thatcher 1.0.46 → 1.0.48

package/README.md

@@ -194,7 +194,7 @@ Each entity derives from config:
 | Config Key | Purpose |
 |-----------|---------|
 | `fields` | Column definitions (type, required, ref, enum, etc.) |
-| `permission_template` | Maps roles → allowed actions |
+| `permission_template` | Maps roles -> allowed actions |
 | `workflow` | State machine name for lifecycle |
 | `row_access` | Scoping: `team`, `assigned`, `client` |
 | `list.defaultSort` | Default list ordering |
@@ -342,30 +342,30 @@ Use via `@/lib/email-sender` (included).
 All APIs accessible via thatcher instance:
 
 ### CRUD
-- `thatcher.list(entity, where, opts)` → Array
-- `thatcher.get(entity, id)` → object
-- `thatcher.create(entity, data, user)` → object
-- `thatcher.update(entity, id, data, user)` → object
-- `thatcher.delete(entity, id)` → void
+- `thatcher.list(entity, where, opts)` -> Array
+- `thatcher.get(entity, id)` -> object
+- `thatcher.create(entity, data, user)` -> object
+- `thatcher.update(entity, id, data, user)` -> object
+- `thatcher.delete(entity, id)` -> void
 
 ### Search
-- `thatcher.search(entity, query, where, opts)` → Array (uses FTS)
+- `thatcher.search(entity, query, where, opts)` -> Array (uses FTS)
 
 ### Workflow
-- `thatcher.transition(entityType, entityId, workflowName, toState, user, reason)` → object
-- `thatcher.getAvailableTransitions(workflowName, currentState, user, record)` → Array
+- `thatcher.transition(entityType, entityId, workflowName, toState, user, reason)` -> object
+- `thatcher.getAvailableTransitions(workflowName, currentState, user, record)` -> Array
 
 ### AuthZ
-- `thatcher.can(user, spec, action)` → boolean
-- `thatcher.requirePermission(user, spec, action)` → throws if denied
+- `thatcher.can(user, spec, action)` -> boolean
+- `thatcher.requirePermission(user, spec, action)` -> throws if denied
 
 ### Config
-- `thatcher.getConfigEngine()` → ConfigGeneratorEngine
-- `thatcher.getEntitySpec(entityName)` → spec object
-- `thatcher.getAllEntities()` → Array<string>
+- `thatcher.getConfigEngine()` -> ConfigGeneratorEngine
+- `thatcher.getEntitySpec(entityName)` -> spec object
+- `thatcher.getAllEntities()` -> Array<string>
 
 ### Direct DB
-- `thatcher.withTransaction(cb)` → Promise<result>
+- `thatcher.withTransaction(cb)` -> Promise<result>
 
 ## Environment Variables
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.46",
+  "version": "1.0.48",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/cli.js

@@ -100,20 +100,16 @@ async function startRepl() {
   const thatcher = new Thatcher({});
   await thatcher.init();
 
-  // Expose thatcher in REPL context
-  const context = {
-    thatcher,
-    create: async (entity, data, user) => thatcher.create(entity, data, user),
-    get: async (entity, id) => thatcher.get(entity, id),
-    list: async (entity, where) => thatcher.list(entity, where),
-    update: async (entity, id, data, user) => thatcher.update(entity, id, data, user),
-    remove: async (entity, id) => thatcher.delete(entity, id),
-    search: async (entity, q, where) => thatcher.search(entity, q, where),
-    transition: async (entityType, entityId, wf, toState, user, reason) =>
-      thatcher.transition(entityType, entityId, wf, toState, user, reason),
-    config: thatcher.config,
-    entities: thatcher.getAllEntities(),
-  };
+  const create = async (entity, data, user) => thatcher.create(entity, data, user);
+  const get = async (entity, id) => thatcher.get(entity, id);
+  const list = async (entity, where) => thatcher.list(entity, where);
+  const update = async (entity, id, data, user) => thatcher.update(entity, id, data, user);
+  const remove = async (entity, id) => thatcher.delete(entity, id);
+  const search = async (entity, q, where) => thatcher.search(entity, q, where);
+  const transition = async (entityType, entityId, wf, toState, user, reason) =>
+    thatcher.transition(entityType, entityId, wf, toState, user, reason);
+  const config = thatcher.config;
+  const entities = thatcher.getAllEntities();
 
   rl.prompt();
 

package/src/config/config-loader.js

@@ -14,7 +14,7 @@ export async function loadConfig(configSource) {
     }
     const content = fs.readFileSync(configPath, 'utf-8');
     config = yamlLoad(content);
-  } else if (typeof configSource === 'object') {
+  } else if (typeof configSource === 'object' && configSource !== null) {
     config = configSource;
   } else {
     throw new Error('Config must be a file path or object');

package/src/index.js

@@ -84,7 +84,7 @@ export class Thatcher {
       const content = fs.readFileSync(configPath, 'utf-8');
       const { load: yamlLoad } = await import('js-yaml');
       masterConfig = yamlLoad(content);
-    } else if (typeof config === 'object') {
+    } else if (typeof config === 'object' && config !== null) {
       masterConfig = config;
     } else {
       // Auto-discover

package/src/lib/busybase/store.js

@@ -203,13 +203,17 @@ export async function count(entity, where = {}, options = {}) {
   const tbl = tableName(entity);
   let rows = unwrap(await applyWhere(client().from(tbl).select('*'), where), 'count');
   rows = applyVisibility(spec, rows, where, options);
+  if (options.user && (spec.rowAccess || spec.row_access)) {
+    const { permissionService } = await import('../services/permission.service.js');
+    rows = permissionService.filterRecords(options.user, spec, rows);
+  }
   return rows.length;
 }
 
-export async function listWithPagination(entity, where = {}, page = 1, pageSize = 50) {
+export async function listWithPagination(entity, where = {}, page = 1, pageSize = 50, options = {}) {
   const finalPage = Math.max(1, page);
-  const total = await count(entity, where);
-  const items = await list(entity, where, { offset: (finalPage - 1) * pageSize, limit: pageSize });
+  const total = await count(entity, where, options);
+  const items = await list(entity, where, { ...options, offset: (finalPage - 1) * pageSize, limit: pageSize });
   return { items, pagination: { page: finalPage, pageSize, total, totalPages: Math.ceil(total / pageSize) } };
 }
 
@@ -337,11 +341,11 @@ export async function search(entity, query, where = {}, options = {}) {
   return matched;
 }
 
-export async function searchWithPagination(entity, query, where = {}, page = 1, pageSize = null) {
+export async function searchWithPagination(entity, query, where = {}, page = 1, pageSize = null, options = {}) {
   const spec = specOf(entity);
   const finalPageSize = pageSize || spec.list?.pageSize || 50;
   const finalPage = Math.max(1, page);
-  const all = await search(entity, query, where);
+  const all = await search(entity, query, where, options);
   const total = all.length;
   const items = all.slice((finalPage - 1) * finalPageSize, finalPage * finalPageSize);
   return { items, pagination: { page: finalPage, pageSize: finalPageSize, total, totalPages: Math.ceil(total / finalPageSize) } };

package/src/lib/crud-handlers.js

@@ -43,7 +43,7 @@ export function createCrudHandlers(entityName, spec) {
       let items, pagination;
 
       if (q) {
-        const result = await searchWithPagination(entityName, q, {}, finalPage, finalPageSize);
+        const result = await searchWithPagination(entityName, q, {}, finalPage, finalPageSize, { user });
         items = result.items;
         pagination = result.pagination;
       } else {
@@ -54,7 +54,7 @@ export function createCrudHandlers(entityName, spec) {
             coercedFilters[key] = fd ? coerceFieldValue(value, fd.type) : value;
           }
         }
-        const result = await listWithPagination(entityName, coercedFilters, finalPage, finalPageSize);
+        const result = await listWithPagination(entityName, coercedFilters, finalPage, finalPageSize, { user });
         items = result.items;
         pagination = result.pagination;
       }
@@ -200,7 +200,7 @@ export function createCrudHandlers(entityName, spec) {
           id,
           data: { id, uploaded_files: files },
           user,
-        });
+        }).catch(e => log.error(e.message));
         return ok({ id, uploaded_files: files });
       }
 

package/src/server/server.js

@@ -3,6 +3,31 @@ import path from 'path';
 import fs from 'fs';
 import { fileURLToPath } from 'url';
 import { createLogger } from '../lib/logger.js';
+import { getLucia } from '../engine.server.js';
+import { requirePermission } from '../lib/auth-middleware.js';
+
+// Request-scoped session resolution: NOT engine.server.js's getUser(), which
+// reads a module-level _currentRequest global -- unsafe here since this raw
+// http server handles requests concurrently and that global would let one
+// in-flight request's cookie leak into another's session lookup mid-await.
+// getLucia() itself holds no per-request state, so calling it directly per
+// request and validating against this request's own cookie header is safe.
+async function resolveRequestUser(req) {
+  let lucia;
+  try { lucia = getLucia(); } catch { return null; }
+  const cookieHeader = req.headers?.cookie || '';
+  if (!cookieHeader) return null;
+  const cookieName = lucia.sessionCookieName || 'thatcher_session';
+  const match = cookieHeader.split(';').find(c => c.trim().startsWith(cookieName + '='));
+  if (!match) return null;
+  const sessionId = decodeURIComponent(match.split('=')[1] || '');
+  if (!sessionId) return null;
+  try {
+    const { user, session } = await lucia.validateSession(sessionId);
+    if (!user || !session) return null;
+    return user;
+  } catch { return null; }
+}
 
 const log = createLogger('[Server]');
 const pageLog = createLogger('[Page]');
@@ -203,11 +228,12 @@ async function sendResponse(res, response) {
 }
 
 async function handleGenericCrud(req, res, entity, id, action, thatcher, configEngineArg) {
-  // Simple auth: get from cookie or header
-  let user = null;
-  // In a real implementation, we'd decode session token
-  // For now, default to system user for testing
-  user = { id: 'system', role: 'admin' };
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
 
   // Prefer the engine passed down from createServer options (guaranteed the
   // same instance that was initialized at startup); fall back to thatcher /
@@ -217,15 +243,23 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
     configEngine = getConfigEngineSync();
   }
+  let spec;
   try {
-    configEngine.generateEntitySpec(entity);
+    spec = configEngine.generateEntitySpec(entity);
   } catch (e) {
     res.writeHead(404);
     res.end(JSON.stringify({ error: `Entity '${entity}' not found` }));
     return;
   }
 
-  // Permission check would go here via thatcher.can(user, spec, action)
+  const methodAction = { GET: 'list', POST: 'create', PUT: 'edit', PATCH: 'edit', DELETE: 'delete' }[req.method] || 'view';
+  try {
+    await requirePermission(user, spec, id && req.method === 'GET' ? 'view' : methodAction);
+  } catch (e) {
+    res.writeHead(e?.status || 403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: e?.message || 'Forbidden' }));
+    return;
+  }
 
   let body;
   try {
@@ -250,7 +284,7 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
             return;
           }
         } else {
-          result = await thatcher.list(entity);
+          result = await thatcher.list(entity, {}, { user });
         }
         break;
 

package/src/services/permission.service.js

@@ -47,12 +47,12 @@ class PermissionService {
       return false;
     }
 
-    if (scope === 'assigned' && record[ownerField] && record[ownerField] !== user.id && user.role !== partnerRole) {
+    if (scope === 'assigned' && user.role !== partnerRole && record[ownerField] !== user.id) {
       return false;
     }
 
     if (scope === 'assigned_or_team' && user.role !== partnerRole) {
-      const assignedMatch = record[ownerField] && record[ownerField] === user.id;
+      const assignedMatch = record[ownerField] === user.id;
       const teamMatch = record.team_id && user.team_id && record.team_id === user.team_id;
       if (!assignedMatch && !teamMatch) return false;
     }

package/src/lib/compression.js

@@ -1,44 +0,0 @@
-import zlib from 'zlib';
-
-const COMPRESSION_THRESHOLD = 1024; // Only compress files >1KB
-
-export function compress(content, acceptEncoding = '') {
-  const size = Buffer.byteLength(content, 'utf-8');
-  if (size < COMPRESSION_THRESHOLD) return { content, encoding: null };
-  
-  const ae = acceptEncoding.toLowerCase();
-  
-  if (ae.includes('br')) {
-    const compressed = zlib.brotliCompressSync(content, {
-      params: {
-        [zlib.constants.BROTLI_PARAM_QUALITY]: 6,
-        [zlib.constants.BROTLI_PARAM_SIZE_HINT]: size
-      }
-    });
-    return { content: compressed, encoding: 'br' };
-  }
-  
-  if (ae.includes('gzip')) {
-    const compressed = zlib.gzipSync(content, { level: 6 });
-    return { content: compressed, encoding: 'gzip' };
-  }
-  
-  return { content, encoding: null };
-}
-
-export function getCacheHeaders(type, maxAge = 86400) {
-  if (type === 'static') {
-    return {
-      'Cache-Control': `public, max-age=${maxAge}, immutable`,
-      'Expires': new Date(Date.now() + maxAge * 1000).toUTCString()
-    };
-  }
-  if (type === 'dynamic') {
-    return {
-      'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
-      'Pragma': 'no-cache',
-      'Expires': '0'
-    };
-  }
-  return {};
-}

package/src/lib/route-resolver.js

@@ -1,160 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-export function resolveParamRoute(baseDir, segments) {
-  if (!fs.existsSync(baseDir)) return null;
-  if (segments.length === 0) {
-    const r = path.join(baseDir, 'route.js');
-    return fs.existsSync(r) ? r : null;
-  }
-  const [seg, ...rest] = segments;
-  const entries = fs.readdirSync(baseDir, { withFileTypes: true }).filter(e => e.isDirectory());
-  for (const entry of entries) {
-    const name = entry.name;
-    if (name === seg || name.startsWith('[')) {
-      const found = resolveParamRoute(path.join(baseDir, name), rest);
-      if (found) return found;
-    }
-  }
-  return null;
-}
-
-export function resolveSpecificParams(routeFile, pathParts) {
-  const result = {};
-  const routeRelative = routeFile.replace(/.*src\/app\/api\//, '').replace(/\/route\.js$/, '');
-  const routeSegments = routeRelative.split('/');
-  const urlSegments = pathParts.slice(0);
-  for (let i = 0; i < routeSegments.length && i < urlSegments.length; i++) {
-    const seg = routeSegments[i];
-    if (seg.startsWith('[') && seg.endsWith(']')) {
-      const paramName = seg.replace(/^\[\.\.\./, '').replace(/[[\]]/g, '');
-      result[paramName] = urlSegments[i];
-    }
-  }
-  return result;
-}
-
-function singularize(name) {
-  if (name.endsWith('ies')) return name.slice(0, -3) + 'y';
-  if (name.endsWith('ses') || name.endsWith('xes') || name.endsWith('zes')) return name.slice(0, -2);
-  if (name.endsWith('s') && !name.endsWith('ss')) return name.slice(0, -1);
-  return name;
-}
-
-export function buildNestedRoutePath(baseDir, domain, parentEntity, childParts) {
-  if (childParts.length === 0) return null;
-
-  function buildSegments(parentParam, childParamFn) {
-    const segs = [domain, parentEntity, parentParam];
-    for (let i = 0; i < childParts.length; i++) {
-      if (i % 2 === 0) segs.push(childParts[i]);
-      else segs.push(childParamFn(i));
-    }
-    return path.join(baseDir, 'src/app/api', ...segs, 'route.js');
-  }
-
-  const variants = [
-    () => buildSegments('[id]', (i) => `[${childParts[i - 1]}Id]`),
-    () => buildSegments('[id]', (i) => `[${singularize(childParts[i - 1])}Id]`),
-    () => buildSegments(`[${parentEntity}Id]`, (i) => `[${childParts[i - 1]}Id]`),
-    () => buildSegments(`[${parentEntity}Id]`, (i) => `[${singularize(childParts[i - 1])}Id]`),
-    () => buildSegments('[id]', () => `[${childParts[0]}Id]`),
-    () => buildSegments('[id]', () => `[${singularize(childParts[0])}Id]`),
-  ];
-
-  // Also try a "leaf-action" shape with no further id after the child segment.
-  // Routes like /mwr/review/[id]/export-pdf/route.js (parent + id + leaf action)
-  // were missed by the segment-pair variants above.
-  if (childParts.length === 1) {
-    const leaf = path.join(baseDir, 'src/app/api', domain, parentEntity, '[id]', childParts[0], 'route.js');
-    if (fs.existsSync(leaf)) return leaf;
-    const leafByEntity = path.join(baseDir, 'src/app/api', domain, parentEntity, `[${parentEntity}Id]`, childParts[0], 'route.js');
-    if (fs.existsSync(leafByEntity)) return leafByEntity;
-  }
-
-  for (const variant of variants) {
-    const candidate = variant();
-    if (fs.existsSync(candidate)) return candidate;
-  }
-  return variants[0]();
-}
-
-const DOMAINS = ['friday', 'mwr'];
-
-export function resolveRoute(__dirname, pathname, url) {
-  const pathParts = pathname.slice(5).split('/').filter(Boolean);
-
-  // Reject any '..' or '.' segment before it can reach a filesystem path
-  // join or a dynamic import -- otherwise a crafted URL can traverse out of
-  // src/app/api into arbitrary files on disk.
-  if (pathParts.some(seg => seg === '..' || seg === '.')) {
-    return { routeFile: null, params: {}, isDomain: false, firstPart: pathParts[0], pathParts };
-  }
-
-  const firstPart = pathParts[0];
-  const isDomain = DOMAINS.includes(firstPart);
-  let routeFile = null;
-  let params = {};
-
-  if (isDomain) {
-    const domain = firstPart;
-    const domainParts = pathParts.slice(1);
-
-    const specificCheck = path.join(__dirname, `src/app/api/${domain}/${domainParts.join('/')}/route.js`);
-    if (fs.existsSync(specificCheck)) {
-      routeFile = specificCheck;
-      params = resolveSpecificParams(specificCheck, pathParts);
-    }
-
-    if (!routeFile && domainParts.length >= 3) {
-      const parentEntity = domainParts[0];
-      const childParts = domainParts.slice(2);
-      const parentId = domainParts[1];
-      const childEntity = childParts[0];
-      const childId = childParts[1] || null;
-
-      const nestedSpecific = buildNestedRoutePath(__dirname, domain, parentEntity, childParts);
-      if (nestedSpecific && fs.existsSync(nestedSpecific)) {
-        routeFile = nestedSpecific;
-        params = resolveSpecificParams(nestedSpecific, pathParts);
-      }
-
-      if (!routeFile) {
-        routeFile = path.join(__dirname, 'src/app/api/[entity]/[[...path]]/route.js');
-        url.searchParams.set('domain', domain);
-        params = { entity: childEntity, path: childId ? [childId] : [], parentEntity, parentId };
-      }
-    }
-
-    if (!routeFile && domainParts.length >= 1) {
-      const entity = domainParts[0];
-      const entityPath = domainParts.slice(1);
-      routeFile = path.join(__dirname, 'src/app/api/[entity]/[[...path]]/route.js');
-      url.searchParams.set('domain', domain);
-      params = { entity, path: entityPath };
-    }
-  }
-
-  if (!routeFile && firstPart) {
-    const exactRoute = path.join(__dirname, `src/app/api/${pathParts.join('/')}/route.js`);
-    if (fs.existsSync(exactRoute)) {
-      routeFile = exactRoute;
-      params = resolveSpecificParams(exactRoute, pathParts);
-    }
-  }
-
-  if (!routeFile && firstPart) {
-    const paramRouteFile = resolveParamRoute(path.join(__dirname, 'src/app/api', firstPart), pathParts.slice(1));
-    if (paramRouteFile) {
-      routeFile = paramRouteFile;
-      params = resolveSpecificParams(paramRouteFile, pathParts);
-    }
-  }
-
-  if (!routeFile) {
-    routeFile = path.join(__dirname, 'src/app/api/[entity]/[[...path]]/route.js');
-    params = { entity: firstPart, path: pathParts.slice(1) };
-  }
-
-  return { routeFile, params, isDomain, firstPart, pathParts };
-}

package/src/lib/state-protocol.js

@@ -1,184 +0,0 @@
-// state-sync channel: message-type vocabulary + VectorClock + schema validation
-// shared by state-transport-server.js / state-transport-client.js /
-// state-transport-reconnect.js. This is a structured, reconnect-aware
-// WebSocket protocol (real `ws` transport, IP/rate-limited via
-// connection-guard.js, exponential-backoff client reconnect with a polling
-// fallback) -- distinct from the simpler in-process pub/sub in
-// realtime-server.js (the "ws-broadcast" channel actually wired into the CRUD
-// write path via src/lib/api.js). As of this writing, grepping the whole repo
-// found ZERO importers of this quartet outside their own internal cross-imports
-// (state-transport-client.js imports state-transport-reconnect.js; both import
-// this file) -- nothing external constructs a StateTransportServer/Client, so
-// this stack is currently unwired/dormant rather than superseding
-// realtime-server.js. Keep both; re-check importers before deleting either.
-const MESSAGE_TYPES = {
-  STATE_UPDATE: 'state_update',
-  STATE_SNAPSHOT: 'state_snapshot',
-  STATE_REQUEST: 'state_request',
-  STATE_ACK: 'state_ack',
-  STATE_NACK: 'state_nack',
-  PING: 'ping',
-  PONG: 'pong'
-}
-
-const ERROR_CODES = {
-  INVALID_MESSAGE: 'invalid_message',
-  INVALID_VERSION: 'invalid_version',
-  CONFLICT_DETECTED: 'conflict_detected',
-  RATE_LIMITED: 'rate_limited',
-  VALIDATION_FAILED: 'validation_failed'
-}
-
-class VectorClock {
-  constructor(nodeId) {
-    this.nodeId = nodeId
-    this.clock = { [nodeId]: 0 }
-  }
-
-  increment() {
-    this.clock[this.nodeId] = (this.clock[this.nodeId] || 0) + 1
-    return this.clock[this.nodeId]
-  }
-
-  update(otherClock) {
-    for (const [nodeId, timestamp] of Object.entries(otherClock)) {
-      this.clock[nodeId] = Math.max(this.clock[nodeId] || 0, timestamp)
-    }
-  }
-
-  compare(otherClock) {
-    const keys = new Set([...Object.keys(this.clock), ...Object.keys(otherClock)])
-    let hasGreater = false
-    let hasLess = false
-
-    for (const key of keys) {
-      const mine = this.clock[key] || 0
-      const theirs = otherClock[key] || 0
-      if (mine > theirs) hasGreater = true
-      if (mine < theirs) hasLess = true
-    }
-
-    if (hasGreater && !hasLess) return 1
-    if (hasLess && !hasGreater) return -1
-    if (!hasGreater && !hasLess) return 0
-    return null // Concurrent
-  }
-
-  serialize() {
-    return { ...this.clock }
-  }
-
-  static deserialize(data, nodeId) {
-    const vc = new VectorClock(nodeId)
-    vc.clock = { ...data }
-    return vc
-  }
-}
-
-const MessageSchema = {
-  validate(message) {
-    if (!message || typeof message !== 'object') {
-      return { valid: false, error: 'Message must be an object' }
-    }
-    const validTypes = Object.values(MESSAGE_TYPES)
-    if (!validTypes.includes(message.type)) {
-      return { valid: false, error: 'Invalid message type' }
-    }
-    if (message.type !== MESSAGE_TYPES.PING && message.type !== MESSAGE_TYPES.PONG) {
-      if (!message.version || typeof message.version !== 'object') {
-        return { valid: false, error: 'Missing or invalid version vector' }
-      }
-    }
-    if (message.type === MESSAGE_TYPES.STATE_UPDATE || message.type === MESSAGE_TYPES.STATE_SNAPSHOT) {
-      if (message.data === undefined) {
-        return { valid: false, error: 'Missing data field' }
-      }
-    }
-    return { valid: true }
-  }
-}
-
-function createMessage(type, payload = {}) {
-  return {
-    type,
-    timestamp: Date.now(),
-    ...payload
-  }
-}
-
-function createStateUpdate(vectorClock, data, operations = []) {
-  return createMessage(MESSAGE_TYPES.STATE_UPDATE, {
-    version: vectorClock.serialize(),
-    data,
-    operations
-  })
-}
-
-function createStateSnapshot(vectorClock, data) {
-  return createMessage(MESSAGE_TYPES.STATE_SNAPSHOT, {
-    version: vectorClock.serialize(),
-    data
-  })
-}
-
-function createStateRequest(vectorClock) {
-  return createMessage(MESSAGE_TYPES.STATE_REQUEST, {
-    version: vectorClock.serialize()
-  })
-}
-
-function createStateAck(messageId, vectorClock) {
-  return createMessage(MESSAGE_TYPES.STATE_ACK, {
-    messageId,
-    version: vectorClock.serialize()
-  })
-}
-
-function createStateNack(messageId, error, errorCode) {
-  return createMessage(MESSAGE_TYPES.STATE_NACK, {
-    messageId,
-    error,
-    errorCode
-  })
-}
-
-function createPing() {
-  return createMessage(MESSAGE_TYPES.PING)
-}
-
-function createPong(pingTimestamp) {
-  return createMessage(MESSAGE_TYPES.PONG, { pingTimestamp })
-}
-
-const Protocol = {
-  MESSAGE_TYPES,
-  ERROR_CODES,
-  VectorClock,
-  MessageSchema,
-  createMessage,
-  createStateUpdate,
-  createStateSnapshot,
-  createStateRequest,
-  createStateAck,
-  createStateNack,
-  createPing,
-  createPong
-}
-
-export {
-  MESSAGE_TYPES,
-  ERROR_CODES,
-  VectorClock,
-  MessageSchema,
-  createMessage,
-  createStateUpdate,
-  createStateSnapshot,
-  createStateRequest,
-  createStateAck,
-  createStateNack,
-  createPing,
-  createPong,
-  Protocol
-}
-
-export default Protocol

package/src/lib/state-transport-client.js

@@ -1,178 +0,0 @@
-// state-sync channel (client side): browser WebSocket client with
-// exponential-backoff reconnect + polling fallback, part of the
-// state-protocol.js quartet. See the header comment in state-protocol.js --
-// this is a structured, reconnect-aware protocol distinct from
-// realtime-server.js's simple in-process pub/sub. Zero real importers found
-// repo-wide as of this writing; currently dormant/unwired.
-import Protocol from './state-protocol.js'
-import { CONFIG, ReconnectManager } from './state-transport-reconnect.js'
-import { createLogger } from './logger.js'
-
-const log = createLogger('[StateTransport]')
-
-class StateTransportClient {
-  constructor(config = {}) {
-    this.config = { ...CONFIG, ...config }
-    this.ws = null
-    this.state = 'disconnected'
-    this.listeners = new Map()
-    this.messageQueue = []
-    this.connectionTimeoutTimer = null
-
-    this.reconnect = new ReconnectManager(this.config, {
-      onReconnecting: (data) => { this.emit('reconnecting', data); this.connect() },
-      onFallback: (msg) => this.emit('fallback', msg),
-      onPollStart: () => this.emit('poll_start'),
-      onPollSuccess: (result) => this.emit('poll_success', result),
-      onPollError: (error) => this.emit('poll_error', error)
-    })
-  }
-
-  connect(url) {
-    this.url = url || this.url
-    if (!this.url) {
-      this.emit('error', new Error('No URL provided for connection'))
-      return
-    }
-    this.reconnect.wsUrl = this.url
-
-    if (this.state === 'connecting' || this.state === 'connected') return
-
-    this.state = 'connecting'
-    this.emit('connecting')
-
-    try {
-      this.ws = new WebSocket(this.url)
-
-      this.connectionTimeoutTimer = setTimeout(() => {
-        if (this.state === 'connecting') this.handleConnectionTimeout()
-      }, this.config.connectionTimeout)
-
-      this.ws.onopen = () => this.handleOpen()
-      this.ws.onclose = (event) => this.handleClose(event)
-      this.ws.onerror = (error) => this.handleError(error)
-      this.ws.onmessage = (event) => this.handleMessage(event)
-    } catch (error) {
-      this.handleConnectionFailure(error)
-    }
-  }
-
-  handleOpen() {
-    clearTimeout(this.connectionTimeoutTimer)
-    this.state = 'connected'
-    this.reconnect.resetAttempts()
-    this.emit('connected')
-    this.reconnect.startPingInterval(
-      (msg) => this.send(msg),
-      () => this.ws.close()
-    )
-    this.flushMessageQueue()
-    this.reconnect.stopPolling()
-  }
-
-  handleClose(event) {
-    clearTimeout(this.connectionTimeoutTimer)
-    this.state = 'disconnected'
-    this.reconnect.stopPingInterval()
-    this.emit('disconnected', { code: event.code, reason: event.reason })
-    this.reconnect.scheduleReconnect()
-  }
-
-  handleError(error) {
-    this.emit('error', error)
-  }
-
-  handleConnectionTimeout() {
-    if (this.ws) this.ws.close()
-    this.handleConnectionFailure(new Error('Connection timeout'))
-  }
-
-  handleConnectionFailure(error) {
-    this.emit('error', error)
-    this.state = 'disconnected'
-
-    if (this.reconnect.shouldFallback) {
-      this.reconnect.activateFallback()
-    } else {
-      this.reconnect.scheduleReconnect()
-    }
-  }
-
-  handleMessage(event) {
-    try {
-      const message = JSON.parse(event.data)
-      if (message.type === Protocol.MESSAGE_TYPES.PONG) {
-        this.reconnect.recordPong()
-        return
-      }
-      this.emit('message', message)
-    } catch (error) {
-      this.emit('error', { error, phase: 'message_parsing', data: event.data })
-    }
-  }
-
-  send(message) {
-    if (this.state === 'connected' && this.ws && this.ws.readyState === WebSocket.OPEN) {
-      try {
-        this.ws.send(JSON.stringify(message))
-        return true
-      } catch (error) {
-        this.emit('error', { error, phase: 'send' })
-        this.messageQueue.push(message)
-        return false
-      }
-    }
-    this.messageQueue.push(message)
-    return false
-  }
-
-  flushMessageQueue() {
-    while (this.messageQueue.length > 0 && this.state === 'connected') {
-      const message = this.messageQueue.shift()
-      this.send(message)
-    }
-  }
-
-  disconnect() {
-    this.reconnect.cleanup()
-    if (this.ws) {
-      this.ws.close()
-      this.ws = null
-    }
-    this.state = 'disconnected'
-  }
-
-  on(event, handler) {
-    if (!this.listeners.has(event)) this.listeners.set(event, [])
-    this.listeners.get(event).push(handler)
-  }
-
-  off(event, handler) {
-    if (!this.listeners.has(event)) return
-    const handlers = this.listeners.get(event)
-    const index = handlers.indexOf(handler)
-    if (index > -1) handlers.splice(index, 1)
-  }
-
-  emit(event, data) {
-    if (!this.listeners.has(event)) return
-    for (const handler of this.listeners.get(event)) {
-      try {
-        handler(data)
-      } catch (error) {
-        log.error(`event handler error for ${event}:`, { message: error?.message || String(error) })
-      }
-    }
-  }
-
-  getState() {
-    return this.state
-  }
-
-  isConnected() {
-    return this.state === 'connected'
-  }
-}
-
-export { StateTransportClient }
-export default StateTransportClient

package/src/lib/state-transport-reconnect.js

@@ -1,126 +0,0 @@
-// state-sync channel (reconnect logic): exponential-backoff + polling-fallback
-// manager consumed by state-transport-client.js, part of the state-protocol.js
-// quartet. See the header comment in state-protocol.js for the full
-// ws-broadcast vs state-sync distinction. Zero real importers repo-wide
-// outside this quartet's own internal cross-imports as of this writing.
-import Protocol from './state-protocol.js'
-
-const CONFIG = {
-  reconnectInitialDelay: 1000,
-  reconnectMaxDelay: 30000,
-  reconnectBackoffFactor: 2,
-  pingInterval: 25000,
-  connectionTimeout: 10000,
-  pollingInterval: 5000,
-  pollingFallbackDelay: 3000
-}
-
-class ReconnectManager {
-  constructor(config, callbacks) {
-    this.config = config
-    this.callbacks = callbacks
-    this.reconnectAttempts = 0
-    this.reconnectTimer = null
-    this.pingTimer = null
-    this.pollingTimer = null
-    this.lastPongTime = 0
-    this.useFallback = false
-    this.wsUrl = null
-  }
-
-  get shouldFallback() {
-    return this.reconnectAttempts >= 3 && !this.useFallback
-  }
-
-  resetAttempts() {
-    this.reconnectAttempts = 0
-    this.useFallback = false
-  }
-
-  recordPong() {
-    this.lastPongTime = Date.now()
-  }
-
-  scheduleReconnect() {
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer)
-    }
-
-    const delay = Math.min(
-      this.config.reconnectInitialDelay * Math.pow(this.config.reconnectBackoffFactor, this.reconnectAttempts),
-      this.config.reconnectMaxDelay
-    )
-
-    const jitter = Math.random() * 1000
-    this.reconnectAttempts++
-
-    this.reconnectTimer = setTimeout(() => {
-      this.callbacks.onReconnecting({ attempt: this.reconnectAttempts })
-    }, delay + jitter)
-  }
-
-  activateFallback() {
-    this.useFallback = true
-    this.callbacks.onFallback('Switching to polling mode')
-    this.startPolling()
-  }
-
-  startPolling() {
-    if (this.pollingTimer) return
-
-    this.pollingTimer = setInterval(async () => {
-      try {
-        this.callbacks.onPollStart()
-        const result = await this.pollState()
-        this.callbacks.onPollSuccess(result)
-      } catch (error) {
-        this.callbacks.onPollError(error)
-      }
-    }, this.config.pollingInterval)
-  }
-
-  async pollState() {
-    const httpUrl = this.wsUrl.replace('ws://', 'http://').replace('wss://', 'https://')
-    const response = await fetch(`${httpUrl}/poll`)
-    if (!response.ok) {
-      throw new Error(`Polling failed: ${response.status}`)
-    }
-    return await response.json()
-  }
-
-  startPingInterval(sendFn, closeFn) {
-    this.pingTimer = setInterval(() => {
-      sendFn(Protocol.createPing())
-      const timeSinceLastPong = Date.now() - this.lastPongTime
-      if (timeSinceLastPong > this.config.pingInterval * 2) {
-        closeFn()
-      }
-    }, this.config.pingInterval)
-  }
-
-  stopPingInterval() {
-    if (this.pingTimer) {
-      clearInterval(this.pingTimer)
-      this.pingTimer = null
-    }
-  }
-
-  stopPolling() {
-    if (this.pollingTimer) {
-      clearInterval(this.pollingTimer)
-      this.pollingTimer = null
-    }
-  }
-
-  cleanup() {
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer)
-      this.reconnectTimer = null
-    }
-    this.stopPolling()
-    this.stopPingInterval()
-  }
-}
-
-export { CONFIG, ReconnectManager }
-export default ReconnectManager

package/src/lib/state-transport-server.js

@@ -1,189 +0,0 @@
-// state-sync channel (server side): real `ws`-backed WebSocketServer with
-// connection-guard IP/rate limiting, part of the state-protocol.js quartet.
-// See the header comment in state-protocol.js for the full picture -- this is
-// a structured, reconnect-aware state-sync protocol, DIFFERENT from and not a
-// replacement for realtime-server.js's simple in-process pub/sub
-// (the "ws-broadcast" channel actually used by the CRUD write path). As of
-// this writing this file has zero real importers repo-wide; nothing
-// constructs a StateTransportServer today.
-import { WebSocketServer } from 'ws'
-import { EventEmitter } from 'events'
-import Protocol from '@/lib/state-protocol.js'
-import ConnectionGuard from '@/lib/connection-guard.js'
-
-const CONFIG = {
-  pingInterval: 30000,
-  connectionTimeout: 60000,
-  maxConnectionsPerIP: 10,
-  messageRateLimit: 100
-}
-
-class StateTransportServer extends EventEmitter {
-  constructor(server, config = {}) {
-    super()
-    this.config = { ...CONFIG, ...config }
-    this.wss = null
-    this.clients = new Map()
-    this.server = server
-    this.guard = new ConnectionGuard(this.config)
-    this.setupServer()
-  }
-
-  setupServer() {
-    try {
-      this.wss = new WebSocketServer({ server: this.server, path: '/state-sync' })
-      this.wss.on('connection', (ws, req) => this.handleConnection(ws, req))
-      this.wss.on('error', (error) => this.handleError(error))
-      this.guard.startPingInterval(this.clients, (id) => this.handleClose(id))
-      this.emit('ready')
-    } catch (error) {
-      this.emit('error', error)
-      setTimeout(() => this.setupServer(), 5000)
-    }
-  }
-
-  handleConnection(ws, req) {
-    const clientId = this.guard.generateClientId()
-    const ip = req.socket.remoteAddress
-
-    if (!this.guard.checkConnectionLimit(ip)) {
-      ws.close(1008, 'Too many connections from this IP')
-      return
-    }
-
-    const client = {
-      id: clientId,
-      ws,
-      ip,
-      alive: true,
-      connectedAt: Date.now(),
-      messageCount: 0
-    }
-
-    this.clients.set(clientId, client)
-    this.guard.trackIPConnection(ip)
-
-    ws.on('message', (data) => this.handleMessage(clientId, data))
-    ws.on('close', () => this.handleClose(clientId))
-    ws.on('error', (error) => this.handleClientError(clientId, error))
-    ws.on('pong', () => { client.alive = true })
-
-    this.emit('client_connected', clientId)
-  }
-
-  handleMessage(clientId, data) {
-    try {
-      const client = this.clients.get(clientId)
-      if (!client) return
-
-      if (!this.guard.checkRateLimit(clientId)) {
-        this.sendMessage(clientId, Protocol.createStateNack(
-          null,
-          'Rate limit exceeded',
-          Protocol.ERROR_CODES.RATE_LIMITED
-        ))
-        return
-      }
-
-      const message = JSON.parse(data.toString())
-      const validation = Protocol.MessageSchema.validate(message)
-
-      if (!validation.valid) {
-        this.sendMessage(clientId, Protocol.createStateNack(
-          message.id,
-          validation.error,
-          Protocol.ERROR_CODES.INVALID_MESSAGE
-        ))
-        return
-      }
-
-      client.messageCount++
-      this.emit('message', clientId, message)
-
-      if (message.type === Protocol.MESSAGE_TYPES.PING) {
-        this.sendMessage(clientId, Protocol.createPong(message.timestamp))
-      }
-    } catch (error) {
-      this.emit('error', { clientId, error, phase: 'message_handling' })
-    }
-  }
-
-  handleClose(clientId) {
-    const client = this.clients.get(clientId)
-    if (client) {
-      this.guard.untrackIPConnection(client.ip)
-      this.clients.delete(clientId)
-      this.guard.clearRateLimit(clientId)
-      this.emit('client_disconnected', clientId)
-    }
-  }
-
-  handleClientError(clientId, error) {
-    this.emit('error', { clientId, error, phase: 'client_error' })
-  }
-
-  handleError(error) {
-    this.emit('error', { error, phase: 'server_error' })
-  }
-
-  sendMessage(clientId, message) {
-    try {
-      const client = this.clients.get(clientId)
-      if (client && client.ws.readyState === 1) {
-        client.ws.send(JSON.stringify(message))
-        return true
-      }
-      return false
-    } catch (error) {
-      this.emit('error', { clientId, error, phase: 'send_message' })
-      return false
-    }
-  }
-
-  broadcast(message, excludeClientId = null) {
-    const results = { sent: 0, failed: 0 }
-    for (const [clientId] of this.clients) {
-      if (clientId === excludeClientId) continue
-      if (this.sendMessage(clientId, message)) {
-        results.sent++
-      } else {
-        results.failed++
-      }
-    }
-    return results
-  }
-
-  getClientCount() {
-    return this.clients.size
-  }
-
-  getClient(clientId) {
-    return this.clients.get(clientId)
-  }
-
-  close() {
-    this.guard.destroy()
-    for (const client of this.clients.values()) {
-      client.ws.close()
-    }
-    this.clients.clear()
-    if (this.wss) {
-      this.wss.close()
-    }
-  }
-}
-
-if (!global.stateTransportServer) {
-  global.stateTransportServer = null
-}
-
-export function createStateTransportServer(server, config) {
-  if (global.stateTransportServer) {
-    global.stateTransportServer.close()
-  }
-  global.stateTransportServer = new StateTransportServer(server, config)
-  return global.stateTransportServer
-}
-
-export { StateTransportServer }
-export default StateTransportServer

package/src/lib/static-server.js

@@ -1,97 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ROOT = path.join(__dirname, '../..');
-
-export function serveStatic(pathname, req, res, compress, getCacheHeaders, _loadModule) {
-  const acceptEncoding = req.headers['accept-encoding'] || '';
-
-  if (pathname === '/favicon.ico') {
-    res.setHeader('Content-Type', 'image/x-icon');
-    res.setHeader('Cache-Control', 'public, max-age=86400');
-    res.setHeader('Content-Length', '0');
-    res.writeHead(200);
-    res.end();
-    return true;
-  }
-
-  if (pathname === '/manifest.json') {
-    const manifest = JSON.stringify({ name: 'Thatcher', short_name: 'Thatcher', start_url: '/', display: 'standalone', background_color: '#f1f5f9', theme_color: '#04141f' });
-    res.setHeader('Content-Type', 'application/json');
-    res.setHeader('Cache-Control', 'public, max-age=86400');
-    res.setHeader('Content-Length', Buffer.byteLength(manifest, 'utf-8'));
-    res.writeHead(200);
-    res.end(manifest);
-    return true;
-  }
-
-  if (pathname === '/service-worker.js') {
-    const swPath = path.join(ROOT, 'src/service-worker.js');
-    if (fs.existsSync(swPath)) {
-      const content = fs.readFileSync(swPath, 'utf-8');
-      const cacheHeaders = getCacheHeaders('dynamic');
-      Object.entries(cacheHeaders).forEach(([k, v]) => res.setHeader(k, v));
-      res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
-      res.setHeader('Content-Length', Buffer.byteLength(content, 'utf-8'));
-      res.writeHead(200);
-      res.end(content);
-      return true;
-    }
-  }
-
-  if (pathname.startsWith('/lib/webjsx/')) {
-    const file = pathname.slice(12);
-    const filePath = path.join(ROOT, 'node_modules/webjsx/dist', file);
-    if (!fs.existsSync(filePath)) return false;
-    const content = fs.readFileSync(filePath, 'utf-8');
-    const cacheHeaders = getCacheHeaders('static', 31536000);
-    Object.entries(cacheHeaders).forEach(([k, v]) => res.setHeader(k, v));
-    const { content: finalContent, encoding } = compress(content, acceptEncoding);
-    res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
-    if (encoding) res.setHeader('Content-Encoding', encoding);
-    res.setHeader('Content-Length', Buffer.byteLength(finalContent));
-    res.writeHead(200);
-    res.end(finalContent);
-    return true;
-  }
-
-  if (pathname.startsWith('/ui/') && pathname.endsWith('.css')) {
-    const cssPath = path.join(ROOT, 'src/ui', path.basename(pathname));
-    if (!fs.existsSync(cssPath)) return false;
-    let content = fs.readFileSync(cssPath, 'utf-8');
-    const etag = `"${content.length}-${fs.statSync(cssPath).mtimeMs.toString(36)}"`;
-    if (req.headers['if-none-match'] === etag) { res.writeHead(304); res.end(); return true; }
-    res.setHeader('Cache-Control', 'public, max-age=0, must-revalidate');
-    res.setHeader('ETag', etag);
-    const { content: finalContent, encoding } = compress(content, acceptEncoding);
-    res.setHeader('Content-Type', 'text/css; charset=utf-8');
-    if (encoding) res.setHeader('Content-Encoding', encoding);
-    res.setHeader('Content-Length', Buffer.byteLength(finalContent));
-    res.writeHead(200);
-    res.end(finalContent);
-    return true;
-  }
-
-  if (pathname === '/ui/client.js' || pathname === '/ui/event-delegation.js' || pathname === '/ui/common-handlers.js') {
-    const jsPath = path.join(ROOT, 'src/ui', pathname.split('/').pop());
-    if (!fs.existsSync(jsPath)) return false;
-    const content = fs.readFileSync(jsPath, 'utf-8');
-    const cacheHeaders = getCacheHeaders('static', 86400);
-    Object.entries(cacheHeaders).forEach(([k, v]) => res.setHeader(k, v));
-    const { content: finalContent, encoding } = compress(content, acceptEncoding);
-    res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
-    if (encoding) res.setHeader('Content-Encoding', encoding);
-    res.setHeader('Content-Length', Buffer.byteLength(finalContent));
-    res.writeHead(200);
-    res.end(finalContent);
-    return true;
-  }
-
-  return false;
-}
-
-export function html404() {
-  return `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><script>(function(){try{var t=localStorage.getItem('thatcher-theme')||((window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches)?'dark':'light');document.documentElement.setAttribute('data-theme',t)}catch(e){document.documentElement.setAttribute('data-theme','light')}})();</script><meta name="viewport" content="width=device-width,initial-scale=1"><title>404 - Page Not Found | Thatcher</title><link href="/ui/rippleui.css" rel="stylesheet"><link href="/ui/styles2.css" rel="stylesheet"><style>body{margin:0;background:var(--color-bg,#f1f5f9);font-family:system-ui,sans-serif}.nav-shell{background:#04141f;padding:0 2rem;height:56px;display:flex;align-items:center}a.logo-link{color:#fff;text-decoration:none;font-weight:700;font-size:1.1rem}.error-shell{min-height:calc(100vh - 56px);display:flex;align-items:center;justify-content:center}.error-card{background:#fff;border-radius:12px;padding:3rem 4rem;text-align:center;box-shadow:0 1px 3px rgba(0,0,0,.1)}.error-code{font-size:4rem;font-weight:900;color:#04141f;line-height:1}.error-msg{font-size:1.2rem;color:#64748b;margin:0.5rem 0 2rem}.home-btn{display:inline-block;padding:0.75rem 2rem;background:#04141f;color:#fff;border-radius:8px;text-decoration:none;font-weight:600;font-size:0.95rem}</style></head><body><nav class="nav-shell"><a href="/" class="logo-link">Thatcher</a></nav><div class="error-shell"><div class="error-card"><div class="error-code">404</div><p class="error-msg">Page not found</p><a href="/" class="home-btn">Go to Dashboard</a></div></div></body></html>`;
-}