thatcher 1.0.4

package/src/ui/page-handler-reviews.js

@@ -0,0 +1,165 @@
+import { list, get } from '@/lib/query-engine.js';
+import { getSpec } from '@/config/spec-helpers.js';
+import { getDatabase } from '@/lib/database-core.js';
+import { renderEntityList, renderAccessDenied } from '@/ui/renderer.js';
+import { renderSectionReport, renderReviewListTabbed } from '@/ui/review-renderer.js';
+import { renderChecklistDetails, renderChecklistsHome } from '@/ui/checklist-renderer.js';
+import { renderPdfViewer, renderPdfEditorPlaceholder } from '@/ui/pdf-viewer-renderer.js';
+import { renderReviewAnalytics } from '@/ui/review-analytics-renderer.js';
+import { renderHighlightThreading } from '@/ui/highlight-threading-renderer.js';
+import { renderSectionResolution } from '@/ui/section-resolution-renderer.js';
+import { renderReviewComparison, renderComparisonPicker } from '@/ui/review-comparison-renderer.js';
+import { renderTenderDashboard } from '@/ui/tender-dashboard-renderer.js';
+import { renderBatchOperations } from '@/ui/batch-review-renderer.js';
+import { canList, canView, canEdit } from '@/ui/permissions-ui.js';
+import { resolveRefFields } from '@/ui/page-handler-helpers.js';
+import { fileURLToPath } from 'url';
+const __dirname_rv = fileURLToPath(new URL('.', import.meta.url));
+
+async function lazyRenderer(name) {
+  const t = globalThis.__reloadTs__ || Date.now();
+  return import(`file://${__dirname_rv}${name}?t=${t}`);
+}
+
+export function handleFilteredReviewList(user, filter) {
+  if (!canList(user, 'review')) return renderAccessDenied(user, 'review', 'list');
+  const spec = getSpec('review'); if (!spec) return null;
+  let items = list('review', {});
+  if (filter === 'active') items = items.filter(r => r.status === 'active' || r.status === 'open');
+  else if (filter === 'priority') { const pids = user.priority_reviews || []; items = items.filter(r => pids.includes(r.id)); }
+  else if (filter === 'history') items = items.filter(r => r.status === 'closed' || r.status === 'completed');
+  else if (filter === 'archive') items = items.filter(r => r.status === 'archived');
+  return renderEntityList('review', resolveRefFields(items, spec), spec, user);
+}
+
+export async function handleReviewRoutes(normalized, segments, user, req) {
+  if (normalized === '/reviews/active' || normalized === '/review/active') return handleFilteredReviewList(user, 'active');
+  if (normalized === '/reviews/priority' || normalized === '/review/priority') return handleFilteredReviewList(user, 'priority');
+  if (normalized === '/reviews/history' || normalized === '/review/history') return handleFilteredReviewList(user, 'history');
+  if (normalized === '/reviews/archive' || normalized === '/review/archive') return handleFilteredReviewList(user, 'archive');
+
+  if (normalized === '/reviews' || normalized === '/review') {
+    if (!canList(user, 'review')) return renderAccessDenied(user, 'review', 'list');
+    let reviews = []; try { reviews = getDatabase().prepare('SELECT * FROM review ORDER BY updated_at DESC').all(); } catch { try { reviews = list('review', {}); } catch {} }
+    const engMap = {}; try { list('engagement', {}).forEach(e => { engMap[e.id] = e.name; }); } catch {}
+    return renderReviewListTabbed(user, reviews.map(r => ({ ...r, engagement_name: engMap[r.engagement_id] || r.engagement_name || null })));
+  }
+
+  if (segments[0] === 'review' && segments.length === 3 && segments[2] === 'sections') {
+    const reviewId = segments[1];
+    if (!canView(user, 'review')) return renderAccessDenied(user, 'review', 'view');
+    const review = get('review', reviewId) || getDatabase().prepare('SELECT * FROM review WHERE id=?').get(reviewId);
+    if (!review) return null;
+    let sections = [];
+    try { sections = list('review_section', {}).filter(s => s.review_id === reviewId); } catch (e) { console.error('Failed to fetch sections', e); }
+    return renderSectionReport(user, review, sections);
+  }
+
+  if (normalized === '/reviews/analytics' || normalized === '/review/analytics') {
+    if (!canList(user, 'review')) return renderAccessDenied(user, 'review', 'list');
+    let reviews = [], highlights = [], activity = [];
+    try { reviews = list('review', {}); } catch {} try { highlights = list('highlight', {}); } catch {} try { activity = list('activity_log', {}).slice(0, 50); } catch {}
+    return renderReviewAnalytics(user, { reviews, highlights, recentActivity: activity });
+  }
+
+  if (normalized === '/reviews/compare' || normalized === '/review/compare') {
+    if (!canList(user, 'review')) return renderAccessDenied(user, 'review', 'list');
+    const url = new URL(req.url, `http://${req.headers.host||'localhost'}`);
+    const leftId = url.searchParams.get('left'), rightId = url.searchParams.get('right');
+    if (leftId && rightId) {
+      const leftReview = get('review', leftId), rightReview = get('review', rightId);
+      if (!leftReview || !rightReview) return null;
+      let leftH = [], rightH = [];
+      try { leftH = list('highlight', {}).filter(h => h.review_id === leftId); } catch {} try { rightH = list('highlight', {}).filter(h => h.review_id === rightId); } catch {}
+      return renderReviewComparison(user, leftReview, rightReview, leftH, rightH);
+    }
+    let reviews = []; try { reviews = list('review', {}); } catch {}
+    return renderComparisonPicker(user, reviews);
+  }
+
+  if (normalized === '/reviews/tenders' || normalized === '/review/tenders') {
+    if (!canList(user, 'review')) return renderAccessDenied(user, 'review', 'list');
+    let tenders = [], reviews = [];
+    try { tenders = list('tender', {}); } catch {} try { reviews = list('review', {}); } catch {}
+    return renderTenderDashboard(user, tenders.map(t => { const r = reviews.find(rev => rev.id === t.review_id); return { ...t, review_name: r?.name || r?.title || '' }; }), reviews);
+  }
+
+  if (normalized === '/reviews/batch' || normalized === '/review/batch') {
+    if (!canEdit(user, 'review')) return renderAccessDenied(user, 'review', 'edit');
+    let reviews = []; try { reviews = list('review', {}); } catch {}
+    const spec = getSpec('review'); if (spec) reviews = resolveRefFields(reviews, spec);
+    return renderBatchOperations(user, reviews);
+  }
+
+  if (segments[0] === 'review' && segments.length === 3) {
+    const reviewId = segments[1], action = segments[2];
+    const getReview = (id) => get('review', id) || getDatabase().prepare('SELECT * FROM review WHERE id=?').get(id);
+    if (action === 'pdf') {
+      if (!canView(user, 'review')) return renderAccessDenied(user, 'review', 'view');
+      const review = getReview(reviewId); if (!review) return null;
+      let h = [], s = [];
+      try { h = list('highlight', {}).filter(x => x.review_id === reviewId); } catch {}
+      try { s = list('review_section', {}).filter(x => x.review_id === reviewId); } catch {}
+      // Flatten bounding_rect JSON → x/y/width/height for the overlay renderer.
+      h = h.map((x) => {
+        let br = null; try { br = typeof x.bounding_rect === 'string' ? JSON.parse(x.bounding_rect) : x.bounding_rect; } catch {}
+        let rects = []; try { rects = typeof x.rects === 'string' ? JSON.parse(x.rects) : (x.rects || []); } catch {}
+        return {
+          ...x,
+          x: br?.x1 ?? 0,
+          y: br?.y1 ?? 0,
+          width: br?.width ?? 0,
+          height: br?.height ?? 0,
+          rects,
+          page_number: Number(x.page_number) || 1,
+        };
+      });
+      return renderPdfViewer(user, review, h, s);
+    }
+    if (action === 'editor') { if (!canEdit(user, 'review')) return renderAccessDenied(user, 'review', 'edit'); const review = getReview(reviewId); if (!review) return null; return renderPdfEditorPlaceholder(user, review); }
+    if (action === 'highlights') { if (!canView(user, 'review')) return renderAccessDenied(user, 'review', 'view'); const review = getReview(reviewId); if (!review) return null; let h = []; try { h = list('highlight', {}).filter(x => x.review_id === reviewId); } catch {} const rm = {}; for (const x of h) { try { rm[x.id] = list('highlight_response', {}).filter(r => r.highlight_id === x.id); } catch { rm[x.id] = []; } } return renderHighlightThreading(user, review, h, rm); }
+    if (action === 'resolution') { if (!canView(user, 'review')) return renderAccessDenied(user, 'review', 'view'); const review = getReview(reviewId); if (!review) return null; let s = []; try { s = list('review_section', {}).filter(x => x.review_id === reviewId); } catch {} const hbs = {}; for (const sec of s) { try { hbs[sec.id] = list('highlight', {}).filter(h => h.review_id === reviewId && h.section_id === sec.id); } catch { hbs[sec.id] = []; } } return renderSectionResolution(user, review, s, hbs); }
+    if (action === 'edit') {
+      if (!canEdit(user, 'review')) return renderAccessDenied(user, 'review', 'edit');
+      const review = get('review', reviewId) || getDatabase().prepare('SELECT * FROM review WHERE id=?').get(reviewId);
+      if (!review) return null;
+      let engagements = [], teams = [];
+      try { engagements = list('engagement', {}); } catch {}
+      try { teams = list('team', {}); } catch {}
+      const { renderReviewEdit } = await lazyRenderer('review-edit-renderer.js');
+      return renderReviewEdit(user, review, engagements, teams);
+    }
+    return null;
+  }
+
+  if (segments.length === 2 && segments[0] === 'review' && segments[1] !== 'new') {
+    const reviewId = segments[1];
+    if (!canView(user, 'review')) return renderAccessDenied(user, 'review', 'view');
+    const review = get('review', reviewId) || getDatabase().prepare('SELECT * FROM review WHERE id=?').get(reviewId); if (!review) return null;
+    let highlights = [], collaborators = [], checklists = [], sections = [], tenders = [];
+    try { highlights = list('highlight', {}).filter(h => h.review_id === reviewId); } catch {}
+    try { collaborators = list('collaborator', {}).filter(c => c.review_id === reviewId); } catch {}
+    try { checklists = list('checklist', {}).filter(c => c.review_id === reviewId).map(c => { let items = []; try { items = list('checklist_item', {}).filter(i => i.checklist_id === c.id); } catch {} return { ...c, total_items: items.length, completed_items: items.filter(i => i.completed).length }; }); } catch {}
+    try { sections = list('review_section', {}).filter(s => s.review_id === reviewId); } catch {}
+    try { tenders = list('tender', {}).filter(t => t.review_id === reviewId); } catch {}
+    const { renderReviewDetail } = await lazyRenderer('review-detail-renderer.js');
+    return renderReviewDetail(user, review, highlights, collaborators, checklists, sections, tenders);
+  }
+
+  if (segments[0] === 'checklist' && segments.length === 2 && segments[1] !== 'new') {
+    const checklistId = segments[1];
+    if (!canView(user, 'checklist')) return renderAccessDenied(user, 'checklist', 'view');
+    const checklist = get('checklist', checklistId); if (!checklist) return null;
+    let items = []; try { items = getDatabase().prepare('SELECT * FROM checklist_item WHERE checklist_id=? ORDER BY "order" ASC, created_at ASC').all(checklistId); } catch {}
+    return renderChecklistDetails(user, checklist, items);
+  }
+
+  if (normalized === '/checklists' || normalized === '/checklist') {
+    if (!canList(user, 'checklist')) return renderAccessDenied(user, 'checklist', 'list');
+    let checklists = [];
+    try { const db = getDatabase(); const stats = db.prepare('SELECT checklist_id, COUNT(*) as total, SUM(CASE WHEN is_done=1 THEN 1 ELSE 0 END) as done FROM checklist_item GROUP BY checklist_id').all(); const statsMap = Object.fromEntries(stats.map(s => [s.checklist_id, s])); checklists = list('checklist', {}).map(c => ({ ...c, total_items: statsMap[c.id]?.total || 0, completed_items: statsMap[c.id]?.done || 0 })); } catch {}
+    return renderChecklistsHome(user, checklists);
+  }
+
+  return null;
+}

package/src/ui/page-handler-rfi.js

@@ -0,0 +1,42 @@
+import { list, get } from '@/lib/query-engine.js';
+import { getDatabase } from '@/lib/database-core.js';
+import { canView, canList, isClerk, isPartner } from '@/ui/permissions-ui.js';
+import { renderAccessDenied } from '@/ui/renderer.js';
+import { renderRfiList } from '@/ui/rfi-list-renderer.js';
+import { fileURLToPath } from 'url';
+const __dirname_rfi = fileURLToPath(new URL('.', import.meta.url));
+const lazyR = (name) => import(`file://${__dirname_rfi}${name}?t=${globalThis.__reloadTs__ || Date.now()}`);
+
+export async function handleRfiDetail(user, rfiId) {
+  if (!canView(user, 'rfi')) return renderAccessDenied(user, 'rfi', 'view');
+  const db = getDatabase();
+  const rfi = db.prepare('SELECT * FROM rfis WHERE id=?').get(rfiId) || get('rfi', rfiId); if (!rfi) return null;
+  let questions = []; try { questions = db.prepare('SELECT q.*, (SELECT COUNT(*) FROM rfi_responses r WHERE r.question_id=q.id) as response_count FROM rfi_questions q WHERE q.rfi_id=?').all(rfiId); } catch { try { questions = list('rfi_question', {}).filter(q => q.rfi_id === rfiId); } catch {} }
+  let sections = []; try { sections = list('rfi_section', {}).filter(s => s.rfi_id === rfiId || s.engagement_id === rfi.engagement_id); } catch {}
+  let engagement = null; try { if (rfi.engagement_id) engagement = get('engagement', rfi.engagement_id); } catch {}
+  const { renderRfiDetail } = await lazyR('rfi-detail-renderer.js');
+  return renderRfiDetail(user, rfi, questions, sections, engagement);
+}
+
+export async function handleRfiList(user) {
+  if (!canList(user, 'rfi')) return renderAccessDenied(user, 'rfi', 'list');
+  let rfis = []; try { rfis = getDatabase().prepare('SELECT * FROM rfis ORDER BY created_at ASC').all(); } catch {}
+  let engagements = []; try { engagements = list('engagement', {}); } catch {}
+  if (isClerk(user)) rfis = rfis.filter(r => engagements.filter(e => e.assigned_to === user.id || e.team_id === user.team_id).some(e => e.id === r.engagement_id));
+  return renderRfiList(user, rfis.map((r, i) => ({ ...r, display_name: 'RFI #' + (i + 1) })), engagements);
+}
+
+export async function handleRfiReport(user, rfiId, res) {
+  const db = getDatabase();
+  let rfi = null, questions = [], responses = [], engagement = null;
+  try { rfi = get('rfi', rfiId) || db.prepare('SELECT * FROM rfis WHERE id=?').get(rfiId); } catch {}
+  if (!rfi) return null;
+  try { questions = db.prepare('SELECT * FROM rfi_questions WHERE rfi_id=? ORDER BY created_at ASC').all(rfiId); } catch {}
+  try { const qIds = questions.map(q => q.id); if (qIds.length) { const ph = qIds.map(() => '?').join(','); responses = db.prepare(`SELECT * FROM rfi_responses WHERE question_id IN (${ph})`).all(...qIds); } } catch {}
+  try { engagement = rfi.engagement_id ? (get('engagement', rfi.engagement_id) || db.prepare('SELECT * FROM engagement WHERE id=?').get(rfi.engagement_id)) : null; } catch {}
+  const { renderRfiReport } = await lazyR('rfi-report-renderer.js');
+  const html = renderRfiReport(user, rfi, engagement, questions, responses);
+  res.setHeader('Content-Type', 'text/html; charset=utf-8');
+  res.setHeader('Content-Length', Buffer.byteLength(html, 'utf-8'));
+  res.writeHead(200); res.end(html); return 'HANDLED';
+}

package/src/ui/page-handler.js

@@ -0,0 +1,210 @@
+import { getUser, setCurrentRequest } from '@/engine.server.js';
+import { hasGoogleAuth } from '@/config/env.js';
+import { getSpec } from '@/config/spec-helpers.js';
+import { list, get } from '@/lib/query-engine.js';
+import { getDatabase } from '@/lib/database-core.js';
+import { renderLogin, renderDashboard, renderEntityList, renderEntityDetail, renderEntityForm, renderAccessDenied, renderPasswordReset, renderPasswordResetConfirm, REDIRECT } from '@/ui/renderer.js';
+import { renderClientDashboard, renderClientList } from '@/ui/client-renderer.js';
+import { canList, canView, canCreate, canEdit, isPartner, isClerk, isClientUser, canClientAccessEntity } from '@/ui/permissions-ui.js';
+import { renderEngagementGrid } from '@/ui/engagement-grid-renderer.js';
+import { renderClientProgress } from '@/ui/client-progress-renderer.js';
+import { renderLetterWorkflow } from '@/ui/letter-workflow-renderer.js';
+import { renderAdvancedSearch } from '@/ui/advanced-search-renderer.js';
+import { getDashboardStats, getClientDashboardStats, resolveRefFields, resolveEnumOptions, getRefOptions } from '@/ui/page-handler-helpers.js';
+import { handleAdminPage } from '@/ui/page-handler-admin.js';
+import { handleReviewRoutes } from '@/ui/page-handler-reviews.js';
+import { handleRfiDetail, handleRfiList, handleRfiReport } from '@/ui/page-handler-rfi.js';
+import { fileURLToPath } from 'url';
+
+const __dirname_ph = fileURLToPath(new URL('.', import.meta.url));
+const lazyRenderer = (name) => import(`file://${__dirname_ph}${name}?t=${globalThis.__reloadTs__ || Date.now()}`);
+
+function reqUrl(req) {
+  return new URL(req.url, `http://${req.headers.host || 'localhost'}`);
+}
+
+async function handleEngagementDetail(user, engId) {
+  if (!canView(user, 'engagement')) return renderAccessDenied(user, 'engagement', 'view');
+  const db = getDatabase();
+  const engagement = get('engagement', engId) || db.prepare('SELECT * FROM engagement WHERE id=?').get(engId);
+  if (!engagement) return null;
+  let client = null; try { client = engagement.client_id ? get('client', engagement.client_id) : null; } catch {}
+  let rfis = []; try { rfis = db.prepare('SELECT * FROM rfis WHERE engagement_id=?').all(engId); } catch { try { rfis = list('rfi', {}).filter(r => r.engagement_id === engId); } catch {} }
+  let sections = []; try { sections = db.prepare('SELECT * FROM rfi_section WHERE engagement_id=? ORDER BY sort_order ASC').all(engId); } catch {}
+  let team = null; try { team = engagement.team_id ? get('team', engagement.team_id) : null; } catch {}
+  let assignedUsers = [];
+  try { const ids = JSON.parse(engagement.users || '[]'); const um = Object.fromEntries(db.prepare('SELECT id, name, email FROM users').all().map(u => [u.id, u.name || u.email])); assignedUsers = ids.map(id => ({ id, name: um[id] || null })).filter(u => u.name); } catch {}
+  const { renderEngagementDetail } = await lazyRenderer('engagement-detail-renderer.js');
+  return renderEngagementDetail(user, { ...engagement, team_name: team?.name || engagement.team_name, client_name: client?.name || engagement.client_name, assigned_users_resolved: assignedUsers }, client, rfis, sections);
+}
+async function handleEngagementList(user, req) {
+  if (!canList(user, 'engagement')) return renderAccessDenied(user, 'engagement', 'list');
+  let engagements = list('engagement', {});
+  const clientMap = Object.fromEntries(list('client', {}).map(c => [c.id, c.name]));
+  engagements = engagements.map(e => ({ ...e, client_name: clientMap[e.client_id] || e.client_name || '-' }));
+  const spec = getSpec('engagement'); if (spec) engagements = resolveRefFields(engagements, spec);
+  let teams = []; try { teams = list('team', {}); } catch {}
+  const teamMap = Object.fromEntries(teams.map(t => [t.id, t.name]));
+  engagements = engagements.map(e => ({ ...e, team_name: teamMap[e.team_id] || e.team_name || '-' }));
+  const years = [...new Set(engagements.map(e => { if (!e.year) return null; const m = String(e.year).match(/\b(20\d{2}|19\d{2})\b/); return m ? m[1] : null; }).filter(Boolean))].sort().reverse();
+  const filter = reqUrl(req).searchParams.get('filter') || 'all';
+  return renderEngagementGrid(user, engagements, { filter, teams, years });
+}
+async function handleSearch(user, req) {
+  const url = reqUrl(req);
+  const q = url.searchParams.get('q') || '', entityFilter = url.searchParams.get('entity') || '', statusFilter = url.searchParams.get('status') || '';
+  let teams = []; try { teams = list('team', {}); } catch {}
+  const results = {};
+  for (const eName of (entityFilter ? [entityFilter] : ['engagement', 'client', 'rfi', 'review'])) {
+    try { let items = list(eName, {}); if (q) items = items.filter(i => JSON.stringify(i).toLowerCase().includes(q.toLowerCase())); if (statusFilter) items = items.filter(i => i.status === statusFilter); const spec = getSpec(eName); if (spec) items = resolveRefFields(items, spec); results[eName] = items.slice(0, 50); } catch {}
+  }
+  return renderAdvancedSearch(user, results, { teams, stages: ['info_gathering', 'commencement', 'team_execution', 'partner_review', 'finalization', 'closeout'] });
+}
+async function handleGenericEntityView(user, entityName, id) {
+  const spec = getSpec(entityName); if (!spec) return null;
+  if (isClientUser(user) && !canClientAccessEntity(user, entityName)) return renderAccessDenied(user, entityName, 'view');
+  if (id === 'new') {
+    if (!canCreate(user, entityName)) return renderAccessDenied(user, entityName, 'create');
+    const resolvedSpec = resolveEnumOptions(spec);
+    const { renderEntityForm: lazyEntityForm } = await lazyRenderer('entity-renderer.js');
+    return lazyEntityForm(entityName, null, resolvedSpec, user, true, getRefOptions(resolvedSpec));
+  }
+  if (!canView(user, entityName)) return renderAccessDenied(user, entityName, 'view');
+  const item = get(entityName, id); if (!item) return null;
+  if (item.team_id && user.team_id && item.team_id !== user.team_id && !isPartner(user)) return renderAccessDenied(user, entityName, 'view');
+  if (isClientUser(user) && user.client_id && item.client_id && item.client_id !== user.client_id) return renderAccessDenied(user, entityName, 'view');
+  const [resolvedItem] = resolveRefFields([item], spec);
+  const { renderEntityDetail: lazyEntityDetail } = await lazyRenderer('entity-renderer.js');
+  return lazyEntityDetail(entityName, resolvedItem, spec, user);
+}
+async function handleClientSubRoute(user, clientId, subRoute) {
+  if (!canView(user, 'client')) return renderAccessDenied(user, 'client', 'view');
+  const client = get('client', clientId); if (!client) return null;
+  if (isClientUser(user) && user.client_id && user.client_id !== clientId) return renderAccessDenied(user, 'client', 'view');
+  if (subRoute === 'dashboard' || subRoute === 'users') return renderClientDashboard(user, client, getClientDashboardStats(clientId));
+  if (subRoute === 'progress') {
+    let engagements = []; try { engagements = list('engagement', {}).filter(e => e.client_id === clientId); } catch {}
+    const spec = getSpec('engagement'); if (spec) engagements = resolveRefFields(engagements, spec);
+    let rfiStats = { total: 0, responded: 0, overdue: 0 };
+    try { const allRfis = list('rfi', {}).filter(r => engagements.some(e => e.id === r.engagement_id)); const now = Math.floor(Date.now() / 1000); rfiStats = { total: allRfis.length, responded: allRfis.filter(r => r.status === 'responded' || r.status === 'completed').length, overdue: allRfis.filter(r => r.due_date && r.due_date < now && r.status !== 'closed').length }; } catch {}
+    return renderClientProgress(user, client, engagements, rfiStats);
+  }
+  return null;
+}
+async function handleGenericEntityEdit(user, entityName, id) {
+  const spec = getSpec(entityName); if (!spec) return null;
+  if (!canEdit(user, entityName)) return renderAccessDenied(user, entityName, 'edit');
+  const item = get(entityName, id); if (!item) return null;
+  if (item.team_id && user.team_id && item.team_id !== user.team_id && !isPartner(user)) return renderAccessDenied(user, entityName, 'edit');
+  const resolvedSpec = resolveEnumOptions(spec);
+  const { renderEntityForm: lazyEntityForm } = await lazyRenderer('entity-renderer.js');
+  return lazyEntityForm(entityName, item, resolvedSpec, user, false, getRefOptions(resolvedSpec));
+}
+export async function handlePage(pathname, req, res) {
+  setCurrentRequest(req);
+  const normalized = pathname === '/' ? '/' : pathname.replace(/\/$/, '');
+  const segments = normalized.split('/').filter(Boolean);
+
+  if (normalized === '/login') {
+    const user = await getUser();
+    if (user) { res.writeHead(302, { Location: '/' }); res.end(); return REDIRECT; }
+    return renderLogin(null, hasGoogleAuth());
+  }
+  if (normalized === '/password-reset') return renderPasswordReset();
+  if (normalized === '/password-reset/confirm') {
+    const token = reqUrl(req).searchParams.get('token') || '';
+    return renderPasswordResetConfirm(token);
+  }
+
+  const user = await getUser();
+  if (!user) { res.writeHead(302, { Location: '/login' }); res.end(); return REDIRECT; }
+  if (normalized === '/unauthorized') return renderAccessDenied(user, 'system', 'access');
+  if (normalized === '/notifications') { let notifs=[]; try{notifs=getDatabase().prepare('SELECT * FROM notification WHERE user_id=? ORDER BY created_at DESC LIMIT 100').all(user.id)}catch{} const{renderNotificationsPage}=await lazyRenderer('notifications-renderer.js'); return renderNotificationsPage(user,notifs); }
+  if (normalized === '/' || normalized === '/dashboard') return renderDashboard(user, await getDashboardStats(user));
+  if (normalized.startsWith('/admin/') || normalized === '/admin/jobs') return handleAdminPage(normalized, segments, user);
+  if (segments[0] === 'client' && segments.length === 3 && ['dashboard', 'users', 'progress'].includes(segments[2])) return handleClientSubRoute(user, segments[1], segments[2]);
+  if (isClerk(user) && segments.length >= 1 && ['user', 'team'].includes(segments[0])) return renderAccessDenied(user, segments[0], 'list');
+  if (normalized === '/mwr' || normalized === '/mwr/home') {
+    if (!canList(user, 'review')) return renderAccessDenied(user, 'review', 'list');
+    const db = getDatabase();
+    let myReviews = [], sharedReviews = [], recentActivity = [];
+    try { myReviews = db.prepare('SELECT * FROM review WHERE created_by=? OR assigned_to=? ORDER BY updated_at DESC LIMIT 100').all(user.id, user.id); } catch { try { myReviews = list('review', {}).filter(r => r.created_by === user.id || r.assigned_to === user.id); } catch {} }
+    try { sharedReviews = db.prepare('SELECT r.* FROM review r JOIN collaborator c ON c.review_id=r.id WHERE c.user_id=? ORDER BY r.updated_at DESC LIMIT 100').all(user.id); } catch {}
+    try { recentActivity = db.prepare("SELECT * FROM audit_logs WHERE entity_type='review' ORDER BY timestamp DESC LIMIT 50").all(); } catch {}
+    const all = [...myReviews, ...sharedReviews];
+    const stats = { myReviews, sharedReviews, recentActivity, totalReviews: all.length, activeReviews: all.filter(r => (r.status||'open') !== 'archived' && (r.status||'open') !== 'completed' && (r.status||'open') !== 'closed').length, flaggedReviews: all.filter(r => r.flagged).length, overdueReviews: 0 };
+    const { renderMwrHome } = await lazyRenderer('review-mwr-renderer.js');
+    return renderMwrHome(user, stats);
+  }
+  const reviewResult = await handleReviewRoutes(normalized, segments, user, req);
+  if (reviewResult !== null) return reviewResult;
+
+  if (normalized === '/engagements') return handleEngagementList(user, req);
+  if (normalized === '/search') return handleSearch(user, req);
+  if (normalized === '/ml-console') {
+    const db = getDatabase();
+    let candidates = []; let reviewMap = {};
+    try {
+      candidates = db.prepare(`SELECT * FROM highlight
+        WHERE (comment IS NOT NULL AND comment != '')
+        AND (comment LIKE '%?' OR length(comment) > 40)
+        ORDER BY created_at DESC LIMIT 50`).all();
+      const revIds = [...new Set(candidates.map((c) => c.review_id))];
+      if (revIds.length) {
+        const ph = revIds.map(() => '?').join(',');
+        const rows = db.prepare(`SELECT id, name FROM review WHERE id IN (${ph})`).all(...revIds);
+        reviewMap = Object.fromEntries(rows.map((r) => [r.id, r.name || '-']));
+      }
+    } catch {}
+    const { renderMlConsole } = await lazyRenderer('ml-console-renderer.js');
+    return renderMlConsole(user, candidates, reviewMap);
+  }
+  if (segments.length === 2 && (segments[0] === 'engagements' || segments[0] === 'engagement') && segments[1] !== 'new') return handleEngagementDetail(user, segments[1]);
+  if (segments[0] === 'engagement' && segments.length === 3 && segments[2] === 'letter') {
+    if (!canView(user, 'engagement')) return renderAccessDenied(user, 'engagement', 'view');
+    const engagement = get('engagement', segments[1]); if (!engagement) return null;
+    return renderLetterWorkflow(user, engagement);
+  }
+  if (segments[0] === 'engagement' && segments.length === 3 && segments[2] === 'report') {
+    if (!canView(user, 'engagement')) return renderAccessDenied(user, 'engagement', 'view');
+    const engId = segments[1]; const engagement = get('engagement', engId); if (!engagement) return null;
+    const db = getDatabase(); let client=null,team=null,rfis=[],reviews=[],highlights=[],activity=[];
+    try{client=engagement.client_id?get('client',engagement.client_id):null}catch{}
+    try{team=engagement.team_id?get('team',engagement.team_id):null}catch{}
+    try{rfis=db.prepare('SELECT * FROM rfi WHERE engagement_id=? ORDER BY created_at DESC').all(engId)}catch{}
+    try{reviews=db.prepare('SELECT * FROM review WHERE engagement_id=? ORDER BY created_at DESC').all(engId)}catch{}
+    try{const rids=reviews.map(r=>r.id);if(rids.length){const ph=rids.map(()=>'?').join(',');highlights=db.prepare(`SELECT * FROM highlight WHERE review_id IN (${ph})`).all(...rids)}}catch{}
+    try{activity=db.prepare("SELECT * FROM audit_logs WHERE entity_type='engagement' AND entity_id=? ORDER BY timestamp DESC LIMIT 20").all(engId)}catch{}
+    const{renderFlexupReport}=await lazyRenderer('flexup-report-renderer.js');
+    return renderFlexupReport(user,engagement,client,rfis,reviews,highlights,activity,team);
+  }
+  if (segments.length === 3 && segments[0] === 'rfi' && segments[2] === 'report') return handleRfiReport(user, segments[1], res);
+  if (segments.length === 2 && segments[0] === 'rfi' && segments[1] !== 'new') return handleRfiDetail(user, segments[1]);
+  if (segments.length === 1 && segments[0] === 'rfi') return handleRfiList(user);
+  if (segments.length === 1 && segments[0] === 'client') {
+    if (!canList(user, 'client')) return renderAccessDenied(user, 'client', 'list');
+    let clients = list('client', {});
+    if (isClientUser(user) && user.client_id) clients = clients.filter(c => c.id === user.client_id);
+    return renderClientList(user, clients);
+  }
+  if (segments.length === 1) {
+    const entityName = segments[0];
+    const spec = getSpec(entityName); if (!spec) return null;
+    if (isClientUser(user) && !canClientAccessEntity(user, entityName)) return renderAccessDenied(user, entityName, 'list');
+    if (!canList(user, entityName)) return renderAccessDenied(user, entityName, 'list');
+    let items = list(entityName, {});
+    if (isClientUser(user) && user.client_id) items = items.filter(item => { if (item.client_id) return item.client_id === user.client_id; if (item.assigned_to) return item.assigned_to === user.id; return true; });
+    const { renderEntityList: lazyEntityList } = await lazyRenderer('entity-renderer.js');
+    return lazyEntityList(entityName, resolveRefFields(items, spec), spec, user);
+  }
+  if (segments.length === 2 && segments[0] === 'client' && segments[1] !== 'new') {
+    if (!canView(user, 'client')) return renderAccessDenied(user, 'client', 'view');
+    if (isClientUser(user) && user.client_id && user.client_id !== segments[1]) return renderAccessDenied(user, 'client', 'view');
+    const client = get('client', segments[1]); if (!client) return null;
+    return renderClientDashboard(user, client, getClientDashboardStats(segments[1]));
+  }
+  if (segments.length === 2) return handleGenericEntityView(user, segments[0], segments[1]);
+  if (segments.length === 3 && segments[2] === 'edit') return handleGenericEntityEdit(user, segments[0], segments[1]);
+
+  return null;
+}

package/src/ui/password-reset-page.js

@@ -0,0 +1,146 @@
+export function renderPasswordResetPage(params = {}) {
+  const token = params.token || '';
+  const isConfirm = !!token;
+  const title = isConfirm ? 'Set New Password' : 'Forgot Password';
+  const subtitle = isConfirm ? 'Enter your new password below' : 'Enter your email to receive a reset link';
+  const btnLabel = isConfirm ? 'Update Password' : 'Send Reset Link';
+
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${title} | Moonlanding</title>
+  <style>
+    *{margin:0;padding:0;box-sizing:border-box}
+    :root{--bg:#f1f5f9;--surface:#fff;--border:#e2e8f0;--text:#0f172a;--text-muted:#64748b;--primary:#04141f;--accent:#2563eb;--danger:#b91c1c;--danger-bg:#fee2e2;--danger-border:#fca5a5;--success-bg:#dcfce7;--success:#15803d;--success-border:#86efac;--info-bg:#dbeafe;--info:#1d4ed8;--info-border:#93c5fd}
+    @media(prefers-color-scheme:dark){:root{--bg:#0f172a;--surface:#1a1a1a;--border:#334155;--text:#f1f5f9;--text-muted:#94a3b8;--primary:#1e3a5f}}
+    body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:var(--bg);min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px;color:var(--text)}
+    .wrap{width:100%;max-width:400px}
+    .logo{text-align:center;margin-bottom:32px}
+    .logo-mark{display:inline-flex;align-items:center;justify-content:center;width:52px;height:52px;background:var(--primary);border-radius:14px;margin-bottom:14px;box-shadow:0 4px 12px rgba(4,20,31,0.25)}
+    .logo-name{font-size:1.35rem;font-weight:800;color:var(--text);letter-spacing:0.5px;display:block;margin-bottom:4px}
+    .logo-sub{color:var(--text-muted);font-size:0.875rem}
+    .card{background:var(--surface);border-radius:10px;box-shadow:0 4px 24px rgba(0,0,0,0.09);padding:32px;border:1px solid var(--border)}
+    .field{margin-bottom:18px}
+    label{display:block;font-size:0.8125rem;font-weight:600;color:var(--text);margin-bottom:6px}
+    input{width:100%;padding:10px 13px;border:1.5px solid var(--border);border-radius:8px;font-size:0.9rem;outline:none;transition:border-color 0.15s,box-shadow 0.15s;background:var(--surface);color:var(--text);min-height:44px}
+    input:focus{border-color:var(--accent);box-shadow:0 0 0 3px rgba(37,99,235,0.12)}
+    input::placeholder{color:var(--text-muted)}
+    .submit-btn{width:100%;padding:12px;background:var(--primary);color:#fff;border:none;border-radius:8px;font-size:0.9375rem;font-weight:600;cursor:pointer;transition:all 0.15s;min-height:46px;margin-top:4px}
+    .submit-btn:hover:not(:disabled){background:#0a2535}
+    .submit-btn:disabled{opacity:0.65;cursor:not-allowed}
+    .submit-btn:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+    .alert{padding:11px 14px;border-radius:8px;margin-bottom:18px;font-size:0.875rem;border:1px solid;line-height:1.4}
+    .alert-error{background:var(--danger-bg);color:var(--danger);border-color:var(--danger-border)}
+    .alert-success{background:var(--success-bg);color:var(--success);border-color:var(--success-border)}
+    .alert-info{background:var(--info-bg);color:var(--info);border-color:var(--info-border)}
+    .back{text-align:center;margin-top:18px;font-size:0.875rem;color:var(--text-muted)}
+    .back a{color:var(--accent);text-decoration:none;font-weight:500}
+    .back a:hover{text-decoration:underline}
+    @media(prefers-color-scheme:dark){
+      .card{background:#1a1a1a;border-color:#334155;box-shadow:0 4px 24px rgba(0,0,0,0.4)}
+      input{background:#1a1a1a;border-color:#334155;color:#f1f5f9}
+      .submit-btn{background:#1e3a5f}
+      .submit-btn:hover:not(:disabled){background:#1e293b}
+    }
+  </style>
+</head>
+<body>
+  <div class="wrap">
+    <div class="logo">
+      <div class="logo-mark">
+        <svg width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="#ffffff" stroke-width="2" aria-hidden="true"><circle cx="12" cy="12" r="3"/><path d="M12 1v6m0 6v6M4.22 4.22l4.24 4.24m4.24 4.24l4.24 4.24M1 12h6m6 0h6M4.22 19.78l4.24-4.24m4.24-4.24l4.24-4.24"/></svg>
+      </div>
+      <span class="logo-name">MOONLANDING</span>
+      <div class="logo-sub">${subtitle}</div>
+    </div>
+    <div class="card">
+      <div id="alertContainer" role="alert" aria-live="assertive"></div>
+      <form id="resetForm" aria-label="${title}" novalidate>
+        ${!isConfirm ? `
+          <div class="field">
+            <label for="email">Email address</label>
+            <input type="email" name="email" id="email" placeholder="you@example.com" required autocomplete="email" autofocus>
+          </div>
+          <button type="submit" id="submitBtn" class="submit-btn">${btnLabel}</button>
+        ` : `
+          <input type="hidden" name="token" value="${token}">
+          <div class="field">
+            <label for="password">New password</label>
+            <input type="password" name="password" id="password" placeholder="At least 8 characters" required minlength="8" autocomplete="new-password" autofocus>
+          </div>
+          <div class="field">
+            <label for="confirm">Confirm new password</label>
+            <input type="password" name="confirm" id="confirm" placeholder="Same password again" required minlength="8" autocomplete="new-password">
+          </div>
+          <button type="submit" id="submitBtn" class="submit-btn">${btnLabel}</button>
+        `}
+      </form>
+      <div class="back"><a href="/login">Back to sign in</a></div>
+    </div>
+  </div>
+  <script src="/ui/event-delegation.js"></script>
+  <script>
+    var form = document.getElementById('resetForm');
+    var submitBtn = document.getElementById('submitBtn');
+    var alertContainer = document.getElementById('alertContainer');
+    var isConfirm = ${isConfirm};
+
+    function showAlert(message, type) {
+      alertContainer.innerHTML = '<div class="alert alert-' + (type || 'error') + '">' + message + '</div>';
+    }
+
+    if (isConfirm && !form.token.value) {
+      showAlert('Invalid or expired reset link. Please request a new one.', 'error');
+      submitBtn.disabled = true;
+    }
+
+    form.addEventListener('submit', async function(e) {
+      e.preventDefault();
+      alertContainer.innerHTML = '';
+      var formData = new FormData(form);
+      var data = Object.fromEntries(formData);
+
+      if (isConfirm && data.password !== data.confirm) {
+        showAlert('Passwords do not match.', 'error');
+        return;
+      }
+
+      var origText = submitBtn.textContent;
+      submitBtn.textContent = isConfirm ? 'Updating\u2026' : 'Sending\u2026';
+      submitBtn.disabled = true;
+
+      try {
+        var body = isConfirm ? { token: data.token, password: data.password } : { email: data.email };
+        var res = await fetch('/api/auth/password-reset', {
+          method: isConfirm ? 'PUT' : 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(body)
+        });
+        var result = await res.json().catch(function() { return {}; });
+        if (res.ok) {
+          if (isConfirm) {
+            showAlert('Password updated. <a href="/login" style="color:var(--success);font-weight:600;text-decoration:underline">Sign in now</a>', 'success');
+            form.style.display = 'none';
+          } else {
+            form.reset();
+            showAlert('If an account exists with that email, a reset link has been sent.', 'info');
+            submitBtn.textContent = origText;
+            submitBtn.disabled = false;
+          }
+        } else {
+          showAlert(result.error || 'An error occurred. Please try again.', 'error');
+          submitBtn.textContent = origText;
+          submitBtn.disabled = false;
+        }
+      } catch(err) {
+        showAlert('Network error. Please try again.', 'error');
+        submitBtn.textContent = origText;
+        submitBtn.disabled = false;
+      }
+    });
+  </script>
+</body>
+</html>`;
+}