thatcher 1.0.61 → 1.0.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.61",
+  "version": "1.0.63",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/bulk-operations.js

@@ -0,0 +1,91 @@
+import { get, update, remove } from './busybase/store.js';
+import { validateUpdate, sanitizeData } from './validation/index.js';
+import { requirePermission } from './auth-middleware.js';
+import { permissionService } from '../services/permission.service.js';
+import { executeHook } from './hook-engine.js';
+import { logAction } from './busybase/audit.js';
+import { now } from './id-helpers.js';
+import { createLogger } from './logger.js';
+
+const log = createLogger('[BulkOps]');
+const MAX_BULK_IDS = 500;
+
+async function bulkDeleteOne(entityName, spec, id, user) {
+  await requirePermission(user, spec, 'delete');
+  const existing = await get(entityName, id, { user });
+  if (!existing) throw new Error('Not found');
+  if (!permissionService.checkRowAccess(user, spec, existing)) throw new Error('Access denied');
+
+  let result;
+  if (spec.immutable === true && spec.immutable_strategy === 'move_to_archive') {
+    const archiveData = { archived: true, archived_at: now(), archived_by: user?.id };
+    result = await update(entityName, id, archiveData, user);
+    logAction(entityName, id, 'archive', user?.id, existing, archiveData);
+  } else if (spec.fields?.status) {
+    result = await update(entityName, id, { status: 'deleted' }, user);
+    logAction(entityName, id, 'delete', user?.id, existing, { status: 'deleted' });
+  } else {
+    result = await remove(entityName, id);
+    logAction(entityName, id, 'delete', user?.id, existing, null);
+  }
+  executeHook(`delete:${entityName}:after`, { entity: entityName, id, data: result, user }).catch(e => log.error(e.message));
+  return result;
+}
+
+async function bulkSetFieldOne(entityName, spec, id, user, field, value) {
+  await requirePermission(user, spec, 'edit');
+  const existing = await get(entityName, id, { user });
+  if (!existing) throw new Error('Not found');
+  if (!permissionService.checkRowAccess(user, spec, existing)) throw new Error('Access denied');
+
+  const rawData = { [field]: value };
+  permissionService.enforceEditPermissions(user, spec, rawData);
+
+  const errors = await validateUpdate(entityName, rawData, existing);
+  if (Object.keys(errors).length > 0) throw new Error(`Validation failed: ${JSON.stringify(errors)}`);
+
+  const sanitized = sanitizeData(entityName, rawData, spec, existing);
+  const record = await update(entityName, id, sanitized, user);
+  logAction(entityName, id, 'update', user?.id, existing, record);
+  executeHook(`update:${entityName}:after`, { entity: entityName, id, data: record, before: existing, after: record, user }).catch(e => log.error(e.message));
+  return record;
+}
+
+async function bulkTransitionOne(entityName, id, workflowName, toState, user) {
+  const { transition } = await import('./workflow-engine.js');
+  return transition(entityName, id, workflowName, toState, user, 'bulk operation');
+}
+
+export async function runBulkOperation(entityName, spec, ids, action, user) {
+  if (!Array.isArray(ids) || !ids.length) return { ok: false, error: 'ids array required and must be non-empty' };
+  if (ids.length > MAX_BULK_IDS) return { ok: false, error: `Cannot process more than ${MAX_BULK_IDS} ids in one bulk operation` };
+  if (!action || typeof action.type !== 'string') return { ok: false, error: 'action.type required' };
+
+  const uniqueIds = [...new Set(ids)];
+  const results = [];
+
+  for (const id of uniqueIds) {
+    try {
+      if (action.type === 'delete') {
+        await bulkDeleteOne(entityName, spec, id, user);
+        results.push({ id, success: true });
+      } else if (action.type === 'set_field') {
+        if (!action.field || typeof action.field !== 'string') throw new Error('action.field required');
+        await bulkSetFieldOne(entityName, spec, id, user, action.field, action.value);
+        results.push({ id, success: true });
+      } else if (action.type === 'transition') {
+        if (!action.workflow || !action.toState) throw new Error('action.workflow and action.toState required');
+        await bulkTransitionOne(entityName, id, action.workflow, action.toState, user);
+        results.push({ id, success: true });
+      } else {
+        results.push({ id, success: false, error: `Unknown action type "${action.type}"` });
+      }
+    } catch (error) {
+      results.push({ id, success: false, error: error.message });
+    }
+  }
+
+  const succeeded = results.filter(r => r.success).length;
+  const failed = results.length - succeeded;
+  return { ok: true, total: results.length, succeeded, failed, results };
+}

package/src/lib/config-generator-engine.js

@@ -68,11 +68,23 @@ const WEBHOOK_DELIVERY_ENTITY_DEFAULT = {
   },
 };
 
+const ENTITY_TEMPLATE_ENTITY_DEFAULT = {
+  label: 'Entity Template',
+  label_plural: 'Entity Templates',
+  system_entity: true,
+  fields: {
+    entity: { type: 'text', required: true, label: 'Entity' },
+    name: { type: 'text', required: true, label: 'Name' },
+    field_values: { type: 'json', label: 'Field Values' },
+  },
+};
+
 function withWebhookDefaults(masterConfig) {
   const entities = { ...(masterConfig.entities || {}) };
   let changed = false;
   if (!entities.webhook) { entities.webhook = WEBHOOK_ENTITY_DEFAULT; changed = true; }
   if (!entities.webhook_delivery) { entities.webhook_delivery = WEBHOOK_DELIVERY_ENTITY_DEFAULT; changed = true; }
+  if (!entities.entity_template) { entities.entity_template = ENTITY_TEMPLATE_ENTITY_DEFAULT; changed = true; }
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 

package/src/server/server.js

@@ -134,6 +134,18 @@ export function createServer(options) {
           return await handleDeleteWebhook(req, res, id, thatcher, configEngine);
         }
 
+        if (req.method === 'POST' && id === 'bulk' && !action) {
+          return await handleBulkOperation(req, res, entity, thatcher, configEngine);
+        }
+
+        if (req.method === 'POST' && entity === 'entity_template' && id === 'create' && !action) {
+          return await handleCreateEntityTemplate(req, res, thatcher, configEngine);
+        }
+
+        if (req.method === 'POST' && entity === 'entity_template' && id && action === 'delete') {
+          return await handleDeleteEntityTemplate(req, res, id, thatcher, configEngine);
+        }
+
         // Check if user has custom route for this
         const userRoutePath = path.join(process.cwd(), 'app/api', ...parts, 'route.js');
         const routeExists = await fileExists(userRoutePath);
@@ -379,6 +391,132 @@ async function requireAuthedPartner(req, res) {
   return user;
 }
 
+async function handleBulkOperation(req, res, entityName, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+  let spec;
+  try {
+    spec = configEngine.generateEntitySpec(entityName);
+  } catch (e) {
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: `Entity "${entityName}" not found` }));
+    return;
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const ids = Array.isArray(body?.ids) ? body.ids : null;
+  const action = body?.action;
+  if (!ids) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'ids array required' }));
+    return;
+  }
+
+  try {
+    const { runBulkOperation } = await import('../lib/bulk-operations.js');
+    const result = await runBulkOperation(entityName, spec, ids, action, user);
+    if (!result.ok) {
+      res.writeHead(400);
+      res.end(JSON.stringify({ error: result.error }));
+      return;
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function handleCreateEntityTemplate(req, res, thatcher, configEngineArg) {
+  const user = await requireAuthedPartner(req, res);
+  if (!user) return;
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const { entity, name, field_values } = body || {};
+  if (!entity || typeof entity !== 'string') {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'entity required' }));
+    return;
+  }
+  try {
+    configEngine.generateEntitySpec(entity);
+  } catch {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: `Unknown entity "${entity}"` }));
+    return;
+  }
+  if (!name || typeof name !== 'string' || !name.trim()) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'name required' }));
+    return;
+  }
+
+  try {
+    const { create } = await import('../lib/busybase/store.js');
+    const record = await create('entity_template', { entity, name: name.trim(), field_values: field_values || {} }, user);
+    res.writeHead(201, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, id: record.id }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function handleDeleteEntityTemplate(req, res, templateId, thatcher, configEngineArg) {
+  const user = await requireAuthedPartner(req, res);
+  if (!user) return;
+
+  try {
+    const { remove, get } = await import('../lib/busybase/store.js');
+    const existing = await get('entity_template', templateId);
+    if (!existing) {
+      res.writeHead(404);
+      res.end(JSON.stringify({ error: 'Template not found' }));
+      return;
+    }
+    await remove('entity_template', templateId);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleCreateWebhook(req, res, thatcher, configEngineArg) {
   const user = await requireAuthedPartner(req, res);
   if (!user) return;

package/src/ui/entity-renderer.js

@@ -111,12 +111,13 @@ export function renderEntityDetail(entityName, item, spec, user) {
     </div>` : `<div style="margin-bottom:1.5rem"><h1 style="font-size:1.5rem;font-weight:700">${displayNameSafe}</h1></div>`
 
   const editBtn = userCanEdit ? `<a href="/${entityName}/${item.id}/edit" class="btn btn-outline btn-sm">Edit</a>` : ''
+  const cloneBtn = canCreate(user, entityName) ? `<a href="/${entityName}/new?clone_from=${esc(item.id)}" class="btn btn-outline btn-sm">Clone</a>` : ''
   const delBtn = userCanDelete ? `<button data-action="showDeleteConfirm" class="btn btn-error btn-outline btn-sm">Delete</button>` : ''
 
   const content = `
     <div style="display:flex;justify-content:space-between;align-items:flex-start">
       <div style="flex:1">${headerExtra}</div>
-      <div style="display:flex;gap:0.5rem;margin-left:1rem">${editBtn}${delBtn}</div>
+      <div style="display:flex;gap:0.5rem;margin-left:1rem">${editBtn}${cloneBtn}${delBtn}</div>
     </div>
     <div class="card-clean">
       <div class="card-clean-body"><div class="detail-grid">${fieldRows || '<p style="color:var(--color-text-muted);font-size:0.875rem;grid-column:1/-1">No details available</p>'}</div></div>
@@ -129,7 +130,7 @@ export function renderEntityDetail(entityName, item, spec, user) {
   return page(user, `${label} Detail`, bc, content, [script])
 }
 
-export function renderEntityForm(entityName, item, spec, user, isNew = false, refOptions = {}) {
+export function renderEntityForm(entityName, item, spec, user, isNew = false, refOptions = {}, templates = []) {
   const label = spec?.label || entityName
   const fields = spec?.fields || {}
   const lbl = (k, f, req) => `<label class="form-label" for="field-${k}">${esc(f.label||k)}${req ? '<span class="req">*</span>' : ''}</label>`
@@ -165,8 +166,14 @@ export function renderEntityForm(entityName, item, spec, user, isNew = false, re
   const bc = isNew
     ? [{ href: '/', label: 'Dashboard' }, { href: `/${entityName}`, label: spec?.labelPlural || label }, { label: 'Create' }]
     : [{ href: '/', label: 'Dashboard' }, { href: `/${entityName}`, label: spec?.labelPlural || label }, { href: `/${entityName}/${item?.id}`, label: item?.name || item?.title || `#${item?.id}` }, { label: 'Edit' }]
+  const templatePicker = isNew && templates.length
+    ? `<div class="form-field full"><label class="form-label" for="template-picker">Start from template</label>
+        <select id="template-picker" onchange="if(this.value)window.location='/${entityName}/new?template='+this.value">
+          <option value="">Blank</option>${templates.map(t => `<option value="${esc(t.id)}">${esc(t.name)}</option>`).join('')}
+        </select></div>`
+    : ''
   const content = `<div class="form-shell"><div style="margin-bottom:24px"><h1 style="font-size:24px;font-weight:700">${isNew ? 'Create' : 'Edit'} ${esc(label)}</h1></div>
-    <div class="form-section"><form id="entity-form" class="form-grid" aria-label="${isNew ? 'Create' : 'Edit'} ${esc(label)}">${formFields}${pwField}
+    <div class="form-section"><form id="entity-form" class="form-grid" aria-label="${isNew ? 'Create' : 'Edit'} ${esc(label)}">${templatePicker}${formFields}${pwField}
     <div class="form-actions" style="grid-column:1/-1"><button type="submit" id="submit-btn" class="btn-primary-clean"><span class="btn-text">Save</span><span class="btn-loading-text" style="display:none">Saving...</span></button>
     <a href="/${entityName}${isNew ? '' : '/' + item?.id}" class="btn-ghost-clean">Cancel</a></div></form></div></div>`
   const script = `${TOAST_SCRIPT}const form=document.getElementById('entity-form');const sb=document.getElementById('submit-btn');form.addEventListener('submit',async(e)=>{e.preventDefault();sb.classList.add('btn-loading');sb.querySelector('.btn-text').style.display='none';sb.querySelector('.btn-loading-text').style.display='inline';sb.disabled=true;const fd=new FormData(form);const data={};for(const[k,v]of fd.entries())data[k]=v;form.querySelectorAll('input[type=checkbox]').forEach(cb=>{data[cb.name]=cb.checked});form.querySelectorAll('input[type=number]').forEach(inp=>{if(inp.name&&data[inp.name]!==undefined&&data[inp.name]!=='')data[inp.name]=Number(data[inp.name])});const url=${isNew}?'/api/${entityName}':'/api/${entityName}/${item?.id}';const method=${isNew}?'POST':'PUT';try{const res=await fetch(url,{method,headers:{'Content-Type':'application/json'},body:JSON.stringify(data)});const result=await res.json();if(res.ok){showToast('${isNew?'Created':'Updated'} successfully!','success');const ed=result.data||result;setTimeout(()=>{window.location='/${entityName}/'+(ed.id||'${item?.id}')},500)}else{showToast(result.message||result.error||'Save failed','error');sb.classList.remove('btn-loading');sb.querySelector('.btn-text').style.display='inline';sb.querySelector('.btn-loading-text').style.display='none';sb.disabled=false}}catch(err){showToast('Error: '+err.message,'error');sb.classList.remove('btn-loading');sb.querySelector('.btn-text').style.display='inline';sb.querySelector('.btn-loading-text').style.display='none';sb.disabled=false}})`

package/src/ui/grid-view-renderer.js

@@ -30,7 +30,8 @@ function gridRow(entityName, item, columns) {
       : '';
     return `<td data-col="${esc(key)}"${editableAttrs}>${rendered}</td>`;
   }).join('');
-  return `<tr data-row data-navigate="/${esc(entityName)}/${esc(item.id)}" style="cursor:pointer">${cells}</tr>`;
+  const checkboxCell = `<td style="width:32px"><input type="checkbox" class="bulk-row-select" data-row-id="${esc(item.id)}" onclick="event.stopPropagation()"></td>`;
+  return `<tr data-row data-navigate="/${esc(entityName)}/${esc(item.id)}" style="cursor:pointer">${checkboxCell}${cells}</tr>`;
 }
 
 const GRID_EDIT_SCRIPT = `(function(){
@@ -77,6 +78,63 @@ const GRID_EDIT_SCRIPT = `(function(){
   },true);
 })();`;
 
+const BULK_OPS_SCRIPT = `(function(){
+  function selectedIds(){
+    return Array.prototype.slice.call(document.querySelectorAll('.bulk-row-select:checked')).map(function(cb){return cb.getAttribute('data-row-id')});
+  }
+  function updateToolbar(){
+    var ids=selectedIds();
+    var toolbar=document.getElementById('bulk-toolbar');
+    var label=document.getElementById('bulk-count-label');
+    if(ids.length>0){toolbar.style.display='flex';label.textContent=ids.length+' selected'}
+    else{toolbar.style.display='none'}
+  }
+  document.addEventListener('change',function(e){
+    if(e.target.classList&&e.target.classList.contains('bulk-row-select')){updateToolbar()}
+    if(e.target.id==='bulk-select-all'){
+      var checked=e.target.checked;
+      document.querySelectorAll('.bulk-row-select').forEach(function(cb){cb.checked=checked});
+      updateToolbar();
+    }
+  });
+  function postBulk(entity,ids,action,onDone){
+    var status=document.getElementById('bulk-status');
+    status.textContent='Processing...';
+    fetch('/api/'+entity+'/bulk',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({ids:ids,action:action})})
+      .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+      .then(function(res){
+        if(res.ok){
+          var failed=res.d.failed||0;
+          status.textContent=res.d.succeeded+' succeeded, '+failed+' failed';
+          if(failed===0){setTimeout(function(){location.reload()},800)}
+        }else{status.textContent='Error: '+(res.d.error||'bulk operation failed')}
+        if(onDone)onDone();
+      })
+      .catch(function(err){status.textContent='Error: '+err.message});
+  }
+  window.bulkDelete=function(entity){
+    var ids=selectedIds();
+    if(!ids.length)return;
+    if(!window.confirm('Delete '+ids.length+' items?'))return;
+    postBulk(entity,ids,{type:'delete'});
+  };
+  window.bulkSetField=function(entity){
+    var ids=selectedIds();
+    if(!ids.length)return;
+    var field=document.getElementById('bulk-set-field').value;
+    var value=document.getElementById('bulk-set-value').value;
+    if(!field)return;
+    postBulk(entity,ids,{type:'set_field',field:field,value:value});
+  };
+  window.bulkTransition=function(entity,workflow){
+    var ids=selectedIds();
+    if(!ids.length)return;
+    var toState=document.getElementById('bulk-transition-target').value;
+    if(!toState)return;
+    postBulk(entity,ids,{type:'transition',workflow:workflow,toState:toState});
+  };
+})();`;
+
 export function renderGridView(user, entityName, spec, records, options = {}) {
   const label = getEntityLabel(spec, true) || entityName;
   const columns = getColumns(spec);
@@ -105,9 +163,32 @@ export function renderGridView(user, entityName, spec, records, options = {}) {
   const rows = records.map(item => gridRow(entityName, item, columns)).join('') ||
     emptyRow(columns.length || 1, `No ${esc(label.toLowerCase())} found`);
 
+  const editableFieldOpts = columns.filter(([, f]) => isEditable(f)).map(([key, f]) =>
+    `<option value="${esc(key)}">${esc(f.label || key)}</option>`
+  ).join('');
+
+  const workflowStageOpts = spec.workflowDef?.stages
+    ? spec.workflowDef.stages.map(s => `<option value="${esc(s.name)}">${esc(s.label || s.name)}</option>`).join('')
+    : '';
+  const transitionButton = spec.workflow && workflowStageOpts
+    ? `<select id="bulk-transition-target"><option value="">Transition to...</option>${workflowStageOpts}</select>
+       <button type="button" class="btn-ghost-clean" data-action="bulkTransition" data-args='["${esc(entityName)}","${esc(spec.workflow)}"]'>Apply</button>`
+    : '';
+
+  const bulkToolbar = `<div id="bulk-toolbar" style="display:none;align-items:center;gap:8px;padding:8px;background:var(--color-bg-secondary,#f5f5f5);border-radius:4px;margin-bottom:8px;flex-wrap:wrap">
+    <span id="bulk-count-label" style="font-size:13px;font-weight:600"></span>
+    <button type="button" class="btn-danger-clean" data-action="bulkDelete" data-args='["${esc(entityName)}"]'>Delete Selected</button>
+    <select id="bulk-set-field"><option value="">Set field...</option>${editableFieldOpts}</select>
+    <input type="text" id="bulk-set-value" placeholder="value" style="width:120px">
+    <button type="button" class="btn-ghost-clean" data-action="bulkSetField" data-args='["${esc(entityName)}"]'>Apply</button>
+    ${transitionButton}
+    <span id="bulk-status" style="font-size:13px"></span>
+  </div>`;
+
   const content = `<div class="page-header">
         <div><h1 class="page-title">${esc(label)}</h1><p class="page-subtitle">${records.length} total ${esc(label.toLowerCase())}</p></div>
       </div>
+      ${bulkToolbar}
       <div class="table-wrap">
         <div class="table-toolbar">
           <div class="table-search"><input id="search-input" type="text" placeholder="Search ${esc(label.toLowerCase())}..."></div>
@@ -115,10 +196,10 @@ export function renderGridView(user, entityName, spec, records, options = {}) {
           <span class="table-count" id="row-count">${records.length} items</span>
         </div>
         <table class="data-table" role="grid" data-page-size="${esc(pageSize)}">
-          <thead><tr>${headerCells}</tr></thead>
+          <thead><tr><th style="width:32px"><input type="checkbox" id="bulk-select-all"></th>${headerCells}</tr></thead>
           <tbody>${rows}</tbody>
         </table>
       </div>`;
 
-  return page(user, `${label} | Thatcher`, null, content, [TABLE_SCRIPT, GRID_EDIT_SCRIPT]);
+  return page(user, `${label} | Thatcher`, null, content, [TABLE_SCRIPT, GRID_EDIT_SCRIPT, BULK_OPS_SCRIPT]);
 }

package/src/ui/page-handler-admin.js

@@ -9,6 +9,7 @@ import { renderJobManagement } from '@/ui/job-management-renderer.js';
 import { renderWorkflowList, renderWorkflowEditor } from '@/ui/workflow-builder-renderer.js';
 import { renderRolesList, renderTemplateList, renderPermissionMatrix } from '@/ui/rbac-renderer.js';
 import { renderWebhookList, renderWebhookDetail } from '@/ui/webhook-renderer.js';
+import { renderTemplateList as renderEntityTemplateList } from '@/ui/template-renderer.js';
 import { isPartner, isManager } from '@/ui/permissions-ui.js';
 import { getSystemConfig, getSettingsCounts, getAuditData, getSystemHealth, renderBuildLogsContent } from '@/ui/page-handler-helpers.js';
 import { fileURLToPath } from 'url';
@@ -178,5 +179,17 @@ export async function handleAdminPage(normalized, segments, user) {
     try { deliveries = (await list('webhook_delivery', { webhook_id: segments[2] }, { sort: { field: 'created_at', dir: 'DESC' } })).slice(0, 20); } catch {}
     return renderWebhookDetail(user, webhook, deliveries);
   }
+  if (normalized === '/admin/templates') {
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const entityNames = engine.getAllEntities().filter(e => e !== 'entity_template' && e !== 'webhook' && e !== 'webhook_delivery' && e !== 'user_organization');
+    let allTemplates = []; try { allTemplates = await list('entity_template', {}); } catch {}
+    const templatesByEntity = {};
+    for (const t of allTemplates) {
+      if (!templatesByEntity[t.entity]) templatesByEntity[t.entity] = [];
+      templatesByEntity[t.entity].push(t);
+    }
+    return renderEntityTemplateList(user, entityNames, templatesByEntity);
+  }
   return null;
 }

package/src/ui/page-handler.js

@@ -72,14 +72,43 @@ async function handleSearch(user, req) {
   }
   return renderAdvancedSearch(user, results, { teams, entityNames: allEntityNames });
 }
-async function handleGenericEntityView(user, entityName, id) {
+const SYSTEM_FIELDS_TO_STRIP = new Set(['id', 'created_at', 'created_by', 'updated_at', 'status', 'organization_id']);
+
+async function handleGenericEntityView(user, entityName, id, req) {
   const spec = getSpec(entityName); if (!spec) return null;
   if (isClientUser(user) && !canClientAccessEntity(user, entityName)) return renderAccessDenied(user, entityName, 'view');
   if (id === 'new') {
     if (!canCreate(user, entityName)) return renderAccessDenied(user, entityName, 'create');
     const resolvedSpec = resolveEnumOptions(spec);
     const { renderEntityForm: lazyEntityForm } = await lazyRenderer('entity-renderer.js');
-    return lazyEntityForm(entityName, null, resolvedSpec, user, true, await getRefOptions(resolvedSpec));
+
+    let prefill = null;
+    const params = req ? reqUrl(req).searchParams : null;
+    const cloneFromId = params?.get('clone_from');
+    const templateId = params?.get('template');
+    if (cloneFromId) {
+      const source = await get(entityName, cloneFromId, { user });
+      if (source) {
+        prefill = {};
+        for (const [key, value] of Object.entries(source)) {
+          if (!SYSTEM_FIELDS_TO_STRIP.has(key)) prefill[key] = value;
+        }
+      }
+    } else if (templateId) {
+      const template = await get('entity_template', templateId);
+      if (template && template.entity === entityName) {
+        try {
+          prefill = typeof template.field_values === 'string' ? JSON.parse(template.field_values || '{}') : (template.field_values || {});
+        } catch {
+          prefill = {};
+        }
+      }
+    }
+
+    let templates = [];
+    try { templates = await list('entity_template', { entity: entityName }); } catch {}
+
+    return lazyEntityForm(entityName, prefill, resolvedSpec, user, true, await getRefOptions(resolvedSpec), templates);
   }
   if (!canView(user, entityName)) return renderAccessDenied(user, entityName, 'view');
   const item = await get(entityName, id, { user }); if (!item) return null;
@@ -264,7 +293,7 @@ export async function handlePage(pathname, req, res) {
     const client = await get('client', segments[1], { user }); if (!client) return null;
     return renderClientDashboard(user, client, await getClientDashboardStats(segments[1]));
   }
-  if (segments.length === 2) return handleGenericEntityView(user, segments[0], segments[1]);
+  if (segments.length === 2) return handleGenericEntityView(user, segments[0], segments[1], req);
   if (segments.length === 3 && segments[2] === 'edit') return handleGenericEntityEdit(user, segments[0], segments[1]);
 
   return null;

package/src/ui/template-renderer.js

@@ -0,0 +1,48 @@
+import { page } from '@/ui/layout.js';
+import { esc } from '@/ui/render-helpers.js';
+
+export function renderTemplateList(user, entityNames, templatesByEntity) {
+  const sections = entityNames.map(entityName => {
+    const templates = templatesByEntity[entityName] || [];
+    const rows = templates.map(t =>
+      `<tr><td>${esc(t.name)}</td><td><button type="button" class="btn-ghost-clean" data-action="deleteTemplate" data-args='["${esc(t.id)}"]'>Delete</button></td></tr>`
+    ).join('') || '<tr><td colspan="2">No templates</td></tr>';
+    return `<div class="card-clean" style="margin-bottom:16px"><div class="card-clean-body">
+      <h3 style="margin-bottom:8px">${esc(entityName)}</h3>
+      <table class="data-table"><thead><tr><th>Name</th><th></th></tr></thead><tbody>${rows}</tbody></table>
+      <div style="margin-top:8px;display:flex;gap:8px">
+        <input type="text" id="new-tpl-name-${esc(entityName)}" placeholder="Template name" style="flex:1">
+        <button type="button" class="btn-primary-clean" data-action="createTemplate" data-args='["${esc(entityName)}"]'>Add (blank)</button>
+      </div>
+    </div></div>`;
+  }).join('');
+
+  const content = `<div class="page-header"><h1 class="page-title">Record Templates</h1></div>
+    <p style="font-size:13px;color:var(--color-text-muted,#666);margin-bottom:16px">Templates created here start blank; edit field_values via the entity_template record to set starter values.</p>
+    ${sections}
+    <span id="tpl-status" style="font-size:13px"></span>`;
+
+  const script = `(function(){
+    window.createTemplate=function(entity){
+      var input=document.getElementById('new-tpl-name-'+entity);
+      var name=(input.value||'').trim();
+      var status=document.getElementById('tpl-status');
+      if(!name){status.textContent='Name required';return}
+      status.textContent='Creating...';
+      fetch('/api/entity_template/create',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({entity:entity,name:name,field_values:{}})})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){location.reload()}else{status.textContent='Error: '+(res.d.error||'create failed')}})
+        .catch(function(err){status.textContent='Error: '+err.message});
+    };
+    window.deleteTemplate=function(id){
+      var status=document.getElementById('tpl-status');
+      status.textContent='Deleting...';
+      fetch('/api/entity_template/'+id+'/delete',{method:'POST'})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){location.reload()}else{status.textContent='Error: '+(res.d.error||'delete failed')}})
+        .catch(function(err){status.textContent='Error: '+err.message});
+    };
+  })();`;
+
+  return page(user, 'Record Templates | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { label: 'Templates' }], content, [script]);
+}