thatcher 1.0.7 → 1.0.34

package/src/app/api/auth/google/route.js

@@ -1,4 +1,7 @@
 import { NextResponse } from '@/lib/next-polyfills';
+import { createLogger } from '@/lib/logger.js';
+
+const log = createLogger('[OAuth]');
 import { google } from '@/engine.server';
 import { Google } from 'arctic';
 import { generateState, generateCodeVerifier } from 'arctic';
@@ -52,7 +55,7 @@ export async function HEAD(request) {
     const { valid } = validateOAuthProvider(google);
     return new Response(null, { status: valid ? 200 : 503 });
   } catch (error) {
-    console.error('[OAuth HEAD] Error:', error);
+    log.error('HEAD error:', { message: error.message });
     return new Response(null, { status: 500 });
   }
 }

package/src/app/api/auth/login/route.js

@@ -1,4 +1,7 @@
+import { createLogger } from '@/lib/logger.js';
 import { getBy, verifyPassword, migrate } from '@/engine';
+
+const log = createLogger('[Login]');
 import { initializeSystemConfig } from '@/config/system-config-loader';
 import { withErrorHandler } from '@/lib/with-error-handler';
 import { lucia } from '@/engine.server';
@@ -40,7 +43,7 @@ export const POST = withErrorHandler(async (request) => {
       await initializeSystemConfig();
       migrate();
     } catch (e) {
-      console.error('[Login] Init failed:', e.message);
+      log.error('init failed:', { message: e.message });
       return new Response(JSON.stringify({ error: 'System init failed' }), { status: 500, headers: { 'Content-Type': 'application/json' } });
     }
   }
@@ -115,7 +118,7 @@ export const POST = withErrorHandler(async (request) => {
       }
     });
   } catch (err) {
-    console.error('[Login] Error:', err.message);
+    log.error(err.message);
     return new Response(JSON.stringify({ error: 'Authentication failed' }), { status: 500, headers: { 'Content-Type': 'application/json' } });
   }
 }, 'Auth:Login');

package/src/app/api/auth/mwr-bridge/route.js

@@ -1,6 +1,6 @@
-import { getBy } from '@/engine';
+import { getBy, list, update } from '@/engine';
 import { lucia } from '@/engine.server';
-import { getDatabase, now } from '@/lib/database-core';
+import { now } from '@/lib/id-helpers';
 import { withErrorHandler } from '@/lib/with-error-handler';
 import crypto from 'crypto';
 
@@ -21,34 +21,24 @@ export const POST = withErrorHandler(async (request) => {
   }
 
   const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
-  const db = getDatabase();
 
-  let bridgeRecord;
+  let bridgeRecord = null;
   try {
-    bridgeRecord = db.prepare('SELECT * FROM mwr_bridge_tokens WHERE token_hash = ? AND used = 0').get(tokenHash);
-  } catch (e) {
-    db.exec(`CREATE TABLE IF NOT EXISTS mwr_bridge_tokens (
-      id TEXT PRIMARY KEY,
-      token_hash TEXT NOT NULL,
-      email TEXT NOT NULL,
-      expires_at INTEGER NOT NULL,
-      used INTEGER DEFAULT 0,
-      created_at INTEGER NOT NULL
-    )`);
-    db.exec('CREATE INDEX IF NOT EXISTS idx_mwr_bridge_token ON mwr_bridge_tokens(token_hash)');
-    bridgeRecord = null;
-  }
+    const matches = (await list('mwr_bridge_tokens', { token_hash: tokenHash }))
+      .filter(r => !r.used || r.used === 0);
+    bridgeRecord = matches[0] || null;
+  } catch { bridgeRecord = null; }
 
-  const user = getBy('user', 'email', email.toLowerCase().trim());
+  const user = await getBy('user', 'email', email.toLowerCase().trim());
   if (!user) {
-    return new Response(JSON.stringify({ error: 'User not found in Moonlanding' }), {
+    return new Response(JSON.stringify({ error: 'User not found' }), {
       status: 404, headers: { 'Content-Type': 'application/json' }
     });
   }
 
   if (bridgeRecord) {
     if (bridgeRecord.expires_at < now()) {
-      db.prepare('UPDATE mwr_bridge_tokens SET used = 1 WHERE id = ?').run(bridgeRecord.id);
+      await update('mwr_bridge_tokens', bridgeRecord.id, { used: 1 });
       return new Response(JSON.stringify({ error: 'Bridge token has expired' }), {
         status: 401, headers: { 'Content-Type': 'application/json' }
       });
@@ -60,7 +50,7 @@ export const POST = withErrorHandler(async (request) => {
       });
     }
 
-    db.prepare('UPDATE mwr_bridge_tokens SET used = 1 WHERE id = ?').run(bridgeRecord.id);
+    await update('mwr_bridge_tokens', bridgeRecord.id, { used: 1 });
   }
 
   const session = await lucia.createSession(user.id, {});

package/src/app/api/auth/password-reset/route.js

@@ -1,6 +1,5 @@
-import { getBy } from '@/engine';
-import { hashPassword } from '@/engine';
-import { getDatabase, genId, now } from '@/lib/database-core';
+import { getBy, hashPassword, list, create, update, remove } from '@/engine';
+import { genId, now } from '@/lib/id-helpers';
 import { withErrorHandler } from '@/lib/with-error-handler';
 import crypto from 'crypto';
 
@@ -12,16 +11,16 @@ export const POST = withErrorHandler(async (request) => {
     return new Response(JSON.stringify({ error: 'Email is required' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
   }
 
-  const user = getBy('user', 'email', email);
+  const user = await getBy('user', 'email', email);
 
   if (user) {
-    const db = getDatabase();
     const token = crypto.randomBytes(32).toString('hex');
     const expiresAt = now() + 3600;
 
-    db.prepare('DELETE FROM password_reset_tokens WHERE user_id = ?').run(user.id);
-    db.prepare('INSERT INTO password_reset_tokens (id, user_id, token, expires_at, used, created_at) VALUES (?, ?, ?, ?, 0, ?)').run(genId(), user.id, token, expiresAt, now());
-
+    // Clear any existing reset tokens for this user, then issue a fresh one.
+    const existing = await list('password_reset_tokens', { user_id: user.id });
+    for (const t of existing) await remove('password_reset_tokens', t.id);
+    await create('password_reset_tokens', { id: genId(), user_id: user.id, token, expires_at: expiresAt, used: 0, created_at: now() });
   }
 
   return new Response(JSON.stringify({ status: 'success', message: 'If an account exists with that email, a reset link has been sent.' }), {
@@ -41,23 +40,25 @@ export const PUT = withErrorHandler(async (request) => {
     return new Response(JSON.stringify({ error: 'Password must be at least 8 characters' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
   }
 
-  const db = getDatabase();
-  const resetToken = db.prepare('SELECT * FROM password_reset_tokens WHERE token = ? AND used = 0').get(token);
+  const matches = (await list('password_reset_tokens', { token })).filter(t => !t.used || t.used === 0);
+  const resetToken = matches[0];
 
   if (!resetToken) {
     return new Response(JSON.stringify({ error: 'Invalid or expired reset token' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
   }
 
   if (resetToken.expires_at < now()) {
-    db.prepare('UPDATE password_reset_tokens SET used = 1 WHERE id = ?').run(resetToken.id);
+    await update('password_reset_tokens', resetToken.id, { used: 1 });
     return new Response(JSON.stringify({ error: 'Reset token has expired. Please request a new one.' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
   }
 
   const passwordHash = await hashPassword(password);
 
-  db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(passwordHash, resetToken.user_id);
-  db.prepare('UPDATE password_reset_tokens SET used = 1 WHERE id = ?').run(resetToken.id);
-  db.prepare('DELETE FROM sessions WHERE user_id = ?').run(resetToken.user_id);
+  await update('user', resetToken.user_id, { password_hash: passwordHash });
+  await update('password_reset_tokens', resetToken.id, { used: 1 });
+  // Invalidate all sessions for this user.
+  const sessions = await list('sessions', { user_id: resetToken.user_id });
+  for (const s of sessions) await remove('sessions', s.id);
 
   return new Response(JSON.stringify({ status: 'success', message: 'Password updated successfully' }), {
     status: 200, headers: { 'Content-Type': 'application/json' }

package/src/app/api/cron/trigger/route.js

@@ -1,4 +1,7 @@
+import { createLogger } from '@/lib/logger.js';
 import { runDueJobs } from '@/engine/job-engine';
+
+const log = createLogger('[Cron]');
 import { create } from '@/engine';
 
 export const runtime = 'nodejs';
@@ -28,7 +31,7 @@ export async function POST(request) {
       duration_ms: duration,
       status: results.failed > 0 ? 'partial_failure' : 'success',
       error_details: results.errors || null
-    }).catch(err => console.error('[Cron] Log error:', err.message));
+    }).catch(err => log.error('log error:', { message: err.message }));
 
     return new Response(
       JSON.stringify({

package/src/app/api/debug/[[...path]]/route.js

@@ -1,8 +1,3 @@
-/**
- * Debug API Routes - Comprehensive observability endpoints
- * Exposes all subsystem state as JSON for debugging and monitoring
- */
-
 import { tracer } from '@/lib/tracing.js';
 import { perfProfiler } from '@/lib/perf-profiler.js';
 import { debugRegistry } from '@/lib/debug-registry.js';
@@ -27,6 +22,12 @@ function errorResponse(message, status = 400) {
 }
 
 export async function GET(request) {
+  // The debug surface exposes memory, CPU, queries, hooks, config and env state.
+  // That is operational intelligence an attacker must never get in production, so
+  // the endpoint is disabled there outright (opt back in only behind real auth).
+  if (process.env.NODE_ENV === 'production') {
+    return errorResponse('Debug endpoints are disabled in production', 403);
+  }
   const url = new URL(request.url);
   const path = url.pathname;
   const params = url.searchParams;

package/src/app/api/debug/sqlite/route.js

@@ -1,21 +1,16 @@
 import { NextResponse } from '@/lib/next-polyfills';
-import { getDatabase } from '@/engine';
 
+// The data layer is busybase (LanceDB), not SQLite — the old pragma/page-count probe
+// no longer applies. This endpoint now reports the configured store kind.
 export async function GET() {
   if (process.env.NODE_ENV === 'production') {
     return NextResponse.json({ error: 'Not available in production' }, { status: 403 });
   }
-  try {
-    const db = getDatabase();
-    const page_count = db.pragma('page_count', { simple: true });
-    const page_size = db.pragma('page_size', { simple: true });
-    const journal_mode = db.pragma('journal_mode', { simple: true });
-    const wal_autocheckpoint = db.pragma('wal_autocheckpoint', { simple: true });
-    const path = db.name;
-    return NextResponse.json({ path, page_count, page_size, bytes: page_count * page_size, journal_mode, wal_autocheckpoint });
-  } catch (e) {
-    return NextResponse.json({ error: String(e?.message || e) }, { status: 500 });
-  }
+  return NextResponse.json({
+    store: 'busybase',
+    dir: process.env.BUSYBASE_DIR || 'busybase_data',
+    note: 'SQLite has been replaced by busybase (LanceDB); pragma stats are not applicable.',
+  });
 }
 
 export const config = { runtime: 'nodejs' };

package/src/app/api/debug/sync/route.js

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import { NextResponse } from '@/lib/next-polyfills';
-import { getDatabase } from '@/engine';
+import { count } from '@/engine';
 
 export async function GET() {
   if (process.env.NODE_ENV === 'production') {
@@ -17,10 +17,10 @@ export async function GET() {
   } catch {}
   let table_counts = {};
   try {
-    const db = getDatabase();
-    const tables = ['users', 'engagement', 'review', 'rfi_template', 'entity_type', 'engagement_type', 'client'];
-    for (const t of tables) {
-      try { table_counts[t] = db.prepare(`SELECT COUNT(*) c FROM ${t}`).get()?.c ?? null; } catch { table_counts[t] = null; }
+    // entity names (busybase tables); 'user' maps to the users table in the store
+    const entities = ['user', 'engagement', 'review', 'rfi_template', 'entity_type', 'engagement_type', 'client'];
+    for (const e of entities) {
+      try { table_counts[e] = await count(e, {}); } catch { table_counts[e] = null; }
     }
   } catch (e) { table_counts._error = String(e?.message || e); }
   return NextResponse.json({ last_run_at, table_counts });

package/src/app/api/domains/route.js

@@ -1,4 +1,7 @@
+import { createLogger } from '@/lib/logger.js';
 import { getDomainLoader } from '@/lib/domain-loader';
+
+const log = createLogger('[DomainsAPI]');
 import { ok } from '@/lib/response-formatter';
 import { withErrorHandler } from '@/lib/with-error-handler';
 import { getConfigEngine } from '@/lib/config-generator-engine';
@@ -12,7 +15,7 @@ export const GET = withErrorHandler(async (request) => {
     try {
       return domainLoader.getDomainInfo(domainName);
     } catch (error) {
-      console.error(`[Domains API] Error loading domain ${domainName}:`, error.message);
+      log.error(`error loading domain ${domainName}:`, { message: error.message });
       return null;
     }
   }).filter(Boolean);

package/src/app/api/email/allocate/batch/route.js

@@ -1,5 +1,9 @@
 import { NextResponse } from '@/lib/next-polyfills';
-import { getDatabase, genId, now } from '@/lib/database-core';
+import { createLogger } from '@/lib/logger.js';
+
+const log = createLogger('[EmailBatchAllocate]');
+import { genId, now } from '@/lib/id-helpers';
+import { list, create, update } from '@/engine';
 import { autoAllocateEmail } from '@/lib/email-parser';
 
 export async function POST(request) {
@@ -14,14 +18,9 @@ export async function POST(request) {
     const body = await request.json();
     const { min_confidence = 70, batch_size = 50 } = body;
 
-    const db = getDatabase();
-
-    const unallocatedEmails = db.prepare(`
-      SELECT * FROM email
-      WHERE allocated = 0 AND status = 'pending'
-      ORDER BY received_at DESC
-      LIMIT ?
-    `).all(batch_size);
+    const unallocatedEmails = (await list('email', { status: 'pending' }, { sort: { field: 'received_at', dir: 'DESC' } }))
+      .filter(e => !e.allocated || e.allocated === 0)
+      .slice(0, batch_size);
 
     const results = {
       allocated: [],
@@ -38,24 +37,20 @@ export async function POST(request) {
           const logId = genId();
           const timestamp = now();
 
-          db.prepare(`
-            INSERT INTO activity_log (
-              id, entity_type, entity_id, action, message, details, created_at
-            ) VALUES (?, ?, ?, ?, ?, ?, ?)
-          `).run(
-            logId,
-            'email',
-            email.id,
-            'batch_allocated',
-            `Email batch-allocated to ${result.engagement_id ? 'engagement' : 'RFI'}`,
-            JSON.stringify({
+          await create('activity_log', {
+            id: logId,
+            entity_type: 'email',
+            entity_id: email.id,
+            action: 'batch_allocated',
+            message: `Email batch-allocated to ${result.engagement_id ? 'engagement' : 'RFI'}`,
+            details: JSON.stringify({
               engagement_id: result.engagement_id || null,
               rfi_id: result.rfi_id || null,
               confidence: result.confidence,
               method: 'batch_automatic',
             }),
-            timestamp
-          );
+            created_at: timestamp,
+          });
 
           results.allocated.push({
             email_id: email.id,
@@ -85,19 +80,14 @@ export async function POST(request) {
           reason: error.message,
         });
 
-        db.prepare(`
-          UPDATE email
-          SET processing_error = ?,
-              updated_at = ?
-          WHERE id = ?
-        `).run(error.message, now(), email.id);
+        await update('email', email.id, { processing_error: error.message, updated_at: now() });
       }
     }
 
     return NextResponse.json(results);
 
   } catch (error) {
-    console.error('[EMAIL_BATCH_ALLOCATE] Error:', error);
+    log.error('error:', { message: error.message });
     return NextResponse.json(
       { error: 'Internal server error', message: error.message },
       { status: 500 }

package/src/app/api/email/allocate/route.js

@@ -1,5 +1,9 @@
 import { NextResponse } from '@/lib/next-polyfills';
-import { getDatabase, genId, now } from '@/lib/database-core';
+import { createLogger } from '@/lib/logger.js';
+import { genId, now } from '@/lib/id-helpers';
+import { get, create } from '@/engine';
+
+const log = createLogger('[EmailAllocate]');
 import {
   allocateEmailToEntity,
   autoAllocateEmail,
@@ -23,8 +27,7 @@ export async function POST(request) {
       );
     }
 
-    const db = getDatabase();
-    const email = db.prepare('SELECT * FROM email WHERE id = ?').get(email_id);
+    const email = await get('email', email_id);
 
     if (!email) {
       return NextResponse.json(
@@ -104,24 +107,20 @@ export async function POST(request) {
     const logId = genId();
     const timestamp = now();
 
-    db.prepare(`
-      INSERT INTO activity_log (
-        id, entity_type, entity_id, action, message, details, created_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)
-    `).run(
-      logId,
-      'email',
-      email_id,
-      'allocated',
-      `Email allocated to ${result.engagement_id ? 'engagement' : 'RFI'}`,
-      JSON.stringify({
+    await create('activity_log', {
+      id: logId,
+      entity_type: 'email',
+      entity_id: email_id,
+      action: 'allocated',
+      message: `Email allocated to ${result.engagement_id ? 'engagement' : 'RFI'}`,
+      details: JSON.stringify({
         engagement_id: result.engagement_id || null,
         rfi_id: result.rfi_id || null,
         method: auto ? 'automatic' : 'manual',
         confidence: result.confidence || 100,
       }),
-      timestamp
-    );
+      created_at: timestamp,
+    });
 
     return NextResponse.json({
       success: true,
@@ -132,7 +131,7 @@ export async function POST(request) {
     });
 
   } catch (error) {
-    console.error('[EMAIL_ALLOCATE] Error:', error);
+    log.error('error:', { message: error.message });
     return NextResponse.json(
       { error: 'Internal server error', message: error.message },
       { status: 500 }

package/src/app/api/email/receive/route.js

@@ -1,12 +1,16 @@
 import { NextResponse } from '@/lib/next-polyfills';
-import { getDatabase, genId, now } from '@/lib/database-core';
+import { createLogger } from '@/lib/logger.js';
+import { genId, now } from '@/lib/id-helpers';
+import { create } from '@/engine';
+
+const log = createLogger('[EmailReceive]');
 import path from 'path';
 import fs from 'fs';
 
-const TEMP_EMAIL_ATTACHMENTS_DIR = path.resolve(process.cwd(), 'data', 'temp_email_attachments');
+const EMAIL_ATTACHMENTS_DIR = path.resolve(process.cwd(), 'data', 'temp_email_attachments');
 
-if (!fs.existsSync(TEMP_EMAIL_ATTACHMENTS_DIR)) {
-  fs.mkdirSync(TEMP_EMAIL_ATTACHMENTS_DIR, { recursive: true });
+if (!fs.existsSync(EMAIL_ATTACHMENTS_DIR)) {
+  fs.mkdirSync(EMAIL_ATTACHMENTS_DIR, { recursive: true });
 }
 
 export async function POST(request) {
@@ -49,7 +53,7 @@ export async function POST(request) {
         const attachmentId = genId();
         const ext = path.extname(filename);
         const safeFilename = `${attachmentId}${ext}`;
-        const filePath = path.join(TEMP_EMAIL_ATTACHMENTS_DIR, safeFilename);
+        const filePath = path.join(EMAIL_ATTACHMENTS_DIR, safeFilename);
 
         const buffer = Buffer.isBuffer(content)
           ? content
@@ -86,45 +90,30 @@ export async function POST(request) {
       processing_error: null,
     };
 
-    const db = getDatabase();
-    const stmt = db.prepare(`
-      INSERT INTO email (
-        id, sender_email, sender_name, subject, body, html_body,
-        message_id, in_reply_to, references, received_at, allocated,
-        engagement_id, rfi_id, attachments, status, processed, processing_error,
-        created_at, updated_at
-      ) VALUES (
-        ?, ?, ?, ?, ?, ?,
-        ?, ?, ?, ?, ?,
-        ?, ?, ?, ?, ?, ?,
-        ?, ?
-      )
-    `);
-
     const emailId = genId();
     const timestamp = now();
 
-    stmt.run(
-      emailId,
-      emailRecord.sender_email,
-      emailRecord.sender_name,
-      emailRecord.subject,
-      emailRecord.body,
-      emailRecord.html_body,
-      emailRecord.message_id,
-      emailRecord.in_reply_to,
-      emailRecord.references,
-      emailRecord.received_at,
-      emailRecord.allocated ? 1 : 0,
-      emailRecord.engagement_id,
-      emailRecord.rfi_id,
-      emailRecord.attachments,
-      emailRecord.status,
-      emailRecord.processed ? 1 : 0,
-      emailRecord.processing_error,
-      timestamp,
-      timestamp
-    );
+    await create('email', {
+      id: emailId,
+      sender_email: emailRecord.sender_email,
+      sender_name: emailRecord.sender_name,
+      subject: emailRecord.subject,
+      body: emailRecord.body,
+      html_body: emailRecord.html_body,
+      message_id: emailRecord.message_id,
+      in_reply_to: emailRecord.in_reply_to || '',
+      references: emailRecord.references || '',
+      received_at: emailRecord.received_at,
+      allocated: emailRecord.allocated ? 1 : 0,
+      engagement_id: emailRecord.engagement_id || '',
+      rfi_id: emailRecord.rfi_id || '',
+      attachments: emailRecord.attachments,
+      status: emailRecord.status,
+      processed: emailRecord.processed ? 1 : 0,
+      processing_error: emailRecord.processing_error || '',
+      created_at: timestamp,
+      updated_at: timestamp,
+    });
 
     return NextResponse.json({
       success: true,
@@ -134,7 +123,7 @@ export async function POST(request) {
     });
 
   } catch (error) {
-    console.error('[EMAIL_RECEIVE] Error processing webhook:', error);
+    log.error('error processing webhook:', { message: error.message });
 
     return NextResponse.json(
       {

package/src/app/api/email/send/route.js

@@ -1,5 +1,9 @@
 import { NextResponse } from '@/lib/next-polyfills';
-import { getDatabase, now } from '@/lib/database-core';
+import { createLogger } from '@/lib/logger.js';
+import { now } from '@/lib/id-helpers';
+
+const log = createLogger('[Email]');
+import { list, update } from '@/engine';
 import { getConfigEngine } from '@/lib/config-generator-engine';
 import { EMAIL_STATUS } from '@/config/constants';
 import { sendSingleEmail, checkFailureRate } from '@/lib/email-sender';
@@ -19,7 +23,6 @@ export async function POST(request) {
   if (!token || token !== process.env.CRON_SECRET)
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
 
-  const db = getDatabase();
   try {
     const emailCfg = await getEmailConfig();
     const MAX_RETRIES = emailCfg.send_max_retries || 3;
@@ -27,8 +30,10 @@ export async function POST(request) {
     const RATE_LIMIT_DELAY = emailCfg.rate_limit_delay_ms || 6000;
     const MAX_DELAY_MS = emailCfg.retry_max_delay_ms || 30000;
 
-    const pendingEmails = db.prepare(`SELECT * FROM email WHERE status=? AND (retry_count IS NULL OR retry_count < ?) ORDER BY created_at ASC LIMIT ?`)
-      .all(EMAIL_STATUS.PENDING, MAX_RETRIES, BATCH_SIZE);
+    // pending emails under the retry cap, oldest first, limited to the batch size
+    const pendingEmails = (await list('email', { status: EMAIL_STATUS.PENDING }, { sort: { field: 'created_at', dir: 'ASC' } }))
+      .filter(e => (e.retry_count == null || e.retry_count < MAX_RETRIES))
+      .slice(0, BATCH_SIZE);
 
     if (!pendingEmails.length)
       return NextResponse.json({ success: true, message: 'No pending emails', processed: 0 });
@@ -38,18 +43,18 @@ export async function POST(request) {
 
     for (let i = 0; i < pendingEmails.length; i++) {
       const email = pendingEmails[i];
-      db.prepare(`UPDATE email SET status=?, updated_at=? WHERE id=?`).run(EMAIL_STATUS.PROCESSING, now(), email.id);
-      const result = await sendSingleEmail(db, email, email.retry_count || 1, MAX_RETRIES, MAX_DELAY_MS);
+      await update('email', email.id, { status: EMAIL_STATUS.PROCESSING, updated_at: now() });
+      const result = await sendSingleEmail(email, email.retry_count || 1, MAX_RETRIES, MAX_DELAY_MS);
       results.push(result);
       result.success ? successCount++ : failureCount++;
       if (i < pendingEmails.length - 1)
         await new Promise(r => setTimeout(r, RATE_LIMIT_DELAY));
     }
 
-    checkFailureRate(db);
+    await checkFailureRate();
     return NextResponse.json({ success: true, processed: pendingEmails.length, results: { success: successCount, failed: failureCount }, details: results });
   } catch (error) {
-    console.error('[EMAIL] Queue processing error:', error);
+    log.error('queue processing error:', { message: error.message });
     return NextResponse.json({ error: 'Email queue processing failed', details: error.message }, { status: 500 });
   }
 }
@@ -59,16 +64,23 @@ export async function GET(request) {
   if (!token || token !== process.env.CRON_SECRET)
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
 
-  const db = getDatabase();
   try {
-    const stats = db.prepare(`SELECT status, COUNT(*) as count FROM email GROUP BY status`).all();
-    const failureStats = db.prepare(`SELECT COUNT(*) as total, SUM(CASE WHEN status=? THEN 1 ELSE 0 END) as failed FROM email WHERE created_at >= ?`)
-      .get(EMAIL_STATUS.FAILED, now() - 86400);
-    const recentFailures = db.prepare(`SELECT id, recipient_email, subject, processing_error, retry_count, created_at FROM email WHERE status=? ORDER BY created_at DESC LIMIT 10`)
-      .all(EMAIL_STATUS.FAILED);
+    const emails = await list('email', {});
+    // status counts (old GROUP BY status)
+    const stats = {};
+    for (const e of emails) stats[e.status] = (stats[e.status] || 0) + 1;
+    // failure rate over the last 24h
+    const cutoff = now() - 86400;
+    const recent = emails.filter(e => (e.created_at || 0) >= cutoff);
+    const failedTotal = recent.filter(e => e.status === EMAIL_STATUS.FAILED).length;
+    const recentFailures = emails
+      .filter(e => e.status === EMAIL_STATUS.FAILED)
+      .sort((a, b) => (b.created_at || 0) - (a.created_at || 0))
+      .slice(0, 10)
+      .map(e => ({ id: e.id, recipient_email: e.recipient_email, subject: e.subject, processing_error: e.processing_error, retry_count: e.retry_count, created_at: e.created_at }));
     return NextResponse.json({
-      stats: stats.reduce((acc, r) => ({ ...acc, [r.status]: r.count }), {}),
-      failureRate: failureStats.total > 0 ? failureStats.failed / failureStats.total : 0,
+      stats,
+      failureRate: recent.length > 0 ? failedTotal / recent.length : 0,
       recentFailures,
     });
   } catch (error) {