thatcher 1.0.4

package/src/app/api/auth/google/callback/route.js

@@ -0,0 +1,94 @@
+import { google, createSession } from '@/engine.server';
+import { getBy, create } from '@/engine';
+import { Google } from 'arctic';
+import { GOOGLE_APIS } from '@/config/constants';
+import { config } from '@/config';
+import { getConfigEngine } from '@/lib/config-generator-engine';
+import { globalManager } from '@/lib/hot-reload/mutex';
+import { NextResponse } from '@/lib/next-polyfills';
+import {
+  validateOAuthProvider,
+  getOAuthCookie,
+  deleteOAuthCookie,
+  buildOAuthErrorResponse,
+  validateOAuthState,
+} from '@/lib/auth-route-helpers';
+
+export async function GET(request) {
+  const protocol = request.headers['x-forwarded-proto'] || 'http';
+  const host = request.headers['x-forwarded-host'] || request.headers.host || 'localhost:3000';
+  const redirectUri = `${protocol}://${host}/api/auth/google/callback`;
+
+  const dynamicGoogle = new Google(
+    config.auth.google.clientId,
+    config.auth.google.clientSecret,
+    redirectUri
+  );
+
+  const { valid, error } = validateOAuthProvider(dynamicGoogle);
+  if (!valid) {
+    return buildOAuthErrorResponse(error, request);
+  }
+
+  const url = new URL(request.url);
+  const code = url.searchParams.get('code');
+  const stateKey = url.searchParams.get('state');  // Google returns the key we sent
+
+  const storedData = await getOAuthCookie(stateKey);
+  const state = storedData?.state;
+  const codeVerifier = storedData?.codeVerifier;
+
+  const stateValidation = validateOAuthState(code, stateKey, state, codeVerifier);
+  if (!stateValidation.valid) {
+    console.error('[OAuth Callback] State validation failed:', stateValidation.error);
+    return buildOAuthErrorResponse(stateValidation.error, request);
+  }
+
+  try {
+    const tokens = await dynamicGoogle.validateAuthorizationCode(code, codeVerifier);
+    const accessToken = tokens.accessToken;
+
+    const googleResponse = await fetch(GOOGLE_APIS.oauth2, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+
+    if (!googleResponse.ok) {
+      throw new Error('Failed to fetch user info');
+    }
+
+    const googleUser = await googleResponse.json();
+
+    const user = await globalManager.lock('oauth-user-create', async () => {
+      let existing = getBy('user', 'email', googleUser.email);
+      if (existing) return existing;
+
+      const engine = await getConfigEngine();
+      const roles = engine.getRoles();
+      const defaultRole = Object.keys(roles)[0] || 'clerk';
+
+      return create('user', {
+        email: googleUser.email,
+        name: googleUser.name,
+        avatar: googleUser.picture,
+        type: 'auditor',
+        role: defaultRole,
+        status: 'active',
+      });
+    });
+
+    const { sessionCookie } = await createSession(user.id);
+
+    await deleteOAuthCookie(stateKey);
+
+    const redirectUrl = new URL('/', request.url);
+    const response = NextResponse.redirect(redirectUrl);
+
+    const cookieValue = `${sessionCookie.value}; Path=${sessionCookie.attributes.path || '/'}; HttpOnly${sessionCookie.attributes.secure ? '; Secure' : ''}; SameSite=${sessionCookie.attributes.sameSite || 'Lax'}`;
+    response.headers.set('Set-Cookie', `${sessionCookie.name}=${cookieValue}`);
+
+    return response;
+  } catch (error) {
+    console.error('Google OAuth error:', error);
+    return buildOAuthErrorResponse('oauth_failed', request);
+  }
+}

package/src/app/api/auth/google/route.js

@@ -0,0 +1,58 @@
+import { NextResponse } from '@/lib/next-polyfills';
+import { google } from '@/engine.server';
+import { Google } from 'arctic';
+import { generateState, generateCodeVerifier } from 'arctic';
+import { globalManager } from '@/lib/hot-reload/mutex';
+import { config } from '@/config';
+import { validateOAuthProvider, setOAuthCookie, buildOAuthErrorResponse } from '@/lib/auth-route-helpers';
+
+export async function GET(request) {
+  const url = new URL(request.url);
+  const isCheck = url.searchParams.get('check') === '1';
+
+  if (isCheck) {
+    const { valid } = validateOAuthProvider(google);
+    return new Response(JSON.stringify({ configured: valid }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' }
+    });
+  }
+
+  const protocol = request.headers['x-forwarded-proto'] || 'http';
+  const host = request.headers['x-forwarded-host'] || request.headers.host || 'localhost:3000';
+  const redirectUri = `${protocol}://${host}/api/auth/google/callback`;
+
+  const dynamicGoogle = new Google(
+    config.auth.google.clientId,
+    config.auth.google.clientSecret,
+    redirectUri
+  );
+
+  const { valid, error } = validateOAuthProvider(dynamicGoogle);
+  if (!valid) {
+    return buildOAuthErrorResponse(error);
+  }
+
+  return globalManager.lock('oauth-state-init', async () => {
+    const state = generateState();
+    const codeVerifier = generateCodeVerifier();
+
+    const stateKey = await setOAuthCookie('google_oauth_state', { state, codeVerifier });
+
+    const url = await dynamicGoogle.createAuthorizationURL(stateKey, codeVerifier, {
+      scopes: ['profile', 'email'],
+    });
+
+    return NextResponse.redirect(url);
+  });
+}
+
+export async function HEAD(request) {
+  try {
+    const { valid } = validateOAuthProvider(google);
+    return new Response(null, { status: valid ? 200 : 503 });
+  } catch (error) {
+    console.error('[OAuth HEAD] Error:', error);
+    return new Response(null, { status: 500 });
+  }
+}

package/src/app/api/auth/login/route.js

@@ -0,0 +1,121 @@
+import { getBy, verifyPassword, migrate } from '@/engine';
+import { initializeSystemConfig } from '@/config/system-config-loader';
+import { withErrorHandler } from '@/lib/with-error-handler';
+import { lucia } from '@/engine.server';
+
+let initialized = false;
+
+const loginAttempts = new Map();
+const MAX_ATTEMPTS = 5;
+const LOCKOUT_MS = 15 * 60 * 1000;
+
+function checkRateLimit(ip) {
+  const record = loginAttempts.get(ip);
+  if (!record) return { allowed: true };
+  if (Date.now() - record.firstAttempt > LOCKOUT_MS) {
+    loginAttempts.delete(ip);
+    return { allowed: true };
+  }
+  if (record.count >= MAX_ATTEMPTS) {
+    const retryAfter = Math.ceil((record.firstAttempt + LOCKOUT_MS - Date.now()) / 1000);
+    return { allowed: false, retryAfter };
+  }
+  return { allowed: true };
+}
+
+function recordFailedAttempt(ip) {
+  const record = loginAttempts.get(ip) || { count: 0, firstAttempt: Date.now() };
+  record.count++;
+  loginAttempts.set(ip, record);
+}
+
+function clearAttempts(ip) {
+  loginAttempts.delete(ip);
+}
+
+export const POST = withErrorHandler(async (request) => {
+  if (!initialized) {
+    initialized = true;
+    try {
+      await initializeSystemConfig();
+      migrate();
+    } catch (e) {
+      console.error('[Login] Init failed:', e.message);
+      return new Response(JSON.stringify({ error: 'System init failed' }), { status: 500, headers: { 'Content-Type': 'application/json' } });
+    }
+  }
+
+  const ip = request.headers?.get?.('x-forwarded-for') || request.headers?.['x-forwarded-for'] || 'unknown';
+  const rateCheck = checkRateLimit(ip);
+  if (!rateCheck.allowed) {
+    return new Response(JSON.stringify({ error: 'Too many login attempts. Try again later.' }), {
+      status: 429,
+      headers: { 'Content-Type': 'application/json', 'Retry-After': String(rateCheck.retryAfter) }
+    });
+  }
+
+  try {
+    let email, password;
+    const body = request.body;
+
+    if (typeof body === 'object' && body !== null) {
+      email = body.email;
+      password = body.password;
+    } else if (typeof body === 'string') {
+      const params = new URLSearchParams(body);
+      email = params.get('email');
+      password = params.get('password');
+    } else {
+      return new Response(JSON.stringify({ error: 'Invalid request format' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+    }
+
+    if (!email || !password) {
+      return new Response(JSON.stringify({ error: 'Email and password required' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+    }
+
+    const user = getBy('user', 'email', email);
+    if (!user) {
+      recordFailedAttempt(ip);
+      return new Response(JSON.stringify({ error: 'Invalid email or password' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+    }
+
+    if (!user.password_hash) {
+      recordFailedAttempt(ip);
+      return new Response(JSON.stringify({ error: 'Invalid email or password' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+    }
+
+    const passwordValid = await verifyPassword(password, user.password_hash);
+    if (!passwordValid) {
+      recordFailedAttempt(ip);
+      return new Response(JSON.stringify({ error: 'Invalid email or password' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+    }
+
+    clearAttempts(ip);
+
+    const session = await lucia.createSession(user.id, {});
+    const sessionCookie = lucia.createSessionCookie(session.id);
+    const cookieHeader = `${sessionCookie.name}=${sessionCookie.value}; Path=/; HttpOnly; SameSite=Lax${sessionCookie.attributes.secure ? '; Secure' : ''}`;
+
+    const responseBody = JSON.stringify({
+      status: 'success',
+      message: 'Login successful',
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role
+      }
+    });
+
+    return new Response(responseBody, {
+      status: 200,
+      headers: {
+        'Content-Type': 'application/json',
+        'Set-Cookie': cookieHeader
+      }
+    });
+  } catch (err) {
+    console.error('[Login] Error:', err.message);
+    return new Response(JSON.stringify({ error: 'Authentication failed' }), { status: 500, headers: { 'Content-Type': 'application/json' } });
+  }
+}, 'Auth:Login');

package/src/app/api/auth/logout/route.js

@@ -0,0 +1,52 @@
+import { setCurrentRequest as setEngineRequest, invalidateSession } from '@/engine.server';
+import { setCurrentRequest, setCurrentResponse } from '@/lib/next-polyfills';
+
+function buildLogoutHeaders(headerMap) {
+  const setCookies = headerMap.get('Set-Cookie');
+  return setCookies
+    ? (Array.isArray(setCookies) ? setCookies : [setCookies])
+    : [];
+}
+
+export async function GET(request, { res } = {}) {
+  try {
+    setEngineRequest(request);
+    setCurrentRequest(request);
+    const headers = new Map();
+    setCurrentResponse({
+      getHeader: (name) => headers.get(name),
+      setHeader: (name, value) => headers.set(name, value),
+    });
+    await invalidateSession();
+    const response = new Response(null, { status: 307 });
+    buildLogoutHeaders(headers).forEach(cookie => response.headers.append('Set-Cookie', cookie));
+    response.headers.set('Location', `/login`);
+    return response;
+  } catch {
+    return new Response(null, { status: 307, headers: { Location: '/login' } });
+  }
+}
+
+export async function POST(request) {
+  try {
+    setEngineRequest(request);
+    setCurrentRequest(request);
+    const headers = new Map();
+    setCurrentResponse({
+      getHeader: (name) => headers.get(name),
+      setHeader: (name, value) => headers.set(name, value),
+    });
+    await invalidateSession();
+    const response = new Response(JSON.stringify({ success: true }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' }
+    });
+    buildLogoutHeaders(headers).forEach(cookie => response.headers.append('Set-Cookie', cookie));
+    return response;
+  } catch {
+    return new Response(JSON.stringify({ success: true }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' }
+    });
+  }
+}

package/src/app/api/auth/me/route.js

@@ -0,0 +1,16 @@
+import { NextResponse } from '@/lib/next-polyfills';
+import { getUser, setCurrentRequest } from '@/engine.server';
+import { HTTP } from '@/config/constants';
+
+export async function GET(request) {
+  try {
+    setCurrentRequest(request);
+    const user = await getUser();
+    if (!user) {
+      return NextResponse.json({ user: null }, { status: HTTP.UNAUTHORIZED });
+    }
+    return NextResponse.json({ user });
+  } catch {
+    return NextResponse.json({ user: null }, { status: HTTP.UNAUTHORIZED });
+  }
+}

package/src/app/api/auth/mwr-bridge/route.js

@@ -0,0 +1,77 @@
+import { getBy } from '@/engine';
+import { lucia } from '@/engine.server';
+import { getDatabase, now } from '@/lib/database-core';
+import { withErrorHandler } from '@/lib/with-error-handler';
+import crypto from 'crypto';
+
+export const POST = withErrorHandler(async (request) => {
+  const body = await request.json();
+  const { token, email } = body || {};
+
+  if (!token) {
+    return new Response(JSON.stringify({ error: 'Token is required' }), {
+      status: 400, headers: { 'Content-Type': 'application/json' }
+    });
+  }
+
+  if (!email) {
+    return new Response(JSON.stringify({ error: 'Email is required' }), {
+      status: 400, headers: { 'Content-Type': 'application/json' }
+    });
+  }
+
+  const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
+  const db = getDatabase();
+
+  let bridgeRecord;
+  try {
+    bridgeRecord = db.prepare('SELECT * FROM mwr_bridge_tokens WHERE token_hash = ? AND used = 0').get(tokenHash);
+  } catch (e) {
+    db.exec(`CREATE TABLE IF NOT EXISTS mwr_bridge_tokens (
+      id TEXT PRIMARY KEY,
+      token_hash TEXT NOT NULL,
+      email TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      used INTEGER DEFAULT 0,
+      created_at INTEGER NOT NULL
+    )`);
+    db.exec('CREATE INDEX IF NOT EXISTS idx_mwr_bridge_token ON mwr_bridge_tokens(token_hash)');
+    bridgeRecord = null;
+  }
+
+  const user = getBy('user', 'email', email.toLowerCase().trim());
+  if (!user) {
+    return new Response(JSON.stringify({ error: 'User not found in Moonlanding' }), {
+      status: 404, headers: { 'Content-Type': 'application/json' }
+    });
+  }
+
+  if (bridgeRecord) {
+    if (bridgeRecord.expires_at < now()) {
+      db.prepare('UPDATE mwr_bridge_tokens SET used = 1 WHERE id = ?').run(bridgeRecord.id);
+      return new Response(JSON.stringify({ error: 'Bridge token has expired' }), {
+        status: 401, headers: { 'Content-Type': 'application/json' }
+      });
+    }
+
+    if (bridgeRecord.email.toLowerCase() !== email.toLowerCase().trim()) {
+      return new Response(JSON.stringify({ error: 'Token email mismatch' }), {
+        status: 401, headers: { 'Content-Type': 'application/json' }
+      });
+    }
+
+    db.prepare('UPDATE mwr_bridge_tokens SET used = 1 WHERE id = ?').run(bridgeRecord.id);
+  }
+
+  const session = await lucia.createSession(user.id, {});
+  const sessionCookie = lucia.createSessionCookie(session.id);
+  const cookieHeader = `${sessionCookie.name}=${sessionCookie.value}; Path=/; HttpOnly; SameSite=Lax${sessionCookie.attributes.secure ? '; Secure' : ''}`;
+
+  return new Response(JSON.stringify({
+    status: 'success',
+    user: { id: user.id, email: user.email, name: user.name, role: user.role }
+  }), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json', 'Set-Cookie': cookieHeader }
+  });
+}, 'Auth:MWRBridge');

package/src/app/api/auth/password-reset/route.js

@@ -0,0 +1,65 @@
+import { getBy } from '@/engine';
+import { hashPassword } from '@/engine';
+import { getDatabase, genId, now } from '@/lib/database-core';
+import { withErrorHandler } from '@/lib/with-error-handler';
+import crypto from 'crypto';
+
+export const POST = withErrorHandler(async (request) => {
+  const body = await request.json();
+  const email = body?.email?.trim()?.toLowerCase();
+
+  if (!email) {
+    return new Response(JSON.stringify({ error: 'Email is required' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+  }
+
+  const user = getBy('user', 'email', email);
+
+  if (user) {
+    const db = getDatabase();
+    const token = crypto.randomBytes(32).toString('hex');
+    const expiresAt = now() + 3600;
+
+    db.prepare('DELETE FROM password_reset_tokens WHERE user_id = ?').run(user.id);
+    db.prepare('INSERT INTO password_reset_tokens (id, user_id, token, expires_at, used, created_at) VALUES (?, ?, ?, ?, 0, ?)').run(genId(), user.id, token, expiresAt, now());
+
+  }
+
+  return new Response(JSON.stringify({ status: 'success', message: 'If an account exists with that email, a reset link has been sent.' }), {
+    status: 200, headers: { 'Content-Type': 'application/json' }
+  });
+}, 'Auth:PasswordReset');
+
+export const PUT = withErrorHandler(async (request) => {
+  const body = await request.json();
+  const { token, password } = body || {};
+
+  if (!token || !password) {
+    return new Response(JSON.stringify({ error: 'Token and password are required' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+  }
+
+  if (password.length < 8) {
+    return new Response(JSON.stringify({ error: 'Password must be at least 8 characters' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+  }
+
+  const db = getDatabase();
+  const resetToken = db.prepare('SELECT * FROM password_reset_tokens WHERE token = ? AND used = 0').get(token);
+
+  if (!resetToken) {
+    return new Response(JSON.stringify({ error: 'Invalid or expired reset token' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+  }
+
+  if (resetToken.expires_at < now()) {
+    db.prepare('UPDATE password_reset_tokens SET used = 1 WHERE id = ?').run(resetToken.id);
+    return new Response(JSON.stringify({ error: 'Reset token has expired. Please request a new one.' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+  }
+
+  const passwordHash = await hashPassword(password);
+
+  db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(passwordHash, resetToken.user_id);
+  db.prepare('UPDATE password_reset_tokens SET used = 1 WHERE id = ?').run(resetToken.id);
+  db.prepare('DELETE FROM sessions WHERE user_id = ?').run(resetToken.user_id);
+
+  return new Response(JSON.stringify({ status: 'success', message: 'Password updated successfully' }), {
+    status: 200, headers: { 'Content-Type': 'application/json' }
+  });
+}, 'Auth:PasswordResetConfirm');

package/src/app/api/cron/trigger/route.js

@@ -0,0 +1,58 @@
+import { runDueJobs } from '@/engine/job-engine';
+import { create } from '@/engine';
+
+export const runtime = 'nodejs';
+
+export async function POST(request) {
+  const startTime = Date.now();
+
+  try {
+    const authHeader = request.headers.get('authorization');
+    const token = authHeader?.replace('Bearer ', '');
+
+    if (!token || token !== process.env.CRON_SECRET) {
+      return new Response(
+        JSON.stringify({ status: 'error', message: 'Unauthorized' }),
+        { status: 401, headers: { 'Content-Type': 'application/json' } }
+      );
+    }
+
+    const results = await runDueJobs();
+    const duration = Date.now() - startTime;
+
+    await create('job_execution_log', {
+      timestamp: Math.floor(Date.now() / 1000),
+      total_jobs: results.total || 0,
+      executed_jobs: results.executed || 0,
+      failed_jobs: results.failed || 0,
+      duration_ms: duration,
+      status: results.failed > 0 ? 'partial_failure' : 'success',
+      error_details: results.errors || null
+    }).catch(err => console.error('[Cron] Log error:', err.message));
+
+    return new Response(
+      JSON.stringify({
+        status: 'success',
+        timestamp: new Date().toISOString(),
+        total_jobs: results.total,
+        executed_jobs: results.executed,
+        failed_jobs: results.failed,
+        duration_ms: duration,
+        details: results.details || []
+      }),
+      { status: 200, headers: { 'Content-Type': 'application/json' } }
+    );
+  } catch (error) {
+    return new Response(
+      JSON.stringify({ status: 'error', message: error.message, timestamp: new Date().toISOString() }),
+      { status: 500, headers: { 'Content-Type': 'application/json' } }
+    );
+  }
+}
+
+export async function GET() {
+  return new Response(
+    JSON.stringify({ status: 'ok', message: 'Cron trigger endpoint active. POST with Bearer token to execute.', timestamp: new Date().toISOString() }),
+    { status: 200, headers: { 'Content-Type': 'application/json' } }
+  );
+}

package/src/app/api/csrf-token/route.js

@@ -0,0 +1,8 @@
+import { generateToken } from '@/lib/csrf-protection';
+import { ok } from '@/lib/response-formatter';
+import { withErrorHandler } from '@/lib/with-error-handler';
+
+export const GET = withErrorHandler(async (request) => {
+  const token = generateToken();
+  return ok({ csrfToken: token });
+}, 'CSRF:GetToken');

package/src/app/api/debug/config/route.js

@@ -0,0 +1,22 @@
+import { NextResponse } from '@/lib/next-polyfills';
+
+export async function GET() {
+  if (process.env.NODE_ENV === 'production') {
+    return NextResponse.json({ error: 'Not available in production' }, { status: 403 });
+  }
+  const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+  const engine = getConfigEngineSync();
+  const plugins = engine._plugins ? Object.fromEntries(
+    [...engine._plugins.entries()].map(([k, v]) => [k, { fields: Object.keys(v.fields || {}), hooks: v.hooks?.length || 0, validators: v.validators?.length || 0 }])
+  ) : {};
+  return NextResponse.json({
+    entities: engine.getAllEntities(),
+    roles: Object.keys(engine.getRoles()),
+    workflows: Object.keys(engine.getConfig().workflows || {}),
+    domains: Object.keys(engine.getDomains()),
+    plugins,
+    specCacheSize: engine.specCache?.cache?.size ?? 0,
+  });
+}
+
+export const config = { runtime: 'nodejs' };

package/src/app/api/debug/hooks/route.js

@@ -0,0 +1,16 @@
+import { NextResponse } from '@/lib/next-polyfills';
+
+export async function GET() {
+  if (process.env.NODE_ENV === 'production') {
+    return NextResponse.json({ error: 'Not available in production' }, { status: 403 });
+  }
+  const { hookEngine } = await import('@/lib/hook-engine.js');
+  const stats = hookEngine.stats();
+  const listeners = {};
+  for (const name of Object.keys(stats)) {
+    listeners[name] = hookEngine.listeners(name).map(h => ({ priority: h.priority, once: h.once, name: h.callback?.name || 'anonymous' }));
+  }
+  return NextResponse.json({ hooks: stats, listeners });
+}
+
+export const config = { runtime: 'nodejs' };

package/src/app/api/debug/plugins/route.js

@@ -0,0 +1,20 @@
+import { NextResponse } from '@/lib/next-polyfills';
+
+export async function GET() {
+  if (process.env.NODE_ENV === 'production') {
+    return NextResponse.json({ error: 'Not available in production' }, { status: 403 });
+  }
+  const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+  const engine = getConfigEngineSync();
+  const plugins = engine._plugins ? Object.fromEntries(
+    [...engine._plugins.entries()].map(([k, v]) => [k, {
+      entityName: v.entityName,
+      fields: Object.keys(v.fields || {}),
+      hooks: Object.keys(v.hooks || {}),
+      validators: Object.keys(v.validators || {}),
+    }])
+  ) : {};
+  return NextResponse.json({ plugins, count: Object.keys(plugins).length });
+}
+
+export const config = { runtime: 'nodejs' };

package/src/app/api/debug/sqlite/route.js

@@ -0,0 +1,21 @@
+import { NextResponse } from '@/lib/next-polyfills';
+import { getDatabase } from '@/engine';
+
+export async function GET() {
+  if (process.env.NODE_ENV === 'production') {
+    return NextResponse.json({ error: 'Not available in production' }, { status: 403 });
+  }
+  try {
+    const db = getDatabase();
+    const page_count = db.pragma('page_count', { simple: true });
+    const page_size = db.pragma('page_size', { simple: true });
+    const journal_mode = db.pragma('journal_mode', { simple: true });
+    const wal_autocheckpoint = db.pragma('wal_autocheckpoint', { simple: true });
+    const path = db.name;
+    return NextResponse.json({ path, page_count, page_size, bytes: page_count * page_size, journal_mode, wal_autocheckpoint });
+  } catch (e) {
+    return NextResponse.json({ error: String(e?.message || e) }, { status: 500 });
+  }
+}
+
+export const config = { runtime: 'nodejs' };

package/src/app/api/debug/sync/route.js

@@ -0,0 +1,29 @@
+import fs from 'fs';
+import path from 'path';
+import { NextResponse } from '@/lib/next-polyfills';
+import { getDatabase } from '@/engine';
+
+export async function GET() {
+  if (process.env.NODE_ENV === 'production') {
+    return NextResponse.json({ error: 'Not available in production' }, { status: 403 });
+  }
+  const dataDir = path.resolve('data');
+  let last_run_at = null;
+  try {
+    if (fs.existsSync(dataDir)) {
+      const files = fs.readdirSync(dataDir).map(f => path.join(dataDir, f)).filter(p => { try { return fs.statSync(p).isFile() } catch { return false } });
+      if (files.length) last_run_at = new Date(Math.max(...files.map(p => fs.statSync(p).mtimeMs))).toISOString();
+    }
+  } catch {}
+  let table_counts = {};
+  try {
+    const db = getDatabase();
+    const tables = ['users', 'engagement', 'review', 'rfi_template', 'entity_type', 'engagement_type', 'client'];
+    for (const t of tables) {
+      try { table_counts[t] = db.prepare(`SELECT COUNT(*) c FROM ${t}`).get()?.c ?? null; } catch { table_counts[t] = null; }
+    }
+  } catch (e) { table_counts._error = String(e?.message || e); }
+  return NextResponse.json({ last_run_at, table_counts });
+}
+
+export const config = { runtime: 'nodejs' };