thatcher 1.0.87 → 1.0.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.87",
+  "version": "1.0.88",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/insights-engine.js

@@ -0,0 +1,133 @@
+// A synthesis layer over data already computed this session -- reads the
+// outputs of inventory-forecast.js/demand-forecast.js/resource-capacity.js/
+// contract-expiry.js, never reimplements their math. Deliberately rule-based
+// rather than an external LLM call: no API key, no network dependency, no
+// cost, and every rule is deterministic and directly witnessable via
+// exec_js the same way every other feature this session has been.
+import { daysUntilStockout, isReorderDue } from './inventory-forecast.js';
+import { daysUntilExpiry } from './contract-expiry.js';
+import { userCommittedHours, DEFAULT_WEEKLY_CAPACITY_HOURS } from './resource-capacity.js';
+
+const SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+
+function insight(severity, category, message, entity, entityId) {
+  return { severity, category, message, entity, entity_id: entityId };
+}
+
+// Product X will stock out in N days with no reorder currently scheduled --
+// "no reorder scheduled" here means the reorder isn't yet due (isReorderDue
+// false) but stockout is imminent, distinct from the existing product
+// detail-view warning which only flags the reorder-due boundary itself.
+export function stockoutRiskInsights(products, movementsByProductId) {
+  const results = [];
+  for (const product of products) {
+    const movements = movementsByProductId[product.id] || [];
+    const currentStock = movements.reduce((sum, m) => sum + (Number(m.quantity) || 0), 0);
+    const avgDailyConsumption = movements
+      .filter(m => Number(m.quantity) < 0)
+      .reduce((sum, m) => sum + Math.abs(Number(m.quantity) || 0), 0) / 90;
+    const days = daysUntilStockout(currentStock, avgDailyConsumption);
+    if (days == null) continue;
+    if (days <= 14) {
+      const severity = days <= 3 ? 'critical' : 'warning';
+      results.push(insight(severity, 'inventory', `${product.name || product.id} will stock out in ${Math.round(days)} days`, 'product', product.id));
+    }
+  }
+  return results;
+}
+
+// Contract Y expires in N days with no renewal opportunity linked --
+// cross-references contract.opportunity_id, since a contract already headed
+// toward renewal via a tracked deal is a materially different situation
+// from one with nothing lined up.
+export function contractExpiryInsights(contracts) {
+  const results = [];
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  for (const contract of contracts) {
+    if (contract.status !== 'active' || contract.end_date == null) continue;
+    const days = daysUntilExpiry(contract.end_date, nowSeconds);
+    if (days > (contract.notice_period_days ?? 30)) continue;
+    if (contract.opportunity_id) continue;
+    const severity = days <= 0 ? 'critical' : 'warning';
+    results.push(insight(severity, 'contract', `${contract.name || contract.id} expires in ${days} days with no renewal opportunity linked`, 'contract', contract.id));
+  }
+  return results;
+}
+
+// User Z is at N% capacity across active allocations -- a straightforward
+// utilization-threshold rule reusing the exact load calculation
+// resource-optimizer.js's suggestion ranking already relies on.
+export async function capacityInsights(users, windowStart, windowEnd) {
+  const results = [];
+  for (const user of users) {
+    const committed = await userCommittedHours(user.id, windowStart, windowEnd);
+    const pct = Math.round((committed / DEFAULT_WEEKLY_CAPACITY_HOURS) * 100);
+    if (pct >= 90) {
+      const severity = pct >= 100 ? 'critical' : 'warning';
+      results.push(insight(severity, 'resource', `${user.name || user.id} is at ${pct}% capacity`, 'user', user.id));
+    }
+  }
+  return results;
+}
+
+// Opportunity pipeline for month N shows a >30% drop from month N-1 --
+// compares adjacent buckets from demand-forecast.js's own projectDemandByMonth
+// output, never recomputing the bucket sums itself.
+export function pipelineDropInsights(monthlyBuckets) {
+  const results = [];
+  for (let i = 1; i < monthlyBuckets.length; i++) {
+    const [prevKey, prevValue] = monthlyBuckets[i - 1];
+    const [curKey, curValue] = monthlyBuckets[i];
+    if (prevValue <= 0) continue;
+    const dropPct = ((prevValue - curValue) / prevValue) * 100;
+    if (dropPct > 30) {
+      results.push(insight('warning', 'pipeline', `Projected pipeline for ${curKey} is ${Math.round(dropPct)}% lower than ${prevKey}`, 'opportunity', curKey));
+    }
+  }
+  return results;
+}
+
+export function sortBySeverity(insights) {
+  return [...insights].sort((a, b) => (SEVERITY_ORDER[a.severity] ?? 3) - (SEVERITY_ORDER[b.severity] ?? 3));
+}
+
+// Orchestrator: every list() call here passes {user}, the SAME row/org-access
+// scoping every entity route in the codebase already applies -- an insight
+// can never surface a record the requesting user couldn't otherwise see,
+// because it is generated from the identical scoped query that record's own
+// list view would use. entityType optionally narrows which rule categories
+// run (e.g. 'product' -> only stockout insights), skipping the rest rather
+// than fetching data for rules that won't run.
+export async function generateInsights(user, entityType = null) {
+  const { list } = await import('./busybase/store.js');
+  const results = [];
+
+  if (!entityType || entityType === 'product') {
+    const products = await list('product', {}, { user });
+    const movementsByProductId = {};
+    for (const product of products) {
+      movementsByProductId[product.id] = await list('stock_movement', { product_id: product.id });
+    }
+    results.push(...stockoutRiskInsights(products, movementsByProductId));
+  }
+
+  if (!entityType || entityType === 'contract') {
+    const contracts = await list('contract', {}, { user });
+    results.push(...contractExpiryInsights(contracts));
+  }
+
+  if (!entityType || entityType === 'user' || entityType === 'resource_allocation') {
+    const users = await list('user', {}, { user });
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    results.push(...(await capacityInsights(users, nowSeconds, nowSeconds + 30 * 86400)));
+  }
+
+  if (!entityType || entityType === 'opportunity') {
+    const { projectDemandByMonth } = await import('./demand-forecast.js');
+    const opportunities = await list('opportunity', {}, { user });
+    const buckets = projectDemandByMonth(opportunities);
+    results.push(...pipelineDropInsights(buckets));
+  }
+
+  return sortBySeverity(results);
+}

package/src/ui/insights-renderer.js

@@ -0,0 +1,47 @@
+import { page } from '@/ui/layout.js';
+import { esc, emptyRow } from '@/ui/render-helpers.js';
+
+const SEVERITY_PILL = { critical: 'pill-danger', warning: 'pill-warning', info: 'pill-neutral' };
+const ENTITY_ROUTE = { product: 'product', contract: 'contract', user: 'user', resource_allocation: 'resource_allocation' };
+
+function insightRow(insight) {
+  const pillCls = SEVERITY_PILL[insight.severity] || 'pill-neutral';
+  const entityPath = ENTITY_ROUTE[insight.entity];
+  // opportunity-pipeline insights carry a month-string entity_id (e.g.
+  // '2026-09'), not a real record id -- there is no single record to link
+  // to for a whole-pipeline observation, so only entities with a real
+  // per-record id get a link.
+  const link = entityPath && insight.entity !== 'opportunity'
+    ? `<a href="/${esc(entityPath)}/${esc(insight.entity_id)}" class="text-primary hover:underline">View</a>`
+    : '';
+  return `<tr>
+    <td><span class="pill ${pillCls}">${esc(insight.severity)}</span></td>
+    <td>${esc(insight.category)}</td>
+    <td>${esc(insight.message)}</td>
+    <td>${link}</td>
+  </tr>`;
+}
+
+export function renderInsightsPage(user, insights = []) {
+  const rows = insights.map(insightRow).join('') || emptyRow(4, 'No insights right now');
+  const counts = insights.reduce((acc, i) => { acc[i.severity] = (acc[i.severity] || 0) + 1; return acc; }, {});
+
+  const content = `
+    <div class="page-header">
+      <h1 class="page-title">Insights</h1>
+      <p class="page-subtitle">${esc(String(counts.critical || 0))} critical, ${esc(String(counts.warning || 0))} warning, ${esc(String(counts.info || 0))} info</p>
+    </div>
+    <div class="card-clean">
+      <div class="card-clean-body">
+        <div class="table-wrap">
+          <table class="data-table">
+            <thead><tr><th>Severity</th><th>Category</th><th>Insight</th><th>Link</th></tr></thead>
+            <tbody>${rows}</tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  `;
+
+  return page(user, 'Insights | Thatcher', null, content, []);
+}

package/src/ui/page-handler.js

@@ -241,6 +241,16 @@ export async function handlePage(pathname, req, res) {
   if (!user) { res.writeHead(302, { Location: '/login' }); res.end(); return REDIRECT; }
   if (normalized === '/unauthorized') return renderAccessDenied(user, 'system', 'access');
   if (normalized === '/notifications') { let notifs=[]; try{notifs=await list('notification',{user_id:user.id},{sort:{field:'created_at',dir:'DESC'},limit:100,user})}catch{} const{renderNotificationsPage}=await lazyRenderer('notifications-renderer.js'); return renderNotificationsPage(user,notifs); }
+  if (normalized === '/insights') {
+    // generateInsights internally scopes every underlying list() call to
+    // {user} -- no separate access check needed here, the insights
+    // themselves can never surface a record this user couldn't already see.
+    const { generateInsights } = await import('@/lib/insights-engine.js');
+    let insights = [];
+    try { insights = await generateInsights(user); } catch {}
+    const { renderInsightsPage } = await lazyRenderer('insights-renderer.js');
+    return renderInsightsPage(user, insights);
+  }
   if (normalized === '/' || normalized === '/dashboard') return renderDashboard(user, await getDashboardStats(user));
   if (normalized.startsWith('/admin/') || normalized === '/admin/jobs') return handleAdminPage(normalized, segments, user, req);
   if (segments[0] === 'client' && segments.length === 3 && ['dashboard', 'users', 'progress'].includes(segments[2])) return handleClientSubRoute(user, segments[1], segments[2]);