thatcher 1.0.34 → 1.0.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.34",
+  "version": "1.0.35",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",
@@ -58,6 +58,7 @@
     "lucia": "^3.2.2",
     "nodemailer": "^9.0.1",
     "webjsx": "^0.0.73",
+    "ws": "^8.13.0",
     "xstate": "^5.0.0"
   },
   "devDependencies": {

package/src/adapters/google-gmail.js

@@ -0,0 +1,114 @@
+import { google } from 'googleapis';
+import { createLogger } from '../lib/logger.js';
+import { getJWTClient, getOAuth2Client } from './google-auth.js';
+import { buildConfig } from '../config/env.js';
+
+const log = createLogger('[GoogleGmail]');
+
+export function getGmailClient(user = null) {
+  let client;
+
+  if (user?.oauth_token) {
+    // User-delegated access
+    client = getOAuth2Client();
+    client.setCredentials({ access_token: user.oauth_token });
+  } else {
+    // Service account (app-wide)
+    client = getJWTClient();
+  }
+
+  if (!client) throw new Error('Google Gmail not configured');
+
+  return google.gmail({ version: 'v1', auth: client });
+}
+
+function encodeHeader(value) {
+  // RFC 2047 encoded-word for any non-ASCII header value (subject/name).
+  if (/^[\x00-\x7F]*$/.test(value)) return value;
+  return `=?UTF-8?B?${Buffer.from(value, 'utf8').toString('base64')}?=`;
+}
+
+function buildRawMessage({ to, from, subject, body, html, cc, bcc, attachments = [], inReplyTo, references }) {
+  const boundary = `boundary_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+  const headers = [
+    `To: ${to}`,
+    `From: ${from}`,
+    `Subject: ${encodeHeader(subject || '')}`,
+  ];
+  if (cc) headers.push(`Cc: ${cc}`);
+  if (bcc) headers.push(`Bcc: ${bcc}`);
+  if (inReplyTo) headers.push(`In-Reply-To: ${inReplyTo}`);
+  if (references) headers.push(`References: ${references}`);
+  headers.push('MIME-Version: 1.0');
+
+  const hasAttachments = Array.isArray(attachments) && attachments.length > 0;
+
+  let message;
+  if (!hasAttachments) {
+    if (html) {
+      headers.push('Content-Type: text/html; charset="UTF-8"');
+      message = `${headers.join('\r\n')}\r\n\r\n${html}`;
+    } else {
+      headers.push('Content-Type: text/plain; charset="UTF-8"');
+      message = `${headers.join('\r\n')}\r\n\r\n${body || ''}`;
+    }
+  } else {
+    headers.push(`Content-Type: multipart/mixed; boundary="${boundary}"`);
+    const parts = [];
+
+    parts.push(
+      `--${boundary}`,
+      html ? 'Content-Type: text/html; charset="UTF-8"' : 'Content-Type: text/plain; charset="UTF-8"',
+      '',
+      html || body || '',
+      ''
+    );
+
+    for (const att of attachments) {
+      const content = Buffer.isBuffer(att.content) ? att.content : Buffer.from(att.content || '', att.encoding || 'base64');
+      parts.push(
+        `--${boundary}`,
+        `Content-Type: ${att.contentType || att.mimeType || 'application/octet-stream'}; name="${att.filename || att.name || 'attachment'}"`,
+        'Content-Transfer-Encoding: base64',
+        `Content-Disposition: attachment; filename="${att.filename || att.name || 'attachment'}"`,
+        '',
+        content.toString('base64'),
+        ''
+      );
+    }
+
+    parts.push(`--${boundary}--`);
+    message = `${headers.join('\r\n')}\r\n\r\n${parts.join('\r\n')}`;
+  }
+
+  return Buffer.from(message)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+export async function sendEmail(options, user = null) {
+  const gmail = getGmailClient(user);
+  const from = options.from || buildConfig().email.from;
+
+  const raw = buildRawMessage({ ...options, from });
+
+  const requestBody = { raw };
+  if (options.inReplyTo || options.references) {
+    // threadId is optional; Gmail threads by References/In-Reply-To headers
+    // already embedded in the raw message.
+  }
+
+  try {
+    const res = await gmail.users.messages.send({
+      userId: 'me',
+      requestBody,
+    });
+    log.info('sent:', { messageId: res.data.id });
+    return { id: res.data.id, messageId: res.data.id, threadId: res.data.threadId };
+  } catch (err) {
+    log.error('send failed:', { message: err.message });
+    throw err;
+  }
+}

package/src/app/api/cron/trigger/route.js

@@ -1,51 +1,38 @@
 import { createLogger } from '@/lib/logger.js';
-import { runDueJobs } from '@/engine/job-engine';
+import { timingSafeEqual } from 'node:crypto';
 
 const log = createLogger('[Cron]');
-import { create } from '@/engine';
 
 export const runtime = 'nodejs';
 
-export async function POST(request) {
-  const startTime = Date.now();
+function isValidCronSecret(token) {
+  const secret = process.env.CRON_SECRET;
+  const tokenBuf = Buffer.from(token || '', 'utf8');
+  const secretBuf = Buffer.from(secret || '', 'utf8');
+  return !!secret && !!token && tokenBuf.length === secretBuf.length && timingSafeEqual(tokenBuf, secretBuf);
+}
 
+export async function POST(request) {
   try {
     const authHeader = request.headers.get('authorization');
     const token = authHeader?.replace('Bearer ', '');
 
-    if (!token || token !== process.env.CRON_SECRET) {
+    if (!isValidCronSecret(token)) {
       return new Response(
         JSON.stringify({ status: 'error', message: 'Unauthorized' }),
         { status: 401, headers: { 'Content-Type': 'application/json' } }
       );
     }
 
-    const results = await runDueJobs();
-    const duration = Date.now() - startTime;
-
-    await create('job_execution_log', {
-      timestamp: Math.floor(Date.now() / 1000),
-      total_jobs: results.total || 0,
-      executed_jobs: results.executed || 0,
-      failed_jobs: results.failed || 0,
-      duration_ms: duration,
-      status: results.failed > 0 ? 'partial_failure' : 'success',
-      error_details: results.errors || null
-    }).catch(err => log.error('log error:', { message: err.message }));
-
+    // job-engine was removed (the module never existed in this repo); this
+    // endpoint is not wired to a real job runner, so return a clean 501
+    // instead of crashing on a dead import.
     return new Response(
-      JSON.stringify({
-        status: 'success',
-        timestamp: new Date().toISOString(),
-        total_jobs: results.total,
-        executed_jobs: results.executed,
-        failed_jobs: results.failed,
-        duration_ms: duration,
-        details: results.details || []
-      }),
-      { status: 200, headers: { 'Content-Type': 'application/json' } }
+      JSON.stringify({ status: 'error', message: 'cron trigger not implemented' }),
+      { status: 501, headers: { 'Content-Type': 'application/json' } }
     );
   } catch (error) {
+    log.error('cron trigger error:', { message: error.message });
     return new Response(
       JSON.stringify({ status: 'error', message: error.message, timestamp: new Date().toISOString() }),
       { status: 500, headers: { 'Content-Type': 'application/json' } }

package/src/app/api/email/receive/route.js

@@ -2,11 +2,19 @@ import { NextResponse } from '@/lib/next-polyfills';
 import { createLogger } from '@/lib/logger.js';
 import { genId, now } from '@/lib/id-helpers';
 import { create } from '@/engine';
+import { timingSafeEqual } from 'node:crypto';
 
 const log = createLogger('[EmailReceive]');
 import path from 'path';
 import fs from 'fs';
 
+function isValidWebhookSecret(token) {
+  const secret = process.env.EMAIL_WEBHOOK_SECRET;
+  const tokenBuf = Buffer.from(token || '', 'utf8');
+  const secretBuf = Buffer.from(secret || '', 'utf8');
+  return !!secret && !!token && tokenBuf.length === secretBuf.length && timingSafeEqual(tokenBuf, secretBuf);
+}
+
 const EMAIL_ATTACHMENTS_DIR = path.resolve(process.cwd(), 'data', 'temp_email_attachments');
 
 if (!fs.existsSync(EMAIL_ATTACHMENTS_DIR)) {
@@ -17,7 +25,7 @@ export async function POST(request) {
   try {
     const authHeader = request.headers.get('authorization');
     const token = authHeader?.replace('Bearer ', '');
-    if (!token || token !== process.env.EMAIL_WEBHOOK_SECRET) {
+    if (!isValidWebhookSecret(token)) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }
 

package/src/app/api/email/send/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from '@/lib/next-polyfills';
 import { createLogger } from '@/lib/logger.js';
 import { now } from '@/lib/id-helpers';
+import { timingSafeEqual } from 'node:crypto';
 
 const log = createLogger('[Email]');
 import { list, update } from '@/engine';
@@ -8,6 +9,13 @@ import { getConfigEngine } from '@/lib/config-generator-engine';
 import { EMAIL_STATUS } from '@/config/constants';
 import { sendSingleEmail, checkFailureRate } from '@/lib/email-sender';
 
+function isValidCronSecret(token) {
+  const secret = process.env.CRON_SECRET;
+  const tokenBuf = Buffer.from(token || '', 'utf8');
+  const secretBuf = Buffer.from(secret || '', 'utf8');
+  return !!secret && !!token && tokenBuf.length === secretBuf.length && timingSafeEqual(tokenBuf, secretBuf);
+}
+
 let emailConfig = null;
 
 async function getEmailConfig() {
@@ -20,7 +28,7 @@ async function getEmailConfig() {
 
 export async function POST(request) {
   const token = request.headers.get('authorization')?.replace('Bearer ', '');
-  if (!token || token !== process.env.CRON_SECRET)
+  if (!isValidCronSecret(token))
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
 
   try {
@@ -61,7 +69,7 @@ export async function POST(request) {
 
 export async function GET(request) {
   const token = request.headers.get('authorization')?.replace('Bearer ', '');
-  if (!token || token !== process.env.CRON_SECRET)
+  if (!isValidCronSecret(token))
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
 
   try {

package/src/app/api/files/[id]/route.js

@@ -20,7 +20,7 @@ export async function GET(request, { params }) {
       return NextResponse.json({ error: 'Permission denied' }, { status: HTTP.FORBIDDEN });
     }
 
-    const fileRecord = get('file', id);
+    const fileRecord = await get('file', id);
     if (!fileRecord) {
       return notFound('File not found');
     }

package/src/app/api/health/route.js

@@ -25,23 +25,24 @@ export const GET = async (request) => {
     const start = process.hrtime.bigint()
 
     // busybase liveness probe (replaces the SQLite SELECT 1 + wal_checkpoint).
-    try { await count('user', {}); } catch { /* table may not exist yet; still alive */ }
+    let dbConnected = true
+    try { await count('user', {}); } catch (e) { dbConnected = false; log.warn('db probe failed', { message: e?.message }) }
 
     const dbLatency = Number(process.hrtime.bigint() - start) / 1000000
     const url = new URL(request.url)
     const detailed = url.searchParams.get('detailed') === 'true'
 
     const health = {
-      status: 'ok',
+      status: dbConnected ? 'ok' : 'degraded',
       timestamp: new Date().toISOString(),
       uptime: process.uptime(),
       uptime_ms: Math.round(process.uptime() * 1000),
       last_sync_at: getLastSyncAt(),
       database: {
-        connected: true,
+        connected: dbConnected,
         latency: dbLatency
       },
-      db: 'ok'
+      db: dbConnected ? 'ok' : 'error'
     }
 
     if (detailed) {
@@ -65,7 +66,7 @@ export const GET = async (request) => {
     return new Response(
       JSON.stringify(health, null, 2),
       {
-        status: 200,
+        status: dbConnected ? 200 : 503,
         headers: { 'Content-Type': 'application/json' }
       }
     )

package/src/index.js

@@ -332,13 +332,19 @@ export class Thatcher {
 
   // === Database transaction ===
 
+  /**
+   * Non-atomic passthrough: busybase has no transaction primitive, so this simply
+   * invokes the callback with NO rollback guarantee on partial failure. Callers
+   * must not rely on withTransaction() for atomicity; check supportsTransactions
+   * to detect this at runtime.
+   */
   async withTransaction(callback) {
-    // busybase has no transaction primitive; the old query-engine's withTransaction
-    // was a pass-through, so preserve that contract rather than import a dead file.
     return callback();
   }
 }
 
+Thatcher.prototype.supportsTransactions = false;
+
 export function createThatcher(options) {
   return new Thatcher(options);
 }

package/src/lib/auth-route-helpers.js

@@ -11,7 +11,7 @@ setInterval(() => {
       oauthStateStore.delete(key);
     }
   }
-}, 5 * 60 * 1000);
+}, 5 * 60 * 1000).unref();
 
 export function validateOAuthProvider(provider) {
   if (!provider) {

package/src/lib/events-engine.js

@@ -3,7 +3,7 @@ import { hookEngine } from '@/lib/hook-engine.js';
 
 const log = createLogger('[EventsEngine]');
 import { list, get, update, create, remove } from '@/engine.js';
-import { queueEmail } from '@/engine/notification-engine';
+import { queueEmail } from '@/services/notification-engine.js';
 import { safeJsonParse } from '@/lib/safe-json.js';
 import { validateTransition } from '@/lib/workflow-engine.js';
 import { AppError } from '@/lib/error-handler';

package/src/lib/export-sink.js

@@ -21,11 +21,12 @@ export class ExportSink {
     this._exportCount = 0;
     this._errorCount = 0;
     this._lastError = null;
+    this._options = options;
   }
 
   async init() {
     if (this.target === 'file') {
-      this._filePath = options.filePath || process.env.OBSERVABILITY_EXPORT_FILE || path.join(process.cwd(), 'observability.jsonl');
+      this._filePath = this._options.filePath || process.env.OBSERVABILITY_EXPORT_FILE || path.join(process.cwd(), 'observability.jsonl');
       logger.info('File export sink initialized', { path: this._filePath });
     } else if (this.target === 'http') {
       if (!this.url) {

package/src/lib/route-resolver.js

@@ -83,6 +83,14 @@ const DOMAINS = ['friday', 'mwr'];
 
 export function resolveRoute(__dirname, pathname, url) {
   const pathParts = pathname.slice(5).split('/').filter(Boolean);
+
+  // Reject any '..' or '.' segment before it can reach a filesystem path
+  // join or a dynamic import -- otherwise a crafted URL can traverse out of
+  // src/app/api into arbitrary files on disk.
+  if (pathParts.some(seg => seg === '..' || seg === '.')) {
+    return { routeFile: null, params: {}, isDomain: false, firstPart: pathParts[0], pathParts };
+  }
+
   const firstPart = pathParts[0];
   const isDomain = DOMAINS.includes(firstPart);
   let routeFile = null;

package/src/lib/validation/csrf.js

@@ -48,4 +48,4 @@ export function cleanupExpiredCSRFTokens() {
   }
 }
 
-setInterval(cleanupExpiredCSRFTokens, 60 * 60 * 1000);
+setInterval(cleanupExpiredCSRFTokens, 60 * 60 * 1000).unref();

package/src/lib/validation/rate-limit.js

@@ -28,4 +28,4 @@ setInterval(() => {
       delete global.rateLimitStore[key];
     }
   }
-}, 60000);
+}, 60000).unref();

package/src/services/notification-engine.js

@@ -80,6 +80,89 @@ export async function getUnreadCount(userId) {
   })).length;
 }
 
+// Resolve a `recipients` token (a role/group name used across events-engine.js
+// call sites, e.g. 'client_users', 'team_members', 'collaborator') to a list of
+// user records to notify. There is no dedicated recipient-resolution engine in
+// this codebase yet, so this composes the existing busybase-store queries the
+// same way the rest of the app looks up users -- a single explicit user object
+// on the context (context.recipientUser / a matching *_id field) is honored
+// directly, and a bare role/group token that cannot be resolved to concrete
+// users is logged and skipped rather than silently guessed at.
+async function resolveRecipients(recipients, context) {
+  const { list, get } = await import('../lib/busybase-store.js');
+
+  if (context.recipientUser) return [context.recipientUser];
+  if (context.collaborator?.email) return [context.collaborator];
+
+  if (recipients === 'client_users' && context.engagement?.client_id) {
+    return list('user', { client_id: context.engagement.client_id });
+  }
+  if ((recipients === 'team_members' || recipients === 'team_partners') && context.engagement?.team_id) {
+    const team = await get('team', context.engagement.team_id);
+    const { safeJsonParse } = await import('../lib/safe-json.js');
+    const userIds = safeJsonParse(team?.users, []);
+    const users = [];
+    for (const id of userIds) {
+      const u = await get('user', id);
+      if (u) users.push(u);
+    }
+    return recipients === 'team_partners' ? users.filter(u => u.role === 'partner') : users;
+  }
+  if (recipients === 'client_admin' && context.engagement?.client_id) {
+    return list('user', { client_id: context.engagement.client_id, role: 'admin' });
+  }
+  if (recipients === 'assigned_users' && (context.rfi?.assigned_to || context.rfi?.assigned_users)) {
+    const ids = Array.isArray(context.rfi.assigned_users) ? context.rfi.assigned_users : [context.rfi.assigned_to].filter(Boolean);
+    const users = [];
+    for (const id of ids) {
+      const u = await get('user', id);
+      if (u) users.push(u);
+    }
+    return users;
+  }
+
+  log.warn(`queueEmail: unresolved recipients token "${recipients}"`);
+  return [];
+}
+
+function templateNameForType(type) {
+  // events-engine.js passes descriptive template names (e.g.
+  // 'engagement_info_gathering'); the built-in getTemplates() set in
+  // email-sender.js is generic ('notification', 'invitation'), so an
+  // unrecognized specific name falls back to the generic notification shape.
+  return 'notification';
+}
+
+/**
+ * Send a templated notification email to a resolved set of recipients.
+ * Composes the existing sendTemplatedEmail (src/services/email-sender.js)
+ * rather than reimplementing delivery -- this is the queueEmail primitive
+ * events-engine.js drives its afterCreate/afterUpdate hooks through.
+ */
+export async function queueEmail(templateName, context = {}) {
+  const { recipients, ...rest } = context;
+  try {
+    const users = await resolveRecipients(recipients, rest);
+    if (!users.length) return { sent: 0, templateName };
+
+    const { sendTemplatedEmail } = await import('./email-sender.js');
+    let sent = 0;
+    for (const user of users) {
+      if (!user?.email) continue;
+      try {
+        await sendTemplatedEmail(templateNameForType(templateName), user.email, { ...rest, templateName });
+        sent++;
+      } catch (err) {
+        log.error('queueEmail send failed:', { message: err.message, templateName, to: user.email });
+      }
+    }
+    return { sent, templateName };
+  } catch (err) {
+    log.error('queueEmail failed:', { message: err.message, templateName });
+    return { sent: 0, templateName, error: err.message };
+  }
+}
+
 function interpolate(template, context) {
   if (!template) return '';
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => {

package/src/ui/file-dialogs.js

@@ -48,7 +48,8 @@ export function quickViewAttachment() {
       <div class="dialog-footer"><a id="qv-download" href="#" download class="btn btn-primary btn-sm">Download</a><button class="btn btn-ghost btn-sm" data-dialog-close="quick-view">Close</button></div>
     </div></div>
   <script>
-  window.quickView=function(url,name,type){document.getElementById('quick-view').style.display='flex';document.getElementById('quick-view-title').textContent=name||'Preview';document.getElementById('qv-download').href=url;var c=document.getElementById('qv-content');if(type&&type.startsWith('image/')){c.innerHTML='<img src="'+url+'" alt="'+(name||'File preview')+'" style="max-width:100%;max-height:70vh"/>'}else if(type==='application/pdf'){c.innerHTML='<iframe src="'+url+'" style="width:100%;height:70vh;border:none"></iframe>'}else{c.innerHTML='<div class="py-8 text-gray-500"><div style="display:flex;justify-content:center"><svg width="40" height="40" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><path d="M14 2v6h6"/></svg></div><div class="mt-2">'+name+'</div><div class="text-xs mt-1">Preview not available</div></div>'}};
+  ${FD_ESC}
+  window.quickView=function(url,name,type){document.getElementById('quick-view').style.display='flex';document.getElementById('quick-view-title').textContent=name||'Preview';document.getElementById('qv-download').href=url;var c=document.getElementById('qv-content');if(type&&type.startsWith('image/')){c.innerHTML='<img src="'+url+'" alt="'+fdEsc(name||'File preview')+'" style="max-width:100%;max-height:70vh"/>'}else if(type==='application/pdf'){c.innerHTML='<iframe src="'+url+'" style="width:100%;height:70vh;border:none"></iframe>'}else{c.innerHTML='<div class="py-8 text-gray-500"><div style="display:flex;justify-content:center"><svg width="40" height="40" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><path d="M14 2v6h6"/></svg></div><div class="mt-2">'+fdEsc(name)+'</div><div class="text-xs mt-1">Preview not available</div></div>'}};
   </script>`;
 }
 export function fetchCachedPdf(fileId) {
@@ -67,9 +68,15 @@ export function fetchCachedPdf(fileId) {
   };
   </script>`;
 }
+function fdEscServer(s) {
+  return String(s == null ? '' : s)
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+}
+
 export function fileAttachmentBar(files = []) {
   if (!files.length) return '';
-  const items = files.map(f => `<div class="flex items-center gap-2 p-1 rounded hover:bg-gray-100 cursor-pointer" data-action="quickView" data-args='["/api/file/${f.id}/download","${(f.name || '').replace(/"/g, '&quot;')}","${f.mime_type || ''}"]'><span style="display:inline-flex"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m21.44 11.05-9.19 9.19a6 6 0 0 1-8.49-8.49l9.19-9.19a4 4 0 0 1 5.66 5.66l-9.2 9.19a2 2 0 0 1-2.83-2.83l8.49-8.48"/></svg></span><span class="text-xs truncate" style="max-width:120px">${f.name || 'file'}</span></div>`).join('');
+  const items = files.map(f => `<div class="flex items-center gap-2 p-1 rounded hover:bg-gray-100 cursor-pointer" data-action="quickView" data-args='["/api/file/${fdEscServer(f.id)}/download","${fdEscServer(f.name || '')}","${fdEscServer(f.mime_type || '')}"]'><span style="display:inline-flex"><svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m21.44 11.05-9.19 9.19a6 6 0 0 1-8.49-8.49l9.19-9.19a4 4 0 0 1 5.66 5.66l-9.2 9.19a2 2 0 0 1-2.83-2.83l8.49-8.48"/></svg></span><span class="text-xs truncate" style="max-width:120px">${fdEscServer(f.name || 'file')}</span></div>`).join('');
   return `<div class="flex flex-wrap gap-1 mt-2">${items}</div>`;
 }
 export function fileLinksBar(links = []) {

package/src/ui/review-detail-panels.js

@@ -14,7 +14,7 @@ export function highlightRow(h) {
   try { tags = JSON.parse(h.tags || '[]') || []; } catch {}
   const isFlagged = flags.includes('flagged');
 
-  const flagBtn = `<button data-action="toggleFlag" data-args='["${esc(h.id)}","${isFlagged}"]' title="${isFlagged ? 'Unflag' : 'Flag'}" style="background:none;border:none;cursor:pointer;padding:2px 4px;font-size:15px;line-height:1;color:${isFlagged ? 'var(--color-warning)' : 'var(--color-text-muted)'}">${isFlagged ? '⚑' : '⚐'}</button>`;
+  const flagBtn = `<button data-action="toggleFlag" data-args='["${esc(h.id)}","${isFlagged}"]' title="${isFlagged ? 'Unflag' : 'Flag'}" style="background:none;border:none;cursor:pointer;padding:2px 4px;font-size:15px;line-height:1;color:${isFlagged ? 'var(--color-warning)' : 'var(--color-text-muted)'}">${isFlagged ? 'Unflag' : 'Flag'}</button>`;
   const tagPills = tags.map(t => `<span style="display:inline-flex;align-items:center;gap:3px;background:var(--color-info-bg,#eff6ff);color:var(--color-info,#1e40af);font-size:11px;padding:2px 8px;border-radius:9999px;font-weight:500">${esc(t)}<button data-action="removeTag" data-args='["${esc(h.id)}","${esc(t)}"]' style="background:none;border:none;cursor:pointer;padding:0;margin-left:2px;font-size:11px;color:var(--color-text-muted);line-height:1">&times;</button></span>`).join(' ');
   const addTagBtn = `<button data-action="openAddTag" data-args='["${esc(h.id)}"]' style="background:none;border:none;cursor:pointer;font-size:11px;color:var(--color-text-muted);padding:1px 5px;border:1px dashed var(--color-border,#e5e7eb);border-radius:9999px">+tag</button>`;
   const tagsCell = `<div style="display:flex;flex-wrap:wrap;gap:3px;align-items:center;min-width:80px">${tagPills}${addTagBtn}</div>`;

package/src/ui/styles2.css

@@ -880,11 +880,9 @@ button:focus-visible, a:focus-visible, input:focus-visible, select:focus-visible
 .review-row-name { font-weight: 500; max-width: 220px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 @media (max-width: 767px) { .review-row-name { max-width: 140px; } }
 
-/* ═══════════════════════════════════════════════════════════
-   TAILWIND-COMPATIBLE UTILITY CLASSES
+/* ---- TAILWIND-COMPATIBLE UTILITY CLASSES ----
    Required because rippleui.css is PurgeCSS-built without
-   general utilities. These cover all classes used in UI files.
-   ═══════════════════════════════════════════════════════════ */
+   general utilities. These cover all classes used in UI files. */
 
 /* Display */
 .flex { display: flex; }
@@ -1336,9 +1334,7 @@ tr.is-read td { color: rgb(var(--base-content, 30 30 35) / 0.7); }
 .italic { font-style: italic; }
 .not-italic { font-style: normal; }
 
-/* ═══════════════════════════════════════════════════════════
-   VISUAL POLISH & IMPROVED COMPONENT STYLES
-   ═══════════════════════════════════════════════════════════ */
+/* ---- VISUAL POLISH & IMPROVED COMPONENT STYLES ---- */
 
 /* Nav separator hidden */
 .nav-sep { display: none; }

package/src/lib/generic-crud-handler.js

@@ -1,16 +0,0 @@
-import { createCrudHandlers } from '../lib/crud-factory.js';
-import { getConfigEngineSync } from '../lib/config-generator-engine.js';
-
-export function getEntityHandlers(entityName) {
-  return createCrudHandlers(entityName);
-}
-
-export function hasEntity(entityName) {
-  try {
-    const engine = getConfigEngineSync();
-    engine.generateEntitySpec(entityName);
-    return true;
-  } catch {
-    return false;
-  }
-}