaintext value (daemon-internal only).
-   */
-  resolveRef(ref: string): Promise<string | null>;
-  /**
-   * Resolve a config-key-derived secret
-   * (e.g. 'surfaces.slack.botToken' → GOODVIBES_SURFACES_SLACK_BOT_TOKEN).
-   */
-  resolveConfigSecret(configKey: string): Promise<string | null>;
-  /**
-   * Store a daemon-owned credential. scope defaults 'daemon'.
-   *
-   * This is the DAEMON's own credential store: every caller is daemon code, and
-   * every value written through it is one the daemon itself has to read back —
-   * including its own generated draft encryption key (createAtRestCipher below,
-   * which calls put() with no scope at all). Defaulting to 'user' filed those
-   * in a surface-scoped tier, so the daemon's own material lived somewhere it
-   * only found by accident, and a value written on one surface's behalf was
-   * invisible to the next.
-   */
-  put(
-    secretKey: string,
-    value: string,
-    opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
-  ): Promise<void>;
-  has(secretKey: string): Promise<boolean>;
-}
-
-/** Extract the trailing secret-key segment from a goodvibes://secrets/ reference. */
-function secretKeyFromReference(ref: string): string {
-  const normalized = ref.trim();
-  const segments = normalized.split('/');
-  const last = segments[segments.length - 1] ?? '';
-  return decodeURIComponent(last);
-}
-
-export function createDaemonCredentialStore(secrets: SecretsManager): DaemonCredentialStore {
-  return {
-    async resolveRef(ref: string): Promise<string | null> {
-      const key = isSecretReferenceValue(ref) ? secretKeyFromReference(ref) : ref;
-      return secrets.get(key);
-    },
-    async resolveConfigSecret(configKey: string): Promise<string | null> {
-      return secrets.get(buildGoodVibesSecretKey(configKey));
-    },
-    async put(
-      secretKey: string,
-      value: string,
-      opts?: { scope?: SecretScope; medium?: 'plaintext' | 'secure' },
-    ): Promise<void> {
-      await secrets.set(secretKey, value, {
-        scope: opts?.scope ?? 'daemon',
-        medium: opts?.medium ?? 'secure',
-      });
-    },
-    async has(secretKey: string): Promise<boolean> {
-      const value = await secrets.get(secretKey);
-      return value !== null && value.length > 0;
-    },
-  };
-}
-
-// ---------------------------------------------------------------------------
-// At-rest encryption helper for drafts (draft body must be encrypted at rest).
-// ---------------------------------------------------------------------------
-
-export interface AtRestCipher {
-  encrypt(plaintext: string): Promise<string>;
-  decrypt(ciphertext: string): Promise<string>;
-}
-
-const DEFAULT_DRAFT_KEY_NAME = 'GOODVIBES_DAEMON_DRAFT_AESKEY';
-const AES_KEY_BYTES = 32; // AES-256
-const GCM_IV_BYTES = 12;
-const GCM_TAG_BYTES = 16;
-
-async function loadOrCreateKey(
-  store: DaemonCredentialStore,
-  keyName: string,
-): Promise<Buffer> {
-  const existing = await store.resolveRef(keyName);
-  if (existing && existing.length > 0) {
-    const buf = Buffer.from(existing, 'base64');
-    if (buf.length === AES_KEY_BYTES) return buf;
-  }
-  const generated = randomBytes(AES_KEY_BYTES);
-  await store.put(keyName, generated.toString('base64'), { medium: 'secure' });
-  return generated;
-}
-
-/**
- * Create an AES-256-GCM at-rest cipher backed by a daemon-owned key.
- * encrypt() returns base64(iv | tag | ciphertext). Uses node:crypto (Bun-compatible).
- * NEVER log resolved keys or plaintext.
- */
-export function createAtRestCipher(
-  store: DaemonCredentialStore,
-  keyName: string = DEFAULT_DRAFT_KEY_NAME,
-): AtRestCipher {
-  let keyPromise: Promise<Buffer> | null = null;
-  const getKey = (): Promise<Buffer> => {
-    if (!keyPromise) keyPromise = loadOrCreateKey(store, keyName);
-    return keyPromise;
-  };
-
-  return {
-    async encrypt(plaintext: string): Promise<string> {
-      const key = await getKey();
-      const iv = randomBytes(GCM_IV_BYTES);
-      const cipher = createCipheriv('aes-256-gcm', key, iv);
-      const encrypted = Buffer.concat([
-        cipher.update(plaintext, 'utf-8'),
-        cipher.final(),
-      ]);
-      const tag = cipher.getAuthTag();
-      return Buffer.concat([iv, tag, encrypted]).toString('base64');
-    },
-    async decrypt(ciphertext: string): Promise<string> {
-      const key = await getKey();
-      const raw = Buffer.from(ciphertext, 'base64');
-      const iv = raw.subarray(0, GCM_IV_BYTES);
-      const tag = raw.subarray(GCM_IV_BYTES, GCM_IV_BYTES + GCM_TAG_BYTES);
-      const data = raw.subarray(GCM_IV_BYTES + GCM_TAG_BYTES);
-      const decipher = createDecipheriv('aes-256-gcm', key, iv);
-      decipher.setAuthTag(tag);
-      const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
-      return decrypted.toString('utf-8');
-    },
-  };
-}

package/src/daemon/handlers/drafts/draft-store.ts

@@ -1,427 +0,0 @@
-import { createHash } from 'node:crypto';
-import type { AtRestCipher } from '../credentials.ts';
-import { HandlerSqliteStore } from '../sqlite-store.ts';
-
-// ---------------------------------------------------------------------------
-// Draft Sync Backend store (rebased onto the daemon handler foundation).
-//
-// Mirrors the agent's local draft store (channels/drafts.json) server-side so
-// drafts are visible across surfaces. The agent's local file remains the source
-// of truth; this store is a sync mirror. Conflict resolution (most-recent
-// updatedAt wins) is the integrator's concern — this store performs a plain
-// upsert and records the supplied/derived updatedAt.
-//
-// SECURITY POSTURE:
-//   - The plaintext message body is NEVER persisted. It is encrypted at rest
-//     via the daemon at-rest cipher (AES-256-GCM) as `bodyEnc`.
-//   - The webhook URL is encrypted at rest (`webhookEnc`) and is ALWAYS
-//     redacted ('[redacted]') in every list/get response — the raw URL never
-//     leaves the store.
-//   - `messageDigest` (sha256First(body, 12)) is computed at save time and
-//     stored alongside, so reads never need to decrypt the body. The required
-//     `message` field of every emitted record carries the DIGEST, never the
-//     plaintext body.
-// ---------------------------------------------------------------------------
-
-/** SHA-256 of `input`, truncated to the first `hexChars` hex characters. */
-export function sha256First(input: string, hexChars: number): string {
-  const digest = createHash('sha256').update(input, 'utf-8').digest('hex');
-  return digest.slice(0, Math.max(0, hexChars));
-}
-
-/** Redact a stored webhook for responses: present → '[redacted]', else undefined. */
-export function redactWebhook(value?: string | null): string | undefined {
-  return value === undefined || value === null || value === '' ? undefined : '[redacted]';
-}
-
-export type DraftStatus = 'draft' | 'queued' | 'sent' | 'failed';
-
-/** Statuses callers are permitted to write via save(). */
-export const WRITABLE_DRAFT_STATUSES: readonly DraftStatus[] = ['draft', 'queued'];
-
-/** All known statuses (writable + terminal states set by the send pipeline). */
-export const ALL_DRAFT_STATUSES: readonly DraftStatus[] = [
-  'draft',
-  'queued',
-  'sent',
-  'failed',
-];
-
-export const DRAFT_MESSAGE_DIGEST_HEX = 12;
-export const DEFAULT_DRAFT_VERSION = 1;
-export const DEFAULT_DRAFT_LIST_LIMIT = 50;
-export const MAX_DRAFT_LIST_LIMIT = 200;
-
-/**
- * Public draft record returned by list/get/save. Matches the SDK
- * CHANNEL_DRAFT_SCHEMA: the required `message` field carries the message
- * DIGEST (never the plaintext body). `webhook` is always '[redacted]' when set.
- * `messageDigest` is emitted ONLY by `get` (whose output schema permits
- * additional properties); strict list/save records omit it.
- */
-export interface DraftRecord {
-  version: number;
-  id: string;
-  createdAt: string; // ISO-8601
-  updatedAt: string; // ISO-8601
-  status: DraftStatus;
-  message: string; // sha256First(body, 12) digest — plaintext body is NEVER transmitted
-  title?: string;
-  channel?: string;
-  route?: string;
-  webhook?: string; // '[redacted]' when a webhook is stored, else omitted
-  link?: string;
-  tags?: string[];
-  sentResponseId?: string;
-  sendError?: string;
-}
-
-/** Normalized input accepted by upsert(). `message` is the FULL plaintext body. */
-export interface DraftSaveInput {
-  id?: string;
-  version?: number;
-  title?: string;
-  message: string;
-  channel?: string;
-  route?: string;
-  webhook?: string;
-  link?: string;
-  tags?: string[];
-  status?: DraftStatus;
-  createdAt?: string;
-  /**
-   * Caller-supplied last-modified timestamp (ISO-8601). When provided it is
-   * persisted verbatim, enabling the sync contract's 'most recent updatedAt
-   * wins' conflict model; when omitted the store stamps updatedAt = now().
-   */
-  updatedAt?: string;
-}
-
-export interface DraftListQuery {
-  status?: DraftStatus;
-  limit?: number;
-}
-
-export interface DraftSaveResult {
-  draft: DraftRecord;
-  created: boolean;
-}
-
-export interface DraftSyncStoreOptions {
-  workingDirectory: string;
-  cipher: AtRestCipher;
-  /** Override the sqlite filename (tests). Defaults to 'drafts.sqlite'. */
-  fileName?: string;
-  /** UUID generator injection point (tests). Defaults to crypto.randomUUID. */
-  generateId?: () => string;
-  /** Clock injection point (tests). Defaults to () => new Date().toISOString(). */
-  now?: () => string;
-}
-
-const SCHEMA: string[] = [
-  `CREATE TABLE IF NOT EXISTS drafts (
-     id TEXT PRIMARY KEY,
-     version INTEGER NOT NULL,
-     createdAt TEXT NOT NULL,
-     updatedAt TEXT NOT NULL,
-     status TEXT NOT NULL,
-     title TEXT,
-     bodyEnc TEXT NOT NULL,
-     messageDigest TEXT NOT NULL,
-     channel TEXT,
-     route TEXT,
-     webhookEnc TEXT,
-     link TEXT,
-     tags TEXT,
-     sentResponseId TEXT,
-     sendError TEXT
-   )`,
-  'CREATE INDEX IF NOT EXISTS idx_drafts_status ON drafts (status)',
-  'CREATE INDEX IF NOT EXISTS idx_drafts_updatedAt ON drafts (updatedAt)',
-];
-
-interface DraftRow {
-  id: string;
-  version: number;
-  createdAt: string;
-  updatedAt: string;
-  status: string;
-  title: string | null;
-  messageDigest: string;
-  channel: string | null;
-  route: string | null;
-  webhookEnc: string | null;
-  link: string | null;
-  tags: string | null;
-  sentResponseId: string | null;
-  sendError: string | null;
-}
-
-function nullable(value: string | undefined): string | null {
-  return value === undefined ? null : value;
-}
-
-function parseTags(raw: string | null): string[] | undefined {
-  if (raw === null || raw === '') return undefined;
-  try {
-    const parsed = JSON.parse(raw) as unknown;
-    if (Array.isArray(parsed)) {
-      const tags = parsed.filter((t): t is string => typeof t === 'string');
-      return tags.length > 0 ? tags : undefined;
-    }
-  } catch {
-    // Corrupt tags column — treat as absent rather than throwing on read.
-  }
-  return undefined;
-}
-
-function normalizeStatus(status: DraftStatus | undefined): DraftStatus {
-  return status ?? 'draft';
-}
-
-function normalizeVersion(version: number | undefined): number {
-  if (version === undefined || !Number.isFinite(version)) return DEFAULT_DRAFT_VERSION;
-  const floored = Math.floor(version);
-  return floored < 1 ? DEFAULT_DRAFT_VERSION : floored;
-}
-
-/**
- * Server-side mirror of agent drafts. Wraps HandlerSqliteStore; all body and
- * webhook material is encrypted at rest via the injected AtRestCipher.
- */
-export class DraftSyncStore {
-  private readonly store: HandlerSqliteStore;
-  private readonly cipher: AtRestCipher;
-  private readonly generateId: () => string;
-  private readonly now: () => string;
-  private initialized = false;
-
-  constructor(options: DraftSyncStoreOptions) {
-    this.store = new HandlerSqliteStore({
-      workingDirectory: options.workingDirectory,
-      fileName: options.fileName ?? 'drafts.sqlite',
-      schema: SCHEMA,
-    });
-    this.cipher = options.cipher;
-    this.generateId = options.generateId ?? (() => crypto.randomUUID());
-    this.now = options.now ?? (() => new Date().toISOString());
-  }
-
-  get dbPath(): string {
-    return this.store.dbPath;
-  }
-
-  async init(): Promise<void> {
-    if (this.initialized) return;
-    await this.store.init();
-    this.initialized = true;
-  }
-
-  /** Persist the in-memory db to disk (atomic tmp+rename via the base store). */
-  async save(): Promise<void> {
-    await this.store.save();
-  }
-
-  close(): void {
-    this.store.close();
-    this.initialized = false;
-  }
-
-  /**
-   * Create (no id) or update (id present) a draft. Encrypts the body and
-   * webhook at rest, computes messageDigest, preserves createdAt on update, and
-   * sets updatedAt to input.updatedAt when present (enabling 'most recent
-   * updatedAt wins') or now() otherwise.
-   *
-   * FULL-REPLACE SEMANTICS (intentional, per the full-snapshot sync contract):
-   * every caller-supplied field is a complete snapshot, NOT a partial patch.
-   * The ON CONFLICT UPDATE SET clause assigns each column from the incoming row,
-   * so an OMITTED optional field is CLEARED on update (webhookEnc/tags/title/
-   * channel/route/link → NULL). The ONLY exceptions are sentResponseId/
-   * sendError, which are owned by the send pipeline and survive a save().
-   */
-  async upsert(input: DraftSaveInput): Promise<DraftSaveResult> {
-    const existing = input.id !== undefined ? this.getRow(input.id) : null;
-    const created = existing === null;
-    const id = existing?.id ?? input.id ?? this.generateId();
-    const timestamp = this.now();
-    const createdAt = existing?.createdAt ?? input.createdAt ?? timestamp;
-    const updatedAt = input.updatedAt ?? timestamp;
-    const status = normalizeStatus(input.status);
-    const version = normalizeVersion(input.version);
-
-    const bodyEnc = await this.cipher.encrypt(input.message);
-    const messageDigest = sha256First(input.message, DRAFT_MESSAGE_DIGEST_HEX);
-    const webhookEnc =
-      input.webhook !== undefined && input.webhook !== ''
-        ? await this.cipher.encrypt(input.webhook)
-        : null;
-    const tagsJson =
-      input.tags !== undefined && input.tags.length > 0
-        ? JSON.stringify(input.tags)
-        : null;
-
-    this.store.run(
-      `INSERT INTO drafts (
-         id, version, createdAt, updatedAt, status, title, bodyEnc, messageDigest,
-         channel, route, webhookEnc, link, tags, sentResponseId, sendError
-       ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
-       ON CONFLICT(id) DO UPDATE SET
-         version = excluded.version,
-         updatedAt = excluded.updatedAt,
-         status = excluded.status,
-         title = excluded.title,
-         bodyEnc = excluded.bodyEnc,
-         messageDigest = excluded.messageDigest,
-         channel = excluded.channel,
-         route = excluded.route,
-         webhookEnc = excluded.webhookEnc,
-         link = excluded.link,
-         tags = excluded.tags`,
-      [
-        id,
-        version,
-        createdAt,
-        updatedAt,
-        status,
-        nullable(input.title),
-        bodyEnc,
-        messageDigest,
-        nullable(input.channel),
-        nullable(input.route),
-        webhookEnc,
-        nullable(input.link),
-        tagsJson,
-        // sentResponseId / sendError are owned by the send pipeline, not save().
-        // On update they are preserved (omitted from UPDATE SET); on insert NULL.
-        null,
-        null,
-      ],
-    );
-
-    const row = this.getRow(id);
-    return { draft: toRecord(row ?? this.fallbackRow(id, version, createdAt, updatedAt, status, messageDigest, webhookEnc, input)), created };
-  }
-
-  /** List drafts, newest-updated first, optionally filtered by status. */
-  list(query: DraftListQuery = {}): DraftRecord[] {
-    const limit = clampLimit(query.limit);
-    const rows =
-      query.status !== undefined
-        ? this.store.all<DraftRow>(
-            `SELECT id, version, createdAt, updatedAt, status, title, messageDigest,
-                    channel, route, webhookEnc, link, tags, sentResponseId, sendError
-             FROM drafts WHERE status = ? ORDER BY updatedAt DESC, id ASC LIMIT ?`,
-            [query.status, limit],
-          )
-        : this.store.all<DraftRow>(
-            `SELECT id, version, createdAt, updatedAt, status, title, messageDigest,
-                    channel, route, webhookEnc, link, tags, sentResponseId, sendError
-             FROM drafts ORDER BY updatedAt DESC, id ASC LIMIT ?`,
-            [limit],
-          );
-    return rows.map((row) => toRecord(row));
-  }
-
-  /** Total number of stored drafts (optionally status-filtered). */
-  count(status?: DraftStatus): number {
-    const row =
-      status !== undefined
-        ? this.store.get<{ n: number }>('SELECT COUNT(*) AS n FROM drafts WHERE status = ?', [status])
-        : this.store.get<{ n: number }>('SELECT COUNT(*) AS n FROM drafts');
-    return row?.n ?? 0;
-  }
-
-  /** Fetch a single draft as a redacted record, or null when absent. */
-  get(id: string): DraftRecord | null {
-    const row = this.getRow(id);
-    return row === null ? null : toRecord(row);
-  }
-
-  /** Delete a draft. Returns true when a row was removed. */
-  delete(id: string): boolean {
-    const existed = this.getRow(id) !== null;
-    if (existed) {
-      this.store.run('DELETE FROM drafts WHERE id = ?', [id]);
-    }
-    return existed;
-  }
-
-  private getRow(id: string): DraftRow | null {
-    return this.store.get<DraftRow>(
-      `SELECT id, version, createdAt, updatedAt, status, title, messageDigest,
-              channel, route, webhookEnc, link, tags, sentResponseId, sendError
-       FROM drafts WHERE id = ?`,
-      [id],
-    );
-  }
-
-  // Defensive synthesis if a read-back ever returns null (should not happen for
-  // the row we just wrote); keeps upsert total even under a degraded backend.
-  private fallbackRow(
-    id: string,
-    version: number,
-    createdAt: string,
-    updatedAt: string,
-    status: DraftStatus,
-    messageDigest: string,
-    webhookEnc: string | null,
-    input: DraftSaveInput,
-  ): DraftRow {
-    return {
-      id,
-      version,
-      createdAt,
-      updatedAt,
-      status,
-      title: nullable(input.title),
-      messageDigest,
-      channel: nullable(input.channel),
-      route: nullable(input.route),
-      webhookEnc,
-      link: nullable(input.link),
-      tags:
-        input.tags !== undefined && input.tags.length > 0
-          ? JSON.stringify(input.tags)
-          : null,
-      sentResponseId: null,
-      sendError: null,
-    };
-  }
-}
-
-function clampLimit(limit: number | undefined): number {
-  if (limit === undefined || !Number.isFinite(limit)) return DEFAULT_DRAFT_LIST_LIMIT;
-  const floored = Math.floor(limit);
-  if (floored < 1) return 1;
-  if (floored > MAX_DRAFT_LIST_LIMIT) return MAX_DRAFT_LIST_LIMIT;
-  return floored;
-}
-
-/**
- * Map a stored row to a wire record. The required `message` field carries the
- * DIGEST (never plaintext); the webhook is redacted; tags are parsed.
- */
-export function toRecord(row: DraftRow): DraftRecord {
-  const record: DraftRecord = {
-    version: row.version,
-    id: row.id,
-    createdAt: row.createdAt,
-    updatedAt: row.updatedAt,
-    status: row.status as DraftStatus,
-    message: row.messageDigest,
-  };
-  if (row.title !== null) record.title = row.title;
-  if (row.channel !== null) record.channel = row.channel;
-  if (row.route !== null) record.route = row.route;
-  // Webhook is encrypted at rest; reads ALWAYS redact. Presence of webhookEnc
-  // means a webhook exists → emit '[redacted]'; the raw URL never leaves here.
-  const redacted = redactWebhook(row.webhookEnc);
-  if (redacted !== undefined) record.webhook = redacted;
-  if (row.link !== null) record.link = row.link;
-  const tags = parseTags(row.tags);
-  if (tags !== undefined) record.tags = tags;
-  if (row.sentResponseId !== null) record.sentResponseId = row.sentResponseId;
-  if (row.sendError !== null) record.sendError = row.sendError;
-  return record;
-}

package/src/daemon/handlers/drafts/index.ts

@@ -1,17 +0,0 @@
-/**
- * channels.drafts.* handler surface barrel.
- *
- * Re-exports only the concrete register entrypoint and the store/types other
- * code may need. It imports concrete submodules (no project index barrels), so
- * it introduces no import cycle.
- */
-export { registerDraftMethods } from './register.ts';
-export type { RegisterDraftsOptions } from './register.ts';
-export { DraftSyncStore, sha256First, redactWebhook } from './draft-store.ts';
-export type {
-  DraftListQuery,
-  DraftRecord,
-  DraftSaveInput,
-  DraftSaveResult,
-  DraftStatus,
-} from './draft-store.ts';