thatcher 1.0.78 → 1.0.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.78",
+  "version": "1.0.80",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/busybase/store.js

@@ -196,7 +196,9 @@ export async function list(entity, where = {}, options = {}) {
     const lim = options.limit ? parseInt(options.limit, 10) : rows.length;
     rows = rows.slice(off, off + lim);
   }
-  return attachRefDisplays(entity, rows);
+  const { decryptFields } = await import('../field-encryption.js');
+  const decryptedRows = rows.map(r => decryptFields(r, spec.fields));
+  return attachRefDisplays(entity, decryptedRows);
 }
 
 export async function count(entity, where = {}, options = {}) {
@@ -227,7 +229,9 @@ export async function get(entity, id, options = {}) {
     const { permissionService } = await import('../services/permission.service.js');
     if (!permissionService.checkRowAccess(options.user, spec, row)) return null;
   }
-  const [withDisplay] = await attachRefDisplays(entity, [row]);
+  const { decryptFields } = await import('../field-encryption.js');
+  const decrypted = decryptFields(row, spec.fields);
+  const [withDisplay] = await attachRefDisplays(entity, [decrypted]);
   return withDisplay;
 }
 
@@ -255,15 +259,23 @@ export async function create(entity, data, user) {
     if (field.auto === 'uuid' && !record[key]) record[key] = genId();
     if (field.auto === 'timestamp' && !record[key]) record[key] = now();
   }
+  // Encrypt any field marked encrypted:true BEFORE the null/undefined
+  // sentinel coercion below, so a real value never reaches the insert as
+  // plaintext -- this is the single choke point every create() call passes
+  // through, so no caller needs to know the field is encrypted at all.
+  const { encryptFields } = await import('../field-encryption.js');
+  const encryptedRecord = encryptFields(record, spec.fields);
   // LanceDB cannot infer a column's type from a null on first insert; coerce any
   // null/undefined to a typed sentinel ('' for strings) so the insert schema is stable.
-  for (const k of Object.keys(record)) {
-    if (record[k] === null || record[k] === undefined) record[k] = '';
+  for (const k of Object.keys(encryptedRecord)) {
+    if (encryptedRecord[k] === null || encryptedRecord[k] === undefined) encryptedRecord[k] = '';
   }
-  unwrap(await client().from(tbl).insert(record), 'create');
+  unwrap(await client().from(tbl).insert(encryptedRecord), 'create');
   // Always return the locally-constructed record: it holds the genId we put in
   // the TEXT id column. The store's insert() may return a rowid/driver shape, so
-  // trusting `created` would hand callers the wrong id.
+  // trusting `created` would hand callers the wrong id. Return the UNENCRYPTED
+  // record -- the caller gets back plaintext, matching what get()/list() will
+  // also return after decrypting the stored ciphertext.
   return record;
 }
 
@@ -284,14 +296,19 @@ export async function create(entity, data, user) {
 // unconditional-write behaviour, unchanged for every existing caller; _version
 // is added as a new column, ignored by every reader that doesn't ask for it.
 export async function update(entity, id, data, opts = {}) {
-  specOf(entity);
+  const spec = specOf(entity);
   const tbl = tableName(entity);
 
   const existing = await get(entity, id);
   if (!existing) throw new Error(`${entity} with id ${id} not found`);
 
   const currentVersion = Number(existing._version) || 0;
-  const patch = { ...data, updated_at: now(), _version: currentVersion + 1 };
+  const { encryptFields } = await import('../field-encryption.js');
+  // Encrypt only the fields actually present in this partial update -- a
+  // caller updating an unrelated field must not force-decrypt/re-encrypt an
+  // encrypted field it never touched (encryptFields already skips fields
+  // absent from the object, so this is naturally a no-op for those).
+  const patch = encryptFields({ ...data, updated_at: now(), _version: currentVersion + 1 }, spec.fields);
   let builder = client().from(tbl).update(patch).eq('id', id);
   if (opts.expectedVersion != null) {
     builder = builder.eq('_version', opts.expectedVersion);

package/src/lib/config-generator-engine.js

@@ -274,6 +274,84 @@ function withResourceManagementDefaults(masterConfig) {
   return changed ? { ...masterConfig, entities } : masterConfig;
 }
 
+const CUSTOM_ENTITY_DEF_ENTITY_DEFAULT = {
+  label: 'Custom Entity Definition',
+  label_plural: 'Custom Entity Definitions',
+  system_entity: true,
+  fields: {
+    name: { type: 'text', required: true, unique: true, label: 'Name' },
+    label: { type: 'text', required: true, label: 'Label' },
+    label_plural: { type: 'text', label: 'Label (Plural)' },
+    fields: { type: 'json', required: true, label: 'Fields' },
+    owner_id: { type: 'ref', ref: 'user', label: 'Owner' },
+  },
+};
+
+function withCustomEntityDefaults(masterConfig) {
+  const entities = { ...(masterConfig.entities || {}) };
+  let changed = false;
+  if (!entities.custom_entity_def) { entities.custom_entity_def = CUSTOM_ENTITY_DEF_ENTITY_DEFAULT; changed = true; }
+  return changed ? { ...masterConfig, entities } : masterConfig;
+}
+
+// Every field type this session has established, plus 'id' held reserved by
+// itself since a custom entity spec is never allowed to declare it (the
+// system fields loop in generateEntitySpec injects 'id' unconditionally).
+const KNOWN_FIELD_TYPES = new Set([
+  'text', 'textarea', 'email', 'number', 'int', 'decimal', 'currency', 'date',
+  'timestamp', 'enum', 'bool', 'boolean', 'multiselect', 'ref', 'multiref',
+  'file', 'attachment', 'json',
+]);
+
+// A custom field key colliding with a reserved system field would let a
+// crafted custom_entity_def silently override id/created_at/created_by/
+// updated_at/status -- fields every entity's audit trail, sort defaults, and
+// soft-delete logic assume are the framework's own. Rejected outright rather
+// than allowing the collision and hoping the "declared field wins" merge
+// order in generateEntitySpec never causes trouble.
+const RESERVED_FIELD_KEYS = new Set(['id', 'created_at', 'created_by', 'updated_at', 'status']);
+
+export function validateCustomEntityFields(fieldDefs) {
+  if (!Array.isArray(fieldDefs)) return { valid: false, error: 'fields must be an array' };
+  for (const f of fieldDefs) {
+    if (!f || typeof f.key !== 'string' || !f.key) return { valid: false, error: 'every field requires a key' };
+    if (RESERVED_FIELD_KEYS.has(f.key)) return { valid: false, error: `field key "${f.key}" collides with a reserved system field` };
+    if (!KNOWN_FIELD_TYPES.has(f.type)) return { valid: false, error: `unrecognized field type "${f.type}" for field "${f.key}"` };
+  }
+  return { valid: true };
+}
+
+function slugifyEntityName(name) {
+  return String(name).toLowerCase().trim().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '');
+}
+
+// Turns a custom_entity_def row's {key,type,label,required,options,ref}
+// array into the SAME spec.fields[key] shape every code-registered system
+// entity already uses, so generateEntitySpec's downstream logic (system
+// field injection, permission_template resolution, workflow linkage) never
+// has to know a given entity came from the database instead of source code.
+export function customEntityDefToEntityDef(row) {
+  const fieldsArr = typeof row.fields === 'string' ? JSON.parse(row.fields) : row.fields;
+  const { valid, error } = validateCustomEntityFields(fieldsArr);
+  if (!valid) throw new Error(`[custom_entity_def "${row.name}"] ${error}`);
+  const fields = {};
+  for (const f of fieldsArr) {
+    fields[f.key] = {
+      type: f.type,
+      label: f.label || f.key,
+      required: !!f.required,
+      options: f.options || undefined,
+      ref: f.ref || undefined,
+    };
+  }
+  return {
+    label: row.label || row.name,
+    label_plural: row.label_plural || row.label || row.name,
+    system_entity: false,
+    fields,
+  };
+}
+
 const CONTRACT_LIFECYCLE_WORKFLOW = {
   state_field: 'status',
   stages: [
@@ -316,7 +394,7 @@ function withContractDefaults(masterConfig) {
 export class ConfigGeneratorEngine {
   constructor(masterConfig) {
     if (!masterConfig) throw new Error('[ConfigGeneratorEngine] masterConfig is required');
-    this.masterConfig = deepFreeze(withResourceManagementDefaults(withContractDefaults(withTimeTrackingDefaults(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig)))))))));
+    this.masterConfig = deepFreeze(withCustomEntityDefaults(withResourceManagementDefaults(withContractDefaults(withTimeTrackingDefaults(withInventoryDefaults(withProjectDefaults(withCrmDefaults(withWebhookDefaults(withMultiTenancyDefaults(masterConfig))))))))));
     this.specCache = new LRUCache(100);
     this.debugMode = false;
     this._plugins = new Map();
@@ -346,6 +424,26 @@ export class ConfigGeneratorEngine {
     return this;
   }
 
+  // Merges one custom_entity_def row into masterConfig.entities, keyed by a
+  // slugified version of its name -- after this call, generateEntitySpec(slug)
+  // returns a real usable spec and every generic CRUD/view/report route that
+  // reads config.entities works for it with zero entity-specific code, the
+  // same reuse discipline every code-registered system entity already gets.
+  // A slug colliding with an EXISTING entity (system or another custom one)
+  // is rejected rather than silently overwriting it.
+  registerCustomEntity(row) {
+    const slug = slugifyEntityName(row.name);
+    if (!slug) throw new Error('[ConfigGeneratorEngine] registerCustomEntity: name produces an empty slug');
+    if (this.masterConfig.entities?.[slug] && !this.masterConfig.entities[slug]._fromCustomEntityDef) {
+      throw new Error(`[ConfigGeneratorEngine] registerCustomEntity: "${slug}" collides with an existing entity`);
+    }
+    const entityDef = { ...customEntityDefToEntityDef(row), _fromCustomEntityDef: true };
+    const nextEntities = { ...(this.masterConfig.entities || {}), [slug]: entityDef };
+    this.masterConfig = deepFreeze({ ...this.masterConfig, entities: nextEntities });
+    this.specCache.clear();
+    return slug;
+  }
+
   registerPlugin(entityName, plugin = {}) {
     if (!entityName || typeof entityName !== 'string') {
       throw new Error('[ConfigGeneratorEngine] registerPlugin: entityName required');

package/src/lib/field-encryption.js

@@ -0,0 +1,85 @@
+import crypto from 'crypto';
+
+// AES-256-GCM: authenticated encryption, so a tampered ciphertext fails
+// decryption loudly instead of silently returning corrupted plaintext. A
+// fresh random IV per value (never reused) is required for GCM's security
+// guarantee -- reusing an IV with the same key breaks confidentiality.
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const ENCRYPTED_PREFIX = 'enc:v1:';
+
+let _key = null;
+function getKey() {
+  if (_key) return _key;
+  const raw = process.env.FIELD_ENCRYPTION_KEY;
+  if (!raw) {
+    // Fail loud, never silently store plaintext under an encrypted:true field
+    // just because the operator forgot to configure a key.
+    throw new Error('FIELD_ENCRYPTION_KEY environment variable is not set; cannot encrypt/decrypt a field marked encrypted:true');
+  }
+  // Accept either a 64-char hex string or any string, hashed to a stable
+  // 32-byte key -- never echoed, never logged, this function's return value
+  // is the only place the raw key material appears in memory.
+  const key = /^[0-9a-fA-F]{64}$/.test(raw) ? Buffer.from(raw, 'hex') : crypto.createHash('sha256').update(raw).digest();
+  _key = key;
+  return _key;
+}
+
+export function encryptValue(plaintext) {
+  const key = getKey();
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const serialized = typeof plaintext === 'string' ? plaintext : JSON.stringify(plaintext);
+  const ciphertext = Buffer.concat([cipher.update(serialized, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return ENCRYPTED_PREFIX + Buffer.concat([iv, authTag, ciphertext]).toString('base64');
+}
+
+export function isEncrypted(value) {
+  return typeof value === 'string' && value.startsWith(ENCRYPTED_PREFIX);
+}
+
+export function decryptValue(stored) {
+  if (!isEncrypted(stored)) return stored;
+  const key = getKey();
+  const raw = Buffer.from(stored.slice(ENCRYPTED_PREFIX.length), 'base64');
+  const iv = raw.subarray(0, IV_LENGTH);
+  const authTag = raw.subarray(IV_LENGTH, IV_LENGTH + 16);
+  const ciphertext = raw.subarray(IV_LENGTH + 16);
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+  // setAuthTag + final() throws on any tampering (wrong key, flipped bytes,
+  // truncated ciphertext) -- this is the loud-failure guarantee; there is no
+  // catch here, a decrypt failure must propagate to the caller as an error.
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  try {
+    return JSON.parse(decrypted);
+  } catch {
+    return decrypted;
+  }
+}
+
+// Field-def-driven encrypt of every field marked encrypted:true. Fields not
+// present in `record` or not marked are passed through unchanged.
+export function encryptFields(record, specFields) {
+  if (!specFields) return record;
+  const result = { ...record };
+  for (const [key, fieldDef] of Object.entries(specFields)) {
+    if (!fieldDef.encrypted) continue;
+    if (result[key] === undefined || result[key] === null || result[key] === '') continue;
+    if (isEncrypted(result[key])) continue; // already encrypted, don't double-wrap
+    result[key] = encryptValue(result[key]);
+  }
+  return result;
+}
+
+export function decryptFields(record, specFields) {
+  if (!record || !specFields) return record;
+  const result = { ...record };
+  for (const [key, fieldDef] of Object.entries(specFields)) {
+    if (!fieldDef.encrypted) continue;
+    if (result[key] === undefined || result[key] === null) continue;
+    result[key] = decryptValue(result[key]);
+  }
+  return result;
+}

package/src/server/server.js

@@ -83,6 +83,22 @@ export function createServer(options) {
       if (!systemInitialized) {
         const { loadPlugins } = await load(path.join(__dirname, '../plugins/index.js'));
         await loadPlugins(configEngine);
+        // Custom entities are DB rows, not code -- they can only be loaded
+        // once both the config engine AND the store are available, which is
+        // exactly this first-request boundary (the engine itself must be
+        // constructible with no DB dependency, per its existing contract).
+        // A bad row must not crash server startup for every other entity, so
+        // registration failures are logged and skipped individually.
+        try {
+          const { list } = await import('../lib/busybase/store.js');
+          const customDefs = await list('custom_entity_def', {});
+          for (const row of customDefs) {
+            try { configEngine.registerCustomEntity(row); }
+            catch (e) { log.error(`Failed to register custom entity "${row.name}": ${e.message}`); }
+          }
+        } catch (e) {
+          log.error(`Failed to load custom_entity_def rows: ${e.message}`);
+        }
         systemInitialized = true;
         log.info('System ready');
       }
@@ -191,6 +207,14 @@ export function createServer(options) {
           return await handleDeleteEntityTemplate(req, res, id, thatcher, configEngine);
         }
 
+        if (req.method === 'POST' && entity === 'custom_entity_def' && id === 'create' && !action) {
+          return await handleCreateCustomEntityDef(req, res, thatcher, configEngine);
+        }
+
+        if (req.method === 'POST' && entity === 'custom_entity_def' && id && action === 'delete') {
+          return await handleDeleteCustomEntityDef(req, res, id, thatcher, configEngine);
+        }
+
         if (req.method === 'POST' && entity === 'upload' && !id) {
           return await handleFileUpload(req, res, thatcher, configEngine);
         }
@@ -719,6 +743,92 @@ async function handleDeleteEntityTemplate(req, res, templateId, thatcher, config
   }
 }
 
+async function handleCreateCustomEntityDef(req, res, thatcher, configEngineArg) {
+  const user = await requireAuthedPartner(req, res);
+  if (!user) return;
+
+  let configEngine = configEngineArg || thatcher?.configEngine || globalThis.__thatcherConfigEngine;
+  if (!configEngine) {
+    const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+    configEngine = getConfigEngineSync();
+  }
+
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (e) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: e.message }));
+    return;
+  }
+  const { name, label, label_plural, fields } = body || {};
+  if (!name || typeof name !== 'string' || !name.trim()) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'name required' }));
+    return;
+  }
+  if (!label || typeof label !== 'string' || !label.trim()) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: 'label required' }));
+    return;
+  }
+
+  const { validateCustomEntityFields } = await import('../lib/config-generator-engine.js');
+  // Same allow-listed field-type vocabulary and reserved-key rejection every
+  // custom entity gets, checked here BEFORE the record is ever persisted --
+  // a bad definition must never reach the store, let alone registerCustomEntity.
+  const fieldValidation = validateCustomEntityFields(fields);
+  if (!fieldValidation.valid) {
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: fieldValidation.error }));
+    return;
+  }
+
+  try {
+    const record = { name: name.trim(), label: label.trim(), label_plural: (label_plural || '').trim() || undefined, fields, owner_id: user.id };
+    // Register FIRST -- if the slug collides with an existing entity or the
+    // shape is otherwise invalid at the engine level, the definition is
+    // never persisted, so a rejected custom_entity_def never lingers as a
+    // dead row claiming a slug it was never actually allowed to use.
+    const slug = configEngine.registerCustomEntity(record);
+    const { create } = await import('../lib/busybase/store.js');
+    const created = await create('custom_entity_def', record, user);
+    res.writeHead(201, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, id: created.id, slug }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(400);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function handleDeleteCustomEntityDef(req, res, defId, thatcher, configEngineArg) {
+  const user = await requireAuthedPartner(req, res);
+  if (!user) return;
+
+  try {
+    const { remove, get } = await import('../lib/busybase/store.js');
+    const existing = await get('custom_entity_def', defId);
+    if (!existing) {
+      res.writeHead(404);
+      res.end(JSON.stringify({ error: 'Custom entity definition not found' }));
+      return;
+    }
+    await remove('custom_entity_def', defId);
+    // Deliberately does NOT unregister the entity from the running config
+    // engine -- existing data for that entity must remain readable this
+    // session; removal only takes full effect on next restart's fresh
+    // custom_entity_def load, the same "config changes need a reload"
+    // contract updateWorkflow/updatePermissionTemplate already carry.
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true }));
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(500);
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
 async function handleCreateScheduledJob(req, res, thatcher, configEngineArg) {
   const user = await requireAuthedPartner(req, res);
   if (!user) return;

package/src/ui/custom-entity-renderer.js

@@ -0,0 +1,92 @@
+import { page } from '@/ui/layout.js';
+import { esc } from '@/ui/render-helpers.js';
+
+const FIELD_TYPES = ['text', 'textarea', 'email', 'number', 'currency', 'date', 'enum', 'bool', 'multiselect', 'ref', 'multiref', 'file', 'json'];
+
+export function renderCustomEntityList(user, defs) {
+  const rows = defs.map(d => {
+    const fieldsArr = typeof d.fields === 'string' ? JSON.parse(d.fields || '[]') : (d.fields || []);
+    const fieldSummary = fieldsArr.map(f => `${f.key}:${f.type}`).join(', ');
+    return `<tr>
+      <td>${esc(d.name)}</td>
+      <td>${esc(d.label)}</td>
+      <td style="font-size:12px">${esc(fieldSummary)}</td>
+      <td><a href="/${esc(d.name.toLowerCase().replace(/[^a-z0-9]+/g,'_'))}" class="btn-ghost-clean">View</a>
+        <button type="button" class="btn-ghost-clean" data-action="deleteCustomEntity" data-args='["${esc(d.id)}"]'>Delete</button>
+      </td>
+    </tr>`;
+  }).join('') || '<tr><td colspan="4">No custom entities</td></tr>';
+
+  const typeOpts = FIELD_TYPES.map(t => `<option value="${esc(t)}">${esc(t)}</option>`).join('');
+
+  const content = `<div class="page-header"><h1 class="page-title">Custom Entities</h1></div>
+    <p style="font-size:13px;color:var(--color-text-muted,#666);margin-bottom:16px">Define a brand-new entity at runtime -- once created, it gets the full generic list/detail/form/board/report views and API every built-in entity has, with zero code.</p>
+    <div class="card-clean" style="margin-bottom:16px"><div class="card-clean-body">
+      <table class="data-table"><thead><tr><th>Name</th><th>Label</th><th>Fields</th><th></th></tr></thead><tbody>${rows}</tbody></table>
+    </div></div>
+    <div class="card-clean"><div class="card-clean-body">
+      <h3 style="margin-bottom:8px">New Custom Entity</h3>
+      <div style="display:flex;flex-direction:column;gap:8px;max-width:560px">
+        <input type="text" id="new-entity-name" placeholder="Internal name, e.g. equipment" class="form-input">
+        <input type="text" id="new-entity-label" placeholder="Label, e.g. Equipment" class="form-input">
+        <input type="text" id="new-entity-label-plural" placeholder="Plural label, e.g. Equipment Items" class="form-input">
+        <div id="field-rows"></div>
+        <button type="button" class="btn-ghost-clean" data-action="addFieldRow">+ Add Field</button>
+        <button type="button" class="btn-primary-clean" data-action="createCustomEntity">Create Entity</button>
+      </div>
+    </div></div>
+    <span id="custom-entity-status" style="font-size:13px"></span>`;
+
+  const script = `(function(){
+    var fieldRowCount=0;
+    function addFieldRow(){
+      var container=document.getElementById('field-rows');
+      var idx=fieldRowCount++;
+      var row=document.createElement('div');
+      row.className='field-row';
+      row.style.cssText='display:flex;gap:6px;margin:4px 0';
+      row.innerHTML='<input type="text" class="form-input field-key" placeholder="key" style="flex:1">'+
+        '<select class="form-input field-type" style="flex:1">${typeOpts}</select>'+
+        '<input type="text" class="form-input field-label" placeholder="label" style="flex:1">'+
+        '<label style="display:flex;align-items:center;gap:4px;font-size:12px"><input type="checkbox" class="field-required">required</label>'+
+        '<button type="button" class="btn-ghost-clean" data-action="removeFieldRow">x</button>';
+      container.appendChild(row);
+    }
+    window.addFieldRow=addFieldRow;
+    window.removeFieldRow=function(btn){ if(btn&&btn.closest)btn.closest('.field-row').remove() };
+    addFieldRow();
+
+    window.createCustomEntity=function(){
+      var status=document.getElementById('custom-entity-status');
+      var name=(document.getElementById('new-entity-name').value||'').trim();
+      var label=(document.getElementById('new-entity-label').value||'').trim();
+      var labelPlural=(document.getElementById('new-entity-label-plural').value||'').trim();
+      if(!name){status.textContent='Name required';return}
+      if(!label){status.textContent='Label required';return}
+      var fields=[];
+      document.querySelectorAll('.field-row').forEach(function(row){
+        var key=row.querySelector('.field-key').value.trim();
+        var type=row.querySelector('.field-type').value;
+        var flabel=row.querySelector('.field-label').value.trim();
+        var required=row.querySelector('.field-required').checked;
+        if(key)fields.push({key:key,type:type,label:flabel||key,required:required});
+      });
+      if(!fields.length){status.textContent='At least one field required';return}
+      status.textContent='Creating...';
+      fetch('/api/custom_entity_def/create',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({name:name,label:label,label_plural:labelPlural,fields:fields})})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){location.reload()}else{status.textContent='Error: '+(res.d.error||'create failed')}})
+        .catch(function(err){status.textContent='Error: '+err.message});
+    };
+    window.deleteCustomEntity=function(id){
+      var status=document.getElementById('custom-entity-status');
+      status.textContent='Deleting...';
+      fetch('/api/custom_entity_def/'+id+'/delete',{method:'POST'})
+        .then(function(r){return r.json().then(function(d){return {ok:r.ok,d:d}})})
+        .then(function(res){if(res.ok){location.reload()}else{status.textContent='Error: '+(res.d.error||'delete failed')}})
+        .catch(function(err){status.textContent='Error: '+err.message});
+    };
+  })();`;
+
+  return page(user, 'Custom Entities | Thatcher', [{ href: '/admin/settings', label: 'Settings' }, { label: 'Custom Entities' }], content, [script]);
+}

package/src/ui/page-handler-admin.js

@@ -11,6 +11,7 @@ import { renderRolesList, renderTemplateList, renderPermissionMatrix } from '@/u
 import { renderWebhookList, renderWebhookDetail } from '@/ui/webhook-renderer.js';
 import { renderTemplateList as renderEntityTemplateList } from '@/ui/template-renderer.js';
 import { renderScheduledJobList } from '@/ui/scheduled-job-renderer.js';
+import { renderCustomEntityList } from '@/ui/custom-entity-renderer.js';
 import { isPartner, isManager } from '@/ui/permissions-ui.js';
 import { getSystemConfig, getSettingsCounts, getAuditData, getSystemHealth, renderBuildLogsContent } from '@/ui/page-handler-helpers.js';
 import { fileURLToPath } from 'url';
@@ -206,5 +207,10 @@ export async function handleAdminPage(normalized, segments, user, req) {
     let jobs = []; try { jobs = await list('scheduled_job', {}); } catch {}
     return renderScheduledJobList(user, jobs, entityNames);
   }
+  if (normalized === '/admin/custom-entities') {
+    if (!isPartner(user)) return renderAccessDenied(user, 'admin', 'view');
+    let defs = []; try { defs = await list('custom_entity_def', {}); } catch {}
+    return renderCustomEntityList(user, defs);
+  }
   return null;
 }