thatcher 1.0.45 → 1.0.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.45",
+  "version": "1.0.46",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/adapters/google-auth.js

@@ -4,19 +4,12 @@ import { google } from 'googleapis';
 const log = createLogger('[GoogleAuth]');
 import { buildConfig } from '../config/env.js';
 import fs from 'fs';
-import path from 'path';
 
 let _oauth2Client = null;
 let _jwtClient = null;
 
 export function initGoogleAuth(config = null) {
   const cfg = config || buildConfig();
-  const scopes = [
-    'https://www.googleapis.com/auth/userinfo.email',
-    'https://www.googleapis.com/auth/userinfo.profile',
-    'https://www.googleapis.com/auth/drive',
-    'https://www.googleapis.com/auth/gmail.send',
-  ];
 
   // OAuth2 client for web flow
   _oauth2Client = new google.auth.OAuth2(

package/src/adapters/google-drive.js

@@ -4,8 +4,6 @@ import path from 'path';
 import { getJWTClient, getOAuth2Client } from './google-auth.js';
 import { buildConfig } from '../config/env.js';
 
-const DRIVE_SCOPES = ['https://www.googleapis.com/auth/drive'];
-
 export function getDriveClient(user = null) {
   let client;
 
@@ -26,7 +24,7 @@ export function getDriveClient(user = null) {
 export async function uploadFile(filePath, name, options = {}, user = null) {
   const drive = getDriveClient(user);
   const absPath = path.resolve(filePath);
-  const fileSize = fs.statSync(absPath).size;
+  fs.statSync(absPath);
 
   const res = await drive.files.create({
     requestBody: {

package/src/app/api/[entity]/[[...path]]/route.js

@@ -1,7 +1,7 @@
 import { createCrudHandlers } from '@/lib/crud-factory';
 import { setCurrentRequest } from '@/engine.server';
 
-function wrapHandler(method) {
+function wrapHandler(_method) {
   return async (request, context) => {
     setCurrentRequest(request);
     const params = await context.params;

package/src/app/api/audit/logs/route.js

@@ -1,6 +1,6 @@
 import { NextResponse } from '@/lib/next-shim';
 import { requireAuth } from '@/lib/auth-middleware';
-import { searchLogs, getLogStats, rotateLogsOlderThan } from '@/lib/audit-logger-enhanced';
+import { searchLogs, rotateLogsOlderThan } from '@/lib/audit-logger-enhanced';
 import { withErrorHandler } from '@/lib/errors';
 
 export const GET = withErrorHandler(async (request) => {

package/src/app/api/audit/permissions/route.js

@@ -33,7 +33,6 @@ export async function GET(request) {
     const search = searchParams.get('search');
     const startDate = searchParams.get('start_date');
     const endDate = searchParams.get('end_date');
-    const action = searchParams.get('action');
     const limit = parseInt(searchParams.get('limit') || '100', 10);
     const offset = parseInt(searchParams.get('offset') || '0', 10);
     const format = searchParams.get('format');

package/src/app/api/audit/route.js

@@ -1,13 +1,11 @@
-import { requireAuth, requirePermission } from '@/lib/auth-middleware';
+import { requireAuth } from '@/lib/auth-middleware';
 import { getAuditHistory, getActionStats, getUserStats } from '@/lib/busybase/audit-reads';
-import { getSpec } from '@/config/spec-helpers';
 import { paginated, ok } from '@/lib/response-formatter';
 import { withErrorHandler, AppError } from '@/lib/errors';
 import { HTTP } from '@/config/constants';
-import { parse as parseQuery } from '@/lib/query-string-adapter';
 
 export const GET = withErrorHandler(async (request) => {
-  const user = await requireAuth();
+  await requireAuth();
   const url = new URL(request.url);
 
   const entityType = url.searchParams.get('entityType');

package/src/app/api/auth/google/callback/route.js

@@ -1,5 +1,5 @@
 import { createLogger } from '@/lib/logger.js';
-import { google, createSession } from '@/engine.server';
+import { createSession } from '@/engine.server';
 
 const log = createLogger('[OAuth]');
 import { getBy, create } from '@/engine';

package/src/app/api/auth/google/route.js

@@ -50,7 +50,7 @@ export async function GET(request) {
   });
 }
 
-export async function HEAD(request) {
+export async function HEAD(_request) {
   try {
     const { valid } = validateOAuthProvider(google);
     return new Response(null, { status: valid ? 200 : 503 });

package/src/app/api/auth/logout/route.js

@@ -8,7 +8,7 @@ function buildLogoutHeaders(headerMap) {
     : [];
 }
 
-export async function GET(request, { res } = {}) {
+export async function GET(request) {
   try {
     setEngineRequest(request);
     setCurrentRequest(request);

package/src/app/api/csrf-token/route.js

@@ -2,7 +2,7 @@ import { generateToken } from '@/lib/csrf-protection';
 import { ok } from '@/lib/response-formatter';
 import { withErrorHandler } from '@/lib/errors';
 
-export const GET = withErrorHandler(async (request) => {
+export const GET = withErrorHandler(async (_request) => {
   const token = generateToken();
   return ok({ csrfToken: token });
 }, 'CSRF:GetToken');

package/src/app/api/domains/route.js

@@ -6,7 +6,7 @@ import { ok } from '@/lib/response-formatter';
 import { withErrorHandler } from '@/lib/errors';
 import { getConfigEngine } from '@/lib/config-generator-engine';
 
-export const GET = withErrorHandler(async (request) => {
+export const GET = withErrorHandler(async (_request) => {
   await getConfigEngine();
   const domainLoader = getDomainLoader();
   const validDomains = domainLoader.getValidDomains();

package/src/app/api/email/allocate/route.js

@@ -7,7 +7,6 @@ const log = createLogger('[EmailAllocate]');
 import {
   allocateEmailToEntity,
   autoAllocateEmail,
-  validateAllocation,
   findEntityByAlternateId,
 } from '@/lib/email-parser';
 

package/src/app/api/email/receive/route.js

@@ -143,7 +143,7 @@ export async function POST(request) {
   }
 }
 
-export async function GET(request) {
+export async function GET(_request) {
   return NextResponse.json({
     endpoint: 'Email Receive Webhook',
     method: 'POST',

package/src/app/api/health/route.js

@@ -85,7 +85,7 @@ export const GET = async (request) => {
   }
 }
 
-export const HEAD = async (request) => {
+export const HEAD = async (_request) => {
   try {
     await count('user', {})
     return new Response(null, { status: 200 })

package/src/cli.js

@@ -11,7 +11,7 @@
  *   thatcher example         - Generate example config
  */
 
-import { startThatcher, Thatcher } from './index.js';
+import { Thatcher } from './index.js';
 import * as readline from 'readline';
 import fs from 'fs';
 import path from 'path';

package/src/config/spec-helpers.js

@@ -135,7 +135,6 @@ export function buildNavigation(configEngine, user = null) {
     // Filter by user permissions if provided
     if (user && configEngine.getRolePermissions) {
       return items.filter(item => {
-        const spec = configEngine.generateEntitySpec(item.name);
         const perms = configEngine.getRolePermissions(user.role, item.name);
         return perms.includes('list') || perms.includes('view') || perms.includes('all');
       });

package/src/engine.server.js

@@ -104,7 +104,7 @@ export async function createSession(userId) {
 }
 
 export async function invalidateSession() {
-  const lucia = getLucia();
+  getLucia();
   // Simplified - caller handles cookie clearing
   // In full app this uses @lucia-auth/adapter-sqlite's cookie management
 }

package/src/lib/alert-manager.js

@@ -22,7 +22,7 @@ function checkErrorRate(errorMetrics) {
   const window = thresholds.errorRate.window
   let recentErrors = 0
 
-  for (const [endpoint, data] of Object.entries(errorMetrics.byEndpoint)) {
+  for (const [, data] of Object.entries(errorMetrics.byEndpoint)) {
     const recent = (data.recent || []).filter(e => (now - e.ts) < window)
     recentErrors += recent.length
   }

package/src/lib/api-helpers.js

@@ -30,7 +30,7 @@ export const ok = (data) => NextResponse.json(withMetadata(data, HTTP.OK, 'succe
 export const created = (data) => NextResponse.json(withMetadata(data, HTTP.CREATED, 'created'), { status: HTTP.CREATED });
 export const notFound = (entity = 'Resource') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.notFound(entity) }, HTTP.NOT_FOUND, 'error'), { status: HTTP.NOT_FOUND });
 export const badRequest = (reason = 'invalid data') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.invalidRequest(reason) }, HTTP.BAD_REQUEST, 'error'), { status: HTTP.BAD_REQUEST });
-export const unauthorized = (action = 'perform this action') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.permission.denied }, HTTP.FORBIDDEN, 'error'), { status: HTTP.FORBIDDEN });
+export const unauthorized = (_action = 'perform this action') => NextResponse.json(withMetadata({ error: ERROR_MESSAGES.permission.denied }, HTTP.FORBIDDEN, 'error'), { status: HTTP.FORBIDDEN });
 export const serverError = (msg = null) => NextResponse.json(withMetadata({ error: msg || ERROR_MESSAGES.operationFailed('server operation') }, HTTP.INTERNAL_ERROR, 'error'), { status: HTTP.INTERNAL_ERROR });
 
 export async function withEntityAccess(entity, action, handler) {

package/src/lib/auth-route-helpers.js

@@ -23,7 +23,7 @@ export function validateOAuthProvider(provider) {
   return { valid: true };
 }
 
-export async function setOAuthCookie(name, value, options = {}) {
+export async function setOAuthCookie(name, value) {
   const timestamp = Date.now();
   const key = `oauth-${timestamp}-${Math.random().toString(36).substring(7)}`;
   const expiresAt = timestamp + (SESSION.cookieMaxAge * 1000);

package/src/lib/business-rules-engine.js

@@ -11,7 +11,7 @@ export class BusinessRulesEngine {
       return rule && !this.isDuplicateEngagement(engagement);
     });
 
-    this.registerRule('daysOutstandingNotificationNeeded', (rfi) => {
+    this.registerRule('daysOutstandingNotificationNeeded', (_rfi) => {
       return this.businessRules.rfiDaysOutstanding.enabled;
     });
 
@@ -23,7 +23,7 @@ export class BusinessRulesEngine {
       return true;
     });
 
-    this.registerRule('clientCanRate', (user, engagement) => {
+    this.registerRule('clientCanRate', (user, _engagement) => {
       return user.type === 'client' && user.role === 'client_admin';
     });
 
@@ -66,7 +66,7 @@ export class BusinessRulesEngine {
     return this.businessRules.recreationRules.engagement[interval];
   }
 
-  isDuplicateEngagement(engagement) {
+  isDuplicateEngagement(_engagement) {
     return false;
   }
 

package/src/lib/busybase/adapter.js

@@ -32,7 +32,7 @@ export class BusyBaseAdapter {
       this._client = this._embedded;
       logger.info('Embedded mode initialized', { dir: this.config.dir });
     } else {
-      const { default: BB, createClient } = await import('busybase');
+      const { default: BB } = await import('busybase');
       this._client = BB(this.config.url, this.config.project);
       logger.info('Remote mode initialized', { url: this.config.url });
     }
@@ -106,7 +106,7 @@ export class BusyBaseAdapter {
   }
 
   async unsubscribeAll() {
-    for (const [name, { channel }] of _realtimeChannels.entries()) {
+    for (const [, { channel }] of _realtimeChannels.entries()) {
       channel.unsubscribe();
     }
     _realtimeChannels.clear();

package/src/lib/busybase/store.js

@@ -271,7 +271,7 @@ export async function create(entity, data, user) {
 // unconditional-write behaviour, unchanged for every existing caller; _version
 // is added as a new column, ignored by every reader that doesn't ask for it.
 export async function update(entity, id, data, opts = {}) {
-  const spec = specOf(entity);
+  specOf(entity);
   const tbl = tableName(entity);
 
   const existing = await get(entity, id);

package/src/lib/config-generator-engine.js

@@ -12,9 +12,7 @@
 // as of this writing, vs. workflow-engine.js's 2 and
 // xstate-workflow-engine.js's 2 debug/test-only importers) -- this is live,
 // central infrastructure, not a candidate for deprecation.
-import { load as yamlLoad } from 'js-yaml';
 import { LRUCache, deepFreeze, deepClone, recursiveResolve } from './config-helpers.js';
-import { generateFieldsFromOverrides, ensureFieldLabels } from './config-field-helpers.js';
 
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {

package/src/lib/crud-action-helpers.js

@@ -9,7 +9,7 @@ const ACTION_FIELD_MAPS = {
   respond: (data, user) => ({ status: 'responded', response: data.response, responded_at: now(), responded_by: user.id }),
 };
 
-export function resolveActionUpdate(action, data, user, record) {
+export function resolveActionUpdate(action, data, user, _record) {
   const mapped = ACTION_FIELD_MAPS[action];
   if (typeof mapped === 'function') return mapped(data, user);
   if (mapped) {

package/src/lib/crud-handlers.js

@@ -3,10 +3,10 @@ import { get, listWithPagination, searchWithPagination, create, update, remove }
 
 const log = createLogger('[CRUD]');
 import { validateEntity, validateUpdate, sanitizeData } from './validation/index.js';
-import { requirePermission, getSessionToken } from './auth-middleware.js';
+import { requirePermission } from './auth-middleware.js';
 import { executeHook } from './hook-engine.js';
 import { AppError, NotFoundError, ValidationError } from './errors/index.js';
-import { ok, created, paginated, noContent, error } from './response-formatter.js';
+import { ok, created, paginated, noContent } from './response-formatter.js';
 import { HTTP } from '../config/constants.js';
 import { permissionService } from '../services/permission.service.js';
 import { parse as parseQuery } from './query-string-adapter.js';

package/src/lib/csrf-protection.js

@@ -43,7 +43,6 @@ export async function withCsrfValidation(handler) {
     }
 
     try {
-      const contentType = request.headers.get('content-type') || '';
       const token = request.headers.get('x-csrf-token');
 
       if (!token || !validateToken(token)) {

package/src/lib/debug-registry.js

@@ -1,6 +1,6 @@
 import { createLogger } from './logger.js';
 
-const logger = createLogger('[DebugRegistry]');
+createLogger('[DebugRegistry]');
 
 class DebugRegistry {
   constructor() {

package/src/lib/errors/wrap.js

@@ -48,7 +48,7 @@ export function wrap(fn, options = {}) {
 // retryWithBackoff lives here (not recovery.js) because wrap() itself needs it
 // with no circular dependency; recovery.js imports it back from here.
 export async function retryWithBackoff(fn, options = {}) {
-  const { maxAttempts = 3, delay = 1000, backoff = 2, context = {} } = options;
+  const { maxAttempts = 3, delay = 1000, backoff = 2 } = options;
 
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     try {

package/src/lib/events-engine.js

@@ -175,7 +175,7 @@ export const registerEntityHandlers = () => {
     create('removed_highlight', { review_id: highlight.review_id, original_id: highlight.id, highlight_data: JSON.stringify(highlight) }, user);
   });
 
-  hookEngine.on('collaborator:afterCreate', async (collaborator, user) => {
+  hookEngine.on('collaborator:afterCreate', async (collaborator, _user) => {
     const review = get('review', collaborator.review_id);
     const collabUser = get('user', collaborator.user_id);
     if (review && collabUser) {

package/src/lib/field-iterator.js

@@ -20,13 +20,13 @@ export function getFieldNames(spec) {
 
 export function getEditableFields(spec) {
   return Object.entries(spec.fields || {})
-    .filter(([key, field]) => !field.readonly && !field.auto && !field.auto_generate)
+    .filter(([, field]) => !field.readonly && !field.auto && !field.auto_generate)
     .map(([key]) => key);
 }
 
 export function getFieldsByType(spec, type) {
   return Object.entries(spec.fields || {})
-    .filter(([key, field]) => field.type === type);
+    .filter(([, field]) => field.type === type);
 }
 
 export function fieldQuery(spec, predicates, options = {}) {

package/src/lib/next-shim.js

@@ -262,9 +262,9 @@ export async function cookies() {
 
 export function headers() {
   return {
-    get: (name) => null,
+    get: (_name) => null,
     getSetCookie: () => [],
-    has: (name) => false,
+    has: (_name) => false,
     entries: () => [],
   };
 }

package/src/lib/perf.js

@@ -22,7 +22,6 @@ const logger = createLogger('[Perf]');
 const _profiles = new Map();
 const _alerts = [];
 const MAX_ALERTS = 100;
-const BASELINE_WINDOW_MS = 3600000;
 
 const DEFAULT_THRESHOLDS = {
   'http.request': 500,
@@ -119,7 +118,6 @@ export class PerfProfiler {
     if (!profile) return null;
 
     const durations = profile.durations.map(d => d.durationMs).sort((a, b) => a - b);
-    const count = durations.length;
 
     return {
       operation: profile.operation,

package/src/lib/request-trace.js

@@ -6,11 +6,8 @@
 
 import { tracer } from './tracing.js';
 import { perfProfiler } from './perf.js';
-import { createLogger } from './logger.js';
 import { recordRequest, recordError } from './metrics-collector.js';
 
-const logger = createLogger('[RequestTracing]');
-
 // ---------------------------------------------------------------------------
 // From request-tracing.js
 // ---------------------------------------------------------------------------
@@ -223,7 +220,7 @@ export default withTracing;
 // ---------------------------------------------------------------------------
 // From request-tracker.js
 // ---------------------------------------------------------------------------
-function wrapHandler(handler, metadata = {}) {
+function wrapHandler(handler, _metadata = {}) {
   return async (request, context) => {
     const start = process.hrtime.bigint();
     const method = request.method;

package/src/lib/stage-pipeline.js

@@ -21,7 +21,6 @@ export function createStagePipeline(options = {}) {
   stages.forEach((stage, idx) => {
     const isComplete = idx < currentStageIndex;
     const isCurrent = idx === currentStageIndex;
-    const isUpcoming = idx > currentStageIndex;
 
     const stageItem = document.createElement('div');
     stageItem.className = `stage-item stage-${isComplete ? 'complete' : isCurrent ? 'current' : 'upcoming'}`;

package/src/lib/static-server.js

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.join(__dirname, '../..');
 
-export function serveStatic(pathname, req, res, compress, getCacheHeaders, loadModule) {
+export function serveStatic(pathname, req, res, compress, getCacheHeaders, _loadModule) {
   const acceptEncoding = req.headers['accept-encoding'] || '';
 
   if (pathname === '/favicon.ico') {

package/src/lib/tracing.js

@@ -1,7 +1,4 @@
 import { AsyncLocalStorage } from 'async_hooks';
-import { createLogger } from './logger.js';
-
-const logger = createLogger('[Tracing]');
 
 const _asyncLocalStorage = new AsyncLocalStorage();
 const _traceBuffer = [];

package/src/lib/validation-middleware.js

@@ -10,7 +10,7 @@ import {
 import { validateEntity, validateUpdate, hasErrors } from '@/lib/validation/entity-validators';
 
 export async function validateRequest(request, options = {}) {
-  const { requireCSRF = true, rateLimit = { max: 100, window: 60000 }, entityName = null } = options;
+  const { requireCSRF = true, rateLimit = { max: 100, window: 60000 } } = options;
   
   const ip = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip') || 'unknown';
   const sessionId = request.headers.get('cookie')?.match(/session=([^;]+)/)?.[1] || ip;

package/src/lib/workflow-engine.js

@@ -18,7 +18,7 @@
 // does NOT currently supersede this file; if anything the reverse holds (this file
 // is live, that one is dormant/debug-only). Re-check import sites before treating
 // either as the "old" one.
-import { get, update, create } from './busybase/store.js';
+import { get } from './busybase/store.js';
 import { getConfigEngineSync } from './config-generator-engine.js';
 import { executeHook } from './hook-engine.js';
 import { AppError } from './errors/index.js';

package/src/lib/xstate-workflow-engine.js

@@ -14,7 +14,7 @@
 // src/lib/events-engine.js and re-exported by src/index.js's Thatcher class).
 // This file does NOT supersede workflow-engine.js; treat it as a dormant/
 // debug-only alternate implementation until a real call site adopts it.
-import { createMachine, createActor, assign, fromPromise, sendParent } from 'xstate';
+import { createMachine, createActor, assign } from 'xstate';
 import { getConfigEngineSync } from './config-generator-engine.js';
 import { hookEngine } from './hook-engine.js';
 import { AppError } from './errors/index.js';

package/src/server/server.js

@@ -1,9 +1,8 @@
 import http from 'http';
 import path from 'path';
 import fs from 'fs';
-import { fileURLToPath, pathToFileURL } from 'url';
+import { fileURLToPath } from 'url';
 import { createLogger } from '../lib/logger.js';
-import * as thatcherLib from '../index.js';
 
 const log = createLogger('[Server]');
 const pageLog = createLogger('[Page]');
@@ -13,8 +12,7 @@ const apiLog = createLogger('[API]');
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export function createServer(options) {
-  const { thatcher, config, configEngine, port, host } = options;
-  const PORT = port || 3000;
+  const { thatcher, configEngine } = options;
   const SERVER_START = Date.now();
 
   let systemInitialized = false;
@@ -50,7 +48,6 @@ export function createServer(options) {
   };
 
   const server = http.createServer(async (req, res) => {
-    const t0 = Date.now();
     globalThis.__debug__.activeRequests.count++;
 
     try {
@@ -98,7 +95,7 @@ export function createServer(options) {
       }
 
       // Static file serving (simplified)
-      if (serveStaticFile(pathname, req, res, load)) {
+      if (serveStaticFile(pathname, req, res)) {
         return;
       }
 
@@ -135,7 +132,7 @@ export function createServer(options) {
   return server;
 }
 
-async function serveStaticFile(pathname, req, res, load) {
+async function serveStaticFile(pathname, req, res) {
   if (pathname === '/' || pathname === '/index.html') {
     // Could serve SPA
     return false;
@@ -220,9 +217,8 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
     configEngine = getConfigEngineSync();
   }
-  let spec;
   try {
-    spec = configEngine.generateEntitySpec(entity);
+    configEngine.generateEntitySpec(entity);
   } catch (e) {
     res.writeHead(404);
     res.end(JSON.stringify({ error: `Entity '${entity}' not found` }));

package/src/services/collaborator-role.service.js

@@ -1,8 +1,6 @@
 // Extracted from moonlanding/src/services/collaborator-role.service.js
 
 import { list, get, update, create } from '../lib/busybase/store.js';
-import { AppError } from '../lib/errors/index.js';
-import { HTTP } from '../config/constants.js';
 
 const COLLABORATOR_ROLE_PERMISSIONS = {
   viewer: ['view', 'view_highlights', 'view_pdfs'],
@@ -78,7 +76,7 @@ export function getCollaboratorRolePermissions(roleType) {
   return COLLABORATOR_ROLE_PERMISSIONS[roleType] || [];
 }
 
-export function canAssignRole(userRole, targetRoleType) {
+export function canAssignRole(userRole, _targetRoleType) {
   return ['partner', 'manager'].includes(userRole);
 }
 

package/src/services/notification-engine.js

@@ -1,4 +1,4 @@
-import { getTransporter, sendEmail } from './email-sender.js';
+import { sendEmail } from './email-sender.js';
 import { getConfigEngineSync } from '../lib/config-generator-engine.js';
 import { executeHook } from '../lib/hook-engine.js';
 import { createLogger } from '../lib/logger.js';
@@ -65,7 +65,7 @@ export async function sendNotification(type, userId, context = {}, options = {})
   return notification;
 }
 
-export async function markNotificationRead(notificationId, userId) {
+export async function markNotificationRead(notificationId, _userId) {
   const { update } = await import('../lib/busybase/store.js');
   return update('notification', notificationId, {
     read_at: Math.floor(Date.now() / 1000),
@@ -125,7 +125,7 @@ async function resolveRecipients(recipients, context) {
   return [];
 }
 
-function templateNameForType(type) {
+function templateNameForType(_type) {
   // events-engine.js passes descriptive template names (e.g.
   // 'engagement_info_gathering'); the built-in getTemplates() set in
   // email-sender.js is generic ('notification', 'invitation'), so an

package/src/services/permission.service.js

@@ -1,6 +1,6 @@
 // Adapted from moonlanding/src/services/permission.service.js
 
-import { getCollaboratorRole, checkCollaboratorAccess } from '../services/collaborator-role.service.js';
+import { getCollaboratorRole } from '../services/collaborator-role.service.js';
 import { PermissionError } from '../lib/errors/index.js';
 import { getConfigEngineSync } from '../lib/config-generator-engine.js';
 

package/src/ui/advanced-widgets.js

@@ -1,6 +1,3 @@
-import { h } from '@/ui/webjsx.js'
-import { TOAST_SCRIPT } from '@/ui/render-helpers.js'
-
 export function dataGridAdvanced(config) {
   const { columns = [], data = [], groupBy = null, sortable = true, filterable = true, expandable = false, detailRenderer = null } = config
   const gridId = 'dg-' + Math.random().toString(36).slice(2, 8)

package/src/ui/auth-pages.js

@@ -1,6 +1,6 @@
 import { generateHtml } from '@/ui/layout.js'
 import { nav as navFn } from '@/ui/layout.js'
-import { AUTH_CSS, GOOGLE_SVG, WARN_SVG, LOGO_SVG, authLogoHtml } from '@/ui/auth-styles.js'
+import { AUTH_CSS, GOOGLE_SVG, WARN_SVG, authLogoHtml } from '@/ui/auth-styles.js'
 import { esc } from '@/ui/render-helpers.js'
 
 export function renderLogin(error = null, hasGoogleAuth = false) {

package/src/ui/component-engine.js

@@ -32,7 +32,7 @@ export function renderComponent(componentId, props = {}) {
     const regex = new RegExp(`{{${key}}}`, 'g');
     if (value && typeof value === 'object') {
       if (Array.isArray(value)) {
-        html = html.replace(regex, value.map(v => renderItem(v, key)).join(''));
+        html = html.replace(regex, value.map(v => renderItem(v)).join(''));
       } else {
         html = html.replace(regex, esc(JSON.stringify(value)));
       }
@@ -49,7 +49,7 @@ export function renderComponent(componentId, props = {}) {
   return `<${element}${cssClass}>${html}</${element}>`;
 }
 
-function renderItem(item, key) {
+function renderItem(item) {
   if (typeof item === 'string') return esc(item);
   if (typeof item === 'object' && item.name && item.color) {
     const bg = safeColor(item.color);

package/src/ui/dashboard-renderer.js

@@ -1,7 +1,7 @@
 import { page } from '@/ui/layout.js'
 import { getQuickActions } from '@/ui/permissions-ui.js'
 import { esc, stagePill, statusPill, TABLE_SCRIPT, emptyRow } from '@/ui/render-helpers.js'
-import { SPACING, renderCard } from '@/ui/spacing-system.js'
+import { SPACING } from '@/ui/spacing-system.js'
 
 export function renderDashboard(user, stats = {}) {
   const isClerk = user?.role === 'clerk';

package/src/ui/dialog-engine.js

@@ -1,7 +1,7 @@
 import { getConfigEngineSync } from '@/lib/config-generator-engine';
 import { aria, role } from '@/lib/accessibility';
 
-export function renderDialog(dialogId, context = {}) {
+export function renderDialog(dialogId, _context = {}) {
   const config = getConfigEngineSync().getConfig();
   const dialogConfig = config.dialogs?.[dialogId];
 
@@ -10,15 +10,15 @@ export function renderDialog(dialogId, context = {}) {
     return '';
   }
 
-  const { title, fields = [], actions = [], width = '640px', onSubmit } = dialogConfig;
-  const dialogHtml = generateDialogHtml(dialogId, title, fields, actions, width, context, onSubmit);
+  const { title, fields = [], actions = [], width = '640px' } = dialogConfig;
+  const dialogHtml = generateDialogHtml(dialogId, title, fields, actions, width);
 
   return dialogHtml;
 }
 
-function generateDialogHtml(dialogId, title, fields, actions, width, context, onSubmit) {
+function generateDialogHtml(dialogId, title, fields, actions, width) {
   const titleId = `${dialogId}-title`;
-  const fieldHtml = fields.map(f => generateFieldHtml(f, dialogId, context)).join('');
+  const fieldHtml = fields.map(f => generateFieldHtml(f, dialogId)).join('');
   const actionButtons = (actions || []).map(a => {
     if (a.type === 'cancel') {
       return `<button type="button" class="btn btn-ghost btn-sm" ${aria.label('Cancel dialog')} data-action="closeDialog" data-args='["${dialogId}"]'>${a.label || 'Cancel'}</button>`;
@@ -66,8 +66,8 @@ function generateDialogHtml(dialogId, title, fields, actions, width, context, on
   `;
 }
 
-function generateFieldHtml(field, dialogId, context) {
-  const { name, label, type, required, placeholder, options, value } = field;
+function generateFieldHtml(field, dialogId) {
+  const { name, label, type, required, placeholder, options } = field;
   const fieldId = `${dialogId}-${name}`;
   const requiredAttr = required ? 'required' : '';
   const ariaRequired = required ? aria.required() : '';

package/src/ui/engagement-cards.js

@@ -1,4 +1,3 @@
-import { h } from '@/ui/webjsx.js'
 import { STAGE_COLORS, statusLabel, esc, icon } from '@/ui/render-helpers.js'
 import { teamAvatarGroup } from '@/ui/widgets.js'
 import { canEdit } from '@/ui/permissions-ui.js'

package/src/ui/engagement-dialogs.js

@@ -1,6 +1,4 @@
-import { statusLabel } from '@/ui/renderer.js';
 import { createDialog } from '@/ui/dialog-factory.js';
-import { esc } from '@/ui/render-helpers.js';
 
 export function engagementFileSearchDialog(engagementId) {
   const body = `<div class="modal-form-group"><label for="efs-query" class="sr-only">Search files</label><input type="text" id="efs-query" class="input input-bordered w-full" placeholder="Search files..." aria-label="Search engagement files" oninput="efsSearch()"/></div><div id="efs-results" class="flex flex-col gap-2" style="max-height:400px;overflow:auto"></div>`;

package/src/ui/entity-renderer.js

@@ -1,5 +1,4 @@
-import { h } from '@/ui/webjsx.js'
-import { page, confirmDialog, dataTable } from '@/ui/layout.js'
+import { page, dataTable } from '@/ui/layout.js'
 import { fmtVal, TOAST_SCRIPT, esc } from '@/ui/render-helpers.js'
 import { canCreate, canEdit, canDelete } from '@/ui/permissions-ui.js'
 
@@ -7,7 +6,7 @@ export function renderEntityList(entityName, items, spec, user, options = {}) {
   const label = spec?.labelPlural || spec?.label || entityName
   const fields = spec?.fields || {}
   const { groupBy = null } = options
-  let listFields = Object.entries(fields).filter(([k, f]) => f.list).slice(0, 5)
+  let listFields = Object.entries(fields).filter(([, f]) => f.list).slice(0, 5)
   if (!listFields.length) listFields = Object.entries(fields).filter(([k]) => !['created_by', 'updated_by'].includes(k)).slice(0, 6)
   if (!listFields.length && items.length > 0) listFields = Object.keys(items[0]).filter(k => !['created_by', 'updated_by'].includes(k)).slice(0, 5).map(k => [k, { label: k }])
   const headers = listFields.map(([k, f]) => `<th>${esc(f?.label || k)}</th>`).join('') + '<th>Actions</th>'

package/src/ui/event-delegation.js

@@ -260,7 +260,7 @@ const eventDelegation = {
 
   navigate(path) { window.location = path; },
 
-  toggle(elementId, attr = 'checked') {
+  toggle(elementId, _attr = 'checked') {
     const el = document.getElementById(elementId);
     if (el?.type === 'checkbox') el.checked = !el.checked;
     else el.classList.toggle('active');

package/src/ui/file-dialogs.js

@@ -1,5 +1,3 @@
-import { statusLabel } from '@/ui/renderer.js';
-
 // Inline HTML-escape for client-script innerHTML sinks (file names are DB-sourced).
 const FD_ESC = `function fdEsc(s){return String(s==null?'':s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;')}`;
 

package/src/ui/job-management-renderer.js

@@ -1,4 +1,3 @@
-import { statusLabel } from '@/ui/renderer.js';
 import { page } from '@/ui/layout.js';
 import { isPartner } from '@/ui/permissions-ui.js';
 import { STATUS_COLORS, esc } from '@/ui/render-helpers.js';

package/src/ui/layout.js

@@ -1,7 +1,6 @@
 /* eslint-disable no-useless-escape -- this file embeds raw client <script> text inside a template literal; ESLint parses embedded regex escapes like \d as literal template text and misflags them */
-import { h } from '@/ui/webjsx.js'
-import { getNavItems, getAdminItems, isPartner, isClerk } from '@/ui/permissions-ui.js'
-import { TOAST_SCRIPT, AVATAR_COLORS, esc } from '@/ui/render-helpers.js'
+import { isPartner, isClerk } from '@/ui/permissions-ui.js'
+import { AVATAR_COLORS, esc } from '@/ui/render-helpers.js'
 import { FETCH_JSON_SCRIPT } from '@/ui/fetch-json.js'
 import { aria, role, skipLink, liveRegion } from '@/lib/accessibility'
 
@@ -17,7 +16,7 @@ function withAppName(title) {
   return base === appName ? base : `${base} | ${appName}`
 }
 
-export function generateHtml(title, bodyContent, scripts = [], pathname = '/') {
+export function generateHtml(title, bodyContent, scripts = []) {
   title = withAppName(title)
   const scriptTags = scripts.map(s =>
     typeof s === 'string' ? `<script>${s.replace(/<\/script/gi, '<\\/script').replace(/<!--/g, '<\\!--')}</script>` : `<script type="module" src="${s.src}"></script>`

package/src/ui/page-handler-admin.js

@@ -1,7 +1,7 @@
 import { list, get } from '@/lib/busybase/store.js';
-import { renderAuditDashboard, renderSystemHealth, renderAccessDenied, generateHtml, REDIRECT } from '@/ui/renderer.js';
+import { renderAuditDashboard, renderSystemHealth, renderAccessDenied, generateHtml } from '@/ui/renderer.js';
 import { renderSettingsHome, renderSettingsSystem, renderSettingsUsers } from '@/ui/settings/home.js';
-import { renderSettingsTeams, renderSettingsRfiSections } from '@/ui/settings/teams.js';
+import { renderSettingsRfiSections } from '@/ui/settings/teams.js';
 import { renderSettingsTemplates, renderSettingsChecklists, renderSettingsEntityTypes, renderSettingsEngagementTypes, renderSettingsTemplateManage } from '@/ui/settings/templates.js';
 import { renderSettingsNotifications, renderSettingsIntegrations, renderSettingsRecreation, renderSettingsReviewSettings, renderSettingsFileReview, renderSettingsMwrPermissions } from '@/ui/settings/review.js';
 import { renderChecklistsManagement } from '@/ui/checklist-renderer.js';

package/src/ui/page-handler-helpers.js

@@ -1,4 +1,4 @@
-import { list, get, count } from '@/lib/busybase/store.js';
+import { list, count } from '@/lib/busybase/store.js';
 import { createLogger } from '@/lib/logger.js';
 
 const log = createLogger('[PageHandlerHelpers]');
@@ -19,7 +19,7 @@ export function resolveEnumOptions(spec) {
 
 export async function getRefOptions(spec) {
   const refOptions = {};
-  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([k, f]) => f.type === 'ref' && f.ref)) {
+  for (const [fieldKey, field] of Object.entries(spec.fields || {}).filter(([, f]) => f.type === 'ref' && f.ref)) {
     try { refOptions[fieldKey] = (await list(field.ref, {})).map(r => ({ value: r.id, label: r.name || r.title || r.label || r.email || r.id })); }
     catch { refOptions[fieldKey] = []; }
   }
@@ -31,7 +31,7 @@ export async function getRefOptions(spec) {
 // `_display` key exists (falling back to the raw id) without issuing any query.
 export function resolveRefFields(items, spec) {
   try {
-    const refFields = Object.entries(spec.fields || {}).filter(([k, f]) => f.type === 'ref' && f.ref);
+    const refFields = Object.entries(spec.fields || {}).filter(([, f]) => f.type === 'ref' && f.ref);
     if (!refFields.length) return items;
     return items.map(item => {
       const resolved = { ...item };

package/src/ui/page-handler-rfi.js

@@ -1,5 +1,5 @@
 import { list, get } from '@/lib/busybase/store.js';
-import { canView, canList, isClerk, isPartner } from '@/ui/permissions-ui.js';
+import { canView, canList, isClerk } from '@/ui/permissions-ui.js';
 import { renderAccessDenied } from '@/ui/renderer.js';
 import { renderRfiList } from '@/ui/rfi-list-renderer.js';
 import { fileURLToPath } from 'url';

package/src/ui/page-handler.js

@@ -2,7 +2,7 @@ import { getUser, setCurrentRequest } from '@/engine.server.js';
 import { hasGoogleAuth } from '@/config/env.js';
 import { getSpec } from '@/config/spec-helpers.js';
 import { list, get } from '@/lib/busybase/store.js';
-import { renderLogin, renderDashboard, renderEntityList, renderEntityDetail, renderEntityForm, renderAccessDenied, renderPasswordReset, renderPasswordResetConfirm, REDIRECT } from '@/ui/renderer.js';
+import { renderLogin, renderDashboard, renderAccessDenied, renderPasswordReset, renderPasswordResetConfirm, REDIRECT } from '@/ui/renderer.js';
 import { renderClientDashboard, renderClientList } from '@/ui/client-renderer.js';
 import { canList, canView, canCreate, canEdit, isPartner, isClerk, isClientUser, canClientAccessEntity } from '@/ui/permissions-ui.js';
 import { renderEngagementGrid } from '@/ui/engagement-grid-renderer.js';

package/src/ui/permissions-ui.js

@@ -1,16 +1,5 @@
 import { getConfigEngineSync } from '@/lib/config-generator-engine.js';
 
-function getRoleHierarchy() {
-  const config = getConfigEngineSync();
-  const roles = config.getRoles();
-  const hierarchy = {};
-  let level = 0;
-  for (const [roleName] of Object.entries(roles)) {
-    hierarchy[roleName] = level++;
-  }
-  return hierarchy;
-}
-
 function getEntityPermissions() {
   const config = getConfigEngineSync();
   const entityNames = config.getAllEntities();
@@ -40,7 +29,6 @@ function getEntityPermissions() {
 
 export function canAccess(user, entity, action) {
   if (!user?.role) return false;
-  const config = getConfigEngineSync();
   const allPermissions = getEntityPermissions();
   const permissions = allPermissions[entity];
 

package/src/ui/picker-dialogs.js

@@ -1,4 +1,3 @@
-import { h } from '@/ui/webjsx.js'
 import { STAGE_COLORS, TOAST_SCRIPT } from '@/ui/render-helpers.js'
 
 const DIALOG_COLORS = ['#B0B0B0','#44BBA4','#FF4141','#7F7EFF','#3b82f6','#f59e0b','#ec4899','#8b5cf6','#ef4444','#22c55e','#06b6d4','#f97316','#84cc16','#e11d48','#14b8a6','#6366f1']

package/src/ui/review/comparison.js

@@ -2,7 +2,7 @@ import { statusLabel } from '@/ui/renderer.js';
 import { page } from '@/ui/layout.js';
 import { emptyRow, esc } from '../render-helpers.js';
 
-function reviewSummaryPanel(review, highlights, side) {
+function reviewSummaryPanel(review, highlights, _side) {
   const total = highlights.length;
   const resolved = highlights.filter(h => h.status === 'resolved').length;
   const sts = review.status ? statusLabel(review.status) : '';

package/src/ui/review/detail-renderer.js

@@ -2,7 +2,7 @@ import { page } from '@/ui/layout.js';
 import { reviewZoneNav } from '@/ui/review/zone-nav.js';
 export { reviewZoneNav };
 import { canEdit } from '@/ui/permissions-ui.js';
-import { esc, statusBadge, TOAST_SCRIPT, icon } from '@/ui/render-helpers.js';
+import { esc, statusBadge, icon } from '@/ui/render-helpers.js';
 import { reviewDetailScript } from '@/ui/review/detail-script.js';
 import { highlightRow, collaboratorRow, addCollaboratorDialog } from '@/ui/review/detail-panels.js';
 import { tenderPanelHtml, tenderDialog, linksPanelHtml, linkDialog, sectionsPanelHtml, compareDialogHtml } from '@/ui/review-detail-panels-extra.js';

package/src/ui/review/mwr.js

@@ -1,6 +1,6 @@
 import { page } from '@/ui/layout.js';
 import { reviewZoneNav } from '@/ui/review/zone-nav.js';
-import { SPACING, renderCard, renderButton, renderProgress, renderEmptyState, renderStatsRow, renderPageHeader } from '@/ui/spacing-system.js';
+import { SPACING, renderCard, renderButton, renderEmptyState, renderStatsRow, renderPageHeader } from '@/ui/spacing-system.js';
 import { icon, esc } from '@/ui/format-helpers.js';
 import { TOAST_SCRIPT } from '@/ui/render-helpers.js';
 

package/src/ui/review/widgets.js

@@ -1,4 +1,3 @@
-import { h } from '@/ui/webjsx.js'
 import { statusLabel, TOAST_SCRIPT, esc } from '@/ui/render-helpers.js'
 import { teamAvatarGroup } from '@/ui/widgets.js'
 

package/src/ui/rfi-detail-renderer.js

@@ -1,6 +1,6 @@
 import { page } from '@/ui/layout.js';
 import { canEdit, isPartner, isManager, isClientUser } from '@/ui/permissions-ui.js';
-import { esc, statusBadge, TOAST_SCRIPT, emptyRow } from '@/ui/render-helpers.js';
+import { esc, statusBadge, TOAST_SCRIPT } from '@/ui/render-helpers.js';
 import { SPACING } from '@/ui/spacing-system.js';
 
 const TOAST = TOAST_SCRIPT;

package/src/ui/settings/home.js

@@ -22,7 +22,7 @@ const SETTINGS_CARDS = [
   { key: 'permissions', icon: 'lock', title: 'Permissions', desc: 'MWR permissions and access control', href: '/admin/settings/permissions' },
 ];
 
-export function renderSettingsHome(user, config = {}, counts = {}) {
+export function renderSettingsHome(user, _config = {}, counts = {}) {
   const cards = SETTINGS_CARDS.map(c => {
     const cnt = c.countKey && counts[c.countKey] !== undefined ? counts[c.countKey] : null;
     const badge = cnt !== null ? `<span class="badge badge-flat-primary text-xs">${cnt.toLocaleString('en-ZA')} items</span>` : '';

package/src/ui/settings/review.js

@@ -181,7 +181,6 @@ export function renderSettingsFileReview(user, config = {}, frSettings = {}) {
   const fr = config.fileReview || {};
   const reviewFlags = frSettings.review_flags || [];
   const tenderFlags = frSettings.tender_flags || [];
-  const flagManagers = frSettings.flags_managers || [];
   const tempAccess = frSettings.temp_review_access_period || 0;
   const toggles = [
     { id: 'auto_pdf_cache', label: 'Auto-cache PDFs', desc: 'Cache PDF files for faster loading', checked: fr.auto_pdf_cache !== false },

package/src/ui/settings/teams.js

@@ -12,7 +12,7 @@ function parseMembers(t) {
   } catch { return []; }
 }
 
-export function renderSettingsTeams(user, teams = [], allUsers = []) {
+export function renderSettingsTeams(user, teams = [], _allUsers = []) {
   const editDialog = `<div id="team-dialog" class="modal" style="display:none" role="dialog" aria-modal="true" aria-labelledby="team-dialog-title">
     <div class="modal-overlay" data-dialog-close="team-dialog"></div>
     <div class="modal-content rounded-box max-w-md p-6">

package/src/ui/spacing-system.js

@@ -93,7 +93,7 @@ export function renderButton(label, opts = {}) {
   return `<button type="button"${onclickAttr} class="${btnClass}" ${disabled ? 'disabled' : ''} style="${extraStyle}">${label}</button>`;
 }
 
-export function renderProgress(value, max = 100, variant = 'success', marginTop = SPACING.md) {
+export function renderProgress(value, max = 100, _variant = 'success', marginTop = SPACING.md) {
   const pct = max > 0 ? Math.round((value / max) * 100) : 0;
   return `<div style="margin-top:${typeof marginTop === 'string' ? marginTop : SPACING.md}">
     <div style="display:flex;justify-content:space-between;margin-bottom:${SPACING.sm};align-items:center">