thatcher 1.0.63 → 1.0.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.63",
+  "version": "1.0.65",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/config/spec-helpers.js

@@ -94,10 +94,12 @@ export function getInitialState(spec) {
       state[key] = field.default;
     } else if (field.type === 'bool') {
       state[key] = false;
-    } else if (field.type === 'int' || field.type === 'decimal') {
+    } else if (field.type === 'int' || field.type === 'decimal' || field.type === 'currency') {
       state[key] = 0;
-    } else if (field.type === 'json') {
+    } else if (field.type === 'json' || field.type === 'multiselect') {
       state[key] = [];
+    } else if (field.type === 'file' || field.type === 'attachment') {
+      state[key] = null;
     } else if (field.type === 'date' || field.type === 'timestamp') {
       state[key] = null;
     } else {

package/src/lib/config-generator-engine.js

@@ -79,12 +79,30 @@ const ENTITY_TEMPLATE_ENTITY_DEFAULT = {
   },
 };
 
+const SCHEDULED_JOB_ENTITY_DEFAULT = {
+  label: 'Scheduled Job',
+  label_plural: 'Scheduled Jobs',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, label: 'Name' },
+    entity: { type: 'text', required: true, label: 'Entity' },
+    action: { type: 'json', required: true, label: 'Action' },
+    filter: { type: 'json', label: 'Filter' },
+    interval_minutes: { type: 'int', required: true, label: 'Interval (minutes)' },
+    last_run_at: { type: 'int', label: 'Last Run At' },
+    next_run_at: { type: 'int', label: 'Next Run At' },
+    enabled: { type: 'bool', default: true, label: 'Enabled' },
+    owner_id: { type: 'ref', ref: 'user', required: true, label: 'Owner' },
+  },
+};
+
 function withWebhookDefaults(masterConfig) {
   const entities = { ...(masterConfig.entities || {}) };
   let changed = false;
   if (!entities.webhook) { entities.webhook = WEBHOOK_ENTITY_DEFAULT; changed = true; }
   if (!entities.webhook_delivery) { entities.webhook_delivery = WEBHOOK_DELIVERY_ENTITY_DEFAULT; changed = true; }
   if (!entities.entity_template) { entities.entity_template = ENTITY_TEMPLATE_ENTITY_DEFAULT; changed = true; }
+  if (!entities.scheduled_job) { entities.scheduled_job = SCHEDULED_JOB_ENTITY_DEFAULT; changed = true; }
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 

package/src/lib/crud-handlers.js

@@ -215,10 +215,14 @@ function coerceFieldValue(value, type) {
   switch (type) {
     case 'int':
     case 'decimal':
+    case 'currency':
       return Number(value);
     case 'bool':
       return Boolean(value);
     case 'json':
+    case 'multiselect':
+    case 'file':
+    case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;
     case 'date':
     case 'timestamp':

package/src/lib/field-registry.js

@@ -4,11 +4,15 @@ export function coerceFieldValue(value, type) {
   switch (type) {
     case 'int':
     case 'decimal':
+    case 'currency':
       return Number(value);
     case 'bool':
     case 'boolean':
       return value === true || value === 'true' || value === 1;
     case 'json':
+    case 'multiselect':
+    case 'file':
+    case 'attachment':
       return typeof value === 'string' ? JSON.parse(value) : value;
     case 'date':
     case 'timestamp': {
@@ -31,10 +35,13 @@ export function deserializeField(value, type) {
 
   switch (type) {
     case 'json':
+    case 'multiselect':
+    case 'file':
+    case 'attachment':
       try {
         return typeof value === 'string' ? JSON.parse(value) : value;
       } catch {
-        return {};
+        return type === 'multiselect' ? [] : {};
       }
     case 'bool':
       return Boolean(value);

package/src/lib/scheduler-engine.js

@@ -0,0 +1,69 @@
+import { list, update, getBy } from './busybase/store.js';
+import { runBulkOperation } from './bulk-operations.js';
+import { getConfigEngineSync } from './config-generator-engine.js';
+import { now } from './id-helpers.js';
+import { createLogger } from './logger.js';
+
+const log = createLogger('[Scheduler]');
+const CHECK_INTERVAL_MS = 60 * 1000;
+let intervalHandle = null;
+
+export async function runDueJobs() {
+  const nowTs = now();
+  const dueJobs = await list('scheduled_job', { enabled: true });
+  const results = [];
+  for (const job of dueJobs) {
+    if (!job.enabled) continue;
+    if (job.next_run_at && job.next_run_at > nowTs) continue;
+    results.push(await runOneJob(job, nowTs));
+  }
+  return results;
+}
+
+async function runOneJob(job, nowTs) {
+  try {
+    const owner = await getBy('users', 'id', job.owner_id);
+    if (!owner) throw new Error(`Owner ${job.owner_id} not found`);
+
+    const configEngine = getConfigEngineSync();
+    const spec = configEngine.generateEntitySpec(job.entity);
+
+    const filter = job.filter ? (typeof job.filter === 'string' ? JSON.parse(job.filter) : job.filter) : {};
+    const action = typeof job.action === 'string' ? JSON.parse(job.action) : job.action;
+
+    // list() is org/row-access scoped by passing {user: owner} -- the same
+    // scoping crud-handlers.js's read path enforces for an interactive
+    // request, so a job cannot reach records outside its owner's org just
+    // because it runs unattended.
+    const targets = await list(job.entity, filter, { user: owner });
+    const ids = targets.map(r => r.id);
+
+    let result = { ok: true, total: 0, succeeded: 0, failed: 0, results: [] };
+    if (ids.length) {
+      result = await runBulkOperation(job.entity, spec, ids, action, owner);
+    }
+
+    const nextRunAt = nowTs + job.interval_minutes * 60;
+    await update('scheduled_job', job.id, { last_run_at: nowTs, next_run_at: nextRunAt });
+    log.info(`Job "${job.name}" ran: ${result.succeeded}/${result.total} succeeded`);
+    return { job_id: job.id, ok: true, ...result };
+  } catch (err) {
+    log.error(`Job "${job.name}" failed: ${err.message}`);
+    const nextRunAt = nowTs + job.interval_minutes * 60;
+    await update('scheduled_job', job.id, { last_run_at: nowTs, next_run_at: nextRunAt }).catch(() => {});
+    return { job_id: job.id, ok: false, error: err.message };
+  }
+}
+
+export function startScheduler() {
+  if (intervalHandle) return intervalHandle;
+  intervalHandle = setInterval(() => {
+    runDueJobs().catch(e => log.error(e.message));
+  }, CHECK_INTERVAL_MS);
+  if (intervalHandle.unref) intervalHandle.unref();
+  return intervalHandle;
+}
+
+export function stopScheduler() {
+  if (intervalHandle) { clearInterval(intervalHandle); intervalHandle = null; }
+}

package/src/lib/validation/entity-validators.js

@@ -45,6 +45,18 @@ export async function validateField(fieldDef, value, options = {}) {
     }
   }
 
+  // Multi-select: value validated as array by validateType above; membership checked here (needs entityName for option-list resolution, same as enum)
+  if (fieldDef.type === 'multiselect' && fieldDef.options) {
+    const allowed = resolveEnumOptions(fieldDef, entityName);
+    const arr = Array.isArray(value) ? value : (typeof value === 'string' ? JSON.parse(value) : []);
+    if (allowed.length > 0 && arr.some(v => !allowed.includes(v))) {
+      return {
+        valid: false,
+        error: `Invalid value(s) for '${fieldName}'. Expected values from: ${allowed.join(', ')}`,
+      };
+    }
+  }
+
   // Reference validation
   if (fieldDef.type === 'ref' && fieldDef.ref) {
     if (existingValue !== undefined && value === existingValue) {
@@ -72,14 +84,24 @@ function validateType(fieldDef, value, fieldName) {
 
   if (type === 'string' || type === 'text') {
     if (typeof value !== 'string') return `Field '${fieldName}' must be a string`;
-  } else if (type === 'number' || type === 'int' || type === 'decimal') {
+  } else if (type === 'number' || type === 'int' || type === 'decimal' || type === 'currency') {
     if (typeof value !== 'number' || isNaN(value)) return `Field '${fieldName}' must be a number`;
+    if (type === 'currency' && !Number.isInteger(value)) return `Field '${fieldName}' must be an integer number of cents`;
+    if (fieldDef.step && (value % fieldDef.step !== 0)) return `Field '${fieldName}' must be a multiple of ${fieldDef.step}`;
     if (min !== undefined && value < min) return `Field '${fieldName}' must be at least ${min}`;
     if (max !== undefined && value > max) return `Field '${fieldName}' must be at most ${max}`;
   } else if (type === 'boolean' || type === 'bool') {
     if (typeof value !== 'boolean') return `Field '${fieldName}' must be a boolean`;
   } else if (type === 'timestamp' || type === 'date') {
     if (isNaN(Number(value))) return `Field '${fieldName}' must be a valid timestamp`;
+  } else if (type === 'multiselect') {
+    const arr = Array.isArray(value) ? value : (typeof value === 'string' ? (() => { try { return JSON.parse(value); } catch { return null; } })() : null);
+    if (!Array.isArray(arr)) return `Field '${fieldName}' must be an array`;
+  } else if (type === 'file' || type === 'attachment') {
+    const f = typeof value === 'string' ? (() => { try { return JSON.parse(value); } catch { return null; } })() : value;
+    if (!f || typeof f !== 'object' || typeof f.stored_name !== 'string' || typeof f.url !== 'string') {
+      return `Field '${fieldName}' must be file metadata with stored_name and url`;
+    }
   } else if (type === 'json') {
     if (typeof value === 'string') {
       try { JSON.parse(value); } catch { return `Field '${fieldName}' must be valid JSON`; }

package/src/server/server.js

@@ -1,6 +1,7 @@
 import http from 'http';
 import path from 'path';
 import fs from 'fs';
+import crypto from 'crypto';
 import { fileURLToPath } from 'url';
 import { createLogger } from '../lib/logger.js';
 import { getLucia } from '../engine.server.js';
@@ -72,6 +73,8 @@ export function createServer(options) {
     });
   };
 
+  import('../lib/scheduler-engine.js').then(({ startScheduler }) => startScheduler()).catch(e => log.error(e.message));
+
   const server = http.createServer(async (req, res) => {
     globalThis.__debug__.activeRequests.count++;
 
@@ -146,6 +149,22 @@ export function createServer(options) {
           return await handleDeleteEntityTemplate(req, res, id, thatcher, configEngine);
         }
 
+        if (req.method === 'POST' && entity === 'upload' && !id) {
+          return await handleFileUpload(req, res, thatcher, configEngine);
+        }
+
+        if (req.method === 'POST' && entity === 'scheduled_job' && id === 'create' && !action) {
+          return await handleCreateScheduledJob(req, res, thatcher, configEngine);
+        }
+
+        if (req.method === 'POST' && entity === 'scheduled_job' && id && action === 'update') {
+          return await handleUpdateScheduledJob(req, res, id, thatcher, configEngine);
+        }
+
+        if (req.method === 'POST' && entity === 'scheduled_job' && id && action === 'delete') {
+          return await handleDeleteScheduledJob(req, res, id, thatcher, configEngine);
+        }
+
         // Check if user has custom route for this
         const userRoutePath = path.join(process.cwd(), 'app/api', ...parts, 'route.js');
         const routeExists = await fileExists(userRoutePath);
@@ -206,6 +225,25 @@ async function serveStaticFile(pathname, req, res) {
     // Could serve SPA
     return false;
   }
+  if (pathname.startsWith('/uploads/')) {
+    // basename strips any traversal the URL decoder let through; uploaded
+    // files are served read-only, by their sanitized stored name only.
+    const name = path.basename(pathname.slice('/uploads/'.length));
+    const filePath = path.join(process.cwd(), 'uploads', name);
+    try {
+      if (await fileExists(filePath) && path.dirname(filePath) === path.join(process.cwd(), 'uploads')) {
+        const content = await fs.promises.readFile(filePath);
+        res.setHeader('Content-Type', 'application/octet-stream');
+        res.setHeader('Content-Disposition', `attachment; filename="${name}"`);
+        res.writeHead(200);
+        res.end(content);
+        return true;
+      }
+    } catch (err) {
+      if (err.code !== 'ENOENT') staticLog.error(`${filePath} ${err.code}`, { message: err.message });
+    }
+    return false;
+  }
   // Try to serve from public/ or static/
   const filePath = path.join(process.cwd(), 'public', pathname);
   try {
@@ -517,6 +555,145 @@ async function handleDeleteEntityTemplate(req, res, templateId, thatcher, config
   }
 }
 
+async function handleCreateScheduledJob(req, res, thatcher, configEngineArg) {
+  const user = await requireAuthedPartner(req, res);
+  if (!user) return;
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const { name, entity, action, filter, interval_minutes } = body || {};
+  if (!entity || typeof entity !== 'string') {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'entity required' }));
+    return;
+  }
+  try {
+    configEngine.generateEntitySpec(entity);
+  } catch {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: `Unknown entity "${entity}"` }));
+    return;
+  }
+  if (!name || typeof name !== 'string' || !name.trim()) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'name required' }));
+    return;
+  }
+  if (!action || typeof action !== 'object' || typeof action.type !== 'string') {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'action.type required' }));
+    return;
+  }
+  const intervalMinutes = Number(interval_minutes);
+  if (!Number.isFinite(intervalMinutes) || intervalMinutes <= 0) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'interval_minutes must be a positive number' }));
+    return;
+  }
+
+  try {
+    const { create } = await import('../lib/busybase/store.js');
+    const { now } = await import('../lib/id-helpers.js');
+    const nowTs = now();
+    const record = await create('scheduled_job', {
+      name: name.trim(),
+      entity,
+      action,
+      filter: filter || {},
+      interval_minutes: intervalMinutes,
+      last_run_at: null,
+      next_run_at: nowTs,
+      enabled: true,
+      owner_id: user.id,
+    }, user);
+    res.writeHead(201, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, id: record.id }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function handleUpdateScheduledJob(req, res, jobId, thatcher, configEngineArg) {
+  const user = await requireAuthedPartner(req, res);
+  if (!user) return;
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+
+  try {
+    const { update, get } = await import('../lib/busybase/store.js');
+    const existing = await get('scheduled_job', jobId);
+    if (!existing) {
+      res.writeHead(404);
+      res.end(JSON.stringify({ error: 'Job not found' }));
+      return;
+    }
+    const patch = {};
+    if (typeof body?.enabled === 'boolean') patch.enabled = body.enabled;
+    if (typeof body?.name === 'string' && body.name.trim()) patch.name = body.name.trim();
+    if (body?.interval_minutes !== undefined) {
+      const intervalMinutes = Number(body.interval_minutes);
+      if (!Number.isFinite(intervalMinutes) || intervalMinutes <= 0) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: 'interval_minutes must be a positive number' }));
+        return;
+      }
+      patch.interval_minutes = intervalMinutes;
+    }
+    if (body?.filter !== undefined) patch.filter = body.filter;
+    if (body?.action !== undefined) patch.action = body.action;
+    const record = await update('scheduled_job', jobId, patch);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, data: record }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function handleDeleteScheduledJob(req, res, jobId, thatcher, configEngineArg) {
+  const user = await requireAuthedPartner(req, res);
+  if (!user) return;
+
+  try {
+    const { remove, get } = await import('../lib/busybase/store.js');
+    const existing = await get('scheduled_job', jobId);
+    if (!existing) {
+      res.writeHead(404);
+      res.end(JSON.stringify({ error: 'Job not found' }));
+      return;
+    }
+    await remove('scheduled_job', jobId);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleCreateWebhook(req, res, thatcher, configEngineArg) {
   const user = await requireAuthedPartner(req, res);
   if (!user) return;
@@ -935,6 +1112,119 @@ async function handleCsvImport(req, res, entity, thatcher, configEngineArg) {
   }
 }
 
+const UPLOAD_ALLOWED_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'application/pdf', 'text/plain', 'text/csv', 'application/json']);
+const UPLOAD_MAX_SIZE = 10 * 1024 * 1024;
+const UPLOAD_DIR = path.join(process.cwd(), 'uploads');
+
+// Sanitize to a flat, extension-preserving, path-traversal-safe name: strip
+// any directory component, keep only [a-zA-Z0-9._-], cap length. The stored
+// filename is never the client-supplied one directly -- a random prefix
+// prevents overwrite/collision and the sanitization prevents "../../etc" or
+// null-byte tricks reaching fs.writeFile.
+function sanitizeUploadFilename(name) {
+  const base = path.basename(String(name || 'file')).replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 128) || 'file';
+  const prefix = crypto.randomBytes(8).toString('hex');
+  return `${prefix}_${base}`;
+}
+
+async function readMultipartFile(req) {
+  const ct = req.headers['content-type'] || '';
+  const boundaryMatch = ct.match(/boundary=(?:"([^"]+)"|([^;]+))/i);
+  if (!boundaryMatch) throw new Error('Multipart boundary not found');
+  const boundary = '--' + (boundaryMatch[1] || boundaryMatch[2]).trim();
+
+  const chunks = [];
+  let size = 0;
+  await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => { req.destroy(); reject(new Error('Request timeout')); }, 30000);
+    req.on('data', chunk => {
+      size += chunk.length;
+      if (size > UPLOAD_MAX_SIZE) { clearTimeout(timeout); req.destroy(); reject(new Error('File too large')); return; }
+      chunks.push(chunk);
+    });
+    req.on('end', () => { clearTimeout(timeout); resolve(); });
+    req.on('error', (err) => { clearTimeout(timeout); reject(err); });
+  });
+
+  const buf = Buffer.concat(chunks);
+  const boundaryBuf = Buffer.from(boundary);
+  const parts = [];
+  let start = buf.indexOf(boundaryBuf);
+  while (start !== -1) {
+    const next = buf.indexOf(boundaryBuf, start + boundaryBuf.length);
+    if (next === -1) break;
+    parts.push(buf.slice(start + boundaryBuf.length, next));
+    start = next;
+  }
+
+  for (const part of parts) {
+    const headerEnd = part.indexOf('\r\n\r\n');
+    if (headerEnd === -1) continue;
+    const headerText = part.slice(0, headerEnd).toString('utf-8');
+    if (!/name="file"/i.test(headerText)) continue;
+    const filenameMatch = headerText.match(/filename="([^"]*)"/i);
+    if (!filenameMatch || !filenameMatch[1]) continue;
+    const typeMatch = headerText.match(/Content-Type:\s*([^\r\n]+)/i);
+    const contentType = (typeMatch ? typeMatch[1] : 'application/octet-stream').trim();
+    let body = part.slice(headerEnd + 4);
+    if (body.slice(-2).toString() === '\r\n') body = body.slice(0, -2);
+    return { filename: filenameMatch[1], contentType, buffer: body };
+  }
+  throw new Error('No file field found in upload');
+}
+
+async function handleFileUpload(req, res, thatcher, configEngineArg) {
+  const user = await resolveRequestUser(req);
+  if (!user) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required' }));
+    return;
+  }
+
+  let file;
+  try {
+    file = await readMultipartFile(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+
+  if (!UPLOAD_ALLOWED_TYPES.has(file.contentType)) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: `Unsupported file type: ${file.contentType}` }));
+    return;
+  }
+  if (file.buffer.length === 0) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'Empty file' }));
+    return;
+  }
+
+  try {
+    await fs.promises.mkdir(UPLOAD_DIR, { recursive: true });
+    const storedName = sanitizeUploadFilename(file.filename);
+    const destPath = path.join(UPLOAD_DIR, storedName);
+    // Belt-and-suspenders: confirm the resolved path is still inside UPLOAD_DIR
+    // even though sanitizeUploadFilename already strips traversal sequences.
+    if (path.dirname(destPath) !== UPLOAD_DIR) throw new Error('Invalid upload path');
+    await fs.promises.writeFile(destPath, file.buffer);
+    res.writeHead(201, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({
+      filename: file.filename,
+      stored_name: storedName,
+      content_type: file.contentType,
+      size: file.buffer.length,
+      url: `/uploads/${storedName}`,
+      uploaded_by: user.id,
+    }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function readBody(req) {
   return new Promise((resolve, reject) => {
     let data = '';

package/src/ui/entity-renderer.js

@@ -63,7 +63,7 @@ function roleLabel(r) {
   return KNOWN_ROLE_LABELS[key] || (key.length > 8 ? 'Staff' : (key.charAt(0).toUpperCase() + key.slice(1)))
 }
 
-function formatFieldValue(k, v, entityName) {
+function formatFieldValue(k, v, entityName, f) {
   if (entityName === 'user' && k === 'role') return `<span class="pill pill-neutral">${roleLabel(v)}</span>`
   if (entityName === 'user' && k === 'status') {
     const cls = v === 'active' ? 'pill-success' : v === 'deleted' ? 'pill-danger' : 'pill-neutral'
@@ -71,6 +71,15 @@ function formatFieldValue(k, v, entityName) {
   }
   if (entityName === 'user' && k === 'email' && v) { const e = esc(v); return `<a href="mailto:${e}" class="text-primary hover:underline">${e}</a>` }
   if (k === 'photo_url' && v && v.startsWith('http')) return `<img src="${esc(v)}" style="width:2.5rem;height:2.5rem;border-radius:50%;object-fit:cover" alt="avatar" onerror="this.style.display='none'"/>`
+  if (f?.type === 'currency' && typeof v === 'number') return esc((f.currency_symbol || '$') + (v / 100).toFixed(2))
+  if (f?.type === 'multiselect') {
+    const arr = Array.isArray(v) ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return [] } })() : [])
+    return arr.length ? arr.map(x => `<span class="pill pill-neutral" style="margin-right:4px">${esc(x)}</span>`).join('') : '-'
+  }
+  if (f?.type === 'file' || f?.type === 'attachment') {
+    const meta = typeof v === 'object' && v ? v : (typeof v === 'string' && v ? (() => { try { return JSON.parse(v) } catch { return null } })() : null)
+    return meta?.url ? `<a href="${esc(meta.url)}" class="text-primary hover:underline" target="_blank" rel="noopener">${esc(meta.filename || 'Download')}</a>` : '-'
+  }
   return fmtVal(v, k)
 }
 
@@ -85,7 +94,7 @@ export function renderEntityDetail(entityName, item, spec, user) {
   const fieldRows = visibleFields.map(([k, f]) =>
     `<div class="detail-row">
       <span class="detail-row-label">${esc(f.label || k)}</span>
-      <span class="detail-row-value">${formatFieldValue(k, item[k], entityName)}</span>
+      <span class="detail-row-value">${formatFieldValue(k, item[k], entityName, f)}</span>
     </div>`
   ).join('')
 
@@ -159,6 +168,21 @@ export function renderEntityForm(entityName, item, spec, user, isNew = false, re
       const opts = (Array.isArray(f.options) ? f.options : []).map(o => { const ov = typeof o === 'string' ? o : o.value; const ol = typeof o === 'string' ? o : o.label; return `<option value="${esc(ov)}" ${val===ov?'selected':''}>${esc(ol)}</option>` }).join('')
       return `<div class="form-field">${lbl(k,f,f.required)}<select id="field-${k}" name="${k}" class="form-input" ${req}><option value="">Select ${esc(f.label||k)}...</option>${opts}</select></div>`
     }
+    if (f.type === 'multiselect' && f.options) {
+      const selected = new Set(Array.isArray(val) ? val : (typeof val === 'string' && val ? (() => { try { return JSON.parse(val) } catch { return [] } })() : []))
+      const opts = (Array.isArray(f.options) ? f.options : []).map(o => { const ov = typeof o === 'string' ? o : o.value; const ol = typeof o === 'string' ? o : o.label; return `<label style="display:flex;align-items:center;gap:6px;margin:2px 0"><input type="checkbox" name="${k}[]" value="${esc(ov)}" class="checkbox checkbox-primary" ${selected.has(ov)?'checked':''}/><span>${esc(ol)}</span></label>` }).join('')
+      return `<div class="form-field full">${lbl(k,f,f.required)}<div id="field-${k}" data-multiselect="${k}">${opts}</div></div>`
+    }
+    if (f.type === 'currency') {
+      const symbol = esc(f.currency_symbol || '$')
+      const decimalVal = typeof val === 'number' ? (val / 100).toFixed(2) : val
+      return `<div class="form-field">${lbl(k,f,f.required)}<div style="display:flex;align-items:center;gap:6px"><span>${symbol}</span><input type="number" step="0.01" id="field-${k}" name="${k}" value="${esc(decimalVal)}" class="form-input" data-currency="${k}" ${req} placeholder="0.00"/></div></div>`
+    }
+    if (f.type === 'file' || f.type === 'attachment') {
+      const existing = val && typeof val === 'object' ? val : (typeof val === 'string' && val ? (() => { try { return JSON.parse(val) } catch { return null } })() : null)
+      const existingNote = existing?.filename ? `<div style="font-size:0.8rem;color:var(--color-text-muted)" data-existing-file="${k}">Current: ${esc(existing.filename)}</div>` : ''
+      return `<div class="form-field">${lbl(k,f,f.required)}<input type="file" id="field-${k}" data-attachment="${k}" class="form-input" ${existing ? '' : req}/>${existingNote}<input type="hidden" id="field-${k}-value" name="${k}" value="${existing ? esc(JSON.stringify(existing)) : ''}"/></div>`
+    }
     return `<div class="form-field">${lbl(k,f,f.required)}<input type="${type}" id="field-${k}" name="${k}" value="${esc(val)}" class="form-input" ${req} ${placeholder}/></div>`
   }).join('\n')
 
@@ -176,7 +200,7 @@ export function renderEntityForm(entityName, item, spec, user, isNew = false, re
     <div class="form-section"><form id="entity-form" class="form-grid" aria-label="${isNew ? 'Create' : 'Edit'} ${esc(label)}">${templatePicker}${formFields}${pwField}
     <div class="form-actions" style="grid-column:1/-1"><button type="submit" id="submit-btn" class="btn-primary-clean"><span class="btn-text">Save</span><span class="btn-loading-text" style="display:none">Saving...</span></button>
     <a href="/${entityName}${isNew ? '' : '/' + item?.id}" class="btn-ghost-clean">Cancel</a></div></form></div></div>`
-  const script = `${TOAST_SCRIPT}const form=document.getElementById('entity-form');const sb=document.getElementById('submit-btn');form.addEventListener('submit',async(e)=>{e.preventDefault();sb.classList.add('btn-loading');sb.querySelector('.btn-text').style.display='none';sb.querySelector('.btn-loading-text').style.display='inline';sb.disabled=true;const fd=new FormData(form);const data={};for(const[k,v]of fd.entries())data[k]=v;form.querySelectorAll('input[type=checkbox]').forEach(cb=>{data[cb.name]=cb.checked});form.querySelectorAll('input[type=number]').forEach(inp=>{if(inp.name&&data[inp.name]!==undefined&&data[inp.name]!=='')data[inp.name]=Number(data[inp.name])});const url=${isNew}?'/api/${entityName}':'/api/${entityName}/${item?.id}';const method=${isNew}?'POST':'PUT';try{const res=await fetch(url,{method,headers:{'Content-Type':'application/json'},body:JSON.stringify(data)});const result=await res.json();if(res.ok){showToast('${isNew?'Created':'Updated'} successfully!','success');const ed=result.data||result;setTimeout(()=>{window.location='/${entityName}/'+(ed.id||'${item?.id}')},500)}else{showToast(result.message||result.error||'Save failed','error');sb.classList.remove('btn-loading');sb.querySelector('.btn-text').style.display='inline';sb.querySelector('.btn-loading-text').style.display='none';sb.disabled=false}}catch(err){showToast('Error: '+err.message,'error');sb.classList.remove('btn-loading');sb.querySelector('.btn-text').style.display='inline';sb.querySelector('.btn-loading-text').style.display='none';sb.disabled=false}})`
+  const script = `${TOAST_SCRIPT}const form=document.getElementById('entity-form');const sb=document.getElementById('submit-btn');form.addEventListener('submit',async(e)=>{e.preventDefault();sb.classList.add('btn-loading');sb.querySelector('.btn-text').style.display='none';sb.querySelector('.btn-loading-text').style.display='inline';sb.disabled=true;try{const fileInputs=[...form.querySelectorAll('input[type=file][data-attachment]')];for(const fi of fileInputs){const f=fi.files&&fi.files[0];if(!f)continue;const uf=new FormData();uf.append('file',f);const ures=await fetch('/api/upload',{method:'POST',body:uf});const ud=await ures.json();if(!ures.ok)throw new Error(ud.error||'File upload failed');const hidden=document.getElementById('field-'+fi.dataset.attachment+'-value');hidden.value=JSON.stringify(ud)}const fd=new FormData(form);const data={};for(const[k,v]of fd.entries()){if(k.endsWith('[]'))continue;data[k]=v}form.querySelectorAll('input[type=checkbox]:not([name$="[]"])').forEach(cb=>{data[cb.name]=cb.checked});form.querySelectorAll('[data-multiselect]').forEach(ms=>{const name=ms.dataset.multiselect;data[name]=[...ms.querySelectorAll('input[type=checkbox]:checked')].map(cb=>cb.value)});form.querySelectorAll('input[type=number]:not([data-currency])').forEach(inp=>{if(inp.name&&data[inp.name]!==undefined&&data[inp.name]!=='')data[inp.name]=Number(data[inp.name])});form.querySelectorAll('input[data-currency]').forEach(inp=>{const name=inp.dataset.currency;if(inp.value!=='')data[name]=Math.round(Number(inp.value)*100)});const url=${isNew}?'/api/${entityName}':'/api/${entityName}/${item?.id}';const method=${isNew}?'POST':'PUT';const res=await fetch(url,{method,headers:{'Content-Type':'application/json'},body:JSON.stringify(data)});const result=await res.json();if(res.ok){showToast('${isNew?'Created':'Updated'} successfully!','success');const ed=result.data||result;setTimeout(()=>{window.location='/${entityName}/'+(ed.id||'${item?.id}')},500)}else{showToast(result.message||result.error||'Save failed','error');sb.classList.remove('btn-loading');sb.querySelector('.btn-text').style.display='inline';sb.querySelector('.btn-loading-text').style.display='none';sb.disabled=false}}catch(err){showToast('Error: '+err.message,'error');sb.classList.remove('btn-loading');sb.querySelector('.btn-text').style.display='inline';sb.querySelector('.btn-loading-text').style.display='none';sb.disabled=false}})`
   return page(user, `${isNew ? 'Create' : 'Edit'} ${label}`, bc, content, [script])
 }
 

package/src/ui/page-handler-admin.js

@@ -10,6 +10,7 @@ import { renderWorkflowList, renderWorkflowEditor } from '@/ui/workflow-builder-
 import { renderRolesList, renderTemplateList, renderPermissionMatrix } from '@/ui/rbac-renderer.js';
 import { renderWebhookList, renderWebhookDetail } from '@/ui/webhook-renderer.js';
 import { renderTemplateList as renderEntityTemplateList } from '@/ui/template-renderer.js';
+import { renderScheduledJobList } from '@/ui/scheduled-job-renderer.js';
 import { isPartner, isManager } from '@/ui/permissions-ui.js';
 import { getSystemConfig, getSettingsCounts, getAuditData, getSystemHealth, renderBuildLogsContent } from '@/ui/page-handler-helpers.js';
 import { fileURLToPath } from 'url';
@@ -191,5 +192,13 @@ export async function handleAdminPage(normalized, segments, user) {
     }
     return renderEntityTemplateList(user, entityNames, templatesByEntity);
   }
+  if (normalized === '/admin/scheduled-jobs') {
+    if (!isPartner(user)) return renderAccessDenied(user, 'admin', 'view');
+    const { getConfigEngineSync } = await import('@/lib/config-generator-engine.js');
+    const engine = getConfigEngineSync();
+    const entityNames = engine.getAllEntities().filter(e => e !== 'scheduled_job' && e !== 'entity_template' && e !== 'webhook' && e !== 'webhook_delivery' && e !== 'user_organization');
+    let jobs = []; try { jobs = await list('scheduled_job', {}); } catch {}
+    return renderScheduledJobList(user, jobs, entityNames);
+  }
   return null;
 }

package/src/ui/scheduled-job-renderer.js

@@ -0,0 +1,92 @@
+import { page } from '@/ui/layout.js';
+import { esc } from '@/ui/render-helpers.js';
+
+function fmtTs(ts) {
+  if (!ts) return '-';
+  return new Date(ts * 1000).toISOString().replace('T', ' ').slice(0, 19);
+}
+
+export function renderScheduledJobList(user, jobs, entityNames) {
+  const rows = jobs.map(j => {
+    const statusPill = j.enabled ? `<span class="pill pill-success">Enabled</span>` : `<span class="pill pill-neutral">Disabled</span>`;
+    const toggleLabel = j.enabled ? 'Disable' : 'Enable';
+    return `<tr>
+      <td>${esc(j.name)}</td>
+      <td>${esc(j.entity)}</td>
+      <td>${esc(String(j.interval_minutes))} min</td>
+      <td>${statusPill}</td>
+      <td>${esc(fmtTs(j.last_run_at))}</td>
+      <td>${esc(fmtTs(j.next_run_at))}</td>
+      <td style="display:flex;gap:8px">
+        <button type="button" class="btn-ghost-clean" data-action="toggleJob" data-args='["${esc(j.id)}", ${j.enabled ? 'false' : 'true'}]'>${toggleLabel}</button>
+        <button type="button" class="btn-ghost-clean" data-action="deleteJob" data-args='["${esc(j.id)}"]'>Delete</button>
+      </td>
+    </tr>`;
+  }).join('') || '<tr><td colspan="7">No scheduled jobs</td></tr>';
+
+  const entityOpts = entityNames.map(e => `<option value="${esc(e)}">${esc(e)}</option>`).join('');
+
+  const content = `<div class="page-header"><h1 class="page-title">Scheduled Jobs</h1></div>
+    <div class="card-clean" style="margin-bottom:16px"><div class="card-clean-body">
+      <table class="data-table"><thead><tr><th>Name</th><th>Entity</th><th>Interval</th><th>Status</th><th>Last Run</th><th>Next Run</th><th></th></tr></thead><tbody>${rows}</tbody></table>
+    </div></div>
+    <div class="card-clean"><div class="card-clean-body">
+      <h3 style="margin-bottom:8px">New Scheduled Job</h3>
+      <div style="display:flex;flex-direction:column;gap:8px;max-width:480px">
+        <input type="text" id="new-job-name" placeholder="Job name" class="form-input">
+        <select id="new-job-entity" class="form-input"><option value="">Select entity...</option>${entityOpts}</select>
+        <select id="new-job-action-type" class="form-input">
+          <option value="delete">Delete matching records</option>
+          <option value="set_field">Set field on matching records</option>
+        </select>
+        <input type="text" id="new-job-field" placeholder="Field name (for set_field)" class="form-input">
+        <input type="text" id="new-job-value" placeholder="Value (for set_field)" class="form-input">
+        <input type="text" id="new-job-filter" placeholder='Filter JSON, e.g. {"status":"pending"}' class="form-input">
+        <input type="number" id="new-job-interval" placeholder="Interval (minutes)" class="form-input" min="1">
+        <button type="button" class="btn-primary-clean" data-action="createJob">Create Job</button>
+      </div>
+    </div></div>
+    <span id="job-status" style="font-size:13px"></span>`;
+
+  const script = `(function(){
+    window.createJob=function(){
+      var status=document.getElementById('job-status');
+      var name=(document.getElementById('new-job-name').value||'').trim();
+      var entity=document.getElementById('new-job-entity').value;
+      var actionType=document.getElementById('new-job-action-type').value;
+      var field=(document.getElementById('new-job-field').value||'').trim();
+      var value=document.getElementById('new-job-value').value;
+      var filterRaw=(document.getElementById('new-job-filter').value||'').trim();
+      var interval=Number(document.getElementById('new-job-interval').value);
+      if(!name){status.textContent='Name required';return}
+      if(!entity){status.textContent='Entity required';return}
+      if(!interval||interval<=0){status.textContent='Interval must be a positive number';return}
+      var filter={};
+      if(filterRaw){try{filter=JSON.parse(filterRaw)}catch(e){status.textContent='Filter must be valid JSON';return}}
+      var action=actionType==='set_field'?{type:'set_field',field:field,value:value}:{type:'delete'};
+      status.textContent='Creating...';
+      fetch('/api/scheduled_job/create',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({name:name,entity:entity,action:action,filter:filter,interval_minutes:interval})})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){location.reload()}else{status.textContent='Error: '+(res.d.error||'create failed')}})
+        .catch(function(err){status.textContent='Error: '+err.message});
+    };
+    window.toggleJob=function(id,enabled){
+      var status=document.getElementById('job-status');
+      status.textContent='Updating...';
+      fetch('/api/scheduled_job/'+id+'/update',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({enabled:enabled})})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){location.reload()}else{status.textContent='Error: '+(res.d.error||'update failed')}})
+        .catch(function(err){status.textContent='Error: '+err.message});
+    };
+    window.deleteJob=function(id){
+      var status=document.getElementById('job-status');
+      status.textContent='Deleting...';
+      fetch('/api/scheduled_job/'+id+'/delete',{method:'POST'})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){location.reload()}else{status.textContent='Error: '+(res.d.error||'delete failed')}})
+        .catch(function(err){status.textContent='Error: '+err.message});
+    };
+  })();`;
+
+  return page(user, 'Scheduled Jobs | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { label: 'Scheduled Jobs' }], content, [script]);
+}