thatcher 1.0.7 → 1.0.34

package/README.md

@@ -12,7 +12,7 @@ Thatcher is a complete extraction of the moonlanding application framework. Buil
 - **Plugin System** — Extend entities with hooks, validators, and custom fields
 - **External Integrations** — Google Drive/Gmail, Email (SMTP), PDF generation
 - **Hot Reload** — Config changes reflect instantly without restart
-- **Production-Ready** — SQLite, WAL mode, connection pooling, metrics, audit logging
+- **Production-Ready** — busybase (LanceDB) document store, vector search, metrics, audit logging
 
 ## Quick Start
 
@@ -84,7 +84,7 @@ thresholds:
 ```
 
 That's it. Start the server and you have:
-- SQLite tables `item` with correct schema
+- busybase `item` table (schemaless; created on first insert)
 - REST endpoints: `GET/POST/PUT/DELETE /api/item`
 - Role-based permissions enforced
 - State transitions via `POST /api/item/:id/transition`
@@ -143,7 +143,7 @@ thatcher/
 │   │   ├── env.js               # Environment config
 │   │   └── constants.js         # HTTP codes, statuses
 │   ├── lib/
-│   │   ├── database-core.js     # SQLite init, migrations
+│   │   ├── busybase-store.js    # busybase data layer (async CRUD)
 │   │   ├── query-engine.js      # Read operations (GET, search)
 │   │   ├── query-engine-write.js # Write operations (CRUD)
 │   │   ├── config-generator-engine.js  # Spec builder
@@ -359,7 +359,7 @@ All APIs accessible via thatcher instance:
 | Variable | Purpose | Default |
 |----------|---------|---------|
 | `PORT` | Server port | 3000 |
-| `DATABASE_PATH` | SQLite file path | `./data/app.db` |
+| `BUSYBASE_DIR` | busybase data directory | `busybase_data` |
 | `NODE_ENV` | `development` \| `production` | `development` |
 | `DEBUG` | Enable debug logging | `false` |
 | `GOOGLE_CLIENT_ID` | OAuth client ID | — |
@@ -370,18 +370,6 @@ All APIs accessible via thatcher instance:
 | `EMAIL_USER` | SMTP username | — |
 | `EMAIL_PASSWORD` | SMTP password | — |
 
-## Migrating from Moonlanding
-
-Thatcher is a drop-in replacement for moonlanding's core:
-
-1. Copy `master-config.yml` → `thatcher.config.yml`
-2. Move any `.plugin.js` files to new project's `plugins/`
-3. Change import paths: `@/lib/...` → `thatcher/...`
-4. Replace `import ... from '@/engine'` with `thatcher.*` methods
-5. Update server initialization: `new Thatcher({ config: '...' })`
-
-All business logic remains in config and plugins — no code changes required.
-
 ## Publishing
 
 Thatcher is published to npm as `thatcher`. Every push to `main` triggers:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thatcher",
-  "version": "1.0.7",
-  "description": "A config-driven application framework for building data-intensive web apps without code. 100% feature-complete extraction from moonlanding.",
+  "version": "1.0.34",
+  "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",
   "exports": {
@@ -15,8 +15,7 @@
     "./config/*.js": "./src/config/*.js",
     "./services/*": "./src/services/*.js",
     "./services/*.js": "./src/services/*.js",
-    "./migration/*": "./src/migration/*.js",
-    "./validation/*": "./src/validation/*.js",
+    "./validation/*": "./src/lib/validation/*.js",
     "./adapters/*": "./src/adapters/*.js",
     "./plugins/*": "./src/plugins/*.js",
     "./package.json": "./package.json"
@@ -28,7 +27,7 @@
   "scripts": {
     "dev": "bun run src/cli.js dev",
     "start": "bun run src/cli.js start",
-    "test": "bun test",
+    "test": "node test.js",
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit"
   },
@@ -41,32 +40,27 @@
     "workflow",
     "sdk",
     "bun",
-    "sqlite"
+    "busybase"
   ],
-  "author": "Extracted from moonlanding",
+  "author": "lanmower",
   "license": "MIT",
   "engines": {
     "node": ">=18.0.0",
     "bun": ">=1.0.0"
   },
   "dependencies": {
-    "@casl/ability": "^6.8.0",
-    "@lucia-auth/adapter-sqlite": "^3.0.2",
     "arctic": "^1.9.2",
-    "bcrypt": "^5.1.1",
-    "better-sqlite3": "^11.10.0",
-    "compression": "^1.8.1",
-    "googleapis": "^140.0.0",
+    "bcrypt": "^6.0.0",
+    "busybase": "^1.0.2",
+    "googleapis": "^173.0.0",
+    "hyperformula": "^3.2.0",
     "js-yaml": "^4.1.1",
     "lucia": "^3.2.2",
-    "nanoid": "^5.0.7",
-    "nodemailer": "^6.9.7",
-    "puppeteer": "^21.6.1",
+    "nodemailer": "^9.0.1",
     "webjsx": "^0.0.73",
-    "tsx": "^4.7.0"
+    "xstate": "^5.0.0"
   },
   "devDependencies": {
-    "@types/better-sqlite3": "^7.6.11",
     "@types/node": "^20.16.5",
     "eslint": "^8.56.0",
     "typescript": "^5.3.3"

package/src/adapters/google-auth.js

@@ -1,9 +1,7 @@
-/**
- * Google Auth Adapter - Factory for Google OAuth2 clients
- * Provides JWT and OAuth2 clients for Google APIs
- */
-
+import { createLogger } from '../lib/logger.js';
 import { google } from 'googleapis';
+
+const log = createLogger('[GoogleAuth]');
 import { buildConfig } from '../config/env.js';
 import fs from 'fs';
 import path from 'path';
@@ -11,10 +9,6 @@ import path from 'path';
 let _oauth2Client = null;
 let _jwtClient = null;
 
-/**
- * Initialize Google auth clients
- * @param {object} [config] - Optional config override
- */
 export function initGoogleAuth(config = null) {
   const cfg = config || buildConfig();
   const scopes = [
@@ -45,36 +39,23 @@ export function initGoogleAuth(config = null) {
         ],
       });
     } catch (err) {
-      console.warn('[GoogleAuth] Failed to load service account:', err.message);
+      log.warn('failed to load service account:', { message: err.message });
     }
   }
 
   return { oauth2: _oauth2Client, jwt: _jwtClient };
 }
 
-/**
- * Get OAuth2 client
- * @returns {OAuth2Client|null}
- */
 export function getOAuth2Client() {
   if (!_oauth2Client) initGoogleAuth();
   return _oauth2Client;
 }
 
-/**
- * Get JWT client (service account)
- * @returns {JWT|null}
- */
 export function getJWTClient() {
   if (!_jwtClient) initGoogleAuth();
   return _jwtClient;
 }
 
-/**
- * Generate OAuth2 authorization URL
- * @param {object} options - state, access_type, prompt, etc.
- * @returns {string}
- */
 export function generateAuthUrl(options = {}) {
   const client = getOAuth2Client();
   if (!client) throw new Error('Google OAuth not configured');
@@ -92,11 +73,6 @@ export function generateAuthUrl(options = {}) {
   });
 }
 
-/**
- * Exchange code for tokens
- * @param {string} code
- * @returns {Promise<object>} tokens
- */
 export async function exchangeCode(code) {
   const client = getOAuth2Client();
   if (!client) throw new Error('Google OAuth not configured');
@@ -105,22 +81,12 @@ export async function exchangeCode(code) {
   return tokens;
 }
 
-/**
- * Get user info from Google
- * @param {string} accessToken
- * @returns {Promise<object>}
- */
 export async function getUserInfo(accessToken) {
   const oauth2 = google.oauth2({ version: 'v2', auth: `Bearer ${accessToken}` });
   const res = await oauth2.userinfo.get();
   return res.data;
 }
 
-/**
- * Verify ID token
- * @param {string} idToken
- * @returns {Promise<object>}
- */
 export async function verifyIdToken(idToken) {
   const client = getOAuth2Client();
   if (!client) throw new Error('Google OAuth not configured');
@@ -132,11 +98,6 @@ export async function verifyIdToken(idToken) {
   return ticket.getPayload();
 }
 
-/**
- * Create OAuth2 client with refresh token
- * @param {string} refreshToken
- * @returns {OAuth2Client}
- */
 export function createClientWithRefresh(refreshToken) {
   const client = new google.auth.OAuth2(
     buildConfig().auth.google.clientId,

package/src/adapters/google-drive.js

@@ -1,8 +1,3 @@
-/**
- * Google Drive Adapter - File storage and manipulation
- * Upload, download, copy, export to PDF
- */
-
 import { google } from 'googleapis';
 import fs from 'fs';
 import path from 'path';
@@ -11,11 +6,6 @@ import { buildConfig } from '../config/env.js';
 
 const DRIVE_SCOPES = ['https://www.googleapis.com/auth/drive'];
 
-/**
- * Get authenticated Drive API client
- * @param {object} [user] - User with oauth_token, or null for service account
- * @returns {object}
- */
 export function getDriveClient(user = null) {
   let client;
 
@@ -33,14 +23,6 @@ export function getDriveClient(user = null) {
   return google.drive({ version: 'v3', auth: client });
 }
 
-/**
- * Upload a file to Google Drive
- * @param {string} filePath - Local file path
- * @param {string} name - File name in Drive
- * @param {object} [options] - { folderId, mimeType, parents }
- * @param {object} [user] - Optional user context
- * @returns {object} File metadata
- */
 export async function uploadFile(filePath, name, options = {}, user = null) {
   const drive = getDriveClient(user);
   const absPath = path.resolve(filePath);
@@ -61,13 +43,6 @@ export async function uploadFile(filePath, name, options = {}, user = null) {
   return res.data;
 }
 
-/**
- * Download file from Drive
- * @param {string} fileId
- * @param {string} [destPath] - If provided, write to file; else return buffer
- * @param {object} [user] - Optional user context
- * @returns {Buffer|string}
- */
 export async function downloadFile(fileId, destPath = null, user = null) {
   const drive = getDriveClient(user);
   const res = await drive.files.get(
@@ -87,14 +62,6 @@ export async function downloadFile(fileId, destPath = null, user = null) {
   return Buffer.from(res.data);
 }
 
-/**
- * Create a copy of a file in Drive
- * @param {string} fileId
- * @param {string} [newName]
- * @param {string} [folderId]
- * @param {object} [user]
- * @returns {object}
- */
 export async function copyFile(fileId, newName = null, folderId = null, user = null) {
   const drive = getDriveClient(user);
   const res = await drive.files.copy({
@@ -107,12 +74,6 @@ export async function copyFile(fileId, newName = null, folderId = null, user = n
   return res.data;
 }
 
-/**
- * Export Google Doc to PDF
- * @param {string} fileId
- * @param {object} [user]
- * @returns {Buffer}
- */
 export async function exportToPdf(fileId, user = null) {
   const drive = getDriveClient(user);
   const res = await drive.files.export(
@@ -122,28 +83,28 @@ export async function exportToPdf(fileId, user = null) {
   return Buffer.from(res.data);
 }
 
-/**
- * List files in folder
- * @param {string} [folderId]
- * @param {object} [query]
- * @param {object} [user]
- * @returns {Array}
- */
+// Escape a value for inclusion in a single-quoted Google Drive query string.
+// Drive Query Language escapes \ and ' with a backslash; without this an
+// attacker-controlled name/id/mimeType could inject query operators.
+function escapeGQLString(str) {
+  return String(str).replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+}
+
 export async function listFiles(folderId = null, query = {}, user = null) {
   const drive = getDriveClient(user);
   const qParts = [];
 
   if (folderId) {
-    qParts.push(`'${folderId}' in parents`);
+    qParts.push(`'${escapeGQLString(folderId)}' in parents`);
   }
   if (query.trashed === false) {
     qParts.push("trashed = false");
   }
   if (query.mimeType) {
-    qParts.push(`mimeType = '${query.mimeType}'`);
+    qParts.push(`mimeType = '${escapeGQLString(query.mimeType)}'`);
   }
   if (query.name) {
-    qParts.push(`name = '${query.name}'`);
+    qParts.push(`name = '${escapeGQLString(query.name)}'`);
   }
 
   const res = await drive.files.list({
@@ -155,36 +116,20 @@ export async function listFiles(folderId = null, query = {}, user = null) {
   return res.data.files || [];
 }
 
-/**
- * Delete file
- * @param {string} fileId
- * @param {object} [user]
- */
 export async function deleteFile(fileId, user = null) {
   const drive = getDriveClient(user);
   await drive.files.delete({ fileId });
 }
 
-/**
- * Get default root folder from config
- * @returns {string}
- */
 function getDefaultFolder() {
   const cfg = buildConfig();
   return cfg.drive.rootFolderId || 'root';
 }
 
-/**
- * Ensure folder exists, create if not
- * @param {string} name
- * @param {string} [parentId]
- * @param {object} [user]
- * @returns {string} folderId
- */
 export async function ensureFolder(name, parentId = null, user = null) {
   const drive = getDriveClient(user);
-  const queryParts = [`name = '${name}'`, "mimeType = 'application/vnd.google-apps.folder'"];
-  if (parentId) queryParts.push(`'${parentId}' in parents`);
+  const queryParts = [`name = '${escapeGQLString(name)}'`, "mimeType = 'application/vnd.google-apps.folder'"];
+  if (parentId) queryParts.push(`'${escapeGQLString(parentId)}' in parents`);
 
   const res = await drive.files.list({
     q: queryParts.join(' AND '),

package/src/app/api/audit/dashboard/route.js

@@ -1,9 +1,12 @@
 import { NextResponse } from '@/lib/next-polyfills';
+import { createLogger } from '@/lib/logger.js';
+
+const log = createLogger('[AuditDashboardAPI]');
 import { getUser, setCurrentRequest } from '@/engine.server';
 import {
   getPermissionAuditTrail, getPermissionAuditStats, getPermissionAuditBreakdown,
   getPermissionAuditByDateRange, searchPermissionAudit, getPermissionDiff,
-} from '@/lib/audit-logger';
+} from '@/lib/busybase-audit-reads';
 
 export async function GET(request) {
   setCurrentRequest(request);
@@ -28,10 +31,10 @@ export async function GET(request) {
     let data;
     switch (view) {
       case 'summary': {
-        const stats = getPermissionAuditStats();
-        const actionBreakdown = getPermissionAuditBreakdown('action');
-        const reasonBreakdown = getPermissionAuditBreakdown('reason_code');
-        const changes = getPermissionAuditByDateRange(startTs, nowTs, limit);
+        const stats = await getPermissionAuditStats();
+        const actionBreakdown = await getPermissionAuditBreakdown('action');
+        const reasonBreakdown = await getPermissionAuditBreakdown('reason_code');
+        const changes = await getPermissionAuditByDateRange(startTs, nowTs, limit);
         data = {
           period_days: days,
           total_changes: changes.length,
@@ -42,17 +45,17 @@ export async function GET(request) {
         break;
       }
       case 'recent':
-        data = { period: `Last ${days} days`, changes: getPermissionAuditByDateRange(startTs, nowTs, limit) };
+        data = { period: `Last ${days} days`, changes: await getPermissionAuditByDateRange(startTs, nowTs, limit) };
         break;
       case 'user':
         if (!userId) return NextResponse.json({ error: 'user_id required' }, { status: 400 });
-        data = { user_id: userId, changes: getPermissionAuditTrail({ userId, limit }) };
+        data = { user_id: userId, changes: await getPermissionAuditTrail({ userId, limit }) };
         break;
       case 'entity':
         if (!entityType || !entityId) return NextResponse.json({ error: 'entity_type and entity_id required' }, { status: 400 });
         data = {
           entity_type: entityType, entity_id: entityId,
-          timeline: getPermissionAuditTrail({ entityType, entityId, limit }).map(c => ({
+          timeline: (await getPermissionAuditTrail({ entityType, entityId, limit })).map(c => ({
             ...c, timestamp_iso: new Date(c.timestamp * 1000).toISOString(),
             diff: c.old_permissions && c.new_permissions ? getPermissionDiff(c.old_permissions, c.new_permissions) : null,
           })),
@@ -60,10 +63,10 @@ export async function GET(request) {
         break;
       case 'search':
         if (!searchTerm) return NextResponse.json({ error: 'search parameter required' }, { status: 400 });
-        data = { search_term: searchTerm, results: searchPermissionAudit(searchTerm, limit) };
+        data = { search_term: searchTerm, results: await searchPermissionAudit(searchTerm, limit) };
         break;
       case 'roles':
-        data = { changes: getPermissionAuditTrail({ limit }).filter(c => c.action === 'role_change') };
+        data = { changes: (await getPermissionAuditTrail({ limit })).filter(c => c.action === 'role_change') };
         break;
       default:
         return NextResponse.json({ error: `Unknown view: ${view}` }, { status: 400 });
@@ -71,7 +74,7 @@ export async function GET(request) {
 
     return NextResponse.json({ success: true, view, data });
   } catch (error) {
-    console.error('[AuditDashboardAPI] GET error:', error);
+    log.error('GET error:', { message: error.message });
     return NextResponse.json({ error: 'Failed to retrieve audit dashboard data', details: error.message }, { status: 500 });
   }
 }

package/src/app/api/audit/logs/route.js

@@ -25,7 +25,7 @@ export const GET = withErrorHandler(async (request) => {
   const page = parseInt(url.searchParams.get('page') || '1');
   const pageSize = parseInt(url.searchParams.get('pageSize') || '100');
 
-  const result = searchLogs(filters, page, pageSize);
+  const result = await searchLogs(filters, page, pageSize);
   return NextResponse.json(result);
 });
 
@@ -38,7 +38,7 @@ export const POST = withErrorHandler(async (request) => {
   const body = await request.json();
   if (body.action === 'rotate') {
     const daysOld = body.daysOld || 90;
-    const result = rotateLogsOlderThan(daysOld);
+    const result = await rotateLogsOlderThan(daysOld);
     return NextResponse.json({ success: true, archived: result.archived, archiveId: result.archiveId });
   }
 

package/src/app/api/audit/permissions/[id]/route.js

@@ -1,6 +1,9 @@
 import { NextResponse, cookies } from '@/lib/next-polyfills';
+import { createLogger } from '@/lib/logger.js';
+
+const log = createLogger('[AuditDetailAPI]');
 import { lucia } from '@/engine.server';
-import { getPermissionAuditById, getPermissionDiff } from '@/lib/audit-logger';
+import { getPermissionAuditById, getPermissionDiff } from '@/lib/busybase-audit-reads';
 
 async function getUser() {
   const sessionId = (await cookies()).get(lucia.sessionCookieName)?.value ?? null;
@@ -18,7 +21,7 @@ export async function GET(request, context) {
     const auditId = params.id;
     if (!auditId) return NextResponse.json({ error: 'Audit ID is required' }, { status: 400 });
 
-    const audit = getPermissionAuditById(auditId);
+    const audit = await getPermissionAuditById(auditId);
     if (!audit) return NextResponse.json({ error: 'Audit record not found' }, { status: 404 });
 
     if (user.role === 'clerk' && audit.user_id !== user.id) return NextResponse.json({ error: 'Permission denied' }, { status: 403 });
@@ -31,7 +34,7 @@ export async function GET(request, context) {
       data: { ...audit, timestamp_iso: new Date(audit.timestamp * 1000).toISOString(), diff },
     });
   } catch (error) {
-    console.error('[AuditDetailAPI] GET error:', error);
+    log.error('GET error:', { message: error.message });
     return NextResponse.json({ error: 'Failed to retrieve audit record', details: error.message }, { status: 500 });
   }
 }

package/src/app/api/audit/permissions/route.js

@@ -1,10 +1,13 @@
 import { NextResponse } from '@/lib/next-polyfills';
+import { createLogger } from '@/lib/logger.js';
+
+const log = createLogger('[AuditAPI]');
 import { lucia } from '@/engine.server';
 import { cookies } from '@/lib/next-polyfills';
 import {
   logPermissionChange, getPermissionAuditTrail, searchPermissionAudit,
   getPermissionAuditByDateRange, exportPermissionAuditCSV,
-} from '@/lib/audit-logger';
+} from '@/lib/busybase-audit-reads';
 
 async function getUser() {
   const sessionId = (await cookies()).get(lucia.sessionCookieName)?.value ?? null;
@@ -37,9 +40,9 @@ export async function GET(request) {
 
     let results;
     if (search) {
-      results = searchPermissionAudit(search, limit);
+      results = await searchPermissionAudit(search, limit);
     } else if (startDate && endDate) {
-      results = getPermissionAuditByDateRange(parseInt(startDate, 10), parseInt(endDate, 10), limit);
+      results = await getPermissionAuditByDateRange(parseInt(startDate, 10), parseInt(endDate, 10), limit);
     } else {
       const filters = {};
       const entityType = searchParams.get('entity_type');
@@ -53,7 +56,7 @@ export async function GET(request) {
       if (affectedUserId) filters.affectedUserId = affectedUserId;
       filters.limit = limit;
       filters.offset = offset;
-      results = getPermissionAuditTrail(filters);
+      results = await getPermissionAuditTrail(filters);
     }
 
     if (format === 'csv') {
@@ -63,7 +66,7 @@ export async function GET(request) {
 
     return NextResponse.json({ success: true, data: results, count: results.length, scope: permCheck.scope });
   } catch (error) {
-    console.error('[AuditAPI] GET error:', error);
+    log.error('GET error:', { message: error.message });
     return NextResponse.json({ error: 'Failed to retrieve audit trail', details: error.message }, { status: 500 });
   }
 }
@@ -80,14 +83,14 @@ export async function POST(request) {
     const ipAddress = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip') || null;
     const sessionId = (await cookies()).get(lucia.sessionCookieName)?.value ?? null;
 
-    const auditId = logPermissionChange({
+    const auditId = await logPermissionChange({
       userId: user.id, entityType, entityId, action, oldPermissions, newPermissions,
       reason, reasonCode: reasonCode || 'other', affectedUserId, ipAddress, sessionId, metadata,
     });
 
     return NextResponse.json({ success: true, auditId });
   } catch (error) {
-    console.error('[AuditAPI] POST error:', error);
+    log.error('POST error:', { message: error.message });
     return NextResponse.json({ error: 'Failed to log permission change', details: error.message }, { status: 500 });
   }
 }

package/src/app/api/audit/permissions/stats/route.js

@@ -1,6 +1,9 @@
 import { NextResponse } from '@/lib/next-polyfills';
+import { createLogger } from '@/lib/logger.js';
+
+const log = createLogger('[AuditStatsAPI]');
 import { getUser, setCurrentRequest } from '@/engine.server';
-import { getPermissionAuditStats, getPermissionAuditBreakdown } from '@/lib/audit-logger';
+import { getPermissionAuditStats, getPermissionAuditBreakdown } from '@/lib/busybase-audit-reads';
 
 export async function GET(request) {
   setCurrentRequest(request);
@@ -9,9 +12,9 @@ export async function GET(request) {
     if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     if (user.role !== 'partner' && user.role !== 'manager') return NextResponse.json({ error: 'Permission denied' }, { status: 403 });
 
-    const stats = getPermissionAuditStats();
-    const actionBreakdown = getPermissionAuditBreakdown('action');
-    const reasonCodeBreakdown = getPermissionAuditBreakdown('reason_code');
+    const stats = await getPermissionAuditStats();
+    const actionBreakdown = await getPermissionAuditBreakdown('action');
+    const reasonCodeBreakdown = await getPermissionAuditBreakdown('reason_code');
 
     return NextResponse.json({
       success: true,
@@ -23,7 +26,7 @@ export async function GET(request) {
       breakdown: { by_action: actionBreakdown, by_reason_code: reasonCodeBreakdown },
     });
   } catch (error) {
-    console.error('[AuditStatsAPI] GET error:', error);
+    log.error('GET error:', { message: error.message });
     return NextResponse.json({ error: 'Failed to retrieve audit statistics', details: error.message }, { status: 500 });
   }
 }

package/src/app/api/audit/route.js

@@ -1,5 +1,5 @@
 import { requireAuth, requirePermission } from '@/lib/auth-middleware';
-import { getAuditHistory, getActionStats, getUserStats } from '@/lib/audit-logger';
+import { getAuditHistory, getActionStats, getUserStats } from '@/lib/busybase-audit-reads';
 import { getSpec } from '@/config/spec-helpers';
 import { paginated, ok } from '@/lib/response-formatter';
 import { withErrorHandler } from '@/lib/with-error-handler';
@@ -32,8 +32,8 @@ export const GET = withErrorHandler(async (request) => {
     if (!fromDate || !toDate) {
       throw new AppError('fromDate and toDate required for stats', 'BAD_REQUEST', HTTP.BAD_REQUEST);
     }
-    const actionStats = getActionStats(fromDate, toDate);
-    const userStats = getUserStats(fromDate, toDate);
+    const actionStats = await getActionStats(fromDate, toDate);
+    const userStats = await getUserStats(fromDate, toDate);
     return ok({
       actionStats,
       userStats
@@ -48,7 +48,7 @@ export const GET = withErrorHandler(async (request) => {
   if (fromDate) filters.fromDate = fromDate;
   if (toDate) filters.toDate = toDate;
 
-  const { items, pagination } = getAuditHistory(filters, page, pageSize);
+  const { items, pagination } = await getAuditHistory(filters, page, pageSize);
 
   const enriched = items.map(log => ({
     ...log,

package/src/app/api/audit/stats/route.js

@@ -13,6 +13,6 @@ export const GET = withErrorHandler(async (request) => {
   const fromDate = url.searchParams.get('from') ? parseInt(url.searchParams.get('from')) : Math.floor(Date.now() / 1000) - (24 * 60 * 60);
   const toDate = url.searchParams.get('to') ? parseInt(url.searchParams.get('to')) : Math.floor(Date.now() / 1000);
 
-  const stats = getLogStats(fromDate, toDate);
+  const stats = await getLogStats(fromDate, toDate);
   return NextResponse.json({ success: true, stats, period: { from: fromDate, to: toDate } });
 });

package/src/app/api/auth/google/callback/route.js

@@ -1,4 +1,7 @@
+import { createLogger } from '@/lib/logger.js';
 import { google, createSession } from '@/engine.server';
+
+const log = createLogger('[OAuth]');
 import { getBy, create } from '@/engine';
 import { Google } from 'arctic';
 import { GOOGLE_APIS } from '@/config/constants';
@@ -40,7 +43,7 @@ export async function GET(request) {
 
   const stateValidation = validateOAuthState(code, stateKey, state, codeVerifier);
   if (!stateValidation.valid) {
-    console.error('[OAuth Callback] State validation failed:', stateValidation.error);
+    log.warn('state validation failed:', { error: stateValidation.error });
     return buildOAuthErrorResponse(stateValidation.error, request);
   }
 
@@ -88,7 +91,7 @@ export async function GET(request) {
 
     return response;
   } catch (error) {
-    console.error('Google OAuth error:', error);
+    log.error('Google OAuth error:', { message: error.message });
     return buildOAuthErrorResponse('oauth_failed', request);
   }
 }