thatcher 1.0.43 → 1.0.45

package/README.md

@@ -133,36 +133,50 @@ const canEdit = await thatcher.can(user, thatcher.getEntitySpec('item'), 'edit')
 
 ```
 thatcher/
-├── src/
-│   ├── index.js           # Main entry: createThatcher()
-│   ├── cli.js             # CLI commands
-│   ├── config/
-│   │   ├── config-loader.js     # YAML loading & validation
-│   │   ├── spec-helpers.js      # Entity spec utilities
-│   │   ├── env.js               # Environment config
-│   │   └── constants.js         # HTTP codes, statuses
-│   ├── lib/
-│   │   ├── busybase-store.js    # busybase data layer (async CRUD)
-│   │   ├── query-engine.js      # Read operations (GET, search)
-│   │   ├── query-engine-write.js # Write operations (CRUD)
-│   │   ├── config-generator-engine.js  # Spec builder
-│   │   ├── hook-engine.js       # Event system
-│   │   ├── workflow-engine.js   # State machines
-│   │   ├── auth-middleware.js   # Auth checks
-│   │   ├── crud-factory.js      # Handler factory
-│   │   ├── crud-handlers.js     # HTTP handlers
-│   │   ├── validate.js          # Validation
-│   │   └── logger.js            # Structured logging
-│   ├── services/
-│   │   └── permission.service.js  # Authorization
-│   ├── adapters/
-│   │   ├── google-auth.js       # Google OAuth
-│   │   └── google-drive.js      # Drive file operations
-│   ├── plugins/
-│   │   └── index.js             # Plugin auto-discovery
-│   └── server/
-│       └── server.js            # HTTP server
-└── package.json
+  src/
+    index.js                # Main entry: createThatcher()
+    engine.js / engine.server.js  # Runtime engine, server-only auth/session surface
+    cli.js                  # CLI commands
+    config/
+      config-loader.js      # YAML loading & validation
+      spec-helpers.js       # Entity spec utilities
+      env.js                # Environment config
+      constants.js          # HTTP codes, statuses
+    lib/
+      busybase/
+        adapter.js          # busybase connection/adapter layer
+        store.js            # busybase data layer (async CRUD)
+        audit.js / audit-reads.js  # Audit log writes/reads
+        lucia-adapter.js    # Lucia auth session adapter
+      errors/
+        types.js            # AppError and error type hierarchy
+        wrap.js              # wrap() - unified handler wrapper (timeout/retry/logging)
+        recovery.js          # Circuit breaker, checkpoint, retry-with-backoff
+      validation/
+        entity-validators.js / business-validators.js / format-validators.js / security-validators.js / file-validators.js
+        csrf.js / rate-limit.js
+      config-generator-engine.js  # Spec builder
+      hook-engine.js         # Event system
+      workflow-engine.js     # State machines (legacy/canonical) - xstate-workflow-engine.js is the debug/test-only successor
+      auth-middleware.js     # Auth checks
+      crud-factory.js        # Handler factory
+      crud-handlers.js       # HTTP handlers - read + write CRUD operations
+      logger.js              # Structured logging
+    services/
+      permission.service.js         # Authorization
+      collaborator-role.service.js
+      notification-engine.js / email-sender.js
+    adapters/
+      google-auth.js         # Google OAuth
+      google-drive.js        # Drive file operations
+      google-gmail.js        # Gmail send/receive
+    plugins/
+      index.js               # Plugin auto-discovery
+    app/api/                 # Route handlers (Next.js-style file routing, [entity]/[[...path]] catch-all + explicit routes)
+    ui/                      # Server-rendered HTML components + client-side scripts
+    server/
+      server.js              # HTTP server
+  package.json
 ```
 
 ### How It Works

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.43",
+  "version": "1.0.45",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/adapters/google-gmail.js

@@ -24,6 +24,7 @@ export function getGmailClient(user = null) {
 
 function encodeHeader(value) {
   // RFC 2047 encoded-word for any non-ASCII header value (subject/name).
+  // eslint-disable-next-line no-control-regex -- \x00-\x7F is the intentional ASCII range check, not a stray control char
   if (/^[\x00-\x7F]*$/.test(value)) return value;
   return `=?UTF-8?B?${Buffer.from(value, 'utf8').toString('base64')}?=`;
 }

package/src/app/api/files/[id]/route.js

@@ -27,7 +27,7 @@ export async function GET(request, { params }) {
 
     const content = await fileService.download(fileRecord.drive_file_id);
 
-    const safeName = (fileRecord.file_name || 'download').replace(/[^\w.\-]/g, '_');
+    const safeName = (fileRecord.file_name || 'download').replace(/[^\w.-]/g, '_');
     return new NextResponse(content, {
       headers: {
         'Content-Type': fileRecord.mime_type || 'application/octet-stream',

package/src/cli.js

@@ -13,6 +13,8 @@
 
 import { startThatcher, Thatcher } from './index.js';
 import * as readline from 'readline';
+import fs from 'fs';
+import path from 'path';
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -20,7 +22,7 @@ const command = args[0];
 async function main() {
   switch (command) {
     case 'start':
-    case 'dev':
+    case 'dev': {
       console.log(`[Thatcher] Starting in ${command} mode...`);
       const thatcher = new Thatcher({
         server: { hotReload: command === 'dev' },
@@ -34,15 +36,17 @@ async function main() {
         process.exit(1);
       }
       break;
+    }
 
-    case 'migrate':
+    case 'migrate': {
       console.log('[Thatcher] Running migrations...');
       const t1 = new Thatcher({});
       await t1.init();
       console.log('[Thatcher] Migrations complete');
       break;
+    }
 
-    case 'validate':
+    case 'validate': {
       console.log('[Thatcher] Validating configuration...');
       try {
         const t2 = new Thatcher({});
@@ -55,6 +59,7 @@ async function main() {
         process.exit(1);
       }
       break;
+    }
 
     case 'console':
     case 'repl':

package/src/lib/errors/recovery.js

@@ -43,8 +43,6 @@ export async function withCircuitBreaker(name, fn, options = {}) {
 
   try {
     const result = await fn();
-    if (breaker.state === 'half-open') {
-    }
     breaker.failures = 0;
     breaker.state = 'closed';
     return result;
@@ -248,12 +246,6 @@ export async function withRecovery(fn, options = {}) {
 
   let operation = fn;
 
-  if (checkpointName) {
-    const savedState = restoreCheckpoint(checkpointName);
-    if (savedState) {
-    }
-  }
-
   if (supervisor) {
     operation = () => supervise(supervisor, operation, options);
   }

package/src/lib/field-registry.js

@@ -11,9 +11,10 @@ export function coerceFieldValue(value, type) {
     case 'json':
       return typeof value === 'string' ? JSON.parse(value) : value;
     case 'date':
-    case 'timestamp':
+    case 'timestamp': {
       const num = Number(value);
       return isNaN(num) ? null : num;
+    }
     case 'ref':
       return String(value);
     default:

package/src/lib/hot-reload/index.js

@@ -41,7 +41,7 @@ const __dirname = path.dirname(__filename);
 const require = createRequire(import.meta.url);
 
 const promiseContainerMod = require('./promise-container.js');
-export { Mutex, MutexManager, globalManager } from './mutex.js';
+import { Mutex, MutexManager, globalManager } from './mutex.js';
 import { Supervisor, SupervisorTree, globalTree } from './supervisor.js';
 const checkpointMod = require('./checkpoint.js');
 const timeoutMod = require('./timeout-wrapper.js');
@@ -72,6 +72,7 @@ expose('hotReload', {
 }, 'Hot reload infrastructure');
 
 export {
+  Mutex, MutexManager, globalManager,
   PromiseContainer, globalContainer, contain,
   Supervisor, SupervisorTree, globalTree,
   CheckpointManager, globalCheckpoint,

package/src/lib/minifier.js

@@ -5,7 +5,7 @@ export function minifyJS(code) {
     .replace(/^\s+/gm, '')
     .replace(/\s+$/gm, '')
     .replace(/\n+/g, '\n')
-    .replace(/\s*([{}()\[\];:,=<>!+\-*\/&|?])\s*/g, '$1')
+    .replace(/\s*([{}()[\];:,=<>!+\-*/&|?])\s*/g, '$1')
     .trim();
 }
 

package/src/lib/route-resolver.js

@@ -27,7 +27,7 @@ export function resolveSpecificParams(routeFile, pathParts) {
   for (let i = 0; i < routeSegments.length && i < urlSegments.length; i++) {
     const seg = routeSegments[i];
     if (seg.startsWith('[') && seg.endsWith(']')) {
-      const paramName = seg.replace(/^\[\.\.\./, '').replace(/[\[\]]/g, '');
+      const paramName = seg.replace(/^\[\.\.\./, '').replace(/[[\]]/g, '');
       result[paramName] = urlSegments[i];
     }
   }

package/src/lib/validation/security-validators.js

@@ -12,7 +12,7 @@ const XSS_PATTERNS = [
 ];
 
 const SQL_INJECTION_PATTERNS = [
-  /('|(\-\-)|(;)|(\|\|)|(\/\*)|(\*\/)|xp_)/gi,
+  /('|(--)|(;)|(\|\|)|(\/\*)|(\*\/)|xp_)/gi,
   /(union|select|insert|update|delete|drop|create|alter|exec|execute)\s/gi,
   /0x[0-9a-f]+/gi,
   /char\(/gi,
@@ -20,7 +20,7 @@ const SQL_INJECTION_PATTERNS = [
 ];
 
 const PATH_TRAVERSAL_PATTERNS = [
-  /\.\.[\\\/]/g,
+  /\.\.[\\/]/g,
   /\.\.%/g,
   /%2e%2e/gi,
   /\.\.\./g

package/src/ui/common-handlers.js

@@ -122,8 +122,8 @@ export const commonHandlers = {
 
   notify: {
     show(message, type = 'info') {
-      if (typeof showToast === 'function') {
-        showToast(message, type);
+      if (typeof window.showToast === 'function') {
+        window.showToast(message, type);
       }
     },
     success(message) { this.show(message, 'success'); },

package/src/ui/dialog-engine.js

@@ -92,21 +92,23 @@ function generateFieldHtml(field, dialogId, context) {
     case 'date':
       inputHtml = `<input type="date" id="${fieldId}" name="${name}" class="input input-bordered w-full" ${requiredAttr} ${ariaRequired} ${ariaDesc}/>`;
       break;
-    case 'select':
+    case 'select': {
       const optionsHtml = (options || []).map(opt =>
         `<option value="${opt.value}">${escapeHtml(opt.label || opt.value)}</option>`
       ).join('');
       inputHtml = `<select id="${fieldId}" name="${name}" class="select select-bordered w-full" ${requiredAttr} ${ariaRequired} ${ariaDesc}><option value="">Select...</option>${optionsHtml}</select>`;
       break;
+    }
     case 'checkbox':
       inputHtml = `<label class="flex items-center gap-2"><input type="checkbox" id="${fieldId}" name="${name}" class="checkbox" ${requiredAttr} ${ariaRequired} ${ariaDesc}/><span class="text-sm">${label}</span></label>`;
       break;
-    case 'multi-select':
+    case 'multi-select': {
       const multiOptHtml = (options || []).map(opt =>
         `<label class="flex items-center gap-2"><input type="checkbox" name="${name}" value="${opt.value}" class="checkbox"/><span class="text-sm">${escapeHtml(opt.label || opt.value)}</span></label>`
       ).join('');
       inputHtml = `<div class="flex flex-col gap-2" ${role.list}>${multiOptHtml}</div>`;
       break;
+    }
     case 'file':
       inputHtml = `<input type="file" id="${fieldId}" name="${name}" class="file-input file-input-bordered w-full" ${requiredAttr} ${ariaRequired} ${ariaDesc}/>`;
       break;

package/src/ui/layout.js

@@ -1,3 +1,4 @@
+/* eslint-disable no-useless-escape -- this file embeds raw client <script> text inside a template literal; ESLint parses embedded regex escapes like \d as literal template text and misflags them */
 import { h } from '@/ui/webjsx.js'
 import { getNavItems, getAdminItems, isPartner, isClerk } from '@/ui/permissions-ui.js'
 import { TOAST_SCRIPT, AVATAR_COLORS, esc } from '@/ui/render-helpers.js'