thatcher 1.0.44 → 1.0.46

package/README.md

@@ -133,36 +133,50 @@ const canEdit = await thatcher.can(user, thatcher.getEntitySpec('item'), 'edit')
 
 ```
 thatcher/
-├── src/
-│   ├── index.js           # Main entry: createThatcher()
-│   ├── cli.js             # CLI commands
-│   ├── config/
-│   │   ├── config-loader.js     # YAML loading & validation
-│   │   ├── spec-helpers.js      # Entity spec utilities
-│   │   ├── env.js               # Environment config
-│   │   └── constants.js         # HTTP codes, statuses
-│   ├── lib/
-│   │   ├── busybase-store.js    # busybase data layer (async CRUD)
-│   │   ├── query-engine.js      # Read operations (GET, search)
-│   │   ├── query-engine-write.js # Write operations (CRUD)
-│   │   ├── config-generator-engine.js  # Spec builder
-│   │   ├── hook-engine.js       # Event system
-│   │   ├── workflow-engine.js   # State machines
-│   │   ├── auth-middleware.js   # Auth checks
-│   │   ├── crud-factory.js      # Handler factory
-│   │   ├── crud-handlers.js     # HTTP handlers
-│   │   ├── validate.js          # Validation
-│   │   └── logger.js            # Structured logging
-│   ├── services/
-│   │   └── permission.service.js  # Authorization
-│   ├── adapters/
-│   │   ├── google-auth.js       # Google OAuth
-│   │   └── google-drive.js      # Drive file operations
-│   ├── plugins/
-│   │   └── index.js             # Plugin auto-discovery
-│   └── server/
-│       └── server.js            # HTTP server
-└── package.json
+  src/
+    index.js                # Main entry: createThatcher()
+    engine.js / engine.server.js  # Runtime engine, server-only auth/session surface
+    cli.js                  # CLI commands
+    config/
+      config-loader.js      # YAML loading & validation
+      spec-helpers.js       # Entity spec utilities
+      env.js                # Environment config
+      constants.js          # HTTP codes, statuses
+    lib/
+      busybase/
+        adapter.js          # busybase connection/adapter layer
+        store.js            # busybase data layer (async CRUD)
+        audit.js / audit-reads.js  # Audit log writes/reads
+        lucia-adapter.js    # Lucia auth session adapter
+      errors/
+        types.js            # AppError and error type hierarchy
+        wrap.js              # wrap() - unified handler wrapper (timeout/retry/logging)
+        recovery.js          # Circuit breaker, checkpoint, retry-with-backoff
+      validation/
+        entity-validators.js / business-validators.js / format-validators.js / security-validators.js / file-validators.js
+        csrf.js / rate-limit.js
+      config-generator-engine.js  # Spec builder
+      hook-engine.js         # Event system
+      workflow-engine.js     # State machines (legacy/canonical) - xstate-workflow-engine.js is the debug/test-only successor
+      auth-middleware.js     # Auth checks
+      crud-factory.js        # Handler factory
+      crud-handlers.js       # HTTP handlers - read + write CRUD operations
+      logger.js              # Structured logging
+    services/
+      permission.service.js         # Authorization
+      collaborator-role.service.js
+      notification-engine.js / email-sender.js
+    adapters/
+      google-auth.js         # Google OAuth
+      google-drive.js        # Drive file operations
+      google-gmail.js        # Gmail send/receive
+    plugins/
+      index.js               # Plugin auto-discovery
+    app/api/                 # Route handlers (Next.js-style file routing, [entity]/[[...path]] catch-all + explicit routes)
+    ui/                      # Server-rendered HTML components + client-side scripts
+    server/
+      server.js              # HTTP server
+  package.json
 ```
 
 ### How It Works

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.44",
+  "version": "1.0.46",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/adapters/google-auth.js

@@ -4,19 +4,12 @@ import { google } from 'googleapis';
 const log = createLogger('[GoogleAuth]');
 import { buildConfig } from '../config/env.js';
 import fs from 'fs';
-import path from 'path';
 
 let _oauth2Client = null;
 let _jwtClient = null;
 
 export function initGoogleAuth(config = null) {
   const cfg = config || buildConfig();
-  const scopes = [
-    'https://www.googleapis.com/auth/userinfo.email',
-    'https://www.googleapis.com/auth/userinfo.profile',
-    'https://www.googleapis.com/auth/drive',
-    'https://www.googleapis.com/auth/gmail.send',
-  ];
 
   // OAuth2 client for web flow
   _oauth2Client = new google.auth.OAuth2(

package/src/adapters/google-drive.js

@@ -4,8 +4,6 @@ import path from 'path';
 import { getJWTClient, getOAuth2Client } from './google-auth.js';
 import { buildConfig } from '../config/env.js';
 
-const DRIVE_SCOPES = ['https://www.googleapis.com/auth/drive'];
-
 export function getDriveClient(user = null) {
   let client;
 
@@ -26,7 +24,7 @@ export function getDriveClient(user = null) {
 export async function uploadFile(filePath, name, options = {}, user = null) {
   const drive = getDriveClient(user);
   const absPath = path.resolve(filePath);
-  const fileSize = fs.statSync(absPath).size;
+  fs.statSync(absPath);
 
   const res = await drive.files.create({
     requestBody: {

package/src/adapters/google-gmail.js

@@ -24,6 +24,7 @@ export function getGmailClient(user = null) {
 
 function encodeHeader(value) {
   // RFC 2047 encoded-word for any non-ASCII header value (subject/name).
+  // eslint-disable-next-line no-control-regex -- \x00-\x7F is the intentional ASCII range check, not a stray control char
   if (/^[\x00-\x7F]*$/.test(value)) return value;
   return `=?UTF-8?B?${Buffer.from(value, 'utf8').toString('base64')}?=`;
 }

package/src/app/api/[entity]/[[...path]]/route.js

@@ -1,7 +1,7 @@
 import { createCrudHandlers } from '@/lib/crud-factory';
 import { setCurrentRequest } from '@/engine.server';
 
-function wrapHandler(method) {
+function wrapHandler(_method) {
   return async (request, context) => {
     setCurrentRequest(request);
     const params = await context.params;

package/src/app/api/audit/logs/route.js

@@ -1,6 +1,6 @@
 import { NextResponse } from '@/lib/next-shim';
 import { requireAuth } from '@/lib/auth-middleware';
-import { searchLogs, getLogStats, rotateLogsOlderThan } from '@/lib/audit-logger-enhanced';
+import { searchLogs, rotateLogsOlderThan } from '@/lib/audit-logger-enhanced';
 import { withErrorHandler } from '@/lib/errors';
 
 export const GET = withErrorHandler(async (request) => {

package/src/app/api/audit/permissions/route.js

@@ -33,7 +33,6 @@ export async function GET(request) {
     const search = searchParams.get('search');
     const startDate = searchParams.get('start_date');
     const endDate = searchParams.get('end_date');
-    const action = searchParams.get('action');
     const limit = parseInt(searchParams.get('limit') || '100', 10);
     const offset = parseInt(searchParams.get('offset') || '0', 10);
     const format = searchParams.get('format');

package/src/app/api/audit/route.js

@@ -1,13 +1,11 @@
-import { requireAuth, requirePermission } from '@/lib/auth-middleware';
+import { requireAuth } from '@/lib/auth-middleware';
 import { getAuditHistory, getActionStats, getUserStats } from '@/lib/busybase/audit-reads';
-import { getSpec } from '@/config/spec-helpers';
 import { paginated, ok } from '@/lib/response-formatter';
 import { withErrorHandler, AppError } from '@/lib/errors';
 import { HTTP } from '@/config/constants';
-import { parse as parseQuery } from '@/lib/query-string-adapter';
 
 export const GET = withErrorHandler(async (request) => {
-  const user = await requireAuth();
+  await requireAuth();
   const url = new URL(request.url);
 
   const entityType = url.searchParams.get('entityType');

package/src/app/api/auth/google/callback/route.js

@@ -1,5 +1,5 @@
 import { createLogger } from '@/lib/logger.js';
-import { google, createSession } from '@/engine.server';
+import { createSession } from '@/engine.server';
 
 const log = createLogger('[OAuth]');
 import { getBy, create } from '@/engine';

package/src/app/api/auth/google/route.js

@@ -50,7 +50,7 @@ export async function GET(request) {
   });
 }
 
-export async function HEAD(request) {
+export async function HEAD(_request) {
   try {
     const { valid } = validateOAuthProvider(google);
     return new Response(null, { status: valid ? 200 : 503 });

package/src/app/api/auth/logout/route.js

@@ -8,7 +8,7 @@ function buildLogoutHeaders(headerMap) {
     : [];
 }
 
-export async function GET(request, { res } = {}) {
+export async function GET(request) {
   try {
     setEngineRequest(request);
     setCurrentRequest(request);

package/src/app/api/csrf-token/route.js

@@ -2,7 +2,7 @@ import { generateToken } from '@/lib/csrf-protection';
 import { ok } from '@/lib/response-formatter';
 import { withErrorHandler } from '@/lib/errors';
 
-export const GET = withErrorHandler(async (request) => {
+export const GET = withErrorHandler(async (_request) => {
   const token = generateToken();
   return ok({ csrfToken: token });
 }, 'CSRF:GetToken');

package/src/app/api/domains/route.js

@@ -6,7 +6,7 @@ import { ok } from '@/lib/response-formatter';
 import { withErrorHandler } from '@/lib/errors';
 import { getConfigEngine } from '@/lib/config-generator-engine';
 
-export const GET = withErrorHandler(async (request) => {
+export const GET = withErrorHandler(async (_request) => {
   await getConfigEngine();
   const domainLoader = getDomainLoader();
   const validDomains = domainLoader.getValidDomains();

package/src/app/api/email/allocate/route.js

@@ -7,7 +7,6 @@ const log = createLogger('[EmailAllocate]');
 import {
   allocateEmailToEntity,
   autoAllocateEmail,
-  validateAllocation,
   findEntityByAlternateId,
 } from '@/lib/email-parser';
 

package/src/app/api/email/receive/route.js

@@ -143,7 +143,7 @@ export async function POST(request) {
   }
 }
 
-export async function GET(request) {
+export async function GET(_request) {
   return NextResponse.json({
     endpoint: 'Email Receive Webhook',
     method: 'POST',

package/src/app/api/files/[id]/route.js

@@ -27,7 +27,7 @@ export async function GET(request, { params }) {
 
     const content = await fileService.download(fileRecord.drive_file_id);
 
-    const safeName = (fileRecord.file_name || 'download').replace(/[^\w.\-]/g, '_');
+    const safeName = (fileRecord.file_name || 'download').replace(/[^\w.-]/g, '_');
     return new NextResponse(content, {
       headers: {
         'Content-Type': fileRecord.mime_type || 'application/octet-stream',

package/src/app/api/health/route.js

@@ -85,7 +85,7 @@ export const GET = async (request) => {
   }
 }
 
-export const HEAD = async (request) => {
+export const HEAD = async (_request) => {
   try {
     await count('user', {})
     return new Response(null, { status: 200 })

package/src/cli.js

@@ -11,8 +11,10 @@
  *   thatcher example         - Generate example config
  */
 
-import { startThatcher, Thatcher } from './index.js';
+import { Thatcher } from './index.js';
 import * as readline from 'readline';
+import fs from 'fs';
+import path from 'path';
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -20,7 +22,7 @@ const command = args[0];
 async function main() {
   switch (command) {
     case 'start':
-    case 'dev':
+    case 'dev': {
       console.log(`[Thatcher] Starting in ${command} mode...`);
       const thatcher = new Thatcher({
         server: { hotReload: command === 'dev' },
@@ -34,15 +36,17 @@ async function main() {
         process.exit(1);
       }
       break;
+    }
 
-    case 'migrate':
+    case 'migrate': {
       console.log('[Thatcher] Running migrations...');
       const t1 = new Thatcher({});
       await t1.init();
       console.log('[Thatcher] Migrations complete');
       break;
+    }
 
-    case 'validate':
+    case 'validate': {
       console.log('[Thatcher] Validating configuration...');
       try {
         const t2 = new Thatcher({});
@@ -55,6 +59,7 @@ async function main() {
         process.exit(1);
       }
       break;
+    }
 
     case 'console':
     case 'repl':

package/src/config/spec-helpers.js

@@ -135,7 +135,6 @@ export function buildNavigation(configEngine, user = null) {
     // Filter by user permissions if provided
     if (user && configEngine.getRolePermissions) {
       return items.filter(item => {
-        const spec = configEngine.generateEntitySpec(item.name);
         const perms = configEngine.getRolePermissions(user.role, item.name);
         return perms.includes('list') || perms.includes('view') || perms.includes('all');
       });

package/src/engine.server.js

@@ -104,7 +104,7 @@ export async function createSession(userId) {
 }
 
 export async function invalidateSession() {
-  const lucia = getLucia();
+  getLucia();
   // Simplified - caller handles cookie clearing
   // In full app this uses @lucia-auth/adapter-sqlite's cookie management
 }

package/src/lib/alert-manager.js

@@ -22,7 +22,7 @@ function checkErrorRate(errorMetrics) {
   const window = thresholds.errorRate.window
   let recentErrors = 0
 
-  for (const [endpoint, data] of Object.entries(errorMetrics.byEndpoint)) {
+  for (const [, data] of Object.entries(errorMetrics.byEndpoint)) {
     const recent = (data.recent || []).filter(e => (now - e.ts) < window)
     recentErrors += recent.length
   }

package/src/lib/api-helpers.js

@@ -30,7 +30,7 @@ export const ok = (data) => NextResponse.json(withMetadata(data, HTTP.OK, 'succe
 export const created = (data) => NextResponse.json(withMetadata(data, HTTP.CREATED, 'created'), { status: HTTP.CREATED });
 export const notFound = (entity = 'Resource') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.notFound(entity) }, HTTP.NOT_FOUND, 'error'), { status: HTTP.NOT_FOUND });
 export const badRequest = (reason = 'invalid data') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.invalidRequest(reason) }, HTTP.BAD_REQUEST, 'error'), { status: HTTP.BAD_REQUEST });
-export const unauthorized = (action = 'perform this action') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.permission.denied }, HTTP.FORBIDDEN, 'error'), { status: HTTP.FORBIDDEN });
+export const unauthorized = (_action = 'perform this action') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.permission.denied }, HTTP.FORBIDDEN, 'error'), { status: HTTP.FORBIDDEN });
 export const serverError = (msg = null) => NextResponse.json(withMetadata({ error: msg || ERROR_MESSAGES.operationFailed('server operation') }, HTTP.INTERNAL_ERROR, 'error'), { status: HTTP.INTERNAL_ERROR });
 
 export async function withEntityAccess(entity, action, handler) {

package/src/lib/auth-route-helpers.js

@@ -23,7 +23,7 @@ export function validateOAuthProvider(provider) {
   return { valid: true };
 }
 
-export async function setOAuthCookie(name, value, options = {}) {
+export async function setOAuthCookie(name, value) {
   const timestamp = Date.now();
   const key = `oauth-${timestamp}-${Math.random().toString(36).substring(7)}`;
   const expiresAt = timestamp + (SESSION.cookieMaxAge * 1000);

package/src/lib/business-rules-engine.js

@@ -11,7 +11,7 @@ export class BusinessRulesEngine {
       return rule && !this.isDuplicateEngagement(engagement);
     });
 
-    this.registerRule('daysOutstandingNotificationNeeded', (rfi) => {
+    this.registerRule('daysOutstandingNotificationNeeded', (_rfi) => {
       return this.businessRules.rfiDaysOutstanding.enabled;
     });
 
@@ -23,7 +23,7 @@ export class BusinessRulesEngine {
       return true;
     });
 
-    this.registerRule('clientCanRate', (user, engagement) => {
+    this.registerRule('clientCanRate', (user, _engagement) => {
       return user.type === 'client' && user.role === 'client_admin';
     });
 
@@ -66,7 +66,7 @@ export class BusinessRulesEngine {
     return this.businessRules.recreationRules.engagement[interval];
   }
 
-  isDuplicateEngagement(engagement) {
+  isDuplicateEngagement(_engagement) {
     return false;
   }
 

package/src/lib/busybase/adapter.js

@@ -32,7 +32,7 @@ export class BusyBaseAdapter {
       this._client = this._embedded;
       logger.info('Embedded mode initialized', { dir: this.config.dir });
     } else {
-      const { default: BB, createClient } = await import('busybase');
+      const { default: BB } = await import('busybase');
       this._client = BB(this.config.url, this.config.project);
       logger.info('Remote mode initialized', { url: this.config.url });
     }
@@ -106,7 +106,7 @@ export class BusyBaseAdapter {
   }
 
   async unsubscribeAll() {
-    for (const [name, { channel }] of _realtimeChannels.entries()) {
+    for (const [, { channel }] of _realtimeChannels.entries()) {
       channel.unsubscribe();
     }
     _realtimeChannels.clear();

package/src/lib/busybase/store.js

@@ -271,7 +271,7 @@ export async function create(entity, data, user) {
 // unconditional-write behaviour, unchanged for every existing caller; _version
 // is added as a new column, ignored by every reader that doesn't ask for it.
 export async function update(entity, id, data, opts = {}) {
-  const spec = specOf(entity);
+  specOf(entity);
   const tbl = tableName(entity);
 
   const existing = await get(entity, id);

package/src/lib/config-generator-engine.js

@@ -12,9 +12,7 @@
 // as of this writing, vs. workflow-engine.js's 2 and
 // xstate-workflow-engine.js's 2 debug/test-only importers) -- this is live,
 // central infrastructure, not a candidate for deprecation.
-import { load as yamlLoad } from 'js-yaml';
 import { LRUCache, deepFreeze, deepClone, recursiveResolve } from './config-helpers.js';
-import { generateFieldsFromOverrides, ensureFieldLabels } from './config-field-helpers.js';
 
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {

package/src/lib/crud-action-helpers.js

@@ -9,7 +9,7 @@ const ACTION_FIELD_MAPS = {
   respond: (data, user) => ({ status: 'responded', response: data.response, responded_at: now(), responded_by: user.id }),
 };
 
-export function resolveActionUpdate(action, data, user, record) {
+export function resolveActionUpdate(action, data, user, _record) {
   const mapped = ACTION_FIELD_MAPS[action];
   if (typeof mapped === 'function') return mapped(data, user);
   if (mapped) {

package/src/lib/crud-handlers.js

@@ -3,10 +3,10 @@ import { get, listWithPagination, searchWithPagination, create, update, remove }
 
 const log = createLogger('[CRUD]');
 import { validateEntity, validateUpdate, sanitizeData } from './validation/index.js';
-import { requirePermission, getSessionToken } from './auth-middleware.js';
+import { requirePermission } from './auth-middleware.js';
 import { executeHook } from './hook-engine.js';
 import { AppError, NotFoundError, ValidationError } from './errors/index.js';
-import { ok, created, paginated, noContent, error } from './response-formatter.js';
+import { ok, created, paginated, noContent } from './response-formatter.js';
 import { HTTP } from '../config/constants.js';
 import { permissionService } from '../services/permission.service.js';
 import { parse as parseQuery } from './query-string-adapter.js';

package/src/lib/csrf-protection.js

@@ -43,7 +43,6 @@ export async function withCsrfValidation(handler) {
     }
 
     try {
-      const contentType = request.headers.get('content-type') || '';
       const token = request.headers.get('x-csrf-token');
 
       if (!token || !validateToken(token)) {

package/src/lib/debug-registry.js

@@ -1,6 +1,6 @@
 import { createLogger } from './logger.js';
 
-const logger = createLogger('[DebugRegistry]');
+createLogger('[DebugRegistry]');
 
 class DebugRegistry {
   constructor() {

package/src/lib/errors/recovery.js

@@ -43,8 +43,6 @@ export async function withCircuitBreaker(name, fn, options = {}) {
 
   try {
     const result = await fn();
-    if (breaker.state === 'half-open') {
-    }
     breaker.failures = 0;
     breaker.state = 'closed';
     return result;
@@ -248,12 +246,6 @@ export async function withRecovery(fn, options = {}) {
 
   let operation = fn;
 
-  if (checkpointName) {
-    const savedState = restoreCheckpoint(checkpointName);
-    if (savedState) {
-    }
-  }
-
   if (supervisor) {
     operation = () => supervise(supervisor, operation, options);
   }

package/src/lib/errors/wrap.js

@@ -48,7 +48,7 @@ export function wrap(fn, options = {}) {
 // retryWithBackoff lives here (not recovery.js) because wrap() itself needs it
 // with no circular dependency; recovery.js imports it back from here.
 export async function retryWithBackoff(fn, options = {}) {
-  const { maxAttempts = 3, delay = 1000, backoff = 2, context = {} } = options;
+  const { maxAttempts = 3, delay = 1000, backoff = 2 } = options;
 
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     try {

package/src/lib/events-engine.js

@@ -175,7 +175,7 @@ export const registerEntityHandlers = () => {
     create('removed_highlight', { review_id: highlight.review_id, original_id: highlight.id, highlight_data: JSON.stringify(highlight) }, user);
   });
 
-  hookEngine.on('collaborator:afterCreate', async (collaborator, user) => {
+  hookEngine.on('collaborator:afterCreate', async (collaborator, _user) => {
     const review = get('review', collaborator.review_id);
     const collabUser = get('user', collaborator.user_id);
     if (review && collabUser) {

package/src/lib/field-iterator.js

@@ -20,13 +20,13 @@ export function getFieldNames(spec) {
 
 export function getEditableFields(spec) {
   return Object.entries(spec.fields || {})
-    .filter(([key, field]) => !field.readonly && !field.auto && !field.auto_generate)
+    .filter(([, field]) => !field.readonly && !field.auto && !field.auto_generate)
     .map(([key]) => key);
 }
 
 export function getFieldsByType(spec, type) {
   return Object.entries(spec.fields || {})
-    .filter(([key, field]) => field.type === type);
+    .filter(([, field]) => field.type === type);
 }
 
 export function fieldQuery(spec, predicates, options = {}) {

package/src/lib/field-registry.js

@@ -11,9 +11,10 @@ export function coerceFieldValue(value, type) {
     case 'json':
       return typeof value === 'string' ? JSON.parse(value) : value;
     case 'date':
-    case 'timestamp':
+    case 'timestamp': {
       const num = Number(value);
       return isNaN(num) ? null : num;
+    }
     case 'ref':
       return String(value);
     default:

package/src/lib/hot-reload/index.js

@@ -41,7 +41,7 @@ const __dirname = path.dirname(__filename);
 const require = createRequire(import.meta.url);
 
 const promiseContainerMod = require('./promise-container.js');
-export { Mutex, MutexManager, globalManager } from './mutex.js';
+import { Mutex, MutexManager, globalManager } from './mutex.js';
 import { Supervisor, SupervisorTree, globalTree } from './supervisor.js';
 const checkpointMod = require('./checkpoint.js');
 const timeoutMod = require('./timeout-wrapper.js');
@@ -72,6 +72,7 @@ expose('hotReload', {
 }, 'Hot reload infrastructure');
 
 export {
+  Mutex, MutexManager, globalManager,
   PromiseContainer, globalContainer, contain,
   Supervisor, SupervisorTree, globalTree,
   CheckpointManager, globalCheckpoint,

package/src/lib/minifier.js

@@ -5,7 +5,7 @@ export function minifyJS(code) {
     .replace(/^\s+/gm, '')
     .replace(/\s+$/gm, '')
     .replace(/\n+/g, '\n')
-    .replace(/\s*([{}()\[\];:,=<>!+\-*\/&|?])\s*/g, '$1')
+    .replace(/\s*([{}()[\];:,=<>!+\-*/&|?])\s*/g, '$1')
     .trim();
 }
 

package/src/lib/next-shim.js

@@ -262,9 +262,9 @@ export async function cookies() {
 
 export function headers() {
   return {
-    get: (name) => null,
+    get: (_name) => null,
     getSetCookie: () => [],
-    has: (name) => false,
+    has: (_name) => false,
     entries: () => [],
   };
 }

package/src/lib/perf.js

@@ -22,7 +22,6 @@ const logger = createLogger('[Perf]');
 const _profiles = new Map();
 const _alerts = [];
 const MAX_ALERTS = 100;
-const BASELINE_WINDOW_MS = 3600000;
 
 const DEFAULT_THRESHOLDS = {
   'http.request': 500,
@@ -119,7 +118,6 @@ export class PerfProfiler {
     if (!profile) return null;
 
     const durations = profile.durations.map(d => d.durationMs).sort((a, b) => a - b);
-    const count = durations.length;
 
     return {
       operation: profile.operation,

package/src/lib/request-trace.js

@@ -6,11 +6,8 @@
 
 import { tracer } from './tracing.js';
 import { perfProfiler } from './perf.js';
-import { createLogger } from './logger.js';
 import { recordRequest, recordError } from './metrics-collector.js';
 
-const logger = createLogger('[RequestTracing]');
-
 // ---------------------------------------------------------------------------
 // From request-tracing.js
 // ---------------------------------------------------------------------------
@@ -223,7 +220,7 @@ export default withTracing;
 // ---------------------------------------------------------------------------
 // From request-tracker.js
 // ---------------------------------------------------------------------------
-function wrapHandler(handler, metadata = {}) {
+function wrapHandler(handler, _metadata = {}) {
   return async (request, context) => {
     const start = process.hrtime.bigint();
     const method = request.method;