chore: Commit

14 files changed, 257 insertions, 551 deletions

diff --git a/crates/daemon/src/aclient/api_client.rs b/crates/daemon/src/aclient/api_client.rs
index c0688cf9..954426b4 100644
--- a/crates/daemon/src/aclient/api_client.rs
+++ b/crates/daemon/src/aclient/api_client.rs
@@ -39,7 +39,7 @@ fn make_url(address: &str, path: &str, user_id: Uuid) -> Result<String> {
     Ok(url.to_string())
 }
 
-pub(crate) fn ensure_version(response: &Response) -> Result<bool> {
+fn ensure_version(response: &Response) -> Result<bool> {
     let version = response.headers().get(ATUIN_HEADER_VERSION);
 
     let version = if let Some(version) = version {
@@ -141,7 +141,7 @@ impl<'a> Client<'a> {
         })
     }
 
-    pub(crate) async fn delete_store(&self) -> Result<()> {
+    async fn delete_store(&self) -> Result<()> {
         let url = make_url(self.sync_addr, "/store", self.user_id)?;
         let url = Url::parse(url.as_str())?;
 
diff --git a/crates/daemon/src/aclient/database/mod.rs b/crates/daemon/src/aclient/database/mod.rs
index cdf71065..9da943ca 100644
--- a/crates/daemon/src/aclient/database/mod.rs
+++ b/crates/daemon/src/aclient/database/mod.rs
@@ -12,8 +12,8 @@ use sqlx::{
 };
 use time::OffsetDateTime;
 use tracing::debug;
-use turtle::history::{History, HistoryId, get_host_user};
-use turtle_common::utils;
+use turtle::history::{History, HistoryId};
+use turtle_common::utils::{self, get_host_user};
 use uuid::Uuid;
 
 use crate::aclient::{
@@ -25,46 +25,29 @@ use crate::aclient::{settings::Settings, utils::setup_db};
 
 #[derive(Clone)]
 pub(crate) struct Context {
-    pub(crate) session: String,
-    pub(crate) cwd: String,
-    pub(crate) hostname: String,
-    pub(crate) host_id: String,
-    pub(crate) git_root: Option<PathBuf>,
+    session: String,
+    cwd: String,
+    hostname: String,
+    host_id: String,
+    git_root: Option<PathBuf>,
 }
 
 #[derive(Default, Clone)]
-pub(crate) struct OptFilters {
-    pub(crate) exit: Option<i64>,
-    pub(crate) exclude_exit: Option<i64>,
-    pub(crate) cwd: Option<String>,
-    pub(crate) exclude_cwd: Option<String>,
-    pub(crate) before: Option<String>,
-    pub(crate) after: Option<String>,
-    pub(crate) limit: Option<i64>,
-    pub(crate) offset: Option<i64>,
-    pub(crate) reverse: bool,
-    pub(crate) include_duplicates: bool,
-}
-
-pub(crate) async fn current_context(session: String) -> eyre::Result<Context> {
-    // TODO(@bpeetz): More of this needs to be moved to the client <2026-07-20>
-
-    let hostname = get_host_user();
-    let cwd = utils::get_current_dir();
-    let host_id = Settings::host_id().await?;
-    let git_root = utils::in_git_repo(cwd.as_str());
-
-    Ok(Context {
-        session,
-        hostname,
-        cwd,
-        git_root,
-        host_id: host_id.0.as_simple().to_string(),
-    })
+struct OptFilters {
+    exit: Option<i64>,
+    exclude_exit: Option<i64>,
+    cwd: Option<String>,
+    exclude_cwd: Option<String>,
+    before: Option<String>,
+    after: Option<String>,
+    limit: Option<i64>,
+    offset: Option<i64>,
+    reverse: bool,
+    include_duplicates: bool,
 }
 
 impl Context {
-    pub(crate) fn from_history(entry: &History) -> Self {
+    fn from_history(entry: &History) -> Self {
         Self {
             session: entry.session.clone(),
             cwd: entry.cwd.clone(),
@@ -88,12 +71,12 @@ fn get_session_start_time(session_id: &str) -> Option<i64> {
 // Intended for use on a developer machine and not a sync server.
 // TODO: implement IntoIterator
 #[derive(Debug, Clone)]
-pub struct ClientSqlite {
-    pub(crate) pool: SqlitePool,
+pub(crate) struct ClientSqlite {
+    pool: SqlitePool,
 }
 
 impl ClientSqlite {
-    pub async fn new(path: impl AsRef<Path>, timeout: f64) -> Result<Self> {
+    pub(crate) async fn new(path: impl AsRef<Path>, timeout: f64) -> Result<Self> {
         fn mk_opts(path: &str) -> Result<SqliteConnectOptions> {
             let opts = SqliteConnectOptions::from_str(path)?
                 .journal_mode(SqliteJournalMode::Wal)
@@ -220,7 +203,7 @@ impl ClientSqlite {
         Ok(())
     }
 
-    pub(crate) async fn load(&self, id: &str) -> Result<Option<History>> {
+    async fn load(&self, id: &str) -> Result<Option<History>> {
         debug!("loading history item {}", id);
 
         let res = sqlx::query("select * from history where id = ?1")
@@ -232,11 +215,10 @@ impl ClientSqlite {
         Ok(res)
     }
 
-    // make a unique list, that only shows the *newest* version of things
+    /// make a unique list, that only shows the *newest* version of things
     pub(crate) async fn list(
         &self,
-        filters: &[FilterMode],
-        context: &Context,
+        filters: Option<(&Context, &[FilterMode])>,
         max: Option<usize>,
         unique: bool,
         include_deleted: bool,
@@ -249,28 +231,30 @@ impl ClientSqlite {
             query.and_where_is_null("deleted_at");
         }
 
-        let git_root = context.git_root.clone().map_or_else(
-            || context.cwd.clone(),
-            |git_root| git_root.to_str().unwrap_or("/").to_string(),
-        );
+        if let Some((context, filters)) = filters {
+            let git_root = context.git_root.clone().map_or_else(
+                || context.cwd.clone(),
+                |git_root| git_root.to_str().unwrap_or("/").to_string(),
+            );
 
-        let session_start = get_session_start_time(&context.session);
+            let session_start = get_session_start_time(&context.session);
 
-        for filter in filters {
-            match filter {
-                FilterMode::Global => &mut query,
-                FilterMode::Host => query.and_where_eq("hostname", quote(&context.hostname)),
-                FilterMode::Session => query.and_where_eq("session", quote(&context.session)),
-                FilterMode::SessionPreload => {
-                    query.and_where_eq("session", quote(&context.session));
-                    if let Some(session_start) = session_start {
-                        query.or_where_lt("timestamp", session_start);
+            for filter in filters {
+                match filter {
+                    FilterMode::Global => &mut query,
+                    FilterMode::Host => query.and_where_eq("hostname", quote(&context.hostname)),
+                    FilterMode::Session => query.and_where_eq("session", quote(&context.session)),
+                    FilterMode::SessionPreload => {
+                        query.and_where_eq("session", quote(&context.session));
+                        if let Some(session_start) = session_start {
+                            query.or_where_lt("timestamp", session_start);
+                        }
+                        &mut query
                     }
-                    &mut query
-                }
-                FilterMode::Directory => query.and_where_eq("cwd", quote(&context.cwd)),
-                FilterMode::Workspace => query.and_where_like_left("cwd", &git_root),
-            };
+                    FilterMode::Directory => query.and_where_eq("cwd", quote(&context.cwd)),
+                    FilterMode::Workspace => query.and_where_like_left("cwd", &git_root),
+                };
+            }
         }
 
         if unique {
@@ -310,7 +294,7 @@ impl ClientSqlite {
         Ok(res)
     }
 
-    pub(crate) async fn last(&self) -> Result<Option<History>> {
+    async fn last(&self) -> Result<Option<History>> {
         let res = sqlx::query(
             "select * from history where duration >= 0 order by timestamp desc limit 1",
         )
@@ -321,7 +305,7 @@ impl ClientSqlite {
         Ok(res)
     }
 
-    pub(crate) async fn history_count(&self, include_deleted: bool) -> Result<i64> {
+    async fn history_count(&self, include_deleted: bool) -> Result<i64> {
         let query = if include_deleted {
             "select count(1) from history"
         } else {
@@ -336,7 +320,7 @@ impl ClientSqlite {
     // Could maybe break it down to a searchparams struct or smth but that feels a little... pointless.
     // Been debating maybe a DSL for search? eg "before:time limit:1 the query"
     #[expect(clippy::too_many_lines)]
-    pub(crate) async fn search(
+    async fn search(
         &self,
         search_mode: SearchMode,
         filter: FilterMode,
@@ -492,7 +476,7 @@ impl ClientSqlite {
         Ok(ordering::reorder_fuzzy(search_mode, orig_query, res))
     }
 
-    pub(crate) async fn query_history(&self, query: &str) -> Result<Vec<History>> {
+    async fn query_history(&self, query: &str) -> Result<Vec<History>> {
         let res = sqlx::query(query)
             .map(Self::query_history_inner)
             .fetch_all(&self.pool)
@@ -501,7 +485,7 @@ impl ClientSqlite {
         Ok(res)
     }
 
-    pub(crate) async fn all_with_count(&self) -> Result<Vec<(History, i32)>> {
+    async fn all_with_count(&self) -> Result<Vec<(History, i32)>> {
         debug!("listing history");
 
         let mut query = SqlBuilder::select_from(SqlName::new("history").alias("h").baquoted());
@@ -539,7 +523,7 @@ impl ClientSqlite {
         Ok(res)
     }
 
-    pub(crate) fn all_paged(&self, page_size: usize, include_deleted: bool, unique: bool) -> Paged {
+    fn all_paged(&self, page_size: usize, include_deleted: bool, unique: bool) -> Paged {
         Paged::new(self.clone(), page_size, include_deleted, unique)
     }
 
@@ -555,7 +539,7 @@ impl ClientSqlite {
         Ok(())
     }
 
-    pub(crate) async fn stats(&self, h: &History) -> Result<HistoryStats> {
+    async fn stats(&self, h: &History) -> Result<HistoryStats> {
         // We select the previous in the session by time
         let mut prev = SqlBuilder::select_from("history");
         prev.field("*")
@@ -672,7 +656,7 @@ impl ClientSqlite {
         })
     }
 
-    pub(crate) async fn get_dups(&self, before: i64, dupkeep: u32) -> Result<Vec<History>> {
+    async fn get_dups(&self, before: i64, dupkeep: u32) -> Result<Vec<History>> {
         let res = sqlx::query(
             "SELECT * FROM (
                 SELECT *, ROW_NUMBER()
@@ -693,7 +677,7 @@ impl ClientSqlite {
     }
 }
 
-pub(crate) struct Paged {
+struct Paged {
     database: ClientSqlite,
     page_size: usize,
     last_id: Option<String>,
@@ -702,12 +686,7 @@ pub(crate) struct Paged {
 }
 
 impl Paged {
-    pub(crate) fn new(
-        database: ClientSqlite,
-        page_size: usize,
-        include_deleted: bool,
-        unique: bool,
-    ) -> Self {
+    fn new(database: ClientSqlite, page_size: usize, include_deleted: bool, unique: bool) -> Self {
         Self {
             database,
             page_size,
@@ -717,7 +696,7 @@ impl Paged {
         }
     }
 
-    pub(crate) async fn next(&mut self) -> Result<Option<Vec<History>>> {
+    async fn next(&mut self) -> Result<Option<Vec<History>>> {
         let mut query = SqlBuilder::select_from(SqlName::new("history").alias("h").baquoted());
 
         query.field("*").order_desc("id");
@@ -1220,12 +1199,12 @@ mod test {
     }
 }
 
-pub(crate) struct QueryTokenizer<'a> {
+struct QueryTokenizer<'a> {
     query: &'a str,
     last_pos: usize,
 }
 
-pub(crate) enum QueryToken<'a> {
+enum QueryToken<'a> {
     Match(&'a str, bool),
     MatchStart(&'a str, bool),
     MatchEnd(&'a str, bool),
@@ -1235,7 +1214,7 @@ pub(crate) enum QueryToken<'a> {
 }
 
 impl QueryToken<'_> {
-    pub(crate) fn has_uppercase(&self) -> bool {
+    fn has_uppercase(&self) -> bool {
         match self {
             Self::Match(term, _)
             | Self::MatchStart(term, _)
@@ -1245,7 +1224,7 @@ impl QueryToken<'_> {
         }
     }
 
-    pub(crate) fn is_inverse(&self) -> bool {
+    fn is_inverse(&self) -> bool {
         match self {
             Self::Match(_, inv)
             | Self::MatchStart(_, inv)
@@ -1257,7 +1236,7 @@ impl QueryToken<'_> {
 }
 
 impl<'a> QueryTokenizer<'a> {
-    pub(crate) fn new(query: &'a str) -> Self {
+    fn new(query: &'a str) -> Self {
         Self { query, last_pos: 0 }
     }
 }
diff --git a/crates/daemon/src/aclient/encryption.rs b/crates/daemon/src/aclient/encryption.rs
index 220ac74e..45e82ab3 100644
--- a/crates/daemon/src/aclient/encryption.rs
+++ b/crates/daemon/src/aclient/encryption.rs
@@ -11,7 +11,7 @@
 use std::io::prelude::Write;
 
 use base64::prelude::{BASE64_STANDARD, Engine};
-pub(crate) use crypto_secretbox::Key;
+use crypto_secretbox::Key;
 use crypto_secretbox::{KeyInit, XSalsa20Poly1305, aead::OsRng};
 use eyre::{Context, Result, bail, ensure, eyre};
 use fs_err as fs;
@@ -19,14 +19,14 @@ use rmp::Marker;
 
 use crate::aclient::settings::Settings;
 
-pub(crate) fn generate_encoded_key() -> Result<(Key, String)> {
+fn generate_encoded_key() -> Result<(Key, String)> {
     let key = XSalsa20Poly1305::generate_key(&mut OsRng);
     let encoded = encode_key(&key)?;
 
     Ok((key, encoded))
 }
 
-pub(crate) fn new_key(settings: &Settings) -> Result<Key> {
+fn new_key(settings: &Settings) -> Result<Key> {
     if settings.sync.encryption_key()?.is_some() {
         bail!("key already exists! cannot overwrite");
     } else if let Some(path) = settings.sync.encryption_key_path.as_ref() {
@@ -50,7 +50,7 @@ pub(crate) fn load_key(settings: &Settings) -> Result<Key> {
     }
 }
 
-pub(crate) fn encode_key(key: &Key) -> Result<String> {
+fn encode_key(key: &Key) -> Result<String> {
     let mut buf = vec![];
     rmp::encode::write_array_len(&mut buf, key.len() as u32)
         .wrap_err("could not encode key to message pack")?;
diff --git a/crates/daemon/src/aclient/history/mod.rs b/crates/daemon/src/aclient/history/mod.rs
index ea71dcf4..f9afa5e9 100644
--- a/crates/daemon/src/aclient/history/mod.rs
+++ b/crates/daemon/src/aclient/history/mod.rs
@@ -1,14 +1,10 @@
-use core::fmt::Formatter;
 use regex::RegexSet;
 use rmp::decode::DecodeStringError;
 use rmp::decode::ValueReadError;
 use rmp::{Marker, decode::Bytes};
-use std::env;
-use std::fmt::Display;
 use turtle::history::History;
 
 use turtle_common::record::DecryptedData;
-use turtle_common::utils::uuid_v7;
 
 use eyre::{Result, bail, eyre};
 
@@ -16,12 +12,12 @@ use time::OffsetDateTime;
 
 pub(crate) mod store;
 
-pub(crate) const HISTORY_VERSION_V0: &str = "v0";
-pub(crate) const HISTORY_VERSION_V1: &str = "v1";
+const HISTORY_VERSION_V0: &str = "v0";
+const HISTORY_VERSION_V1: &str = "v1";
 const HISTORY_RECORD_VERSION_V0: u16 = 0;
 const HISTORY_RECORD_VERSION_V1: u16 = 1;
-pub(crate) const HISTORY_VERSION: &str = HISTORY_VERSION_V1;
-pub(crate) const HISTORY_TAG: &str = "history";
+const HISTORY_VERSION: &str = HISTORY_VERSION_V1;
+const HISTORY_TAG: &str = "history";
 const HISTORY_AUTHOR_ENV: &str = "ATUIN_HISTORY_AUTHOR";
 const HISTORY_INTENT_ENV: &str = "ATUIN_HISTORY_INTENT";
 
@@ -45,7 +41,7 @@ pub(crate) struct HistoryStats {
     pub(crate) duration_over_time: Vec<(String, i64)>,
 }
 
-pub(crate) trait HistoryExt: Sized {
+trait HistoryExt: Sized {
     fn serialize(&self) -> Result<DecryptedData>;
     fn read_optional_string(bytes: &[u8]) -> Result<(Option<String>, &[u8])>;
     fn deserialize_v0(bytes: &[u8]) -> Result<Self>;
@@ -260,7 +256,7 @@ impl HistoryExt for History {
 }
 
 #[derive(Debug, Copy, Clone)]
-pub struct SettingsFilter<'a> {
+struct SettingsFilter<'a> {
     pub history: &'a RegexSet,
     pub cwd: &'a RegexSet,
     pub secrets: bool,
diff --git a/crates/daemon/src/aclient/history/store.rs b/crates/daemon/src/aclient/history/store.rs
index c62f9068..244725eb 100644
--- a/crates/daemon/src/aclient/history/store.rs
+++ b/crates/daemon/src/aclient/history/store.rs
@@ -15,13 +15,13 @@ use super::{HISTORY_TAG, HISTORY_VERSION, HISTORY_VERSION_V0};
 
 #[derive(Debug, Clone)]
 pub(crate) struct HistoryStore {
-    pub(crate) store: SqliteStore,
-    pub(crate) host_id: HostId,
-    pub(crate) encryption_key: [u8; 32],
+    store: SqliteStore,
+    host_id: HostId,
+    encryption_key: [u8; 32],
 }
 
 #[derive(Debug, Eq, PartialEq, Clone)]
-pub(crate) enum HistoryRecord {
+enum HistoryRecord {
     Create(History),   // Create a history record
     Delete(HistoryId), // Delete a history record, identified by ID
 }
@@ -39,7 +39,7 @@ impl HistoryRecord {
     /// twice.
     ///
     /// Deletion simply refers to the history by ID
-    pub(crate) fn serialize(&self) -> Result<DecryptedData> {
+    fn serialize(&self) -> Result<DecryptedData> {
         // probably don't actually need to use rmp here, but if we ever need to extend it, it's a
         // nice wrapper around raw byte stuff
         use rmp::encode;
@@ -65,7 +65,7 @@ impl HistoryRecord {
         Ok(DecryptedData(output))
     }
 
-    pub(crate) fn deserialize(bytes: &DecryptedData, version: &str) -> Result<Self> {
+    fn deserialize(bytes: &DecryptedData, version: &str) -> Result<Self> {
         use rmp::decode;
 
         fn error_report<E: std::fmt::Debug>(err: E) -> eyre::Report {
@@ -175,7 +175,7 @@ impl HistoryStore {
         Ok(())
     }
 
-    pub(crate) async fn delete(&self, id: HistoryId) -> Result<(RecordId, RecordIdx)> {
+    async fn delete(&self, id: HistoryId) -> Result<(RecordId, RecordIdx)> {
         let record = HistoryRecord::Delete(id);
 
         self.push_record(record).await
@@ -183,7 +183,7 @@ impl HistoryStore {
 
     /// Delete a batch of history entries via the record store.
     /// Returns the record IDs so the caller can run `incremental_build` when ready.
-    pub(crate) async fn delete_entries(
+    async fn delete_entries(
         &self,
         entries: impl IntoIterator<Item = History>,
     ) -> Result<Vec<RecordId>> {
@@ -203,7 +203,7 @@ impl HistoryStore {
         self.push_record(record).await
     }
 
-    pub(crate) async fn history(&self) -> Result<Vec<HistoryRecord>> {
+    async fn history(&self) -> Result<Vec<HistoryRecord>> {
         // Atm this loads all history into memory
         // Not ideal as that is potentially quite a lot, although history will be small.
         let records = self.store.all_tagged(HISTORY_TAG).await?;
@@ -226,7 +226,7 @@ impl HistoryStore {
         Ok(ret)
     }
 
-    pub(crate) async fn build(&self, database: &ClientSqlite) -> Result<()> {
+    async fn build(&self, database: &ClientSqlite) -> Result<()> {
         // I'd like to change how we rebuild and not couple this with the database, but need to
         // consider the structure more deeply. This will be easy to change.
 
@@ -298,7 +298,7 @@ impl HistoryStore {
     /// Get a list of history IDs that exist in the store
     /// Note: This currently involves loading all history into memory. This is not going to be a
     /// large amount in absolute terms, but do not all it in a hot loop.
-    pub(crate) async fn history_ids(&self) -> Result<HashSet<HistoryId>> {
+    async fn history_ids(&self) -> Result<HashSet<HistoryId>> {
         let history = self.history().await?;
 
         let ret = history
@@ -312,7 +312,7 @@ impl HistoryStore {
         Ok(ret)
     }
 
-    pub(crate) async fn init_store(&self, db: &ClientSqlite) -> Result<()> {
+    async fn init_store(&self, db: &ClientSqlite) -> Result<()> {
         todo!();
 
         // let pb = ProgressBar::new_spinner();
diff --git a/crates/daemon/src/aclient/meta.rs b/crates/daemon/src/aclient/meta.rs
index 00dabcce..ea660745 100644
--- a/crates/daemon/src/aclient/meta.rs
+++ b/crates/daemon/src/aclient/meta.rs
@@ -2,12 +2,12 @@ use std::path::Path;
 use std::str::FromStr;
 use std::time::Duration;
 
-use turtle_common::record::HostId;
 use eyre::{Result, eyre};
 use sqlx::sqlite::{SqliteConnectOptions, SqliteJournalMode, SqlitePool, SqlitePoolOptions};
 use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 use tokio::sync::OnceCell;
 use tracing::debug;
+use turtle_common::record::HostId;
 use uuid::Uuid;
 
 const KEY_HOST_ID: &str = "host_id";
@@ -71,7 +71,7 @@ impl MetaStore {
 
     // Generic key-value operations
 
-    pub(crate) async fn get(&self, key: &str) -> Result<Option<String>> {
+    async fn get(&self, key: &str) -> Result<Option<String>> {
         let row: Option<(String,)> = sqlx::query_as("SELECT value FROM meta WHERE key = ?1")
             .bind(key)
             .fetch_optional(&self.pool)
@@ -80,7 +80,7 @@ impl MetaStore {
         Ok(row.map(|r| r.0))
     }
 
-    pub(crate) async fn set(&self, key: &str, value: &str) -> Result<()> {
+    async fn set(&self, key: &str, value: &str) -> Result<()> {
         sqlx::query(
             "
             INSERT INTO meta (key, value, updated_at)
@@ -154,8 +154,8 @@ mod tests {
         store.set("foo", "baz").await.unwrap();
         assert_eq!(store.get("foo").await.unwrap(), Some("baz".to_string()));
 
-        store.delete("foo").await.unwrap();
-        assert_eq!(store.get("foo").await.unwrap(), None);
+        // store.delete("foo").await.unwrap();
+        // assert_eq!(store.get("foo").await.unwrap(), None);
     }
 
     #[tokio::test]
diff --git a/crates/daemon/src/aclient/mod.rs b/crates/daemon/src/aclient/mod.rs
index f2d14e01..fdadb81b 100644
--- a/crates/daemon/src/aclient/mod.rs
+++ b/crates/daemon/src/aclient/mod.rs
@@ -1,10 +1,10 @@
 pub(crate) mod database;
-pub mod history;
+pub(crate) mod encryption;
+pub(crate) mod history;
 pub(crate) mod record;
 pub(crate) mod settings;
 
-pub(crate) mod api_client;
-pub(crate) mod encryption;
-pub(crate) mod meta;
-pub(crate) mod ordering;
-pub(crate) mod utils;
+mod api_client;
+mod meta;
+mod ordering;
+mod utils;
diff --git a/crates/daemon/src/aclient/record/encryption.rs b/crates/daemon/src/aclient/record/encryption.rs
index 6851a99f..67f191e9 100644
--- a/crates/daemon/src/aclient/record/encryption.rs
+++ b/crates/daemon/src/aclient/record/encryption.rs
@@ -1,6 +1,3 @@
-use turtle_common::record::{
-    AdditionalData, DecryptedData, EncryptedData, Encryption, HostId, RecordId, RecordIdx,
-};
 use base64::{Engine, engine::general_purpose};
 use eyre::{Context, Result, ensure};
 use rusty_paserk::{Key, KeyId, Local, PieWrappedKey};
@@ -8,6 +5,9 @@ use rusty_paseto::core::{
     ImplicitAssertion, Key as DataKey, Local as LocalPurpose, Paseto, PasetoNonce, Payload, V4,
 };
 use serde::{Deserialize, Serialize};
+use turtle_common::record::{
+    AdditionalData, DecryptedData, EncryptedData, Encryption, HostId, RecordId, RecordIdx,
+};
 
 /// Use PASETO V4 Local encryption using the additional data as an implicit assertion.
 #[expect(non_camel_case_types)]
diff --git a/crates/daemon/src/aclient/record/mod.rs b/crates/daemon/src/aclient/record/mod.rs
index 2ace26f5..4e5774ea 100644
--- a/crates/daemon/src/aclient/record/mod.rs
+++ b/crates/daemon/src/aclient/record/mod.rs
@@ -1,4 +1,3 @@
 pub(crate) mod encryption;
+pub(crate) mod sqlite_store;
 pub(crate) mod sync;
-
-pub mod sqlite_store;
diff --git a/crates/daemon/src/aclient/record/sqlite_store.rs b/crates/daemon/src/aclient/record/sqlite_store.rs
index f2fc9d84..2186da54 100644
--- a/crates/daemon/src/aclient/record/sqlite_store.rs
+++ b/crates/daemon/src/aclient/record/sqlite_store.rs
@@ -24,12 +24,12 @@ use uuid::Uuid;
 use super::encryption::PASETO_V4;
 
 #[derive(Debug, Clone)]
-pub struct SqliteStore {
+pub(crate) struct SqliteStore {
     pool: SqlitePool,
 }
 
 impl SqliteStore {
-    pub async fn new(path: impl AsRef<Path>, timeout: f64) -> Result<Self> {
+    pub(crate) async fn new(path: impl AsRef<Path>, timeout: f64) -> Result<Self> {
         fn mk_opts(path: &str) -> sqlx::Result<SqliteConnectOptions> {
             let opts = SqliteConnectOptions::from_str(path)?
                 .journal_mode(SqliteJournalMode::Wal)
@@ -157,7 +157,7 @@ impl SqliteStore {
         Ok(res)
     }
 
-    pub(crate) async fn delete(&self, id: RecordId) -> Result<()> {
+    async fn delete(&self, id: RecordId) -> Result<()> {
         sqlx::query("delete from store where id = ?1")
             .bind(id.0.as_hyphenated().to_string())
             .execute(&self.pool)
@@ -166,7 +166,7 @@ impl SqliteStore {
         Ok(())
     }
 
-    pub(crate) async fn delete_all(&self) -> Result<()> {
+    async fn delete_all(&self) -> Result<()> {
         sqlx::query("delete from store").execute(&self.pool).await?;
 
         Ok(())
@@ -192,15 +192,11 @@ impl SqliteStore {
         }
     }
 
-    pub(crate) async fn first(
-        &self,
-        host: HostId,
-        tag: &str,
-    ) -> Result<Option<Record<EncryptedData>>> {
+    async fn first(&self, host: HostId, tag: &str) -> Result<Option<Record<EncryptedData>>> {
         self.idx(host, tag, 0).await
     }
 
-    pub(crate) async fn len_tag(&self, tag: &str) -> Result<u64> {
+    async fn len_tag(&self, tag: &str) -> Result<u64> {
         let res: Result<(i64,), sqlx::Error> =
             sqlx::query_as("select count(*) from store where tag=?1")
                 .bind(tag)
@@ -235,7 +231,7 @@ impl SqliteStore {
     }
 
     /// Get the first record for a given host and tag
-    pub(crate) async fn idx(
+    async fn idx(
         &self,
         host: HostId,
         tag: &str,
@@ -293,7 +289,7 @@ impl SqliteStore {
 
     /// Reencrypt every single item in this store with a new key
     /// Be careful - this may mess with sync.
-    pub(crate) async fn re_encrypt(&self, old_key: &[u8; 32], new_key: &[u8; 32]) -> Result<()> {
+    async fn re_encrypt(&self, old_key: &[u8; 32], new_key: &[u8; 32]) -> Result<()> {
         // Load all the records
         // In memory like some of the other code here
         // This will never be called in a hot loop, and only under the following circumstances
@@ -332,7 +328,7 @@ impl SqliteStore {
 
     /// Verify that every record in this store can be decrypted with the current key
     /// Someday maybe also check each tag/record can be deserialized, but not for now.
-    pub(crate) async fn verify(&self, key: &[u8; 32]) -> Result<()> {
+    async fn verify(&self, key: &[u8; 32]) -> Result<()> {
         let all = self.load_all().await?;
 
         all.into_iter()
@@ -344,7 +340,7 @@ impl SqliteStore {
 
     /// Verify that every record in this store can be decrypted with the current key
     /// Someday maybe also check each tag/record can be deserialized, but not for now.
-    pub(crate) async fn purge(&self, key: &[u8; 32]) -> Result<()> {
+    async fn purge(&self, key: &[u8; 32]) -> Result<()> {
         let all = self.load_all().await?;
 
         for record in &all {
diff --git a/crates/daemon/src/aclient/record/sync.rs b/crates/daemon/src/aclient/record/sync.rs
index 94764f67..79239b99 100644
--- a/crates/daemon/src/aclient/record/sync.rs
+++ b/crates/daemon/src/aclient/record/sync.rs
@@ -9,8 +9,8 @@ use super::encryption::PASETO_V4;
 use crate::aclient::record::sqlite_store::SqliteStore;
 use crate::aclient::{api_client::Client, settings::Settings};
 
-use turtle_common::record::{Diff, HostId, RecordId, RecordIdx, RecordStatus};
 use indicatif::{ProgressBar, ProgressState, ProgressStyle};
+use turtle_common::record::{Diff, HostId, RecordId, RecordIdx, RecordStatus};
 
 #[derive(Error, Debug)]
 pub(crate) enum SyncError {
@@ -36,7 +36,7 @@ pub(crate) enum SyncError {
 }
 
 #[derive(Debug, Eq, PartialEq)]
-pub(crate) enum Operation {
+enum Operation {
     // Either upload or download until the states matches the below
     Upload {
         local: RecordIdx,
@@ -56,7 +56,7 @@ pub(crate) enum Operation {
     },
 }
 
-pub(crate) fn build_client(settings: &Settings) -> Result<Client<'_>, SyncError> {
+fn build_client(settings: &Settings) -> Result<Client<'_>, SyncError> {
     Client::new(
         &settings.sync.address,
         settings.network_connect_timeout,
@@ -71,7 +71,7 @@ pub(crate) fn build_client(settings: &Settings) -> Result<Client<'_>, SyncError>
     .map_err(|e| SyncError::OperationalError { msg: e.to_string() })
 }
 
-pub(crate) async fn diff(
+async fn diff(
     client: &Client<'_>,
     store: &SqliteStore,
 ) -> Result<(Vec<Diff>, RecordStatus), SyncError> {
@@ -94,10 +94,7 @@ pub(crate) async fn diff(
 // With the store as context, we can determine if a tail exists locally or not and therefore if it needs uploading or download.
 // In theory this could be done as a part of the diffing stage, but it's easier to reason
 // about and test this way
-pub(crate) fn operations(
-    diffs: Vec<Diff>,
-    _store: &SqliteStore,
-) -> Result<Vec<Operation>, SyncError> {
+fn operations(diffs: Vec<Diff>, _store: &SqliteStore) -> Result<Vec<Operation>, SyncError> {
     let mut operations = Vec::with_capacity(diffs.len());
 
     for diff in diffs {
@@ -283,7 +280,7 @@ async fn sync_download(
     Ok(ret)
 }
 
-pub(crate) async fn sync_remote(
+async fn sync_remote(
     client: &Client<'_>,
     operations: Vec<Operation>,
     local_store: &SqliteStore,
@@ -323,7 +320,7 @@ pub(crate) async fn sync_remote(
     Ok((uploaded, downloaded))
 }
 
-pub(crate) async fn check_encryption_key(
+async fn check_encryption_key(
     client: &Client<'_>,
     remote_index: &RecordStatus,
     encryption_key: &[u8; 32],
diff --git a/crates/daemon/src/aclient/settings/meta.rs b/crates/daemon/src/aclient/settings/meta.rs
index 7993ef6d..1c9b9cd1 100644
--- a/crates/daemon/src/aclient/settings/meta.rs
+++ b/crates/daemon/src/aclient/settings/meta.rs
@@ -2,7 +2,7 @@ use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Serialize, Deserialize, Clone)]
 pub(crate) struct Settings {
-    pub(crate) db_path: String,
+    pub(super) db_path: String,
 }
 
 impl Default for Settings {
diff --git a/crates/daemon/src/aclient/settings/mod.rs b/crates/daemon/src/aclient/settings/mod.rs
index 58afd17c..10c84f50 100644
--- a/crates/daemon/src/aclient/settings/mod.rs
+++ b/crates/daemon/src/aclient/settings/mod.rs
@@ -24,8 +24,7 @@ static DATA_DIR: OnceLock<PathBuf> = OnceLock::new();
 static META_CONFIG: OnceLock<(String, f64)> = OnceLock::new();
 static META_STORE: OnceCell<crate::aclient::meta::MetaStore> = OnceCell::const_new();
 
-pub(crate) mod meta;
-pub(crate) mod watcher;
+mod meta;
 
 #[derive(Clone, Debug, Deserialize, Copy, ValueEnum, PartialEq, Serialize)]
 pub(crate) enum SearchMode {
@@ -48,7 +47,7 @@ pub(crate) enum SearchMode {
 }
 
 impl SearchMode {
-    pub(crate) fn as_str(self) -> &'static str {
+    fn as_str(self) -> &'static str {
         match self {
             Self::Prefix => "PREFIX",
             Self::FullText => "FULLTXT",
@@ -57,7 +56,7 @@ impl SearchMode {
             Self::DaemonFuzzy => "DAEMON",
         }
     }
-    pub(crate) fn next(self, settings: &Settings) -> Self {
+    fn next(self, settings: &Settings) -> Self {
         match self {
             Self::Prefix => Self::FullText,
             // if the user is using skim, we go to skim
@@ -93,7 +92,7 @@ pub(crate) enum FilterMode {
 }
 
 impl FilterMode {
-    pub(crate) fn as_str(self) -> &'static str {
+    fn as_str(self) -> &'static str {
         match self {
             Self::Global => "GLOBAL",
             Self::Host => "HOST",
@@ -106,7 +105,7 @@ impl FilterMode {
 }
 
 #[derive(Clone, Debug, Deserialize, Copy, Serialize)]
-pub(crate) enum ExitMode {
+enum ExitMode {
     #[serde(rename = "return-original")]
     ReturnOriginal,
 
@@ -117,7 +116,7 @@ pub(crate) enum ExitMode {
 // FIXME: Can use upstream Dialect enum if https://github.com/stevedonovan/chrono-english/pull/16 is merged
 // FIXME: Above PR was merged, but dependency was changed to interim (fork of chrono-english) in the ... interim
 #[derive(Clone, Debug, Deserialize, Copy, Serialize)]
-pub(crate) enum Dialect {
+enum Dialect {
     #[serde(rename = "us")]
     Us,
 
@@ -141,7 +140,7 @@ impl From<Dialect> for interim::Dialect {
 ///
 /// See: <https://github.com/atuinsh/atuin/pull/1517#discussion_r1447516426>
 #[derive(Clone, Copy, Debug, Eq, PartialEq, DeserializeFromStr, Serialize)]
-pub(crate) struct Timezone(pub(crate) UtcOffset);
+struct Timezone(UtcOffset);
 impl fmt::Display for Timezone {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         self.0.fmt(f)
@@ -185,7 +184,7 @@ impl FromStr for Timezone {
 }
 
 #[derive(Clone, Debug, Deserialize, Copy, Serialize)]
-pub(crate) enum Style {
+enum Style {
     #[serde(rename = "auto")]
     Auto,
 
@@ -197,7 +196,7 @@ pub(crate) enum Style {
 }
 
 #[derive(Clone, Debug, Deserialize, Copy, Serialize)]
-pub(crate) enum WordJumpMode {
+enum WordJumpMode {
     #[serde(rename = "emacs")]
     Emacs,
 
@@ -206,7 +205,7 @@ pub(crate) enum WordJumpMode {
 }
 
 #[derive(Clone, Debug, Deserialize, Copy, PartialEq, Eq, ValueEnum, Serialize)]
-pub(crate) enum KeymapMode {
+enum KeymapMode {
     #[serde(rename = "emacs")]
     Emacs,
 
@@ -226,7 +225,7 @@ pub(crate) enum KeymapMode {
 // used in HashMap (https://stackoverflow.com/questions/67142663).  We instead
 // define an adapter type.
 #[derive(Clone, Debug, Deserialize, Copy, PartialEq, Eq, ValueEnum, Serialize)]
-pub(crate) enum CursorStyle {
+enum CursorStyle {
     #[serde(rename = "default")]
     DefaultUserShape,
 
@@ -250,13 +249,13 @@ pub(crate) enum CursorStyle {
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
-pub(crate) struct Stats {
+struct Stats {
     #[serde(default = "Stats::common_prefix_default")]
-    pub(crate) common_prefix: Vec<String>, // sudo, etc. commands we want to strip off
+    common_prefix: Vec<String>, // sudo, etc. commands we want to strip off
     #[serde(default = "Stats::common_subcommands_default")]
-    pub(crate) common_subcommands: Vec<String>, // kubectl, commands we should consider subcommands for
+    common_subcommands: Vec<String>, // kubectl, commands we should consider subcommands for
     #[serde(default = "Stats::ignored_commands_default")]
-    pub(crate) ignored_commands: Vec<String>, // cd, ls, etc. commands we want to completely hide from stats
+    ignored_commands: Vec<String>, // cd, ls, etc. commands we want to completely hide from stats
 }
 
 impl Stats {
@@ -310,19 +309,19 @@ impl Default for Stats {
 
 #[derive(Clone, Debug, Deserialize, Default, Serialize)]
 #[expect(clippy::struct_excessive_bools)]
-pub(crate) struct Keys {
-    pub(crate) scroll_exits: bool,
-    pub(crate) exit_past_line_start: bool,
-    pub(crate) accept_past_line_end: bool,
-    pub(crate) accept_past_line_start: bool,
-    pub(crate) accept_with_backspace: bool,
-    pub(crate) prefix: String,
+struct Keys {
+    scroll_exits: bool,
+    exit_past_line_start: bool,
+    accept_past_line_end: bool,
+    accept_past_line_start: bool,
+    accept_with_backspace: bool,
+    prefix: String,
 }
 
 impl Keys {
     /// The standard default values for all `[keys]` options.
     /// These match the config defaults set in `builder_with_data_dir()`.
-    pub(crate) fn standard_defaults() -> Self {
+    fn standard_defaults() -> Self {
         Self {
             scroll_exits: true,
             exit_past_line_start: true,
@@ -336,19 +335,19 @@ impl Keys {
 
 /// A single rule within a conditional keybinding config.
 #[derive(Clone, Debug, Deserialize, Serialize)]
-pub(crate) struct KeyRuleConfig {
+struct KeyRuleConfig {
     /// Optional condition expression (e.g. "cursor-at-start", "input-empty && no-results").
     /// If absent, the rule always matches.
     #[serde(default)]
-    pub(crate) when: Option<String>,
+    when: Option<String>,
     /// The action to perform (e.g. "exit", "cursor-left", "accept").
-    pub(crate) action: String,
+    action: String,
 }
 
 /// A keybinding config value: either a simple action string or an ordered list of conditional rules.
 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(untagged)]
-pub(crate) enum KeyBindingConfig {
+enum KeyBindingConfig {
     /// Simple unconditional binding: `"ctrl-c" = "return-original"`
     Simple(String),
     /// Conditional binding: `"left" = [{ when = "cursor-at-start", action = "exit" }, { action = "cursor-left" }]`
@@ -358,22 +357,22 @@ pub(crate) enum KeyBindingConfig {
 /// User-facing keymap configuration. Each mode maps key strings to bindings.
 /// Keys present here override the defaults for that key; unmentioned keys keep defaults.
 #[derive(Clone, Debug, Deserialize, Serialize, Default)]
-pub(crate) struct KeymapConfig {
+struct KeymapConfig {
     #[serde(default)]
-    pub(crate) emacs: HashMap<String, KeyBindingConfig>,
+    emacs: HashMap<String, KeyBindingConfig>,
     #[serde(default, rename = "vim-normal")]
-    pub(crate) vim_normal: HashMap<String, KeyBindingConfig>,
+    vim_normal: HashMap<String, KeyBindingConfig>,
     #[serde(default, rename = "vim-insert")]
-    pub(crate) vim_insert: HashMap<String, KeyBindingConfig>,
+    vim_insert: HashMap<String, KeyBindingConfig>,
     #[serde(default)]
-    pub(crate) inspector: HashMap<String, KeyBindingConfig>,
+    inspector: HashMap<String, KeyBindingConfig>,
     #[serde(default)]
-    pub(crate) prefix: HashMap<String, KeyBindingConfig>,
+    prefix: HashMap<String, KeyBindingConfig>,
 }
 
 impl KeymapConfig {
     /// Returns true if no keybinding overrides are configured in any mode.
-    pub(crate) fn is_empty(&self) -> bool {
+    fn is_empty(&self) -> bool {
         self.emacs.is_empty()
             && self.vim_normal.is_empty()
             && self.vim_insert.is_empty()
@@ -383,50 +382,50 @@ impl KeymapConfig {
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
-pub(crate) struct Preview {
-    pub(crate) strategy: PreviewStrategy,
+struct Preview {
+    strategy: PreviewStrategy,
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct Daemon {
+pub(crate) struct Daemon {
     /// The daemon will handle sync on an interval. How often to sync, in seconds.
-    pub sync_frequency: u64,
+    pub(crate) sync_frequency: u64,
 
     /// The path to the unix socket used by the daemon
-    pub socket_path: String,
+    pub(crate) socket_path: String,
 
     /// Path to the daemon pidfile used for process coordination.
-    pub pidfile_path: String,
+    pub(crate) pidfile_path: String,
 
     /// Use a socket passed via systemd's socket activation protocol, instead of the path
-    pub systemd_socket: bool,
+    pub(crate) systemd_socket: bool,
 
     /// The port that should be used for TCP on non unix systems
-    pub tcp_port: u64,
+    tcp_port: u64,
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
-pub(crate) struct Search {
+struct Search {
     /// The list of enabled filter modes, in order of priority.
-    pub(crate) filters: Vec<FilterMode>,
+    filters: Vec<FilterMode>,
 
     /// The recency score multiplier for the search index (default: 1.0).
     /// Values < 1.0 reduce weight, > 1.0 increase weight, 0.0 disables.
-    pub(crate) recency_score_multiplier: f64,
+    recency_score_multiplier: f64,
 
     /// The frequency score multiplier for the search index (default: 1.0).
     /// Values < 1.0 reduce weight, > 1.0 increase weight, 0.0 disables.
-    pub(crate) frequency_score_multiplier: f64,
+    frequency_score_multiplier: f64,
 
     /// The overall frecency score multiplier for the search index (default: 1.0).
     /// Applied after combining recency and frequency scores.
-    pub(crate) frecency_score_multiplier: f64,
+    frecency_score_multiplier: f64,
 }
 
 /// Log level for file logging. Maps to tracing's [`LevelFilter`].
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Deserialize, Serialize)]
 #[serde(rename_all = "lowercase")]
-pub(crate) enum LogLevel {
+enum LogLevel {
     Trace,
     Debug,
     #[default]
@@ -437,7 +436,7 @@ pub(crate) enum LogLevel {
 
 impl LogLevel {
     /// Convert to a tracing directive string for use with [`EnvFilter`].
-    pub(crate) fn as_directive(self) -> &'static str {
+    fn as_directive(self) -> &'static str {
         match self {
             Self::Trace => "trace",
             Self::Debug => "debug",
@@ -450,45 +449,45 @@ impl LogLevel {
 
 /// Configuration for a specific log type (search or daemon).
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
-pub(crate) struct LogConfig {
+struct LogConfig {
     /// Log file name (relative to dir) or absolute path.
-    pub(crate) file: String,
+    file: String,
 
     /// Override global enabled setting for this log type.
-    pub(crate) enabled: Option<bool>,
+    enabled: Option<bool>,
 
     /// Override global level setting for this log type.
-    pub(crate) level: Option<LogLevel>,
+    level: Option<LogLevel>,
 
     /// Override global retention days setting for this log type.
-    pub(crate) retention: Option<u64>,
+    retention: Option<u64>,
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
-pub(crate) struct Logs {
+struct Logs {
     /// Enable file logging globally. Defaults to true.
     #[serde(default = "Logs::default_enabled")]
-    pub(crate) enabled: bool,
+    enabled: bool,
 
     /// Directory for log files. Defaults to ~/.atuin/logs
-    pub(crate) dir: String,
+    dir: String,
 
     /// Default log level for file logging. Defaults to "info".
     /// Note: [`ATUIN_LOG`] environment variable overrides this.
     #[serde(default)]
-    pub(crate) level: LogLevel,
+    level: LogLevel,
 
     /// Default retention days for log files. Defaults to 4.
     #[serde(default = "Logs::default_retention")]
-    pub(crate) retention: u64,
+    retention: u64,
 
     /// Search log settings
     #[serde(default)]
-    pub(crate) search: LogConfig,
+    search: LogConfig,
 
     /// Daemon log settings
     #[serde(default)]
-    pub(crate) daemon: LogConfig,
+    daemon: LogConfig,
 }
 
 impl Default for Preview {
@@ -541,37 +540,37 @@ impl Logs {
 
     /// Returns whether search logging is enabled.
     /// Uses search-specific setting if set, otherwise falls back to global.
-    pub(crate) fn search_enabled(&self) -> bool {
+    fn search_enabled(&self) -> bool {
         self.search.enabled.unwrap_or(self.enabled)
     }
 
     /// Returns whether daemon logging is enabled.
     /// Uses daemon-specific setting if set, otherwise falls back to global.
-    pub(crate) fn daemon_enabled(&self) -> bool {
+    fn daemon_enabled(&self) -> bool {
         self.daemon.enabled.unwrap_or(self.enabled)
     }
 
     /// Returns the log level for search logging.
     /// Uses search-specific setting if set, otherwise falls back to global.
-    pub(crate) fn search_level(&self) -> LogLevel {
+    fn search_level(&self) -> LogLevel {
         self.search.level.unwrap_or(self.level)
     }
 
     /// Returns the log level for daemon logging.
     /// Uses daemon-specific setting if set, otherwise falls back to global.
-    pub(crate) fn daemon_level(&self) -> LogLevel {
+    fn daemon_level(&self) -> LogLevel {
         self.daemon.level.unwrap_or(self.level)
     }
 
     /// Returns the retention days for search logging.
     /// Uses search-specific setting if set, otherwise falls back to global.
-    pub(crate) fn search_retention(&self) -> u64 {
+    fn search_retention(&self) -> u64 {
         self.search.retention.unwrap_or(self.retention)
     }
 
     /// Returns the retention days for daemon logging.
     /// Uses daemon-specific setting if set, otherwise falls back to global.
-    pub(crate) fn daemon_retention(&self) -> u64 {
+    fn daemon_retention(&self) -> u64 {
         self.daemon.retention.unwrap_or(self.retention)
     }
 }
@@ -597,7 +596,7 @@ impl Default for Search {
 
 // The preview height strategy also takes max_preview_height into account.
 #[derive(Clone, Debug, Deserialize, Copy, PartialEq, Eq, ValueEnum, Serialize)]
-pub(crate) enum PreviewStrategy {
+enum PreviewStrategy {
     // Preview height is calculated for the length of the selected command.
     #[serde(rename = "auto")]
     Auto,
@@ -614,7 +613,7 @@ pub(crate) enum PreviewStrategy {
 /// Column types available for the interactive search UI.
 #[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq, Serialize)]
 #[serde(rename_all = "lowercase")]
-pub(crate) enum UiColumnType {
+enum UiColumnType {
     /// Command execution duration (e.g., "123ms")
     Duration,
     /// Relative time since execution (e.g., "59s ago")
@@ -636,7 +635,7 @@ pub(crate) enum UiColumnType {
 impl UiColumnType {
     /// Returns the default width for this column type (in characters).
     /// The Command column returns 0 as it expands to fill remaining space.
-    pub(crate) fn default_width(self) -> u16 {
+    fn default_width(self) -> u16 {
         match self {
             Self::Duration => 5,  // "814ms"
             Self::Time => 9,      // "459ms ago"
@@ -659,15 +658,15 @@ impl UiColumnType {
 /// A column configuration with type and optional custom width.
 /// Can be specified as just a string (uses default width) or as an object with type and width.
 #[derive(Clone, Debug, Serialize)]
-pub(crate) struct UiColumn {
-    pub(crate) column_type: UiColumnType,
-    pub(crate) width: u16,
+struct UiColumn {
+    column_type: UiColumnType,
+    width: u16,
     /// If true, this column expands to fill remaining space. Only one column should expand.
-    pub(crate) expand: bool,
+    expand: bool,
 }
 
 impl UiColumn {
-    pub(crate) fn new(column_type: UiColumnType) -> Self {
+    fn new(column_type: UiColumnType) -> Self {
         Self {
             width: column_type.default_width(),
             expand: column_type == UiColumnType::Command,
@@ -747,13 +746,13 @@ impl<'de> Deserialize<'de> for UiColumn {
 
 /// UI-specific settings for the interactive search.
 #[derive(Clone, Debug, Deserialize, Serialize)]
-pub(crate) struct Ui {
+struct Ui {
     /// Columns to display in interactive search, from left to right.
     /// The indicator column (" > ") is always shown first implicitly.
     /// The "command" column should be last as it expands to fill remaining space.
     /// Can be simple strings or objects with type and width.
     #[serde(default = "Ui::default_columns")]
-    pub(crate) columns: Vec<UiColumn>,
+    columns: Vec<UiColumn>,
 }
 
 impl Ui {
@@ -767,7 +766,7 @@ impl Ui {
 
     /// Validate the UI configuration.
     /// Returns an error if more than one column has expand = true.
-    pub(crate) fn validate(&self) -> Result<()> {
+    fn validate(&self) -> Result<()> {
         let expand_count = self.columns.iter().filter(|c| c.expand).count();
         if expand_count > 1 {
             bail!(
@@ -794,13 +793,13 @@ pub(crate) struct Sync {
     pub(crate) address: String,
 
     #[serde(default)]
-    pub(crate) frequency: String,
+    frequency: String,
 
     #[serde(default)]
     pub(crate) auto: bool,
 
     #[serde(default)]
-    pub(crate) user_id_path: Option<PathBuf>,
+    user_id_path: Option<PathBuf>,
 
     #[serde(default)]
     pub(crate) encryption_key_path: Option<PathBuf>,
@@ -853,93 +852,93 @@ impl Sync {
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[expect(clippy::struct_excessive_bools)]
-pub struct Settings {
-    pub(crate) data_dir: Option<String>,
-    pub(crate) dialect: Dialect,
-    pub(crate) timezone: Timezone,
-    pub(crate) style: Style,
+pub(crate) struct Settings {
+    data_dir: Option<String>,
+    dialect: Dialect,
+    timezone: Timezone,
+    style: Style,
 
-    pub db_path: String,
-    pub record_store_path: String,
-    pub(crate) search_mode: SearchMode,
-    pub(crate) filter_mode: Option<FilterMode>,
-    pub(crate) filter_mode_shell_up_key_binding: Option<FilterMode>,
-    pub(crate) search_mode_shell_up_key_binding: Option<SearchMode>,
-    pub(crate) shell_up_key_binding: bool,
-    pub(crate) inline_height: u16,
-    pub(crate) inline_height_shell_up_key_binding: Option<u16>,
-    pub(crate) invert: bool,
-    pub(crate) show_preview: bool,
-    pub(crate) max_preview_height: u16,
-    pub(crate) show_help: bool,
-    pub(crate) show_tabs: bool,
-    pub(crate) show_numeric_shortcuts: bool,
-    pub(crate) auto_hide_height: u16,
-    pub(crate) exit_mode: ExitMode,
-    pub(crate) keymap_mode: KeymapMode,
-    pub(crate) keymap_mode_shell: KeymapMode,
-    pub(crate) keymap_cursor: HashMap<String, CursorStyle>,
-    pub(crate) word_jump_mode: WordJumpMode,
-    pub(crate) word_chars: String,
-    pub(crate) scroll_context_lines: usize,
-    pub(crate) history_format: String,
-    pub(crate) strip_trailing_whitespace: bool,
-    pub(crate) prefers_reduced_motion: bool,
-    pub(crate) store_failed: bool,
-    pub(crate) no_mouse: bool,
+    pub(crate) db_path: String,
+    pub(crate) record_store_path: String,
+    search_mode: SearchMode,
+    filter_mode: Option<FilterMode>,
+    filter_mode_shell_up_key_binding: Option<FilterMode>,
+    search_mode_shell_up_key_binding: Option<SearchMode>,
+    shell_up_key_binding: bool,
+    inline_height: u16,
+    inline_height_shell_up_key_binding: Option<u16>,
+    invert: bool,
+    show_preview: bool,
+    max_preview_height: u16,
+    show_help: bool,
+    show_tabs: bool,
+    show_numeric_shortcuts: bool,
+    auto_hide_height: u16,
+    exit_mode: ExitMode,
+    keymap_mode: KeymapMode,
+    keymap_mode_shell: KeymapMode,
+    keymap_cursor: HashMap<String, CursorStyle>,
+    word_jump_mode: WordJumpMode,
+    word_chars: String,
+    scroll_context_lines: usize,
+    history_format: String,
+    strip_trailing_whitespace: bool,
+    prefers_reduced_motion: bool,
+    store_failed: bool,
+    no_mouse: bool,
 
     #[serde(with = "serde_regex", default = "RegexSet::empty", skip_serializing)]
-    pub(crate) history_filter: RegexSet,
+    history_filter: RegexSet,
 
     #[serde(with = "serde_regex", default = "RegexSet::empty", skip_serializing)]
-    pub(crate) cwd_filter: RegexSet,
+    cwd_filter: RegexSet,
 
-    pub(crate) secrets_filter: bool,
-    pub(crate) workspaces: bool,
-    pub(crate) ctrl_n_shortcuts: bool,
+    secrets_filter: bool,
+    workspaces: bool,
+    ctrl_n_shortcuts: bool,
 
     pub(crate) network_connect_timeout: u64,
     pub(crate) network_timeout: u64,
-    pub local_timeout: f64,
-    pub(crate) enter_accept: bool,
-    pub(crate) smart_sort: bool,
-    pub(crate) command_chaining: bool,
+    pub(crate) local_timeout: f64,
+    enter_accept: bool,
+    smart_sort: bool,
+    command_chaining: bool,
 
     #[serde(default)]
     pub(crate) sync: Sync,
 
     #[serde(default)]
-    pub(crate) stats: Stats,
+    stats: Stats,
 
     #[serde(default)]
-    pub(crate) keys: Keys,
+    keys: Keys,
 
     #[serde(default)]
-    pub(crate) keymap: KeymapConfig,
+    keymap: KeymapConfig,
 
     #[serde(default)]
-    pub(crate) preview: Preview,
+    preview: Preview,
 
     #[serde(default)]
-    pub daemon: Daemon,
+    pub(crate) daemon: Daemon,
 
     #[serde(default)]
-    pub(crate) search: Search,
+    search: Search,
 
     #[serde(default)]
-    pub(crate) ui: Ui,
+    ui: Ui,
 
     #[serde(default)]
-    pub(crate) logs: Logs,
+    logs: Logs,
 
     #[serde(default)]
-    pub(crate) meta: meta::Settings,
+    meta: meta::Settings,
 }
 
 impl Settings {
     // -- Meta store: lazily initialized on first access --
 
-    pub(crate) async fn meta_store() -> Result<&'static crate::aclient::meta::MetaStore> {
+    async fn meta_store() -> Result<&'static crate::aclient::meta::MetaStore> {
         META_STORE
             .get_or_try_init(|| async {
                 let (db_path, timeout) = META_CONFIG.get().ok_or_else(|| {
@@ -954,7 +953,7 @@ impl Settings {
         Self::meta_store().await?.host_id().await
     }
 
-    pub(crate) async fn last_sync() -> Result<OffsetDateTime> {
+    async fn last_sync() -> Result<OffsetDateTime> {
         Self::meta_store().await?.last_sync().await
     }
 
@@ -962,7 +961,7 @@ impl Settings {
         Self::meta_store().await?.save_sync_time().await
     }
 
-    pub(crate) fn default_filter_mode(&self, git_root: bool) -> FilterMode {
+    fn default_filter_mode(&self, git_root: bool) -> FilterMode {
         self.filter_mode
             .filter(|x| self.search.filters.contains(x))
             .or_else(|| {
@@ -979,7 +978,7 @@ impl Settings {
             .unwrap_or(FilterMode::Global)
     }
 
-    pub(crate) fn builder() -> Result<ConfigBuilder<DefaultState>> {
+    fn builder() -> Result<ConfigBuilder<DefaultState>> {
         Self::builder_with_data_dir(&utils::data_dir())
     }
 
@@ -1230,7 +1229,7 @@ impl Settings {
     /// Returns the effective value after merging defaults, config file, and
     /// environment — without the side-effects of full `Settings` construction
     /// (meta store init, path expansion, etc.).
-    pub(crate) fn get_config_value(key: &str) -> Result<String> {
+    fn get_config_value(key: &str) -> Result<String> {
         let config = Self::build_config()?;
         let value: config::Value = config
             .get(key)
@@ -1289,7 +1288,7 @@ impl Settings {
         }
     }
 
-    pub fn new() -> Result<Self> {
+    pub(crate) fn new() -> Result<Self> {
         let config = Self::build_config()?;
         let settings: Self = config
             .try_deserialize()
@@ -1312,7 +1311,7 @@ impl Settings {
             .map_err(|e| eyre!("failed to expand path: {}", e))
     }
 
-    pub(crate) fn paths_ok(&self) -> bool {
+    fn paths_ok(&self) -> bool {
         // TODO(@bpeetz): Add the `sync.*` paths <2026-06-11>
         let paths = [&self.db_path, &self.record_store_path, &self.meta.db_path];
         paths.iter().all(|p| !utils::broken_symlink(p))
diff --git a/crates/daemon/src/aclient/settings/watcher.rs b/crates/daemon/src/aclient/settings/watcher.rs
deleted file mode 100644
index 01d20855..00000000
--- a/crates/daemon/src/aclient/settings/watcher.rs
+++ /dev/null
@@ -1,260 +0,0 @@
-//! Config file watching for automatic settings reload.
-//!
-//! This module provides a `SettingsWatcher` that monitors the config file
-//! for changes and broadcasts updated settings via a `tokio::sync::watch` channel.
-//!
-//! # Example
-//!
-//! ```no_run
-//! use crate::aclient::settings::watcher::global_settings_watcher;
-//!
-//! async fn example() -> eyre::Result<()> {
-//!     let watcher = global_settings_watcher()?;
-//!     let mut rx = watcher.subscribe();
-//!
-//!     // React to settings changes
-//!     while rx.changed().await.is_ok() {
-//!         let settings = rx.borrow();
-//!         println!("Settings updated!");
-//!     }
-//!     Ok(())
-//! }
-//! ```
-
-use std::{
-    path::{Path, PathBuf},
-    sync::{Arc, OnceLock},
-    time::Duration,
-};
-
-use eyre::{Result, WrapErr};
-use log::{debug, error, info, warn};
-use notify::{
-    Config as NotifyConfig, RecommendedWatcher, RecursiveMode, Watcher,
-    event::{EventKind, ModifyKind},
-};
-use tokio::sync::watch;
-
-use super::Settings;
-
-/// Global singleton for the settings watcher.
-static SETTINGS_WATCHER: OnceLock<Result<SettingsWatcher, String>> = OnceLock::new();
-
-/// Get the global settings watcher singleton.
-///
-/// Initializes the watcher on first call. Subsequent calls return the same instance.
-/// The watcher monitors the config file for changes and broadcasts updates.
-pub(crate) fn global_settings_watcher() -> Result<&'static SettingsWatcher> {
-    let result = SETTINGS_WATCHER.get_or_init(|| SettingsWatcher::new().map_err(|e| e.to_string()));
-
-    match result {
-        Ok(watcher) => Ok(watcher),
-        Err(e) => Err(eyre::eyre!("{}", e)),
-    }
-}
-
-/// Watches the config file for changes and broadcasts updated settings.
-///
-/// Uses `notify` for cross-platform file watching and `tokio::sync::watch`
-/// for efficient broadcast to multiple subscribers.
-pub(crate) struct SettingsWatcher {
-    /// Receiver for settings updates. Clone this to subscribe.
-    rx: watch::Receiver<Arc<Settings>>,
-    /// Keeps the file watcher alive for the lifetime of this struct.
-    _watcher: RecommendedWatcher,
-}
-
-impl SettingsWatcher {
-    /// Create a new settings watcher.
-    ///
-    /// Loads initial settings and starts watching the config file for changes.
-    /// Changes are debounced (500ms) to avoid multiple reloads during saves.
-    pub(crate) fn new() -> Result<Self> {
-        let initial_settings = Arc::new(Settings::new()?);
-        let (tx, rx) = watch::channel(initial_settings);
-
-        let config_path = Self::config_path();
-        info!("starting config file watcher: {}", config_path.display());
-
-        let watcher = Self::create_watcher(tx, &config_path)?;
-
-        Ok(Self {
-            rx,
-            _watcher: watcher,
-        })
-    }
-
-    /// Subscribe to settings updates.
-    ///
-    /// Returns a receiver that will be notified when settings change.
-    /// Use `changed().await` to wait for the next update, then `borrow()`
-    /// to access the current settings.
-    pub(crate) fn subscribe(&self) -> watch::Receiver<Arc<Settings>> {
-        self.rx.clone()
-    }
-
-    /// Get the config file path.
-    fn config_path() -> PathBuf {
-        let config_dir = std::env::var("ATUIN_CONFIG_DIR")
-            .map_or_else(|_| turtle_common::utils::config_dir(), PathBuf::from);
-        config_dir.join("config.toml")
-    }
-
-    /// Create the file watcher with debouncing.
-    fn create_watcher(
-        tx: watch::Sender<Arc<Settings>>,
-        config_path: &Path,
-    ) -> Result<RecommendedWatcher> {
-        // Channel for debouncing file events
-        let (debounce_tx, debounce_rx) = std::sync::mpsc::channel::<()>();
-
-        // Spawn debounce thread
-        let config_path_clone = config_path.to_owned();
-        std::thread::spawn(move || {
-            Self::debounce_loop(&debounce_rx, &tx, &config_path_clone);
-        });
-
-        // Clone config_path for use in the watcher callback
-        let config_path_for_watcher = config_path.to_owned();
-
-        // Canonicalize config path for reliable comparison on macOS
-        // (handles symlinks like /var -> /private/var)
-        let canonical_config_path = config_path_for_watcher
-            .canonicalize()
-            .unwrap_or_else(|_| config_path_for_watcher.clone());
-
-        // Create file watcher
-        let mut watcher = RecommendedWatcher::new(
-            move |res: Result<notify::Event, notify::Error>| {
-                match res {
-                    Ok(event) => {
-                        // Defensive: if paths is empty, we can't filter, so assume
-                        // it might be our config file and trigger a reload to be safe
-                        if event.paths.is_empty() {
-                            warn!(
-                                "config watcher: event has no paths, triggering reload to be safe"
-                            );
-                            debounce_tx.send(()).expect("should still be active");
-                            return;
-                        }
-
-                        // Only react to events for our specific config file
-                        // (filter out editor temp files, backups, etc.)
-                        let is_config_file = event.paths.iter().any(|path| {
-                            // Canonicalize for reliable comparison (handles macOS symlinks)
-                            let canonical_event_path =
-                                path.canonicalize().unwrap_or_else(|_| path.clone());
-
-                            // Check if this event is for our config file
-                            // (either exact match or the file was renamed to our config)
-                            canonical_event_path == canonical_config_path
-                                || path.file_name() == config_path_for_watcher.file_name()
-                        });
-
-                        if !is_config_file {
-                            return;
-                        }
-
-                        // Only react to modify events (content changes) or creates
-                        if matches!(
-                            event.kind,
-                            EventKind::Modify(ModifyKind::Data(_) | ModifyKind::Any)
-                                | EventKind::Create(_)
-                        ) {
-                            debug!("config file event detected: {event:?}");
-                            // Send to debounce channel (ignore send errors - receiver might be gone)
-                            debounce_tx.send(()).ok();
-                        }
-                    }
-                    Err(e) => {
-                        error!("file watcher error: {e}");
-                    }
-                }
-            },
-            NotifyConfig::default(),
-        )
-        .wrap_err("failed to create file watcher")?;
-
-        // Watch the config file's parent directory (some editors create new files)
-        let watch_path = config_path.parent().unwrap_or(config_path);
-
-        // Defensive: ensure watch path exists before trying to watch
-        if !watch_path.exists() {
-            warn!(
-                "config directory does not exist, creating it: {}",
-                watch_path.display()
-            );
-            std::fs::create_dir_all(watch_path).wrap_err_with(|| {
-                format!(
-                    "failed to create config directory: {}",
-                    watch_path.display()
-                )
-            })?;
-        }
-
-        watcher
-            .watch(watch_path, RecursiveMode::NonRecursive)
-            .wrap_err_with(|| {
-                format!("failed to watch config directory: {}", watch_path.display())
-            })?;
-
-        info!(
-            "config file watcher initialized for: {}",
-            watch_path.display()
-        );
-        Ok(watcher)
-    }
-
-    /// Debounce loop that batches file events and reloads settings.
-    fn debounce_loop(
-        rx: &std::sync::mpsc::Receiver<()>,
-        tx: &watch::Sender<Arc<Settings>>,
-        config_path: &Path,
-    ) {
-        const DEBOUNCE_DURATION: Duration = Duration::from_millis(500);
-
-        loop {
-            // Wait for first event
-            if rx.recv().is_err() {
-                // Channel closed, watcher was dropped
-                debug!("config watcher debounce loop exiting");
-                return;
-            }
-
-            // Drain any additional events within debounce window
-            while rx.recv_timeout(DEBOUNCE_DURATION).is_ok() {
-                // Keep draining
-            }
-
-            // Defensive: check if config file exists before reloading
-            // (handles case where file was deleted - we'll get notified when it's recreated)
-            if !config_path.exists() {
-                debug!(
-                    "config file does not exist, skipping reload: {}",
-                    config_path.display()
-                );
-                continue;
-            }
-
-            // Now reload settings
-            info!(
-                "config file changed, reloading settings: {}",
-                config_path.display()
-            );
-            match Settings::new() {
-                Ok(settings) => {
-                    if tx.send(Arc::new(settings)).is_err() {
-                        // All receivers dropped
-                        debug!("all settings subscribers dropped, exiting");
-                        return;
-                    }
-                    info!("settings reloaded successfully");
-                }
-                Err(e) => {
-                    warn!("failed to reload settings: {e}");
-                    // Keep the old settings, don't broadcast the error
-                }
-            }
-        }
-    }
-}