thatcher 1.0.4

package/src/lib/static-server.js

@@ -0,0 +1,97 @@
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.join(__dirname, '../..');
+
+export function serveStatic(pathname, req, res, compress, getCacheHeaders, loadModule) {
+  const acceptEncoding = req.headers['accept-encoding'] || '';
+
+  if (pathname === '/favicon.ico') {
+    res.setHeader('Content-Type', 'image/x-icon');
+    res.setHeader('Cache-Control', 'public, max-age=86400');
+    res.setHeader('Content-Length', '0');
+    res.writeHead(200);
+    res.end();
+    return true;
+  }
+
+  if (pathname === '/manifest.json') {
+    const manifest = JSON.stringify({ name: 'MOONLANDING', short_name: 'Moonlanding', start_url: '/', display: 'standalone', background_color: '#f1f5f9', theme_color: '#04141f' });
+    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('Cache-Control', 'public, max-age=86400');
+    res.setHeader('Content-Length', Buffer.byteLength(manifest, 'utf-8'));
+    res.writeHead(200);
+    res.end(manifest);
+    return true;
+  }
+
+  if (pathname === '/service-worker.js') {
+    const swPath = path.join(ROOT, 'src/service-worker.js');
+    if (fs.existsSync(swPath)) {
+      const content = fs.readFileSync(swPath, 'utf-8');
+      const cacheHeaders = getCacheHeaders('dynamic');
+      Object.entries(cacheHeaders).forEach(([k, v]) => res.setHeader(k, v));
+      res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
+      res.setHeader('Content-Length', Buffer.byteLength(content, 'utf-8'));
+      res.writeHead(200);
+      res.end(content);
+      return true;
+    }
+  }
+
+  if (pathname.startsWith('/lib/webjsx/')) {
+    const file = pathname.slice(12);
+    const filePath = path.join(ROOT, 'node_modules/webjsx/dist', file);
+    if (!fs.existsSync(filePath)) return false;
+    const content = fs.readFileSync(filePath, 'utf-8');
+    const cacheHeaders = getCacheHeaders('static', 31536000);
+    Object.entries(cacheHeaders).forEach(([k, v]) => res.setHeader(k, v));
+    const { content: finalContent, encoding } = compress(content, acceptEncoding);
+    res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
+    if (encoding) res.setHeader('Content-Encoding', encoding);
+    res.setHeader('Content-Length', Buffer.byteLength(finalContent));
+    res.writeHead(200);
+    res.end(finalContent);
+    return true;
+  }
+
+  if (pathname.startsWith('/ui/') && pathname.endsWith('.css')) {
+    const cssPath = path.join(ROOT, 'src/ui', path.basename(pathname));
+    if (!fs.existsSync(cssPath)) return false;
+    let content = fs.readFileSync(cssPath, 'utf-8');
+    const etag = `"${content.length}-${fs.statSync(cssPath).mtimeMs.toString(36)}"`;
+    if (req.headers['if-none-match'] === etag) { res.writeHead(304); res.end(); return true; }
+    res.setHeader('Cache-Control', 'public, max-age=0, must-revalidate');
+    res.setHeader('ETag', etag);
+    const { content: finalContent, encoding } = compress(content, acceptEncoding);
+    res.setHeader('Content-Type', 'text/css; charset=utf-8');
+    if (encoding) res.setHeader('Content-Encoding', encoding);
+    res.setHeader('Content-Length', Buffer.byteLength(finalContent));
+    res.writeHead(200);
+    res.end(finalContent);
+    return true;
+  }
+
+  if (pathname === '/ui/client.js' || pathname === '/ui/event-delegation.js' || pathname === '/ui/common-handlers.js') {
+    const jsPath = path.join(ROOT, 'src/ui', pathname.split('/').pop());
+    if (!fs.existsSync(jsPath)) return false;
+    const content = fs.readFileSync(jsPath, 'utf-8');
+    const cacheHeaders = getCacheHeaders('static', 86400);
+    Object.entries(cacheHeaders).forEach(([k, v]) => res.setHeader(k, v));
+    const { content: finalContent, encoding } = compress(content, acceptEncoding);
+    res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
+    if (encoding) res.setHeader('Content-Encoding', encoding);
+    res.setHeader('Content-Length', Buffer.byteLength(finalContent));
+    res.writeHead(200);
+    res.end(finalContent);
+    return true;
+  }
+
+  return false;
+}
+
+export function html404() {
+  return `<!DOCTYPE html><html lang="en" data-theme="light"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>404 - Page Not Found | MOONLANDING</title><link href="/ui/rippleui.css" rel="stylesheet"><link href="/ui/styles2.css" rel="stylesheet"><style>body{margin:0;background:var(--color-bg,#f1f5f9);font-family:system-ui,sans-serif}.nav-shell{background:#04141f;padding:0 2rem;height:56px;display:flex;align-items:center}a.logo-link{color:#fff;text-decoration:none;font-weight:700;font-size:1.1rem}.error-shell{min-height:calc(100vh - 56px);display:flex;align-items:center;justify-content:center}.error-card{background:#fff;border-radius:12px;padding:3rem 4rem;text-align:center;box-shadow:0 1px 3px rgba(0,0,0,.1)}.error-code{font-size:4rem;font-weight:900;color:#04141f;line-height:1}.error-msg{font-size:1.2rem;color:#64748b;margin:0.5rem 0 2rem}.home-btn{display:inline-block;padding:0.75rem 2rem;background:#04141f;color:#fff;border-radius:8px;text-decoration:none;font-weight:600;font-size:0.95rem}</style></head><body><nav class="nav-shell"><a href="/" class="logo-link">MOONLANDING</a></nav><div class="error-shell"><div class="error-card"><div class="error-code">404</div><p class="error-msg">Page not found</p><a href="/" class="home-btn">Go to Dashboard</a></div></div></body></html>`;
+}

package/src/lib/status-helpers.js

@@ -0,0 +1,98 @@
+/**
+ * Status Helpers - Status enumerations and transition maps
+ * These are the standard status values used by moonlanding parity entities
+ */
+
+// Engagement statuses
+export const ENGAGEMENT_STATUS = {
+  DRAFT: 'draft',
+  SENT: 'sent',
+  ACCEPTED: 'accepted',
+  IN_PROGRESS: 'in_progress',
+  COMPLETED: 'completed',
+  CLOSED: 'closed',
+  CANCELLED: 'cancelled',
+};
+
+export const ENGAGEMENT_STAGE = {
+  DRAFT: 'draft',
+  SCOPE: 'scope',
+  KICKOFF: 'kickoff',
+  RFI: 'rfi',
+  REVIEW: 'review',
+  CLOSEOUT: 'closeout',
+  CLOSED: 'closed',
+};
+
+// RFI statuses
+export const RFI_STATUS = {
+  DRAFT: 'draft',
+  OPEN: 'open',
+  DEFERRED: 'deferred',
+  ANSWERED: 'answered',
+  CLARIFICATION: 'clarification',
+  CLOSED: 'closed',
+};
+
+export const RFI_CLIENT_STATUS = {
+  PENDING: 'pending',
+  ESCALATED: 'escalated',
+  RESOLVED: 'resolved',
+};
+
+export const RFI_AUDITOR_STATUS = {
+  REVIEW: 'review',
+  APPROVED: 'approved',
+  REJECTED: 'rejected',
+};
+
+// Review statuses
+export const REVIEW_STATUS = {
+  DRAFT: 'draft',
+  ACTIVE: 'active',
+  ARCHIVED: 'archived',
+  COMPLETED: 'completed',
+};
+
+// Highlight statuses
+export const HIGHLIGHT_STATUS = {
+  OPEN: 'open',
+  RESOLVED: 'resolved',
+  REJECTED: 'rejected',
+};
+
+// Standard stage transitions
+export const STAGE_TRANSITIONS = {
+  draft: 'scope',
+  scope: 'kickoff',
+  kickoff: 'rfi',
+  rfi: 'review',
+  review: 'closeout',
+  closeout: 'closed',
+};
+
+/**
+ * Get next stage in standard lifecycle
+ * @param {string} currentStage
+ * @returns {string|null}
+ */
+export function getNextStage(currentStage) {
+  return STAGE_TRANSITIONS[currentStage] || null;
+}
+
+/**
+ * Get all valid transitions for an engagement
+ * @param {string} currentStage
+ * @returns {Array<string>}
+ */
+export function getValidTransitions(currentStage) {
+  const transitions = [];
+  for (const [from, to] of Object.entries(STAGE_TRANSITIONS)) {
+    if (from === currentStage) transitions.push(to);
+  }
+  // Also allow backward steps
+  for (const [from, to] of Object.entries(STAGE_TRANSITIONS)) {
+    if (to === currentStage) transitions.push(from);
+  }
+  return [...new Set(transitions)];
+}

package/src/lib/universal-handler.js

@@ -0,0 +1,7 @@
+import { createCrudHandlers } from '@/lib/crud-factory';
+
+export function createUniversalHandler(entityName) {
+  return createCrudHandlers(entityName);
+}
+
+export { createUniversalHandler as createApiHandler };

package/src/lib/utils.js

@@ -0,0 +1,93 @@
+/**
+ * Utility Functions - Common helpers
+ */
+
+/**
+ * Get display name for user
+ * @param {object} user - User with name or email
+ * @returns {string}
+ */
+export function getDisplayName(user) {
+  if (!user) return 'Unknown';
+  return user.name || user.email || user.id || 'Unknown';
+}
+
+/**
+ * Get initials from name or email
+ * @param {string|object} userOrName
+ * @returns {string}
+ */
+export function getInitials(userOrName) {
+  let name = typeof userOrName === 'string' ? userOrName : getDisplayName(userOrName);
+  const parts = name.trim().split(/\s+/);
+  if (parts.length === 1) {
+    return parts[0].charAt(0).toUpperCase();
+  }
+  return (parts[0].charAt(0) + parts[parts.length - 1].charAt(0)).toUpperCase();
+}
+
+/**
+ * Get user role
+ * @param {object} user
+ * @returns {string}
+ */
+export function getUserRole(user) {
+  return user?.role || 'user';
+}
+
+/**
+ * Slugify string (URL-safe)
+ * @param {string} str
+ * @returns {string}
+ */
+export function slugify(str) {
+  return str
+    .toLowerCase()
+    .trim()
+    .replace(/[^\w\s-]/g, '')
+    .replace(/[\s_-]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+/**
+ * Truncate text
+ * @param {string} text
+ * @param {number} maxLength
+ * @param {string} suffix
+ * @returns {string}
+ */
+export function truncate(text, maxLength = 50, suffix = '...') {
+  if (!text) return '';
+  if (text.length <= maxLength) return text;
+  return text.slice(0, maxLength - suffix.length) + suffix;
+}
+
+/**
+ * Deep merge objects
+ * @param {object} target
+ * @param {object} source
+ * @returns {object}
+ */
+export function deepMerge(target, source) {
+  const output = { ...target };
+  for (const key of Object.keys(source)) {
+    if (source[key] && typeof source[key] === 'object' && !Array.isArray(source[key])) {
+      output[key] = deepMerge(target[key] || {}, source[key]);
+    } else {
+      output[key] = source[key];
+    }
+  }
+  return output;
+}
+
+/**
+ * Generate a random color
+ * @returns {string} Hex color
+ */
+export function randomColor() {
+  const colors = [
+    '#228be6', '#40c057', '#fab005', '#fa5252', '#15aabf',
+    '#7950f2', '#f03e3e', '#2f9e44', '#e67700', '#cc5de8',
+  ];
+  return colors[Math.floor(Math.random() * colors.length)];
+}

package/src/lib/validate.js

@@ -0,0 +1,197 @@
+/**
+ * Validation System - Field and entity validation
+ * Adapted from moonlanding/src/lib/validate.js
+ */
+
+import { getSpec } from '../config/spec-helpers.js';
+import { isValidEmail as checkEmailFormat } from './validators.js';
+
+const HTML_ESC = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
+
+/**
+ * Sanitize HTML
+ * @param {string} str
+ * @returns {string}
+ */
+function sanitizeHtml(str) {
+  return typeof str === 'string' ? str.replace(/[&<>"']/g, c => HTML_ESC[c]) : str;
+}
+
+/**
+ * Validate a single field
+ * @param {object} fieldDef
+ * @param {any} value
+ * @param {object} options
+ * @returns {Promise<{valid: boolean, error?: string}>}
+ */
+export async function validateField(fieldDef, value, options = {}) {
+  const { fieldName, entityName, existingValue } = options;
+
+  if (fieldDef.auto || fieldDef.auto_generate || fieldDef.readOnly) {
+    return { valid: true };
+  }
+
+  if (fieldDef.required && (value === null || value === undefined || value === '')) {
+    return { valid: false, error: `Field '${fieldName}' is required` };
+  }
+
+  if (value === null || value === undefined || value === '') {
+    return { valid: true }; // Optional field with no value
+  }
+
+  // Type validation
+  const typeErr = validateType(fieldDef, value, fieldName);
+  if (typeErr) return { valid: false, error: typeErr };
+
+  // Enum validation
+  if (fieldDef.type === 'enum' && fieldDef.options) {
+    const allowed = resolveEnumOptions(fieldDef, entityName);
+    if (allowed.length > 0 && !allowed.includes(value)) {
+      return {
+        valid: false,
+        error: `Invalid value for '${fieldName}'. Expected one of: ${allowed.join(', ')}`,
+      };
+    }
+  }
+
+  // Reference validation
+  if (fieldDef.type === 'ref' && fieldDef.ref) {
+    if (existingValue !== undefined && value === existingValue) {
+      return { valid: true };
+    }
+    try {
+      const { get } = await import('./query-engine.js');
+      const refTable = fieldDef.ref === 'user' ? 'users' : fieldDef.ref;
+      if (!get(refTable, value)) {
+        return {
+          valid: false,
+          error: `${fieldDef.ref.charAt(0).toUpperCase() + fieldDef.ref.slice(1)} with id '${value}' not found`,
+        };
+      }
+    } catch {
+      // Reference table might not exist yet
+    }
+  }
+
+  return { valid: true };
+}
+
+/**
+ * Validate type of value
+ * @param {object} fieldDef
+ * @param {any} value
+ * @param {string} fieldName
+ * @returns {string|null}
+ */
+function validateType(fieldDef, value, fieldName) {
+  const { type, min, max } = fieldDef;
+
+  if (type === 'string' || type === 'text') {
+    if (typeof value !== 'string') return `Field '${fieldName}' must be a string`;
+  } else if (type === 'number' || type === 'int' || type === 'decimal') {
+    if (typeof value !== 'number' || isNaN(value)) return `Field '${fieldName}' must be a number`;
+    if (min !== undefined && value < min) return `Field '${fieldName}' must be at least ${min}`;
+    if (max !== undefined && value > max) return `Field '${fieldName}' must be at most ${max}`;
+  } else if (type === 'boolean' || type === 'bool') {
+    if (typeof value !== 'boolean') return `Field '${fieldName}' must be a boolean`;
+  } else if (type === 'timestamp' || type === 'date') {
+    if (isNaN(Number(value))) return `Field '${fieldName}' must be a valid timestamp`;
+  } else if (type === 'json') {
+    if (typeof value === 'string') {
+      try { JSON.parse(value); } catch { return `Field '${fieldName}' must be valid JSON`; }
+    } else if (typeof value !== 'object') {
+      return `Field '${fieldName}' must be an object or JSON string`;
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Resolve enum options from field definition
+ * @param {object} fieldDef
+ * @param {string} entityName
+ * @returns {Array<string>}
+ */
+function resolveEnumOptions(fieldDef, entityName) {
+  if (Array.isArray(fieldDef.options)) {
+    return fieldDef.options.map(o => typeof o === 'object' ? o.value : o);
+  }
+
+  if (typeof fieldDef.options === 'string') {
+    try {
+      const spec = getSpec(entityName);
+      const list = spec.options?.[fieldDef.options];
+      if (list) return list.map(o => typeof o === 'object' ? o.value : o);
+    } catch {
+      // Skip
+    }
+  }
+
+  return [];
+}
+
+/**
+ * Validate all fields for an entity
+ * @param {string} entityName
+ * @param {object} data
+ * @param {object} existingRecord
+ * @returns {Promise<object>} Errors object keyed by field name
+ */
+export async function validateEntity(entityName, data, existingRecord = null) {
+  const spec = getSpec(entityName);
+  const errors = {};
+
+  for (const [fieldName, fieldDef] of Object.entries(spec.fields || {})) {
+    const value = data[fieldName];
+    const result = await validateField(fieldDef, value, {
+      fieldName,
+      entityName,
+      existingValue: existingRecord?.[fieldName],
+    });
+
+    if (!result.valid && result.error) {
+      errors[fieldName] = result.error;
+    }
+  }
+
+  return errors;
+}
+
+/**
+ * Validate update (only changed fields)
+ * @param {string} entityName
+ * @param {object} changes
+ * @param {object} existingRecord
+ * @returns {Promise<object>}
+ */
+export async function validateUpdate(entityName, changes, existingRecord) {
+  const spec = getSpec(entityName);
+  const errors = {};
+
+  for (const [fieldName, fieldDef] of Object.entries(spec.fields || {})) {
+    if (!(fieldName in changes)) continue;
+
+    const value = changes[fieldName];
+    const result = await validateField(fieldDef, value, {
+      fieldName,
+      entityName,
+      existingValue: existingRecord?.[fieldName],
+    });
+
+    if (!result.valid && result.error) {
+      errors[fieldName] = result.error;
+    }
+  }
+
+  return errors;
+}
+
+/**
+ * Check if errors object has any errors
+ * @param {object} errors
+ * @returns {boolean}
+ */
+export function hasErrors(errors) {
+  return errors && Object.keys(errors).length > 0;
+}

package/src/lib/validation/business-validators.js

@@ -0,0 +1,61 @@
+export function validateBusinessRules(entityName, data, existingRecord) {
+  const errors = {};
+  
+  if (entityName === 'engagement') {
+    if (data.start_date && data.end_date) {
+      const start = new Date(data.start_date * 1000);
+      const end = new Date(data.end_date * 1000);
+      if (end < start) {
+        errors.end_date = 'End date must be after start date';
+      }
+    }
+    
+    if (data.budget && data.budget < 0) {
+      errors.budget = 'Budget cannot be negative';
+    }
+    
+    if (data.status && existingRecord?.status) {
+      const validTransitions = {
+        draft: ['active', 'cancelled'],
+        active: ['completed', 'on_hold', 'cancelled'],
+        on_hold: ['active', 'cancelled'],
+        completed: [],
+        cancelled: []
+      };
+      const allowed = validTransitions[existingRecord.status] || [];
+      if (!allowed.includes(data.status) && data.status !== existingRecord.status) {
+        errors.status = `Cannot transition from ${existingRecord.status} to ${data.status}`;
+      }
+    }
+  }
+  
+  if (entityName === 'rfi') {
+    if (data.deadline) {
+      const deadline = new Date(data.deadline * 1000);
+      const now = new Date();
+      const twoYearsFromNow = new Date();
+      twoYearsFromNow.setFullYear(twoYearsFromNow.getFullYear() + 2);
+      
+      if (deadline < now) {
+        errors.deadline = 'Deadline cannot be in the past';
+      }
+      if (deadline > twoYearsFromNow) {
+        errors.deadline = 'Deadline cannot be more than 2 years in future';
+      }
+    }
+  }
+  
+  if (entityName === 'user') {
+    if (data.role && !['admin', 'manager', 'reviewer', 'client_user'].includes(data.role)) {
+      errors.role = 'Invalid user role';
+    }
+  }
+  
+  if (entityName === 'review') {
+    if (data.score && (data.score < 0 || data.score > 100)) {
+      errors.score = 'Score must be between 0 and 100';
+    }
+  }
+  
+  return errors;
+}

package/src/lib/validation/csrf.js

@@ -0,0 +1,51 @@
+import crypto from 'crypto';
+
+const CSRF_TOKEN_LENGTH = 32;
+const CSRF_TOKEN_EXPIRY = 24 * 60 * 60 * 1000;
+
+if (!global.csrfTokenStore) {
+  global.csrfTokenStore = new Map();
+}
+
+export function generateCSRFToken(sessionId) {
+  const token = crypto.randomBytes(CSRF_TOKEN_LENGTH).toString('hex');
+  const expiresAt = Date.now() + CSRF_TOKEN_EXPIRY;
+  
+  global.csrfTokenStore.set(token, { sessionId, expiresAt });
+  
+  return token;
+}
+
+export function validateCSRFToken(token, sessionId) {
+  if (!token || typeof token !== 'string') {
+    return { valid: false, reason: 'CSRF token required' };
+  }
+  
+  const record = global.csrfTokenStore.get(token);
+  
+  if (!record) {
+    return { valid: false, reason: 'Invalid CSRF token' };
+  }
+  
+  if (Date.now() > record.expiresAt) {
+    global.csrfTokenStore.delete(token);
+    return { valid: false, reason: 'CSRF token expired' };
+  }
+  
+  if (record.sessionId !== sessionId) {
+    return { valid: false, reason: 'CSRF token session mismatch' };
+  }
+  
+  return { valid: true };
+}
+
+export function cleanupExpiredCSRFTokens() {
+  const now = Date.now();
+  for (const [token, record] of global.csrfTokenStore.entries()) {
+    if (now > record.expiresAt) {
+      global.csrfTokenStore.delete(token);
+    }
+  }
+}
+
+setInterval(cleanupExpiredCSRFTokens, 60 * 60 * 1000);

package/src/lib/validation/file-validators.js

@@ -0,0 +1,34 @@
+import { detectPathTraversal } from '@/lib/validation/security-validators';
+
+export function validateFileUpload(file, options = {}) {
+  const { maxSize = 10 * 1024 * 1024, allowedTypes = [], allowedExtensions = [] } = options;
+  const errors = [];
+  
+  if (file.size > maxSize) {
+    errors.push(`File size ${file.size} exceeds maximum ${maxSize} bytes`);
+  }
+  
+  if (allowedTypes.length > 0 && !allowedTypes.includes(file.type)) {
+    errors.push(`File type ${file.type} not allowed. Allowed: ${allowedTypes.join(', ')}`);
+  }
+  
+  if (allowedExtensions.length > 0) {
+    const ext = file.name.split('.').pop()?.toLowerCase();
+    if (!ext || !allowedExtensions.includes(ext)) {
+      errors.push(`File extension not allowed. Allowed: ${allowedExtensions.join(', ')}`);
+    }
+  }
+  
+  const pathCheck = detectPathTraversal(file.name);
+  if (!pathCheck.safe) {
+    errors.push(pathCheck.reason);
+  }
+  
+  const DANGEROUS_EXTENSIONS = ['exe', 'bat', 'cmd', 'sh', 'ps1', 'scr', 'com', 'pif', 'msi'];
+  const ext = file.name.split('.').pop()?.toLowerCase();
+  if (ext && DANGEROUS_EXTENSIONS.includes(ext)) {
+    errors.push(`Dangerous file extension: ${ext}`);
+  }
+  
+  return { valid: errors.length === 0, errors };
+}