thatcher 1.0.7 → 1.0.34

package/src/lib/workflow-engine.js

@@ -1,21 +1,15 @@
-/**
- * Workflow Engine - State machine management for entity lifecycle transitions
- * Handles validation of state transitions and available actions
- */
-
-import { get, update, create } from './query-engine.js';
+import { get, update, create } from './busybase-store.js';
 import { getConfigEngineSync } from './config-generator-engine.js';
+import { executeHook } from './hook-engine.js';
 import { AppError } from './error-handler.js';
 import { HTTP } from '../config/constants.js';
+import { createLogger } from './logger.js';
+
+const log = createLogger('[WorkflowEngine]');
 
 const LOCKOUT_SECONDS = 300; // 5 minutes default
 const workflowCache = new Map();
 
-/**
- * Get workflow definition from config
- * @param {string} workflowName
- * @returns {object}
- */
 function getWorkflowDef(workflowName) {
   if (workflowCache.has(workflowName)) {
     return workflowCache.get(workflowName);
@@ -42,15 +36,6 @@ function getWorkflowDef(workflowName) {
   return def;
 }
 
-/**
- * Validate a state transition
- * @param {string} workflowName
- * @param {string} fromState
- * @param {string} toState
- * @param {object} user
- * @returns {{forward: boolean, backward: boolean}}
- * @throws {AppError} if transition invalid
- */
 export function validateTransition(workflowName, fromState, toState, user) {
   const def = getWorkflowDef(workflowName);
   const fromCfg = def.stageMap[fromState];
@@ -70,18 +55,15 @@ export function validateTransition(workflowName, fromState, toState, user) {
     );
   }
 
-  // Role requirement check
   const requiresRole = toCfg.requires_role || [];
   if (requiresRole.length > 0 && user && !requiresRole.includes(user.role)) {
     throw new AppError(`Role "${user.role}" cannot enter state "${toState}"`, 'INSUFFICIENT_PERMISSIONS', HTTP.FORBIDDEN);
   }
 
-  // Entry constraint (e.g., partner_only)
   if (toCfg.entry === 'partner_only' && user?.role !== 'partner') {
     throw new AppError(`Only partners can enter "${toState}"`, 'ENTRY_CONSTRAINT', HTTP.FORBIDDEN);
   }
 
-  // Readonly check
   if (toCfg.readonly) {
     throw new AppError(`State "${toState}" is read-only`, 'STATE_READONLY', HTTP.FORBIDDEN);
   }
@@ -92,14 +74,6 @@ export function validateTransition(workflowName, fromState, toState, user) {
   };
 }
 
-/**
- * Get available transitions for current state
- * @param {string} workflowName
- * @param {string} currentState
- * @param {object} user
- * @param {object} [record]
- * @returns {Array<{stage: string, label: string, forward: boolean, backward: boolean}>}
- */
 export function getAvailableTransitions(workflowName, currentState, user, record = null) {
   const def = getWorkflowDef(workflowName);
   const currentCfg = def.stageMap[currentState];
@@ -111,7 +85,6 @@ export function getAvailableTransitions(workflowName, currentState, user, record
 
   for (const stateName of candidates) {
     try {
-      // Lockout check based on last_transition_at
       if (record?.last_transition_at) {
         const elapsed = (Date.now() / 1000) - record.last_transition_at;
         if (elapsed < LOCKOUT_SECONDS) continue;
@@ -126,18 +99,13 @@ export function getAvailableTransitions(workflowName, currentState, user, record
         backward: (cfg.order || 0) < currentOrder,
       });
     } catch {
-      // Skip invalid transitions
+      // skip
     }
   }
 
   return available;
 }
 
-/**
- * Get transition lockout status
- * @param {object} record
- * @returns {{inLockout: boolean, minutesRemaining: number, failedGates: Array}}
- */
 export function getTransitionStatus(record) {
   let inLockout = false;
   let minutesRemaining = 0;
@@ -153,24 +121,12 @@ export function getTransitionStatus(record) {
   return { inLockout, minutesRemaining, failedGates: [] };
 }
 
-/**
- * Execute a state transition
- * @param {string} entityType
- * @param {string} entityId
- * @param {string} workflowName
- * @param {string} toState
- * @param {object} user
- * @param {string} [reason='']
- * @returns {Promise<object>} Updated record
- */
 export async function transition(entityType, entityId, workflowName, toState, user, reason = '') {
-  // Validate transition
-  const record = get(entityType, entityId);
+  const record = await get(entityType, entityId);
   if (!record) throw new AppError('Record not found', 'NOT_FOUND', HTTP.NOT_FOUND);
 
   validateTransition(workflowName, record.status || record.stage, toState, user);
 
-  // Update record
   const updates = {
     status: toState,
     updated_at: Math.floor(Date.now() / 1000),
@@ -181,10 +137,9 @@ export async function transition(entityType, entityId, workflowName, toState, us
   }
 
   // Dynamically import write engine to avoid circular dependency
-  const { update: updateRecord } = await import('./query-engine-write.js');
-  const updated = updateRecord(entityType, entityId, updates, user);
+  const { update: updateRecord } = await import('./busybase-store.js');
+  const updated = await updateRecord(entityType, entityId, updates, user);
 
-  // Execute hooks
   executeHook(`transition:${entityType}`, {
     entity: entityType,
     id: entityId,
@@ -192,26 +147,16 @@ export async function transition(entityType, entityId, workflowName, toState, us
     to: toState,
     user,
     record: updated,
-  }).catch(err => console.error('transition hook error:', err));
+  }).catch(err => log.error('transition hook error:', { message: err?.message || String(err) }));
 
   return updated;
 }
 
-/**
- * Get state field name for workflow (usually 'status' or 'stage')
- * @param {string} workflowName
- * @returns {string}
- */
 export function getStateField(workflowName) {
   const def = getWorkflowDef(workflowName);
   return def.state_field || 'status';
 }
 
-/**
- * Get stage labels mapping
- * @param {string} workflowName
- * @returns {object}
- */
 export function getStageLabels(workflowName) {
   const def = getWorkflowDef(workflowName);
   const labels = {};
@@ -223,12 +168,6 @@ export function getStageLabels(workflowName) {
   return labels;
 }
 
-/**
- * Get locked fields for a state (readonly fields)
- * @param {string} workflowName
- * @param {string} state
- * @returns {string[]}
- */
 export function getStateLocks(workflowName, state) {
   const def = getWorkflowDef(workflowName);
   const stage = def.stageMap[state];
@@ -236,12 +175,6 @@ export function getStateLocks(workflowName, state) {
   return stage.locks || [];
 }
 
-/**
- * Get actions available in a state
- * @param {string} workflowName
- * @param {string} state
- * @returns {string[]}
- */
 export function getStateActions(workflowName, state) {
   const def = getWorkflowDef(workflowName);
   const stage = def.stageMap[state];

package/src/lib/xstate-workflow-engine.js

@@ -1,8 +1,3 @@
-/**
- * XState Workflow Engine - State machine-based workflow management for Thatcher
- * Replaces the legacy workflow engine with xstate v5 state machines and actors
- */
-
 import { createMachine, createActor, assign, fromPromise, sendParent } from 'xstate';
 import { getConfigEngineSync } from './config-generator-engine.js';
 import { hookEngine } from './hook-engine.js';
@@ -390,10 +385,9 @@ export function getAvailableTransitions(workflowName, currentState, user, record
 }
 
 export async function transition(entityType, entityId, workflowName, toState, user, reason = '') {
-  const { get } = await import('./query-engine.js');
-  const { update: updateRecord } = await import('./query-engine-write.js');
+  const { get, update: updateRecord } = await import('./busybase-store.js');
 
-  const record = get(entityType, entityId);
+  const record = await get(entityType, entityId);
   if (!record) throw new AppError('Record not found', 'NOT_FOUND', HTTP.NOT_FOUND);
 
   validateTransition(workflowName, record.status || record.stage, toState, user);
@@ -407,7 +401,7 @@ export async function transition(entityType, entityId, workflowName, toState, us
     updates.transition_reason = reason;
   }
 
-  const updated = updateRecord(entityType, entityId, updates, user);
+  const updated = await updateRecord(entityType, entityId, updates);
 
   _transitionHistory.push({
     entityType,

package/src/plugins/index.js

@@ -1,8 +1,10 @@
 import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
+import { createLogger } from '../lib/logger.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const log = createLogger('[Plugins]');
 
 export async function loadPlugins(configEngine) {
   const pluginDir = __dirname;
@@ -15,13 +17,13 @@ export async function loadPlugins(configEngine) {
     try {
       const mod = await import(`file://${path.join(pluginDir, file)}?t=${Date.now()}`);
       const plugin = mod.default || mod;
-      if (!plugin.entityName) { console.warn(`[plugins] ${file} missing entityName, skipped`); continue; }
+      if (!plugin.entityName) { log.warn(`${file} missing entityName, skipped`); continue; }
       configEngine.registerPlugin(plugin.entityName, plugin);
       loaded.push(file);
     } catch (e) {
-      console.error(`[plugins] Failed to load ${file}:`, e.message);
+      log.error(`failed to load ${file}:`, { message: e.message });
     }
   }
-  if (loaded.length) console.log(`[plugins] Loaded: ${loaded.join(', ')}`);
+  if (loaded.length) log.info(`loaded: ${loaded.join(', ')}`);
   return loaded;
 }

package/src/server/server.js

@@ -1,13 +1,15 @@
-/**
- * Thatcher HTTP Server - Simplified generic CRUD router
- * Provides out-of-the-box API for all entities
- */
-
 import http from 'http';
 import path from 'path';
+import fs from 'fs';
 import { fileURLToPath, pathToFileURL } from 'url';
+import { createLogger } from '../lib/logger.js';
 import * as thatcherLib from '../index.js';
 
+const log = createLogger('[Server]');
+const pageLog = createLogger('[Page]');
+const staticLog = createLogger('[Static]');
+const apiLog = createLogger('[API]');
+
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export function createServer(options) {
@@ -57,7 +59,7 @@ export function createServer(options) {
         const { loadPlugins } = await load(path.join(__dirname, '../plugins/index.js'));
         await loadPlugins(configEngine);
         systemInitialized = true;
-        console.log('[Server] System ready');
+        log.info('System ready');
       }
 
       const url = new URL(req.url, `http://${req.headers.host}`);
@@ -113,7 +115,7 @@ export function createServer(options) {
             return;
           }
         } catch (e) {
-          console.error('[Page]', e.message);
+          pageLog.error(e.message);
         }
       }
 
@@ -122,7 +124,7 @@ export function createServer(options) {
       res.end(JSON.stringify({ error: 'Not found' }));
 
     } catch (err) {
-      console.error('[Server]', err.message);
+      log.error(err.message);
       res.writeHead(500, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: err.message }));
     } finally {
@@ -133,9 +135,6 @@ export function createServer(options) {
   return server;
 }
 
-/**
- * Serve static file if exists
- */
 async function serveStaticFile(pathname, req, res, load) {
   if (pathname === '/' || pathname === '/index.html') {
     // Could serve SPA
@@ -160,13 +159,14 @@ async function serveStaticFile(pathname, req, res, load) {
       res.end(content);
       return true;
     }
-  } catch {}
+  } catch (err) {
+    // A missing file is a normal 404; anything else (permission denied, file
+    // locked) is a real problem worth surfacing rather than silently swallowing.
+    if (err.code !== 'ENOENT') staticLog.error(`${filePath} ${err.code}`, { message: err.message });
+  }
   return false;
 }
 
-/**
- * File exists check
- */
 function fileExists(p) {
   try {
     return fs.existsSync(p);
@@ -175,9 +175,6 @@ function fileExists(p) {
   }
 }
 
-/**
- * Send response appropriately
- */
 async function sendResponse(res, response) {
   const headerObj = {};
   if (response.headers) {
@@ -208,9 +205,6 @@ async function sendResponse(res, response) {
   res.end(bodyOut);
 }
 
-/**
- * Generic CRUD handler
- */
 async function handleGenericCrud(req, res, entity, id, action, thatcher, configEngineArg) {
   // Simple auth: get from cookie or header
   let user = null;
@@ -299,26 +293,31 @@ async function handleGenericCrud(req, res, entity, id, action, thatcher, configE
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(result));
   } catch (err) {
-    console.error('[API]', err.message);
+    apiLog.error(err.message);
     res.writeHead(500);
     res.end(JSON.stringify({ error: err.message }));
   }
 }
 
-/**
- * Read request body
- */
 async function readBody(req) {
   return new Promise((resolve, reject) => {
     let data = '';
-    req.on('data', chunk => data += chunk);
+    let size = 0;
+    const MAX_SIZE = 10 * 1024 * 1024; // 10MB cap: an unbounded body is an OOM/DoS vector
+    const timeout = setTimeout(() => { req.destroy(); reject(new Error('Request timeout')); }, 30000); // slowloris guard
+    req.on('data', chunk => {
+      size += chunk.length;
+      if (size > MAX_SIZE) { clearTimeout(timeout); req.destroy(); reject(new Error('Request body too large')); return; }
+      data += chunk;
+    });
     req.on('end', () => {
+      clearTimeout(timeout);
       try {
         resolve(JSON.parse(data));
       } catch {
         resolve(data);
       }
     });
-    req.on('error', reject);
+    req.on('error', (err) => { clearTimeout(timeout); reject(err); });
   });
 }

package/src/services/collaborator-role.service.js

@@ -1,9 +1,6 @@
-/**
- * Collaborator Role Service - Role-based access control for review collaborators
- * Extracted from moonlanding/src/services/collaborator-role.service.js
- */
+// Extracted from moonlanding/src/services/collaborator-role.service.js
 
-import { list, get, update, create } from '../lib/query-engine.js';
+import { list, get, update, create } from '../lib/busybase-store.js';
 import { AppError } from '../lib/error-handler.js';
 import { HTTP } from '../config/constants.js';
 
@@ -23,22 +20,17 @@ const COLLABORATOR_ROLE_PERMISSIONS = {
   ],
 };
 
-/**
- * Get active collaborator role
- * @param {string} collaboratorId
- * @returns {object|null}
- */
-export function getCollaboratorRole(collaboratorId) {
+export async function getCollaboratorRole(collaboratorId) {
   if (!collaboratorId) return null;
-  const collaborator = get('collaborator', collaboratorId);
+  const collaborator = await get('collaborator', collaboratorId);
   if (!collaborator) return null;
 
   if (collaborator.primary_role_id) {
-    const role = get('collaborator_role', collaborator.primary_role_id);
+    const role = await get('collaborator_role', collaborator.primary_role_id);
     if (role && role.is_active) return role;
   }
 
-  const roles = list('collaborator_role')
+  const roles = (await list('collaborator_role'))
     .filter(r => r.collaborator_id === collaboratorId && r.is_active);
 
   if (roles.length === 0) return null;
@@ -47,7 +39,7 @@ export function getCollaboratorRole(collaboratorId) {
   const activeRole = roles[0];
 
   if (collaborator.primary_role_id !== activeRole.id) {
-    update('collaborator', collaboratorId, {
+    await update('collaborator', collaboratorId, {
       primary_role_id: activeRole.id,
       is_manager: activeRole.role_type === 'manager'
     });
@@ -55,78 +47,42 @@ export function getCollaboratorRole(collaboratorId) {
   return activeRole;
 }
 
-/**
- * Check if collaborator has permission for action
- * @param {string} collaboratorId
- * @param {string} permission
- * @returns {boolean}
- */
-export function hasCollaboratorPermission(collaboratorId, permission) {
-  const role = getCollaboratorRole(collaboratorId);
+export async function hasCollaboratorPermission(collaboratorId, permission) {
+  const role = await getCollaboratorRole(collaboratorId);
   if (!role) return false;
   const perms = COLLABORATOR_ROLE_PERMISSIONS[role.role_type];
   return perms ? perms.includes(permission) : false;
 }
 
-/**
- * Check collaborator access for specific action (with optional record)
- * @param {string} collaboratorId
- * @param {string} action
- * @param {object} [record]
- * @returns {boolean}
- */
-export function checkCollaboratorAccess(collaboratorId, action, record = null) {
-  const role = getCollaboratorRole(collaboratorId);
+export async function checkCollaboratorAccess(collaboratorId, action, record = null) {
+  const role = await getCollaboratorRole(collaboratorId);
   if (!role) return false;
   const perms = COLLABORATOR_ROLE_PERMISSIONS[role.role_type];
   if (!perms) return false;
   if (perms.includes(action)) return true;
   if (action === 'delete_highlights' && perms.includes('delete_own_highlights') && record) {
-    const collaborator = get('collaborator', collaboratorId);
+    const collaborator = await get('collaborator', collaboratorId);
     return record.created_by === collaborator?.user_id;
   }
   return false;
 }
 
-/**
- * Get role history for collaborator
- * @param {string} collaboratorId
- * @returns {Array}
- */
-export function getCollaboratorRoleHistory(collaboratorId) {
+export async function getCollaboratorRoleHistory(collaboratorId) {
   if (!collaboratorId) return [];
-  return list('collaborator_role')
+  return (await list('collaborator_role'))
     .filter(r => r.collaborator_id === collaboratorId)
     .sort((a, b) => b.assigned_at - a.assigned_at);
 }
 
-/**
- * Get permissions for a role type
- * @param {string} roleType
- * @returns {Array<string>}
- */
 export function getCollaboratorRolePermissions(roleType) {
   return COLLABORATOR_ROLE_PERMISSIONS[roleType] || [];
 }
 
-/**
- * Check if user role can assign target role
- * @param {string} userRole
- * @param {string} targetRoleType
- * @returns {boolean}
- */
 export function canAssignRole(userRole, targetRoleType) {
   return ['partner', 'manager'].includes(userRole);
 }
 
-/**
- * Add a collaborator to a review
- * @param {string} reviewId
- * @param {string} email
- * @param {object} options
- * @returns {object}
- */
-export function addCollaborator(reviewId, email, options = {}) {
+export async function addCollaborator(reviewId, email, options = {}) {
   const { expiresAt, createdBy = 'system', reason = '' } = options;
   const nowSeconds = Math.floor(Date.now() / 1000);
   const isPermanent = !expiresAt;
@@ -137,7 +93,7 @@ export function addCollaborator(reviewId, email, options = {}) {
     if (expiresAt > maxAllowed) throw new Error('Expiry date cannot exceed 30 days from now');
   }
 
-  return create('collaborator', {
+  return await create('collaborator', {
     review_id: reviewId,
     email,
     expires_at: expiresAt || null,
@@ -149,13 +105,8 @@ export function addCollaborator(reviewId, email, options = {}) {
   }, { id: createdBy, role: 'partner' });
 }
 
-/**
- * Get collaborators for a review
- * @param {string} reviewId
- * @returns {Array}
- */
-export function getReviewCollaborators(reviewId) {
-  const collaborators = list('collaborator', { review_id: reviewId });
+export async function getReviewCollaborators(reviewId) {
+  const collaborators = await list('collaborator', { review_id: reviewId });
   const nowSeconds = Math.floor(Date.now() / 1000);
 
   return collaborators.map(c => ({
@@ -171,18 +122,11 @@ export function getReviewCollaborators(reviewId) {
   }));
 }
 
-/**
- * Revoke collaborator access
- * @param {string} collaboratorId
- * @param {string} [reason='manual_revoke']
- * @param {string} [revokedBy='system']
- * @returns {boolean}
- */
-export function revokeCollaborator(collaboratorId, reason = 'manual_revoke', revokedBy = 'system') {
-  const collaborator = get('collaborator', collaboratorId);
+export async function revokeCollaborator(collaboratorId, reason = 'manual_revoke', revokedBy = 'system') {
+  const collaborator = await get('collaborator', collaboratorId);
   if (!collaborator) throw new Error('Collaborator not found');
 
-  update('collaborator', collaboratorId, {
+  await update('collaborator', collaboratorId, {
     revoked_at: Math.floor(Date.now() / 1000),
     revoked_by: revokedBy,
     revocation_reason: reason,

package/src/services/email-sender.js

@@ -1,29 +1,23 @@
-/**
- * Email Sender - SMTP email delivery with templates
- * Uses nodemailer
- */
-
 import nodemailer from 'nodemailer';
 import { buildConfig } from '../config/env.js';
+import { createLogger } from '../lib/logger.js';
+
+const log = createLogger('[Email]');
 
 let transporter = null;
 
-/**
- * Initialize email transporter
- * @param {object} [config]
- */
 export function initEmail(config = null) {
   const cfg = config || buildConfig();
 
   if (!cfg.email.smtp.user || !cfg.email.smtp.password) {
-    console.warn('[Email] SMTP credentials not configured');
+    log.warn('SMTP credentials not configured');
     return null;
   }
 
   transporter = nodemailer.createTransport({
     host: cfg.email.smtp.host,
     port: cfg.email.smtp.port,
-    secure: cfg.email.smtp.port === 465, // true for 465, false for other ports
+    secure: cfg.email.smtp.port === 465,
     auth: {
       user: cfg.email.smtp.user,
       pass: cfg.email.smtp.password,
@@ -33,20 +27,11 @@ export function initEmail(config = null) {
   return transporter;
 }
 
-/**
- * Get initialized transporter
- * @returns {object}
- */
 export function getTransporter() {
   if (!transporter) initEmail();
   return transporter;
 }
 
-/**
- * Send email
- * @param {object} options - { to, subject, text, html, attachments }
- * @returns {Promise<object>}
- */
 export async function sendEmail(options) {
   const transporter = getTransporter();
   if (!transporter) {
@@ -60,19 +45,11 @@ export async function sendEmail(options) {
     ...options,
   });
 
-  console.log('[Email] Sent:', info.messageId);
+  log.info('sent:', { messageId: info.messageId });
   return info;
 }
 
-/**
- * Send templated email
- * @param {string} templateName
- * @param {string} to
- * @param {object} context
- * @returns {Promise<object>}
- */
 export async function sendTemplatedEmail(templateName, to, context = {}) {
-  // Templates could be loaded from config or files
   const templates = getTemplates();
   const template = templates[templateName];
 
@@ -87,15 +64,11 @@ export async function sendTemplatedEmail(templateName, to, context = {}) {
   return sendEmail({ to, subject, text, html });
 }
 
-/**
- * Simple templates (could be loaded from config)
- * @returns {object}
- */
 function getTemplates() {
   return {
     notification: {
       subject: 'Notification from {{appName}}',
-      text: '{{message}}\n\n— {{appName}}',
+      text: '{{message}}\n\n- {{appName}}',
     },
     invitation: {
       subject: 'You\'ve been invited to {{appName}}',