thatcher 1.0.41 → 1.0.43

package/README.md

@@ -380,6 +380,33 @@ Thatcher is published to npm as `thatcher`. Every push to `main` triggers:
 
 CI/CD ready via included GitHub Actions workflow.
 
+## Runtime: Bun vs Node
+
+Thatcher targets Bun as its primary runtime (`engines.bun` in `package.json`,
+a `bun.lock` in the repo root, and `src/cli.js` carries a `#!/usr/bin/env bun`
+shebang), but most of the codebase is plain ES modules with no Bun-only API
+calls, so a Node-only consumer can run everything except the two `bun run`
+scripts as-is.
+
+| Script | Command | Runtime |
+|--------|---------|---------|
+| `npm run dev` | `bun run src/cli.js dev` | **Bun required** — invoked via `bun run`; `thatcher dev` also enables hot reload (`server.hotReload: true`), and the CLI's own shebang is `#!/usr/bin/env bun`. |
+| `npm run start` | `bun run src/cli.js start` | **Bun required** — same `bun run` invocation as `dev`, just without hot reload. |
+| `npm test` | `node test.js` | Plain Node — runs fine under `node test.js` directly. |
+| `npm run lint` | `eslint src/` | Tool-agnostic — standard ESLint CLI, no runtime dependency. |
+| `npm run typecheck` | `tsc --noEmit` | Tool-agnostic — standard TypeScript CLI. |
+
+In practice, `src/cli.js` itself has no Bun-only API calls (no `Bun.*`
+globals) — the `bun run` wrapping in `dev`/`start` is a process-launcher
+choice, not a hard code dependency, so `node src/cli.js start` / `node
+src/cli.js dev` also work for a Node-only deployer. The one place Bun is
+harder to avoid is the `busybase` dependency, whose published `src/*.js` are
+bun-build outputs (per its own build process) rather than hand-authored
+Node-targeted files. A Node-only consumer/deployer can therefore run
+`test`/`lint`/`typecheck` and the CLI itself with plain `node`, but should
+expect the `dev`/`start` npm scripts as published to require Bun on `PATH`
+unless invoking `src/cli.js` directly with `node`.
+
 ## License
 
 MIT — Extracted from moonlanding with all functionality preserved.

package/package.json

@@ -1,16 +1,13 @@
 {
   "name": "thatcher",
-  "version": "1.0.41",
+  "version": "1.0.43",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",
+  "_exportsCuratedNote": "This map is intentionally curated, not a blanket ./lib/* + ./ui/* re-export of every internal file. Rationale (2026-07): grepping thatcher's own source found zero internal self-imports via the 'thatcher/lib/*' or 'thatcher/ui/*' package specifier (internal code uses relative paths / resolveModule file URLs instead), and grepping casey (the primary real external consumer, at ../casey) found it imports only the package root ('thatcher' -> createThatcher). README.md documents exactly two public entry shapes: the root ('thatcher') and 'thatcher/adapters/google-drive'. './engine.server' (auth) was already a named, deliberate entry point distinct from the internal lib dump. './config/*', './services/*', './validation/*', './plugins/*' are kept even though no consumer was evidenced, because they are small, purposeful, plausibly-public directories (plugin-authoring in particular mirrors casey's own plugins/case-tools pattern) and erring toward NOT breaking an unseen consumer outweighs the surface-area savings of dropping them. The wide-open './lib/*' and './ui/*' globs (70+ and 40+ internal implementation files respectively, covering error handling, rendering internals, busybase adapters, etc.) were removed because nothing -- internal or external -- was found to reference them via the package-specifier form; any of thatcher's own modules that genuinely need to reach another lib file already do so via a relative import, which this map does not gate. If a real external consumer is later found needing a specific lib/ui file, add that ONE subpath explicitly rather than reopening the blanket glob.",
   "exports": {
     ".": "./src/index.js",
     "./engine.server": "./src/engine.server.js",
-    "./lib/*": "./src/lib/*.js",
-    "./lib/*.js": "./src/lib/*.js",
-    "./ui/*": "./src/ui/*.js",
-    "./ui/*.js": "./src/ui/*.js",
     "./config/*": "./src/config/*.js",
     "./config/*.js": "./src/config/*.js",
     "./services/*": "./src/services/*.js",

package/src/app/api/audit/dashboard/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[AuditDashboardAPI]');
@@ -6,7 +6,7 @@ import { getUser, setCurrentRequest } from '@/engine.server';
 import {
   getPermissionAuditTrail, getPermissionAuditStats, getPermissionAuditBreakdown,
   getPermissionAuditByDateRange, searchPermissionAudit, getPermissionDiff,
-} from '@/lib/busybase-audit-reads';
+} from '@/lib/busybase/audit-reads';
 
 export async function GET(request) {
   setCurrentRequest(request);

package/src/app/api/audit/logs/route.js

@@ -1,7 +1,7 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { requireAuth } from '@/lib/auth-middleware';
 import { searchLogs, getLogStats, rotateLogsOlderThan } from '@/lib/audit-logger-enhanced';
-import { withErrorHandler } from '@/lib/with-error-handler';
+import { withErrorHandler } from '@/lib/errors';
 
 export const GET = withErrorHandler(async (request) => {
   const user = await requireAuth();

package/src/app/api/audit/permissions/[id]/route.js

@@ -1,9 +1,9 @@
-import { NextResponse, cookies } from '@/lib/next-polyfills';
+import { NextResponse, cookies } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[AuditDetailAPI]');
 import { lucia } from '@/engine.server';
-import { getPermissionAuditById, getPermissionDiff } from '@/lib/busybase-audit-reads';
+import { getPermissionAuditById, getPermissionDiff } from '@/lib/busybase/audit-reads';
 
 async function getUser() {
   const sessionId = (await cookies()).get(lucia.sessionCookieName)?.value ?? null;

package/src/app/api/audit/permissions/route.js

@@ -1,13 +1,13 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[AuditAPI]');
 import { lucia } from '@/engine.server';
-import { cookies } from '@/lib/next-polyfills';
+import { cookies } from '@/lib/next-shim';
 import {
   logPermissionChange, getPermissionAuditTrail, searchPermissionAudit,
   getPermissionAuditByDateRange, exportPermissionAuditCSV,
-} from '@/lib/busybase-audit-reads';
+} from '@/lib/busybase/audit-reads';
 
 async function getUser() {
   const sessionId = (await cookies()).get(lucia.sessionCookieName)?.value ?? null;

package/src/app/api/audit/permissions/stats/route.js

@@ -1,9 +1,9 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[AuditStatsAPI]');
 import { getUser, setCurrentRequest } from '@/engine.server';
-import { getPermissionAuditStats, getPermissionAuditBreakdown } from '@/lib/busybase-audit-reads';
+import { getPermissionAuditStats, getPermissionAuditBreakdown } from '@/lib/busybase/audit-reads';
 
 export async function GET(request) {
   setCurrentRequest(request);

package/src/app/api/audit/route.js

@@ -1,9 +1,8 @@
 import { requireAuth, requirePermission } from '@/lib/auth-middleware';
-import { getAuditHistory, getActionStats, getUserStats } from '@/lib/busybase-audit-reads';
+import { getAuditHistory, getActionStats, getUserStats } from '@/lib/busybase/audit-reads';
 import { getSpec } from '@/config/spec-helpers';
 import { paginated, ok } from '@/lib/response-formatter';
-import { withErrorHandler } from '@/lib/with-error-handler';
-import { AppError } from '@/lib/error-handler';
+import { withErrorHandler, AppError } from '@/lib/errors';
 import { HTTP } from '@/config/constants';
 import { parse as parseQuery } from '@/lib/query-string-adapter';
 

package/src/app/api/audit/stats/route.js

@@ -1,7 +1,7 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { requireAuth } from '@/lib/auth-middleware';
 import { getLogStats } from '@/lib/audit-logger-enhanced';
-import { withErrorHandler } from '@/lib/with-error-handler';
+import { withErrorHandler } from '@/lib/errors';
 
 export const GET = withErrorHandler(async (request) => {
   const user = await requireAuth();

package/src/app/api/auth/google/callback/route.js

@@ -8,7 +8,7 @@ import { GOOGLE_APIS } from '@/config/constants';
 import { config } from '@/config';
 import { getConfigEngine } from '@/lib/config-generator-engine';
 import { globalManager } from '@/lib/hot-reload/mutex';
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import {
   validateOAuthProvider,
   getOAuthCookie,

package/src/app/api/auth/google/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[OAuth]');

package/src/app/api/auth/login/route.js

@@ -3,7 +3,7 @@ import { getBy, verifyPassword, migrate } from '@/engine';
 
 const log = createLogger('[Login]');
 import { initializeSystemConfig } from '@/config/system-config-loader';
-import { withErrorHandler } from '@/lib/with-error-handler';
+import { withErrorHandler } from '@/lib/errors';
 import { lucia } from '@/engine.server';
 
 let initialized = false;

package/src/app/api/auth/logout/route.js

@@ -1,5 +1,5 @@
 import { setCurrentRequest as setEngineRequest, invalidateSession } from '@/engine.server';
-import { setCurrentRequest, setCurrentResponse } from '@/lib/next-polyfills';
+import { setCurrentRequest, setCurrentResponse } from '@/lib/next-shim';
 
 function buildLogoutHeaders(headerMap) {
   const setCookies = headerMap.get('Set-Cookie');

package/src/app/api/auth/me/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { getUser, setCurrentRequest } from '@/engine.server';
 import { HTTP } from '@/config/constants';
 

package/src/app/api/auth/mwr-bridge/route.js

@@ -1,7 +1,7 @@
 import { getBy, list, update } from '@/engine';
 import { lucia } from '@/engine.server';
 import { now } from '@/lib/id-helpers';
-import { withErrorHandler } from '@/lib/with-error-handler';
+import { withErrorHandler } from '@/lib/errors';
 import crypto from 'crypto';
 
 export const POST = withErrorHandler(async (request) => {

package/src/app/api/auth/password-reset/route.js

@@ -1,6 +1,6 @@
 import { getBy, hashPassword, list, create, update, remove } from '@/engine';
 import { genId, now } from '@/lib/id-helpers';
-import { withErrorHandler } from '@/lib/with-error-handler';
+import { withErrorHandler } from '@/lib/errors';
 import crypto from 'crypto';
 
 export const POST = withErrorHandler(async (request) => {

package/src/app/api/csrf-token/route.js

@@ -1,6 +1,6 @@
 import { generateToken } from '@/lib/csrf-protection';
 import { ok } from '@/lib/response-formatter';
-import { withErrorHandler } from '@/lib/with-error-handler';
+import { withErrorHandler } from '@/lib/errors';
 
 export const GET = withErrorHandler(async (request) => {
   const token = generateToken();

package/src/app/api/debug/[[...path]]/route.js

@@ -1,10 +1,10 @@
 import { tracer } from '@/lib/tracing.js';
-import { perfProfiler } from '@/lib/perf-profiler.js';
+import { perfProfiler } from '@/lib/perf.js';
 import { debugRegistry } from '@/lib/debug-registry.js';
 import { getExportSink } from '@/lib/export-sink.js';
 import { getXStateWorkflowEngine } from '@/lib/xstate-workflow-engine.js';
 import { getHyperFormulaService } from '@/lib/hyperformula-service.js';
-import { getBusyBaseAdapter } from '@/lib/busybase-adapter.js';
+import { getBusyBaseAdapter } from '@/lib/busybase/adapter.js';
 import { hookEngine } from '@/lib/hook-engine.js';
 import { createLogger } from '@/lib/logger.js';
 

package/src/app/api/debug/config/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 
 export async function GET() {
   if (process.env.NODE_ENV === 'production') {

package/src/app/api/debug/hooks/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 
 export async function GET() {
   if (process.env.NODE_ENV === 'production') {

package/src/app/api/debug/plugins/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 
 export async function GET() {
   if (process.env.NODE_ENV === 'production') {

package/src/app/api/debug/sqlite/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 
 // The data layer is busybase (LanceDB), not SQLite — the old pragma/page-count probe
 // no longer applies. This endpoint now reports the configured store kind.

package/src/app/api/debug/sync/route.js

@@ -1,6 +1,6 @@
 import fs from 'fs';
 import path from 'path';
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { count } from '@/engine';
 
 export async function GET() {

package/src/app/api/debug/workflow/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 
 export async function GET() {
   if (process.env.NODE_ENV === 'production') {

package/src/app/api/domains/[domain]/route.js

@@ -1,8 +1,7 @@
 import { getDomainLoader } from '@/lib/domain-loader';
 import { getConfigEngine } from '@/lib/config-generator-engine';
 import { ok } from '@/lib/response-formatter';
-import { withErrorHandler } from '@/lib/with-error-handler';
-import { AppError, NotFoundError } from '@/lib/error-handler';
+import { withErrorHandler, AppError, NotFoundError } from '@/lib/errors';
 import { HTTP } from '@/config/constants';
 
 export const GET = withErrorHandler(async (request, context) => {

package/src/app/api/domains/route.js

@@ -3,7 +3,7 @@ import { getDomainLoader } from '@/lib/domain-loader';
 
 const log = createLogger('[DomainsAPI]');
 import { ok } from '@/lib/response-formatter';
-import { withErrorHandler } from '@/lib/with-error-handler';
+import { withErrorHandler } from '@/lib/errors';
 import { getConfigEngine } from '@/lib/config-generator-engine';
 
 export const GET = withErrorHandler(async (request) => {

package/src/app/api/email/allocate/batch/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[EmailBatchAllocate]');

package/src/app/api/email/allocate/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 import { genId, now } from '@/lib/id-helpers';
 import { get, create } from '@/engine';

package/src/app/api/email/receive/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 import { genId, now } from '@/lib/id-helpers';
 import { create } from '@/engine';

package/src/app/api/email/send/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 import { now } from '@/lib/id-helpers';
 import { timingSafeEqual } from 'node:crypto';

package/src/app/api/email/unallocated/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 import { list } from '@/engine';
 

package/src/app/api/files/[id]/route.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[FilesAPI]');

package/src/app/api/health/route.js

@@ -5,8 +5,7 @@ const log = createLogger('[Health]');
 import path from 'path'
 import { count } from '@/engine'
 import { getAllMetrics } from '@/lib/metrics-collector.js'
-import { getDatabaseStats } from '@/lib/db-monitor.js'
-import { getCurrentResources } from '@/lib/resource-monitor.js'
+import { getDatabaseStats, getCurrentResources } from '@/lib/monitor.js'
 import { getRecentAlerts } from '@/lib/alert-manager.js'
 
 function getLastSyncAt() {

package/src/app/api/metrics/route.js

@@ -1,7 +1,6 @@
 import { getAllMetrics, clearMetrics } from '@/lib/metrics-collector.js'
 import { getRecentAlerts } from '@/lib/alert-manager.js'
-import { getDatabaseStats } from '@/lib/db-monitor.js'
-import { getCurrentResources } from '@/lib/resource-monitor.js'
+import { getDatabaseStats, getCurrentResources } from '@/lib/monitor.js'
 import { getLogs } from '@/lib/log-aggregator.js'
 
 export const GET = async (request) => {

package/src/engine.js

@@ -1,12 +1,12 @@
 // Previously `@/engine` resolved to a non-existent module; this barrel makes it
-// concrete and points the data layer at busybase-store.
+// concrete and points the data layer at busybase/store.
 
 // Data layer (busybase)
 export {
   list, get, getBy, count, listWithPagination, searchWithPagination, search,
   create, update, remove, bulkCreate, getChildren, batchGetChildren,
   setBusyBaseClient,
-} from '@/lib/busybase-store.js';
+} from '@/lib/busybase/store.js';
 
 // IDs / time
 export { genId, now } from '@/lib/id-helpers.js';
@@ -15,7 +15,7 @@ export { genId, now } from '@/lib/id-helpers.js';
 export { hashPassword, verifyPassword } from '@/engine.server.js';
 
 // Audit
-export { logAction } from '@/lib/busybase-audit.js';
+export { logAction } from '@/lib/busybase/audit.js';
 
 // Legacy SQLite shims (data layer is busybase now). busybase is schemaless so there
 // is no migration step; migrate() is a no-op kept for callers that still invoke it.

package/src/engine.server.js

@@ -2,7 +2,7 @@
 import { Lucia } from 'lucia';
 import { Google } from 'arctic';
 import bcrypt from 'bcrypt';
-import { BusyBaseLuciaAdapter } from './lib/busybase-lucia-adapter.js';
+import { BusyBaseLuciaAdapter } from './lib/busybase/lucia-adapter.js';
 import { buildConfig, hasGoogleAuth } from './config/env.js';
 
 let _lucia = null;
@@ -118,13 +118,13 @@ export async function verifyPassword(password, hash) {
 }
 
 export async function getUserByEmail(email) {
-  const { getBy } = await import('./lib/busybase-store.js');
+  const { getBy } = await import('./lib/busybase/store.js');
   return getBy('user', 'email', email);
 }
 
 export async function createUser(userData) {
   const hashedPassword = await hashPassword(userData.password);
-  const { create } = await import('./lib/busybase-store.js');
+  const { create } = await import('./lib/busybase/store.js');
   return create('user', {
     ...userData,
     password: hashedPassword,

package/src/index.js

@@ -141,9 +141,9 @@ export class Thatcher {
       || 'busybase_data';
     const client = await createEmbedded({ dir });
 
-    const store = await import(resolveModule('./lib/busybase-store.js'));
+    const store = await import(resolveModule('./lib/busybase/store.js'));
     store.setBusyBaseClient(client);
-    const audit = await import(resolveModule('./lib/busybase-audit.js'));
+    const audit = await import(resolveModule('./lib/busybase/audit.js'));
     audit.setBusyBaseClient(client);
 
     this.busybase = client;
@@ -248,7 +248,32 @@ export class Thatcher {
       _server = null;
     }
     for (const w of _hotReloadWatchers) w.close();
-    _hotReloadWatchers = [];
+    _hotReloadWatchers = []
+    // This never called the underlying database client's own close() at all
+    // -- busybase's createEmbedded() now exposes a real one (busybase's own
+    // embedded.ts fix), but nothing here called it, so a consumer reusing the
+    // SAME database file in the same process (a fresh Thatcher instance, a
+    // test harness) would silently open a SECOND native handle onto an
+    // already-open file rather than genuinely replacing the first --
+    // _databaseInitialized is a MODULE-level singleton (see initDatabase()'s
+    // own comment / AGENTS.md's documented cwd-bound handle caveat), so it
+    // must be reset here too or a subsequent initDatabase() call would
+    // silently skip re-opening and keep using the now-closed client.
+    // NOTE (live-witnessed, Windows): calling close() does NOT synchronously
+    // release the native libsql binding's OS-level file lock while THIS
+    // process keeps running -- the lock only actually clears once the owning
+    // process exits. A caller needing the underlying file/directory removable
+    // in the SAME still-running process (e.g. a per-run isolated-tmpdir test
+    // harness) cannot rely on this call alone for that and must retry the
+    // removal with backoff, or isolate each run in its own child process.
+    // close() is still correct and worth calling regardless -- it prevents
+    // the silent second-handle-fork above, which is a real, distinct benefit.
+    if (this.busybase) {
+      try { this.busybase.close?.() } catch { /* best-effort */ }
+      this.busybase = null
+      globalThis.__thatcherBusyBase = null
+      _databaseInitialized = false
+    }
   }
 
   getConfigEngine() {
@@ -270,38 +295,38 @@ export class Thatcher {
   // === CRUD operations ===
 
   async list(entity, where = {}, opts = {}) {
-    const { list } = await import(resolveModule('./lib/busybase-store.js'));
+    const { list } = await import(resolveModule('./lib/busybase/store.js'));
     return list(entity, where, opts);
   }
 
   async get(entity, id) {
-    const { get } = await import(resolveModule('./lib/busybase-store.js'));
+    const { get } = await import(resolveModule('./lib/busybase/store.js'));
     return get(entity, id);
   }
 
   async create(entity, data, user) {
-    const { create } = await import(resolveModule('./lib/busybase-store.js'));
+    const { create } = await import(resolveModule('./lib/busybase/store.js'));
     return create(entity, data, user);
   }
 
   // opts.expectedVersion: optional optimistic-concurrency guard (see
-  // busybase-store.js update()) -- a caller that read the row's _version can
+  // busybase/store.js update()) -- a caller that read the row's _version can
   // pass it here to detect (via a thrown {code:'conflict'} error) a concurrent
   // writer landing in between, instead of silently clobbering it. `user` stays
   // its own positional param (unused by the store today, kept for API
   // stability with existing callers); opts is a new, optional 5th param.
   async update(entity, id, data, user, opts = {}) {
-    const { update } = await import(resolveModule('./lib/busybase-store.js'));
+    const { update } = await import(resolveModule('./lib/busybase/store.js'));
     return update(entity, id, data, opts);
   }
 
   async delete(entity, id) {
-    const { remove } = await import(resolveModule('./lib/busybase-store.js'));
+    const { remove } = await import(resolveModule('./lib/busybase/store.js'));
     return remove(entity, id);
   }
 
   async search(entity, query, where = {}, opts = {}) {
-    const { search } = await import(resolveModule('./lib/busybase-store.js'));
+    const { search } = await import(resolveModule('./lib/busybase/store.js'));
     return search(entity, query, where, opts);
   }
 

package/src/lib/action-factory.js

@@ -3,7 +3,7 @@
 import { create, update, remove } from '@/engine';
 import { requireUser, check } from '@/engine.server';
 import { getSpec } from '@/config/spec-helpers';
-import { revalidatePath } from '@/lib/next-polyfills';
+import { revalidatePath } from '@/lib/next-shim';
 
 export async function serverCreateEntity(entityName, data) {
   const user = await requireUser();

package/src/lib/api-helpers.js

@@ -1,5 +1,5 @@
 
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { getSpec } from '@/config/spec-helpers';
 import { migrate } from '@/engine';
 import { getUser } from '@/engine.server';

package/src/lib/api.js

@@ -2,13 +2,12 @@ import { getUser } from '@/engine.server';
 import { getSpec } from '@/config/spec-helpers';
 import { API_ENDPOINTS } from '@/config';
 import { can } from '@/services/permission.service';
-import { get, create, update, remove, listWithPagination, search } from '@/lib/busybase-store';
-import { validateEntity, validateUpdate, hasErrors } from '@/lib/validate';
+import { get, create, update, remove, listWithPagination, search } from '@/lib/busybase/store';
+import { validateEntity, validateUpdate, hasErrors } from '@/lib/validation/entity-validators';
 import { broadcastUpdate } from '@/lib/realtime-server';
-import { UnauthorizedError, PermissionError, NotFoundError, ValidationError, AppError } from '@/lib/error-handler';
+import { UnauthorizedError, PermissionError, NotFoundError, ValidationError, AppError, withErrorHandler } from '@/lib/errors';
 import { ok, created, paginated } from '@/lib/response-formatter';
 import { QueryAdapter } from '@/lib/query-string-adapter';
-import { withErrorHandler } from '@/lib/with-error-handler';
 import { HTTP } from '@/config/constants';
 
 const createHandler = (entity, action) => async (request, { params, searchParams }) => {

package/src/lib/audit-logger-enhanced.js

@@ -2,7 +2,7 @@ import { createLogger } from './logger.js';
 import { genId, now } from '@/lib/id-helpers';
 
 const log = createLogger('[AuditEnhanced]');
-import { list, create, remove } from '@/lib/busybase-store';
+import { list, create, remove } from '@/lib/busybase/store';
 
 export const LOG_LEVELS = { DEBUG: 'debug', INFO: 'info', WARN: 'warn', ERROR: 'error' };
 export const OPERATION_TYPES = { CREATE: 'create', UPDATE: 'update', DELETE: 'delete', READ: 'read', AUTH: 'auth', AUTHZ: 'authz' };

package/src/lib/auth-middleware.js

@@ -3,7 +3,7 @@
 import { getUser, getLucia } from '../engine.server.js';
 import { getSpec } from '../config/spec-helpers.js';
 import { can } from '../services/permission.service.js';
-import { UnauthorizedError, PermissionError, NotFoundError } from './error-handler.js';
+import { UnauthorizedError, PermissionError, NotFoundError } from './errors/index.js';
 
 const actionMap = {
   list: 'list',

package/src/lib/auth-route-helpers.js

@@ -1,4 +1,4 @@
-import { NextResponse } from '@/lib/next-polyfills';
+import { NextResponse } from '@/lib/next-shim';
 import { SESSION } from '@/config/auth-config';
 import { HTTP } from '@/config/constants';
 

package/src/lib/{busybase-adapter.js → busybase/adapter.js}

@@ -1,5 +1,5 @@
-import { createLogger } from './logger.js';
-import { hookEngine } from './hook-engine.js';
+import { createLogger } from '../logger.js';
+import { hookEngine } from '../hook-engine.js';
 
 const logger = createLogger('[BusyBase]');
 
@@ -154,4 +154,4 @@ export function isBusyBaseAvailable() {
   return _bbInstance?.initialized === true;
 }
 
-export default BusyBaseAdapter;
+export default BusyBaseAdapter;

package/src/lib/{busybase-audit-reads.js → busybase/audit-reads.js}

@@ -4,7 +4,7 @@
  * audit_logs and permission_audit tables.
  */
 
-import { list, create } from '@/lib/busybase-store.js';
+import { list, create } from '@/lib/busybase/store.js';
 import { genId, now } from '@/lib/id-helpers.js';
 
 const parseJson = (val) => { try { return val ? JSON.parse(val) : null; } catch { return null; } };

package/src/lib/{busybase-audit.js → busybase/audit.js}

@@ -6,8 +6,8 @@
  * forget: it returns immediately and swallows/logs write errors rather than throwing.
  */
 
-import { createLogger } from './logger.js';
-import { genId, now } from './id-helpers.js';
+import { createLogger } from '../logger.js';
+import { genId, now } from '../id-helpers.js';
 
 const log = createLogger('[BusyBaseAudit]');