thatcher 1.0.44 → 1.0.46

package/src/lib/route-resolver.js

@@ -27,7 +27,7 @@ export function resolveSpecificParams(routeFile, pathParts) {
   for (let i = 0; i < routeSegments.length && i < urlSegments.length; i++) {
     const seg = routeSegments[i];
     if (seg.startsWith('[') && seg.endsWith(']')) {
-      const paramName = seg.replace(/^\[\.\.\./, '').replace(/[\[\]]/g, '');
+      const paramName = seg.replace(/^\[\.\.\./, '').replace(/[[\]]/g, '');
       result[paramName] = urlSegments[i];
     }
   }

package/src/lib/stage-pipeline.js

@@ -21,7 +21,6 @@ export function createStagePipeline(options = {}) {
   stages.forEach((stage, idx) => {
     const isComplete = idx < currentStageIndex;
     const isCurrent = idx === currentStageIndex;
-    const isUpcoming = idx > currentStageIndex;
 
     const stageItem = document.createElement('div');
     stageItem.className = `stage-item stage-${isComplete ? 'complete' : isCurrent ? 'current' : 'upcoming'}`;

package/src/lib/static-server.js

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.join(__dirname, '../..');
 
-export function serveStatic(pathname, req, res, compress, getCacheHeaders, loadModule) {
+export function serveStatic(pathname, req, res, compress, getCacheHeaders, _loadModule) {
   const acceptEncoding = req.headers['accept-encoding'] || '';
 
   if (pathname === '/favicon.ico') {

package/src/lib/tracing.js

@@ -1,7 +1,4 @@
 import { AsyncLocalStorage } from 'async_hooks';
-import { createLogger } from './logger.js';
-
-const logger = createLogger('[Tracing]');
 
 const _asyncLocalStorage = new AsyncLocalStorage();
 const _traceBuffer = [];

package/src/lib/validation/security-validators.js

@@ -12,7 +12,7 @@ const XSS_PATTERNS = [
 ];
 
 const SQL_INJECTION_PATTERNS = [
-  /('|(\-\-)|(;)|(\|\|)|(\/\*)|(\*\/)|xp_)/gi,
+  /('|(--)|(;)|(\|\|)|(\/\*)|(\*\/)|xp_)/gi,
   /(union|select|insert|update|delete|drop|create|alter|exec|execute)\s/gi,
   /0x[0-9a-f]+/gi,
   /char\(/gi,
@@ -20,7 +20,7 @@ const SQL_INJECTION_PATTERNS = [
 ];
 
 const PATH_TRAVERSAL_PATTERNS = [
-  /\.\.[\\\/]/g,
+  /\.\.[\\/]/g,
   /\.\.%/g,
   /%2e%2e/gi,
   /\.\.\./g

package/src/lib/validation-middleware.js

@@ -10,7 +10,7 @@ import {
 import { validateEntity, validateUpdate, hasErrors } from '@/lib/validation/entity-validators';
 
 export async function validateRequest(request, options = {}) {
-  const { requireCSRF = true, rateLimit = { max: 100, window: 60000 }, entityName = null } = options;
+  const { requireCSRF = true, rateLimit = { max: 100, window: 60000 } } = options;
   
   const ip = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip') || 'unknown';
   const sessionId = request.headers.get('cookie')?.match(/session=([^;]+)/)?.[1] || ip;

package/src/lib/workflow-engine.js

@@ -18,7 +18,7 @@
 // does NOT currently supersede this file; if anything the reverse holds (this file
 // is live, that one is dormant/debug-only). Re-check import sites before treating
 // either as the "old" one.
-import { get, update, create } from './busybase/store.js';
+import { get } from './busybase/store.js';
 import { getConfigEngineSync } from './config-generator-engine.js';
 import { executeHook } from './hook-engine.js';
 import { AppError } from './errors/index.js';

package/src/lib/xstate-workflow-engine.js

@@ -14,7 +14,7 @@
 // src/lib/events-engine.js and re-exported by src/index.js's Thatcher class).
 // This file does NOT supersede workflow-engine.js; treat it as a dormant/
 // debug-only alternate implementation until a real call site adopts it.
-import { createMachine, createActor, assign, fromPromise, sendParent } from 'xstate';
+import { createMachine, createActor, assign } from 'xstate';
 import { getConfigEngineSync } from './config-generator-engine.js';
 import { hookEngine } from './hook-engine.js';
 import { AppError } from './errors/index.js';

package/src/server/server.js

@@ -1,9 +1,8 @@
 import http from 'http';
 import path from 'path';
 import fs from 'fs';
-import { fileURLToPath, pathToFileURL } from 'url';
+import { fileURLToPath } from 'url';
 import { createLogger } from '../lib/logger.js';
-import * as thatcherLib from '../index.js';
 
 const log = createLogger('[Server]');
 const pageLog = createLogger('[Page]');
@@ -13,8 +12,7 @@ const apiLog = createLogger('[API]');
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export function createServer(options) {
-  const { thatcher, config, configEngine, port, host } = options;
-  const PORT = port || 3000;
+  const { thatcher, configEngine } = options;
   const SERVER_START = Date.now();
 
   let systemInitialized = false;
@@ -50,7 +48,6 @@ export function createServer(options) {
   };
 
   const server = http.createServer(async (req, res) => {
-    const t0 = Date.now();
     globalThis.__debug__.activeRequests.count++;
 
     try {
@@ -98,7 +95,7 @@ export function createServer(options) {
       }
 
       // Static file serving (simplified)
-      if (serveStaticFile(pathname, req, res, load)) {
+      if (serveStaticFile(pathname, req, res)) {
         return;
       }
 
@@ -135,7 +132,7 @@ export function createServer(options) {
   return server;
 }
 
-async function serveStaticFile(pathname, req, res, load) {
+async function serveStaticFile(pathname, req, res) {
   if (pathname === '/' || pathname === '/index.html') {
     // Could serve SPA
     return false;
@@ -220,9 +217,8 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
     configEngine = getConfigEngineSync();
   }
-  let spec;
   try {
-    spec = configEngine.generateEntitySpec(entity);
+    configEngine.generateEntitySpec(entity);
   } catch (e) {
     res.writeHead(404);
     res.end(JSON.stringify({ error: `Entity '${entity}' not found` }));

package/src/services/collaborator-role.service.js

@@ -1,8 +1,6 @@
 // Extracted from moonlanding/src/services/collaborator-role.service.js
 
 import { list, get, update, create } from '../lib/busybase/store.js';
-import { AppError } from '../lib/errors/index.js';
-import { HTTP } from '../config/constants.js';
 
 const COLLABORATOR_ROLE_PERMISSIONS = {
   viewer: ['view', 'view_highlights', 'view_pdfs'],
@@ -78,7 +76,7 @@ export function getCollaboratorRolePermissions(roleType) {
   return COLLABORATOR_ROLE_PERMISSIONS[roleType] || [];
 }
 
-export function canAssignRole(userRole, targetRoleType) {
+export function canAssignRole(userRole, _targetRoleType) {
   return ['partner', 'manager'].includes(userRole);
 }
 

package/src/services/notification-engine.js

@@ -1,4 +1,4 @@
-import { getTransporter, sendEmail } from './email-sender.js';
+import { sendEmail } from './email-sender.js';
 import { getConfigEngineSync } from '../lib/config-generator-engine.js';
 import { executeHook } from '../lib/hook-engine.js';
 import { createLogger } from '../lib/logger.js';
@@ -65,7 +65,7 @@ export async function sendNotification(type, userId, context = {}, options = {})
   return notification;
 }
 
-export async function markNotificationRead(notificationId, userId) {
+export async function markNotificationRead(notificationId, _userId) {
   const { update } = await import('../lib/busybase/store.js');
   return update('notification', notificationId, {
     read_at: Math.floor(Date.now() / 1000),
@@ -125,7 +125,7 @@ async function resolveRecipients(recipients, context) {
   return [];
 }
 
-function templateNameForType(type) {
+function templateNameForType(_type) {
   // events-engine.js passes descriptive template names (e.g.
   // 'engagement_info_gathering'); the built-in getTemplates() set in
   // email-sender.js is generic ('notification', 'invitation'), so an

package/src/services/permission.service.js

@@ -1,6 +1,6 @@
 // Adapted from moonlanding/src/services/permission.service.js
 
-import { getCollaboratorRole, checkCollaboratorAccess } from '../services/collaborator-role.service.js';
+import { getCollaboratorRole } from '../services/collaborator-role.service.js';
 import { PermissionError } from '../lib/errors/index.js';
 import { getConfigEngineSync } from '../lib/config-generator-engine.js';
 

package/src/ui/advanced-widgets.js

@@ -1,6 +1,3 @@
-import { h } from '@/ui/webjsx.js'
-import { TOAST_SCRIPT } from '@/ui/render-helpers.js'
-
 export function dataGridAdvanced(config) {
   const { columns = [], data = [], groupBy = null, sortable = true, filterable = true, expandable = false, detailRenderer = null } = config
   const gridId = 'dg-' + Math.random().toString(36).slice(2, 8)

package/src/ui/auth-pages.js

@@ -1,6 +1,6 @@
 import { generateHtml } from '@/ui/layout.js'
 import { nav as navFn } from '@/ui/layout.js'
-import { AUTH_CSS, GOOGLE_SVG, WARN_SVG, LOGO_SVG, authLogoHtml } from '@/ui/auth-styles.js'
+import { AUTH_CSS, GOOGLE_SVG, WARN_SVG, authLogoHtml } from '@/ui/auth-styles.js'
 import { esc } from '@/ui/render-helpers.js'
 
 export function renderLogin(error = null, hasGoogleAuth = false) {

package/src/ui/common-handlers.js

@@ -122,8 +122,8 @@ export const commonHandlers = {
 
   notify: {
     show(message, type = 'info') {
-      if (typeof showToast === 'function') {
-        showToast(message, type);
+      if (typeof window.showToast === 'function') {
+        window.showToast(message, type);
       }
     },
     success(message) { this.show(message, 'success'); },

package/src/ui/component-engine.js

@@ -32,7 +32,7 @@ export function renderComponent(componentId, props = {}) {
     const regex = new RegExp(`{{${key}}}`, 'g');
     if (value && typeof value === 'object') {
       if (Array.isArray(value)) {
-        html = html.replace(regex, value.map(v => renderItem(v, key)).join(''));
+        html = html.replace(regex, value.map(v => renderItem(v)).join(''));
       } else {
         html = html.replace(regex, esc(JSON.stringify(value)));
       }
@@ -49,7 +49,7 @@ export function renderComponent(componentId, props = {}) {
   return `<${element}${cssClass}>${html}</${element}>`;
 }
 
-function renderItem(item, key) {
+function renderItem(item) {
   if (typeof item === 'string') return esc(item);
   if (typeof item === 'object' && item.name && item.color) {
     const bg = safeColor(item.color);

package/src/ui/dashboard-renderer.js

@@ -1,7 +1,7 @@
 import { page } from '@/ui/layout.js'
 import { getQuickActions } from '@/ui/permissions-ui.js'
 import { esc, stagePill, statusPill, TABLE_SCRIPT, emptyRow } from '@/ui/render-helpers.js'
-import { SPACING, renderCard } from '@/ui/spacing-system.js'
+import { SPACING } from '@/ui/spacing-system.js'
 
 export function renderDashboard(user, stats = {}) {
   const isClerk = user?.role === 'clerk';

package/src/ui/dialog-engine.js

@@ -1,7 +1,7 @@
 import { getConfigEngineSync } from '@/lib/config-generator-engine';
 import { aria, role } from '@/lib/accessibility';
 
-export function renderDialog(dialogId, context = {}) {
+export function renderDialog(dialogId, _context = {}) {
   const config = getConfigEngineSync().getConfig();
   const dialogConfig = config.dialogs?.[dialogId];
 
@@ -10,15 +10,15 @@ export function renderDialog(dialogId, context = {}) {
     return '';
   }
 
-  const { title, fields = [], actions = [], width = '640px', onSubmit } = dialogConfig;
-  const dialogHtml = generateDialogHtml(dialogId, title, fields, actions, width, context, onSubmit);
+  const { title, fields = [], actions = [], width = '640px' } = dialogConfig;
+  const dialogHtml = generateDialogHtml(dialogId, title, fields, actions, width);
 
   return dialogHtml;
 }
 
-function generateDialogHtml(dialogId, title, fields, actions, width, context, onSubmit) {
+function generateDialogHtml(dialogId, title, fields, actions, width) {
   const titleId = `${dialogId}-title`;
-  const fieldHtml = fields.map(f => generateFieldHtml(f, dialogId, context)).join('');
+  const fieldHtml = fields.map(f => generateFieldHtml(f, dialogId)).join('');
   const actionButtons = (actions || []).map(a => {
     if (a.type === 'cancel') {
       return `<button type="button" class="btn btn-ghost btn-sm" ${aria.label('Cancel dialog')} data-action="closeDialog" data-args='["${dialogId}"]'>${a.label || 'Cancel'}</button>`;
@@ -66,8 +66,8 @@ function generateDialogHtml(dialogId, title, fields, actions, width, context, on
   `;
 }
 
-function generateFieldHtml(field, dialogId, context) {
-  const { name, label, type, required, placeholder, options, value } = field;
+function generateFieldHtml(field, dialogId) {
+  const { name, label, type, required, placeholder, options } = field;
   const fieldId = `${dialogId}-${name}`;
   const requiredAttr = required ? 'required' : '';
   const ariaRequired = required ? aria.required() : '';
@@ -92,21 +92,23 @@ function generateFieldHtml(field, dialogId, context) {
     case 'date':
       inputHtml = `<input type="date" id="${fieldId}" name="${name}" class="input input-bordered w-full" ${requiredAttr} ${ariaRequired} ${ariaDesc}/>`;
       break;
-    case 'select':
+    case 'select': {
       const optionsHtml = (options || []).map(opt =>
         `<option value="${opt.value}">${escapeHtml(opt.label || opt.value)}</option>`
       ).join('');
       inputHtml = `<select id="${fieldId}" name="${name}" class="select select-bordered w-full" ${requiredAttr} ${ariaRequired} ${ariaDesc}><option value="">Select...</option>${optionsHtml}</select>`;
       break;
+    }
     case 'checkbox':
       inputHtml = `<label class="flex items-center gap-2"><input type="checkbox" id="${fieldId}" name="${name}" class="checkbox" ${requiredAttr} ${ariaRequired} ${ariaDesc}/><span class="text-sm">${label}</span></label>`;
       break;
-    case 'multi-select':
+    case 'multi-select': {
       const multiOptHtml = (options || []).map(opt =>
         `<label class="flex items-center gap-2"><input type="checkbox" name="${name}" value="${opt.value}" class="checkbox"/><span class="text-sm">${escapeHtml(opt.label || opt.value)}</span></label>`
       ).join('');
       inputHtml = `<div class="flex flex-col gap-2" ${role.list}>${multiOptHtml}</div>`;
       break;
+    }
     case 'file':
       inputHtml = `<input type="file" id="${fieldId}" name="${name}" class="file-input file-input-bordered w-full" ${requiredAttr} ${ariaRequired} ${ariaDesc}/>`;
       break;

package/src/ui/engagement-cards.js

@@ -1,4 +1,3 @@
-import { h } from '@/ui/webjsx.js'
 import { STAGE_COLORS, statusLabel, esc, icon } from '@/ui/render-helpers.js'
 import { teamAvatarGroup } from '@/ui/widgets.js'
 import { canEdit } from '@/ui/permissions-ui.js'

package/src/ui/engagement-dialogs.js

@@ -1,6 +1,4 @@
-import { statusLabel } from '@/ui/renderer.js';
 import { createDialog } from '@/ui/dialog-factory.js';
-import { esc } from '@/ui/render-helpers.js';
 
 export function engagementFileSearchDialog(engagementId) {
   const body = `<div class="modal-form-group"><label for="efs-query" class="sr-only">Search files</label><input type="text" id="efs-query" class="input input-bordered w-full" placeholder="Search files..." aria-label="Search engagement files" oninput="efsSearch()"/></div><div id="efs-results" class="flex flex-col gap-2" style="max-height:400px;overflow:auto"></div>`;

package/src/ui/entity-renderer.js

@@ -1,5 +1,4 @@
-import { h } from '@/ui/webjsx.js'
-import { page, confirmDialog, dataTable } from '@/ui/layout.js'
+import { page, dataTable } from '@/ui/layout.js'
 import { fmtVal, TOAST_SCRIPT, esc } from '@/ui/render-helpers.js'
 import { canCreate, canEdit, canDelete } from '@/ui/permissions-ui.js'
 
@@ -7,7 +6,7 @@ export function renderEntityList(entityName, items, spec, user, options = {}) {
   const label = spec?.labelPlural || spec?.label || entityName
   const fields = spec?.fields || {}
   const { groupBy = null } = options
-  let listFields = Object.entries(fields).filter(([k, f]) => f.list).slice(0, 5)
+  let listFields = Object.entries(fields).filter(([, f]) => f.list).slice(0, 5)
   if (!listFields.length) listFields = Object.entries(fields).filter(([k]) => !['created_by', 'updated_by'].includes(k)).slice(0, 6)
   if (!listFields.length && items.length > 0) listFields = Object.keys(items[0]).filter(k => !['created_by', 'updated_by'].includes(k)).slice(0, 5).map(k => [k, { label: k }])
   const headers = listFields.map(([k, f]) => `<th>${esc(f?.label || k)}</th>`).join('') + '<th>Actions</th>'

package/src/ui/event-delegation.js

@@ -260,7 +260,7 @@ const eventDelegation = {
 
   navigate(path) { window.location = path; },
 
-  toggle(elementId, attr = 'checked') {
+  toggle(elementId, _attr = 'checked') {
     const el = document.getElementById(elementId);
     if (el?.type === 'checkbox') el.checked = !el.checked;
     else el.classList.toggle('active');

package/src/ui/file-dialogs.js

@@ -1,5 +1,3 @@
-import { statusLabel } from '@/ui/renderer.js';
-
 // Inline HTML-escape for client-script innerHTML sinks (file names are DB-sourced).
 const FD_ESC = `function fdEsc(s){return String(s==null?'':s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;')}`;
 

package/src/ui/job-management-renderer.js

@@ -1,4 +1,3 @@
-import { statusLabel } from '@/ui/renderer.js';
 import { page } from '@/ui/layout.js';
 import { isPartner } from '@/ui/permissions-ui.js';
 import { STATUS_COLORS, esc } from '@/ui/render-helpers.js';

package/src/ui/layout.js

@@ -1,6 +1,6 @@
-import { h } from '@/ui/webjsx.js'
-import { getNavItems, getAdminItems, isPartner, isClerk } from '@/ui/permissions-ui.js'
-import { TOAST_SCRIPT, AVATAR_COLORS, esc } from '@/ui/render-helpers.js'
+/* eslint-disable no-useless-escape -- this file embeds raw client <script> text inside a template literal; ESLint parses embedded regex escapes like \d as literal template text and misflags them */
+import { isPartner, isClerk } from '@/ui/permissions-ui.js'
+import { AVATAR_COLORS, esc } from '@/ui/render-helpers.js'
 import { FETCH_JSON_SCRIPT } from '@/ui/fetch-json.js'
 import { aria, role, skipLink, liveRegion } from '@/lib/accessibility'
 
@@ -16,7 +16,7 @@ function withAppName(title) {
   return base === appName ? base : `${base} | ${appName}`
 }
 
-export function generateHtml(title, bodyContent, scripts = [], pathname = '/') {
+export function generateHtml(title, bodyContent, scripts = []) {
   title = withAppName(title)
   const scriptTags = scripts.map(s =>
     typeof s === 'string' ? `<script>${s.replace(/<\/script/gi, '<\\/script').replace(/<!--/g, '<\\!--')}</script>` : `<script type="module" src="${s.src}"></script>`

package/src/ui/page-handler-admin.js

@@ -1,7 +1,7 @@
 import { list, get } from '@/lib/busybase/store.js';
-import { renderAuditDashboard, renderSystemHealth, renderAccessDenied, generateHtml, REDIRECT } from '@/ui/renderer.js';
+import { renderAuditDashboard, renderSystemHealth, renderAccessDenied, generateHtml } from '@/ui/renderer.js';
 import { renderSettingsHome, renderSettingsSystem, renderSettingsUsers } from '@/ui/settings/home.js';
-import { renderSettingsTeams, renderSettingsRfiSections } from '@/ui/settings/teams.js';
+import { renderSettingsRfiSections } from '@/ui/settings/teams.js';
 import { renderSettingsTemplates, renderSettingsChecklists, renderSettingsEntityTypes, renderSettingsEngagementTypes, renderSettingsTemplateManage } from '@/ui/settings/templates.js';
 import { renderSettingsNotifications, renderSettingsIntegrations, renderSettingsRecreation, renderSettingsReviewSettings, renderSettingsFileReview, renderSettingsMwrPermissions } from '@/ui/settings/review.js';
 import { renderChecklistsManagement } from '@/ui/checklist-renderer.js';

package/src/ui/page-handler-helpers.js

@@ -1,4 +1,4 @@
-import { list, get, count } from '@/lib/busybase/store.js';
+import { list, count } from '@/lib/busybase/store.js';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[PageHandlerHelpers]');
@@ -19,7 +19,7 @@ export function resolveEnumOptions(spec) {
 
 export async function getRefOptions(spec) {
   const refOptions = {};
-  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([k, f]) => f.type === 'ref' && f.ref)) {
+  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => f.type === 'ref' && f.ref)) {
     try { refOptions[fieldKey] = (await list(field.ref, {})).map(r => ({ value: r.id, label: r.name || r.title || r.label || r.email || r.id })); }
     catch { refOptions[fieldKey] = []; }
   }
@@ -31,7 +31,7 @@ export async function getRefOptions(spec) {
 // `_display` key exists (falling back to the raw id) without issuing any query.
 export function resolveRefFields(items, spec) {
   try {
-    const refFields = Object.entries(spec.fields || {}).filter(([k, f]) => f.type === 'ref' && f.ref);
+    const refFields = Object.entries(spec.fields || {}).filter(([, f]) => f.type === 'ref' && f.ref);
     if (!refFields.length) return items;
     return items.map(item => {
       const resolved = { ...item };

package/src/ui/page-handler-rfi.js

@@ -1,5 +1,5 @@
 import { list, get } from '@/lib/busybase/store.js';
-import { canView, canList, isClerk, isPartner } from '@/ui/permissions-ui.js';
+import { canView, canList, isClerk } from '@/ui/permissions-ui.js';
 import { renderAccessDenied } from '@/ui/renderer.js';
 import { renderRfiList } from '@/ui/rfi-list-renderer.js';
 import { fileURLToPath } from 'url';

package/src/ui/page-handler.js

@@ -2,7 +2,7 @@ import { getUser, setCurrentRequest } from '@/engine.server.js';
 import { hasGoogleAuth } from '@/config/env.js';
 import { getSpec } from '@/config/spec-helpers.js';
 import { list, get } from '@/lib/busybase/store.js';
-import { renderLogin, renderDashboard, renderEntityList, renderEntityDetail, renderEntityForm, renderAccessDenied, renderPasswordReset, renderPasswordResetConfirm, REDIRECT } from '@/ui/renderer.js';
+import { renderLogin, renderDashboard, renderAccessDenied, renderPasswordReset, renderPasswordResetConfirm, REDIRECT } from '@/ui/renderer.js';
 import { renderClientDashboard, renderClientList } from '@/ui/client-renderer.js';
 import { canList, canView, canCreate, canEdit, isPartner, isClerk, isClientUser, canClientAccessEntity } from '@/ui/permissions-ui.js';
 import { renderEngagementGrid } from '@/ui/engagement-grid-renderer.js';

package/src/ui/permissions-ui.js

@@ -1,16 +1,5 @@
 import { getConfigEngineSync } from '@/lib/config-generator-engine.js';
 
-function getRoleHierarchy() {
-  const config = getConfigEngineSync();
-  const roles = config.getRoles();
-  const hierarchy = {};
-  let level = 0;
-  for (const [roleName] of Object.entries(roles)) {
-    hierarchy[roleName] = level++;
-  }
-  return hierarchy;
-}
-
 function getEntityPermissions() {
   const config = getConfigEngineSync();
   const entityNames = config.getAllEntities();
@@ -40,7 +29,6 @@ function getEntityPermissions() {
 
 export function canAccess(user, entity, action) {
   if (!user?.role) return false;
-  const config = getConfigEngineSync();
   const allPermissions = getEntityPermissions();
   const permissions = allPermissions[entity];
 

package/src/ui/picker-dialogs.js

@@ -1,4 +1,3 @@
-import { h } from '@/ui/webjsx.js'
 import { STAGE_COLORS, TOAST_SCRIPT } from '@/ui/render-helpers.js'
 
 const DIALOG_COLORS = ['#B0B0B0','#44BBA4','#FF4141','#7F7EFF','#3b82f6','#f59e0b','#ec4899','#8b5cf6','#ef4444','#22c55e','#06b6d4','#f97316','#84cc16','#e11d48','#14b8a6','#6366f1']

package/src/ui/review/comparison.js

@@ -2,7 +2,7 @@ import { statusLabel } from '@/ui/renderer.js';
 import { page } from '@/ui/layout.js';
 import { emptyRow, esc } from '../render-helpers.js';
 
-function reviewSummaryPanel(review, highlights, side) {
+function reviewSummaryPanel(review, highlights, _side) {
   const total = highlights.length;
   const resolved = highlights.filter(h => h.status === 'resolved').length;
   const sts = review.status ? statusLabel(review.status) : '';

package/src/ui/review/detail-renderer.js

@@ -2,7 +2,7 @@ import { page } from '@/ui/layout.js';
 import { reviewZoneNav } from '@/ui/review/zone-nav.js';
 export { reviewZoneNav };
 import { canEdit } from '@/ui/permissions-ui.js';
-import { esc, statusBadge, TOAST_SCRIPT, icon } from '@/ui/render-helpers.js';
+import { esc, statusBadge, icon } from '@/ui/render-helpers.js';
 import { reviewDetailScript } from '@/ui/review/detail-script.js';
 import { highlightRow, collaboratorRow, addCollaboratorDialog } from '@/ui/review/detail-panels.js';
 import { tenderPanelHtml, tenderDialog, linksPanelHtml, linkDialog, sectionsPanelHtml, compareDialogHtml } from '@/ui/review-detail-panels-extra.js';

package/src/ui/review/mwr.js

@@ -1,6 +1,6 @@
 import { page } from '@/ui/layout.js';
 import { reviewZoneNav } from '@/ui/review/zone-nav.js';
-import { SPACING, renderCard, renderButton, renderProgress, renderEmptyState, renderStatsRow, renderPageHeader } from '@/ui/spacing-system.js';
+import { SPACING, renderCard, renderButton, renderEmptyState, renderStatsRow, renderPageHeader } from '@/ui/spacing-system.js';
 import { icon, esc } from '@/ui/format-helpers.js';
 import { TOAST_SCRIPT } from '@/ui/render-helpers.js';
 

package/src/ui/review/widgets.js

@@ -1,4 +1,3 @@
-import { h } from '@/ui/webjsx.js'
 import { statusLabel, TOAST_SCRIPT, esc } from '@/ui/render-helpers.js'
 import { teamAvatarGroup } from '@/ui/widgets.js'
 

package/src/ui/rfi-detail-renderer.js

@@ -1,6 +1,6 @@
 import { page } from '@/ui/layout.js';
 import { canEdit, isPartner, isManager, isClientUser } from '@/ui/permissions-ui.js';
-import { esc, statusBadge, TOAST_SCRIPT, emptyRow } from '@/ui/render-helpers.js';
+import { esc, statusBadge, TOAST_SCRIPT } from '@/ui/render-helpers.js';
 import { SPACING } from '@/ui/spacing-system.js';
 
 const TOAST = TOAST_SCRIPT;

package/src/ui/settings/home.js

@@ -22,7 +22,7 @@ const SETTINGS_CARDS = [
   { key: 'permissions', icon: 'lock', title: 'Permissions', desc: 'MWR permissions and access control', href: '/admin/settings/permissions' },
 ];
 
-export function renderSettingsHome(user, config = {}, counts = {}) {
+export function renderSettingsHome(user, _config = {}, counts = {}) {
   const cards = SETTINGS_CARDS.map(c => {
     const cnt = c.countKey && counts[c.countKey] !== undefined ? counts[c.countKey] : null;
     const badge = cnt !== null ? `<span class="badge badge-flat-primary text-xs">${cnt.toLocaleString('en-ZA')} items</span>` : '';

package/src/ui/settings/review.js

@@ -181,7 +181,6 @@ export function renderSettingsFileReview(user, config = {}, frSettings = {}) {
   const fr = config.fileReview || {};
   const reviewFlags = frSettings.review_flags || [];
   const tenderFlags = frSettings.tender_flags || [];
-  const flagManagers = frSettings.flags_managers || [];
   const tempAccess = frSettings.temp_review_access_period || 0;
   const toggles = [
     { id: 'auto_pdf_cache', label: 'Auto-cache PDFs', desc: 'Cache PDF files for faster loading', checked: fr.auto_pdf_cache !== false },

package/src/ui/settings/teams.js

@@ -12,7 +12,7 @@ function parseMembers(t) {
   } catch { return []; }
 }
 
-export function renderSettingsTeams(user, teams = [], allUsers = []) {
+export function renderSettingsTeams(user, teams = [], _allUsers = []) {
   const editDialog = `<div id="team-dialog" class="modal" style="display:none" role="dialog" aria-modal="true" aria-labelledby="team-dialog-title">
     <div class="modal-overlay" data-dialog-close="team-dialog"></div>
     <div class="modal-content rounded-box max-w-md p-6">

package/src/ui/spacing-system.js

@@ -93,7 +93,7 @@ export function renderButton(label, opts = {}) {
   return `<button type="button"${onclickAttr} class="${btnClass}" ${disabled ? 'disabled' : ''} style="${extraStyle}">${label}</button>`;
 }
 
-export function renderProgress(value, max = 100, variant = 'success', marginTop = SPACING.md) {
+export function renderProgress(value, max = 100, _variant = 'success', marginTop = SPACING.md) {
   const pct = max > 0 ? Math.round((value / max) * 100) : 0;
   return `<div style="margin-top:${typeof marginTop === 'string' ? marginTop : SPACING.md}">
     <div style="display:flex;justify-content:space-between;margin-bottom:${SPACING.sm};align-items:center">