@rebasepro/server-core 0.5.0 → 0.6.0

package/src/auth/session-routes.ts

@@ -0,0 +1,341 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { randomBytes } from "crypto";
+import { ApiError } from "../api/errors";
+import { HonoEnv } from "../api/types";
+import { requireAuth } from "./middleware";
+import { logger } from "../utils/logger";
+import { strictAuthLimiter, defaultAuthLimiter } from "./rate-limiter";
+import { hashRefreshToken } from "./jwt";
+import type { AuthModuleConfig } from "./routes";
+import { resolveAuthHooks } from "./auth-hooks";
+import type { CreateUserData } from "./interfaces";
+
+interface SessionRoutesConfig {
+    router: Hono<HonoEnv>;
+    config: AuthModuleConfig;
+    ops: ReturnType<typeof resolveAuthHooks>;
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
+    buildAuthResponse: (
+        user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; metadata?: Record<string, unknown> | null },
+        roleIds: string[],
+        accessToken: string,
+        refreshToken: string
+    ) => unknown;
+    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
+        roleIds: string[];
+        accessToken: string;
+        refreshToken: string;
+    }>;
+}
+
+export function mountSessionRoutes(opts: SessionRoutesConfig): void {
+    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens } = opts;
+    const authRepo = config.authRepo;
+
+    const logoutSchema = z.object({
+        refreshToken: z.string().optional()
+    });
+
+    const linkSchema = z.object({
+        email: z.string().email("Invalid email address").max(255),
+        password: z.string().min(1, "Password is required").max(128)
+    });
+
+    const updateProfileSchema = z.object({
+        displayName: z.string().max(255).optional(),
+        photoURL: z.string().url().max(2048).optional()
+    });
+
+    const isEmailConfigured = () => !!(config.emailService && config.emailService.isConfigured());
+
+    /**
+     * POST /auth/logout
+     */
+    router.post("/logout", async (c) => {
+        const { refreshToken } = parseBody(logoutSchema, await c.req.json());
+
+        if (refreshToken) {
+            const tokenHash = hashRefreshToken(refreshToken);
+            await authRepo.deleteRefreshToken(tokenHash);
+        }
+
+        // Call afterLogout hook (fire-and-forget)
+        // Extract userId from the access token if present
+        const authHeader = c.req.header("authorization");
+        if (ops.afterLogout && authHeader?.startsWith("Bearer ")) {
+            const { verifyAccessToken } = await import("./jwt");
+            const payload = verifyAccessToken(authHeader.substring(7));
+            if (payload) {
+                ops.afterLogout(payload.userId).catch((err) => {
+                    logger.error("[AuthHooks] afterLogout error", {
+                        error: err instanceof Error ? err.message : err
+                    });
+                });
+            }
+        }
+
+        return c.json({ success: true });
+    });
+
+    /**
+     * GET /auth/sessions
+     * Get active refresh tokens (sessions) for the current user
+     */
+    router.get("/sessions", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const currentRefreshToken = c.req.header("x-refresh-token") as string;
+        const currentTokenHash = currentRefreshToken ? hashRefreshToken(currentRefreshToken) : null;
+
+        const sessions = await authRepo.listRefreshTokensForUser(userCtx.userId);
+
+        const mappedSessions = sessions.map((s) => ({
+            id: s.id,
+            userAgent: s.userAgent,
+            ipAddress: s.ipAddress,
+            createdAt: s.createdAt,
+            isCurrentSession: currentTokenHash ? s.tokenHash === currentTokenHash : false
+        }));
+
+        return c.json({ sessions: mappedSessions });
+    });
+
+    /**
+     * DELETE /auth/sessions
+     * Delete all refresh tokens for the current user (remote logout every device)
+     */
+    router.delete("/sessions", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        await authRepo.deleteAllRefreshTokensForUser(userCtx.userId);
+        return c.json({
+            success: true,
+            message: "All sessions revoked successfully"
+        });
+    });
+
+    /**
+     * DELETE /auth/sessions/:id
+     * Delete a specific refresh token (remote logout)
+     */
+    router.delete("/sessions/:id", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const id = c.req.param("id");
+        if (!id) {
+            throw ApiError.badRequest("Session ID is required", "INVALID_INPUT");
+        }
+
+        await authRepo.deleteRefreshTokenById(id, userCtx.userId);
+        return c.json({
+            success: true,
+            message: "Session revoked successfully"
+        });
+    });
+
+    /**
+     * GET /auth/me
+     * Get current authenticated user
+     */
+    router.get("/me", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const result = await authRepo.getUserWithRoles(userCtx.userId);
+        if (!result) {
+            throw ApiError.notFound("User not found");
+        }
+
+        return c.json({
+            user: {
+                uid: result.user.id,
+                email: result.user.email,
+                displayName: result.user.displayName,
+                photoURL: result.user.photoUrl,
+                emailVerified: result.user.emailVerified,
+                roles: result.roles.map((r) => r.id),
+                metadata: result.user.metadata ?? {}
+            }
+        });
+    });
+
+    /**
+     * PATCH /auth/me
+     * Update current authenticated user profile
+     */
+    router.patch("/me", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const { displayName, photoURL } = parseBody(updateProfileSchema, await c.req.json());
+
+        const updatedUser = await authRepo.updateUser(userCtx.userId, {
+            displayName: displayName !== undefined ? displayName : undefined,
+            photoUrl: photoURL !== undefined ? photoURL : undefined
+        });
+
+        if (!updatedUser) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const result = await authRepo.getUserWithRoles(userCtx.userId);
+        if (!result) {
+            throw ApiError.notFound("User not found");
+        }
+
+        return c.json({
+            user: {
+                uid: result.user.id,
+                email: result.user.email,
+                displayName: result.user.displayName,
+                photoURL: result.user.photoUrl,
+                emailVerified: result.user.emailVerified,
+                roles: result.roles.map((r) => r.id),
+                metadata: result.user.metadata ?? {}
+            }
+        });
+    });
+
+    /**
+     * GET /auth/config
+     * Get public auth configuration
+     */
+    router.get("/config", defaultAuthLimiter, async (c) => {
+        let needsSetup: boolean;
+        if (config.isBootstrapCompleted) {
+            needsSetup = !(await config.isBootstrapCompleted());
+        } else {
+            const allUsers = await authRepo.listUsers();
+            needsSetup = allUsers.length === 0;
+        }
+
+        const registrationAllowed = needsSetup || !!config.allowRegistration;
+        const enabledProviders = (config.oauthProviders || []).map((p) => p.id);
+
+        return c.json({
+            needsSetup,
+            registrationEnabled: registrationAllowed,
+            emailServiceEnabled: isEmailConfigured(),
+            enabledProviders
+        });
+    });
+
+    /**
+     * POST /auth/anonymous
+     * Create an anonymous user with temporary credentials
+     */
+    router.post("/anonymous", strictAuthLimiter, async (c) => {
+        const anonId = randomBytes(16).toString("hex");
+        const anonEmail = `anon_${anonId.slice(0, 8)}@anonymous.local`;
+
+        let createData: CreateUserData = {
+            email: anonEmail,
+            emailVerified: false,
+            isAnonymous: true
+        };
+
+        if (ops.beforeUserCreate) {
+            createData = await ops.beforeUserCreate(createData);
+        }
+
+        const user = await authRepo.createUser(createData);
+
+        // Assign default role (follow register route pattern, but never auto-admin)
+        if (config.defaultRole) {
+            await authRepo.assignDefaultRole(user.id, config.defaultRole);
+        }
+
+        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
+            user.id,
+            c.req.header("user-agent") || "unknown",
+            c.req.header("x-forwarded-for") || "unknown"
+        );
+
+        // Fire afterUserCreate hook
+        if (ops.afterUserCreate) {
+            ops.afterUserCreate(user).catch((err) => {
+                logger.error("[AuthHooks] afterUserCreate error", {
+                    error: err instanceof Error ? err.message : err
+                });
+            });
+        }
+
+        // Fire onAuthenticated hook
+        if (ops.onAuthenticated) {
+            ops.onAuthenticated(user, "anonymous").catch((err) => {
+                logger.error("[AuthHooks] onAuthenticated error", {
+                    error: err instanceof Error ? err.message : err
+                });
+            });
+        }
+
+        return c.json(buildAuthResponse(user, roleIds, accessToken, refreshToken), 201);
+    });
+
+    /**
+     * POST /auth/anonymous/link
+     * Upgrade an anonymous user to a permanent account with email/password
+     */
+    router.post("/anonymous/link", requireAuth, async (c) => {
+        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        if (!userCtx) {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const user = await authRepo.getUserById(userCtx.userId);
+        if (!user?.isAnonymous) {
+            throw ApiError.badRequest("User is not anonymous", "NOT_ANONYMOUS");
+        }
+
+        const { email, password } = parseBody(linkSchema, await c.req.json());
+
+        // Validate password strength
+        const passwordValidation = ops.validatePasswordStrength(password);
+        if (!passwordValidation.valid) {
+            throw ApiError.badRequest(passwordValidation.errors.join(". "), "WEAK_PASSWORD");
+        }
+
+        // Check if email is already taken
+        const existingUser = await authRepo.getUserByEmail(email.toLowerCase());
+        if (existingUser) {
+            throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+        }
+
+        // Hash password
+        const passwordHash = await ops.hashPassword(password);
+
+        // Update user: set email, password, remove anonymous flag
+        const updatedUser = await authRepo.updateUser(user.id, {
+            email: email.toLowerCase(),
+            passwordHash,
+            isAnonymous: false
+        });
+
+        if (!updatedUser) {
+            throw ApiError.notFound("User not found");
+        }
+
+        // Generate new tokens with updated identity
+        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
+            user.id,
+            c.req.header("user-agent") || "unknown",
+            c.req.header("x-forwarded-for") || "unknown"
+        );
+
+        return c.json(buildAuthResponse(updatedUser, roleIds, accessToken, refreshToken));
+    });
+}

package/src/auth/slack-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
@@ -27,13 +28,13 @@ export function createSlackProvider(config: { clientId: string; clientSecret: st
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Slack access token:", await tokenResponse.text());
+                    logger.error("Failed to get Slack access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
                 const tokenData = await tokenResponse.json() as { ok: boolean; access_token?: string; error?: string };
                 if (!tokenData.ok || !tokenData.access_token) {
-                    console.error("Slack token exchange failed:", tokenData.error);
+                    logger.error("Slack token exchange failed", { detail: tokenData.error });
                     return null;
                 }
 
@@ -42,7 +43,7 @@ export function createSlackProvider(config: { clientId: string; clientSecret: st
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Slack user info:", await profileResponse.text());
+                    logger.error("Failed to get Slack user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -52,7 +53,7 @@ export function createSlackProvider(config: { clientId: string; clientSecret: st
                 };
 
                 if (!p.ok || !p.email) {
-                    console.error("Slack user has no email");
+                    logger.error("Slack user has no email");
                     return null;
                 }
 
@@ -63,7 +64,7 @@ export function createSlackProvider(config: { clientId: string; clientSecret: st
                     photoUrl: p.picture || null
                 };
             } catch (error) {
-                console.error("Slack OAuth error:", error);
+                logger.error("Slack OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/spotify-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Spotify OAuth Provider integration.
@@ -30,7 +31,7 @@ export function createSpotifyProvider(config: { clientId: string; clientSecret:
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Spotify access token:", await tokenResponse.text());
+                    logger.error("Failed to get Spotify access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -41,7 +42,7 @@ export function createSpotifyProvider(config: { clientId: string; clientSecret:
                 });
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Spotify user info:", await profileResponse.text());
+                    logger.error("Failed to get Spotify user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -50,7 +51,7 @@ export function createSpotifyProvider(config: { clientId: string; clientSecret:
                     email?: string; images?: Array<{ url: string }>;
                 };
 
-                if (!p.email) { console.error("Spotify user has no email"); return null; }
+                if (!p.email) { logger.error("Spotify user has no email"); return null; }
 
                 return {
                     providerId: p.id,
@@ -59,7 +60,7 @@ export function createSpotifyProvider(config: { clientId: string; clientSecret:
                     photoUrl: p.images?.[0]?.url || null
                 };
             } catch (error) {
-                console.error("Spotify OAuth error:", error);
+                logger.error("Spotify OAuth error", { error: error });
                 return null;
             }
         }

package/src/auth/twitter-oauth.ts

@@ -1,5 +1,6 @@
 import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
 import { z } from "zod";
+import { logger } from "../utils/logger";
 
 /**
  * Creates a Twitter/X OAuth 2.0 Provider integration.
@@ -47,7 +48,7 @@ export function createTwitterProvider(config: { clientId: string; clientSecret:
                 });
 
                 if (!tokenResponse.ok) {
-                    console.error("Failed to get Twitter access token:", await tokenResponse.text());
+                    logger.error("Failed to get Twitter access token", { detail: await tokenResponse.text() });
                     return null;
                 }
 
@@ -63,7 +64,7 @@ export function createTwitterProvider(config: { clientId: string; clientSecret:
                 );
 
                 if (!profileResponse.ok) {
-                    console.error("Failed to get Twitter user info:", await profileResponse.text());
+                    logger.error("Failed to get Twitter user info", { detail: await profileResponse.text() });
                     return null;
                 }
 
@@ -112,7 +113,7 @@ export function createTwitterProvider(config: { clientId: string; clientSecret:
                     photoUrl: profileData.profile_image_url?.replace("_normal", "_400x400") || null
                 };
             } catch (error) {
-                console.error("Twitter OAuth error:", error);
+                logger.error("Twitter OAuth error", { error: error });
                 return null;
             }
         }

package/src/collections/loader.ts

@@ -2,6 +2,7 @@ import { EntityCollection } from "@rebasepro/types";
 import * as fs from "fs";
 import * as path from "path";
 import { pathToFileURL } from "url";
+import { logger } from "../utils/logger";
 
 /**
  * Asynchronously load collection files from a directory for backend initialization
@@ -10,7 +11,7 @@ export async function loadCollectionsFromDirectory(directory: string): Promise<E
     const collections: EntityCollection[] = [];
     try {
         if (!fs.existsSync(directory)) {
-            console.warn(`[loadCollectionsFromDirectory] Collections directory not found: ${directory}`);
+            logger.warn(`[loadCollectionsFromDirectory] Collections directory not found: ${directory}`);
             return collections;
         }
 
@@ -34,16 +35,16 @@ export async function loadCollectionsFromDirectory(directory: string): Promise<E
                     if (module && module.default) {
                         collections.push(module.default);
                     } else {
-                        console.warn(`[loadCollectionsFromDirectory] File ${file} does not have a default export. Skipping.`);
+                        logger.warn(`[loadCollectionsFromDirectory] File ${file} does not have a default export. Skipping.`);
                     }
                 } catch (err: unknown) {
                     const message = err instanceof Error ? err.message : String(err);
-                    console.error(`[loadCollectionsFromDirectory] Failed to load collection from ${file}: ${message}`);
+                    logger.error(`[loadCollectionsFromDirectory] Failed to load collection from ${file}: ${message}`);
                 }
             }
         }
     } catch (err) {
-        console.error(`[loadCollectionsFromDirectory] Error reading collections directory: ${err}`);
+        logger.error(`[loadCollectionsFromDirectory] Error reading collections directory: ${err}`);
     }
     return collections;
 }

package/src/cron/cron-scheduler.test.ts

@@ -44,7 +44,7 @@ describe("CronScheduler", () => {
     describe("validateCronExpression", () => {
         it.each([
             "0 * * * *", "*/5 * * * *", "0 0 1 * *", "30 2 * * 1",
-            "0 0 * * 0", "0,15,30,45 * * * *", "0 0 1-15 * *",
+            "0 0 * * 0", "0,15,30,45 * * * *", "0 0 1-15 * *"
         ])("accepts valid expression: %s", (expr) => {
             expect(validateCronExpression(expr)).toEqual({ valid: true });
         });
@@ -106,7 +106,9 @@ describe("CronScheduler", () => {
         });
 
         it("preserves definition metadata", () => {
-            scheduler.registerJobs([makeJob("meta", { name: "My Job", description: "Desc", schedule: "30 2 * * 1" })]);
+            scheduler.registerJobs([makeJob("meta", { name: "My Job",
+description: "Desc",
+schedule: "30 2 * * 1" })]);
             const job = scheduler.getJob("meta")!;
             expect(job.name).toBe("My Job");
             expect(job.description).toBe("Desc");
@@ -262,7 +264,8 @@ describe("CronScheduler", () => {
             // Try second trigger while first is running
             const second = await scheduler.triggerJob("slow");
 
-            expect(second!.result).toEqual({ skipped: true, reason: "already_executing" });
+            expect(second!.result).toEqual({ skipped: true,
+reason: "already_executing" });
             expect(second!.logs).toContain("Skipped: job is already running");
 
             // Let the first one finish
@@ -480,7 +483,7 @@ describe("CronScheduler", () => {
                 ensureTable: jest.fn<() => Promise<void>>().mockResolvedValue(undefined),
                 insertLog,
                 fetchLogs: jest.fn<() => Promise<CronJobLogEntry[]>>().mockResolvedValue([]),
-                fetchJobStats: jest.fn<() => Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string | Date | null }>>>().mockResolvedValue(new Map()),
+                fetchJobStats: jest.fn<() => Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string | Date | null }>>>().mockResolvedValue(new Map())
             };
             scheduler.setStore(mockStore);
             scheduler.registerJobs([makeJob("persisted")]);
@@ -494,7 +497,7 @@ describe("CronScheduler", () => {
                 ensureTable: jest.fn<() => Promise<void>>().mockResolvedValue(undefined),
                 insertLog: jest.fn<() => Promise<void>>().mockRejectedValue(new Error("DB down")),
                 fetchLogs: jest.fn<() => Promise<CronJobLogEntry[]>>().mockResolvedValue([]),
-                fetchJobStats: jest.fn<() => Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string | Date | null }>>>().mockResolvedValue(new Map()),
+                fetchJobStats: jest.fn<() => Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string | Date | null }>>>().mockResolvedValue(new Map())
             };
             scheduler.setStore(mockStore);
             scheduler.registerJobs([makeJob("resilient")]);
@@ -505,12 +508,14 @@ describe("CronScheduler", () => {
 
         it("seeds counters from store on start", async () => {
             const stats = new Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string | Date | null }>();
-            stats.set("seeded", { totalRuns: 42, totalFailures: 3, lastRunAt: "2026-01-01T00:00:00Z" });
+            stats.set("seeded", { totalRuns: 42,
+totalFailures: 3,
+lastRunAt: "2026-01-01T00:00:00Z" });
             const mockStore = {
                 ensureTable: jest.fn<() => Promise<void>>().mockResolvedValue(undefined),
                 insertLog: jest.fn<() => Promise<void>>().mockResolvedValue(undefined),
                 fetchLogs: jest.fn<() => Promise<CronJobLogEntry[]>>().mockResolvedValue([]),
-                fetchJobStats: jest.fn<() => Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string | Date | null }>>>().mockResolvedValue(stats),
+                fetchJobStats: jest.fn<() => Promise<Map<string, { totalRuns: number; totalFailures: number; lastRunAt?: string | Date | null }>>>().mockResolvedValue(stats)
             };
             scheduler.setStore(mockStore);
             scheduler.registerJobs([makeJob("seeded")]);
@@ -527,11 +532,18 @@ describe("CronScheduler", () => {
 
     describe("status shape", () => {
         it("returns all expected fields", () => {
-            scheduler.registerJobs([makeJob("shape", { name: "Shape Test", description: "Desc", schedule: "15 3 * * *" })]);
+            scheduler.registerJobs([makeJob("shape", { name: "Shape Test",
+description: "Desc",
+schedule: "15 3 * * *" })]);
             expect(scheduler.getJob("shape")).toMatchObject({
-                id: "shape", name: "Shape Test", description: "Desc",
-                schedule: "15 3 * * *", enabled: true, state: "idle",
-                totalRuns: 0, totalFailures: 0
+                id: "shape",
+name: "Shape Test",
+description: "Desc",
+                schedule: "15 3 * * *",
+enabled: true,
+state: "idle",
+                totalRuns: 0,
+totalFailures: 0
             });
         });
 

package/src/cron/cron-scheduler.ts

@@ -5,7 +5,7 @@ import type {
     CronJobRunState,
     CronJobContext
 } from "@rebasepro/types";
-import type { RebaseClient } from "@rebasepro/client";
+import type { RebaseClient } from "@rebasepro/types";
 import type { LoadedCronJob } from "./cron-loader";
 import type { CronStore } from "./cron-store";
 import { logger } from "../utils/logger.js";
@@ -62,33 +62,38 @@ function expandCronField(field: string, min: number, max: number): number[] {
  */
 export function validateCronExpression(schedule: string): { valid: true } | { valid: false; reason: string } {
     if (!schedule || typeof schedule !== "string") {
-        return { valid: false, reason: "Schedule must be a non-empty string" };
+        return { valid: false,
+reason: "Schedule must be a non-empty string" };
     }
     const parts = schedule.trim().split(/\s+/);
     if (parts.length !== 5) {
-        return { valid: false, reason: `Expected 5 fields, got ${parts.length}` };
+        return { valid: false,
+reason: `Expected 5 fields, got ${parts.length}` };
     }
     const fieldRanges: [string, number, number][] = [
         ["minute", 0, 59],
         ["hour", 0, 23],
         ["day of month", 1, 31],
         ["month", 1, 12],
-        ["day of week", 0, 6],
+        ["day of week", 0, 6]
     ];
     for (let i = 0; i < 5; i++) {
         const [name, min, max] = fieldRanges[i];
         try {
             const values = expandCronField(parts[i], min, max);
             if (values.length === 0) {
-                return { valid: false, reason: `${name} field "${parts[i]}" produces no values` };
+                return { valid: false,
+reason: `${name} field "${parts[i]}" produces no values` };
             }
             for (const v of values) {
                 if (v < min || v > max) {
-                    return { valid: false, reason: `${name} field value ${v} out of range [${min}–${max}]` };
+                    return { valid: false,
+reason: `${name} field value ${v} out of range [${min}–${max}]` };
                 }
             }
         } catch (err) {
-            return { valid: false, reason: `${name} field: ${err instanceof Error ? err.message : String(err)}` };
+            return { valid: false,
+reason: `${name} field: ${err instanceof Error ? err.message : String(err)}` };
         }
     }
     return { valid: true };
@@ -362,7 +367,8 @@ export class CronScheduler {
                 finishedAt: new Date().toISOString(),
                 durationMs: 0,
                 success: true,
-                result: { skipped: true, reason: "already_executing" },
+                result: { skipped: true,
+reason: "already_executing" },
                 logs: ["Skipped: job is already running"],
                 manual: true
             };

package/src/cron/cron-store.ts

@@ -158,7 +158,7 @@ function rowToLogEntry(row: Record<string, unknown>): CronJobLogEntry {
         success: row.success as boolean,
         error: (row.error as string) ?? undefined,
         result: row.result ?? undefined,
-        logs: Array.isArray(row.logs) ? row.logs : (row.logs ? JSON.parse(row.logs as string) : []),
+        logs: Array.isArray(row.logs) ? row.logs : (row.logs ? (() => { try { return JSON.parse(row.logs as string); } catch { return []; } })() : []),
         manual: row.manual as boolean
     };
 }