@pablozaiden/webapp 1.0.0 → 1.1.1

package/README.md

@@ -1,6 +1,6 @@
 # @pablozaiden/webapp
 
-Opinionated Bun + React framework for single-server TypeScript webapps: one Bun process serves the React UI, API routes, multi-user passkey auth, user-owned API keys, device auth, stateless CLI API-key auth, realtime websocket state, scoped settings, binary builds and Docker images.
+Opinionated Bun + React framework for single-server TypeScript webapps: one Bun process serves the React UI, API routes, multi-user passkey auth, user-owned and server-managed API keys, device auth, stateless CLI API-key auth, realtime websocket state, scoped settings, binary builds and Docker images.
 
 ## Quick start
 

package/docs/auth-validation.md

@@ -39,6 +39,10 @@ Run this checklist before releasing a framework app or cutting a checkpoint.
 3. Call a protected API route with `Authorization: Bearer <token>`.
 4. Delete the key from Settings and confirm the confirmation dialog appears.
 5. Confirm the deleted token no longer authenticates.
+6. Create a managed key through the server-only helper and confirm it authenticates through the same bearer path.
+7. Confirm managed keys and `managedBy` metadata are absent from the normal API-key list and Settings UI.
+8. Restart against the same data directory and confirm a non-expired managed key still authenticates.
+9. Revoke the managed key through the server-only helper and confirm it no longer authenticates.
 
 ## CLI API-key authentication
 

package/docs/auth.md

@@ -42,6 +42,38 @@ API keys are user-owned bearer tokens for scripts and agents. They are stored ha
 
 Expired API keys do not authenticate, are omitted from user-facing lists, and are purged when key lists or expired keys are encountered.
 
+Server-side applications can create managed keys through the server-only helpers exported from
+`@pablozaiden/webapp/server`:
+
+```ts
+import { createManagedApiKey, listManagedApiKeys, revokeManagedApiKey } from "@pablozaiden/webapp/server";
+
+const created = createManagedApiKey(app.store, user, {
+  name: "Runtime credential",
+  managedBy: "my-application",
+  scopes: ["*"],
+});
+const keys = listManagedApiKeys(app.store, user.id, "my-application");
+revokeManagedApiKey(app.store, created.key.id, user.id);
+```
+
+Managed keys have an explicit `kind: "managed"` classification and optional opaque
+`managedBy` metadata. The plaintext token is returned only by creation and is never
+stored; applications must retain it securely. Managed keys use the same bearer
+authentication, ownership, scope, expiration, disabled-user, and lifecycle invalidation
+rules as user keys. They survive an ordinary restart, and applications should explicitly
+revoke each generation during their own resource cleanup.
+
+Managed keys have no browser/API CRUD endpoint. The normal `/api/api-keys` routes and
+Settings UI expose only `kind: "user"` keys, and request input cannot create or convert a
+managed key. User reset, passkey deletion, user deletion, and expiration cleanup cover
+both kinds.
+
+Custom `WebAppStore` implementations must persist `kind` and `managedBy`, migrate
+pre-managed records as `kind: "user"`, include both kinds in expiration cleanup and
+user deletion/reset cleanup, and preserve the owner filter used by the management
+helpers. The built-in SQLite store performs this migration automatically.
+
 Same-origin checks are skipped for API-key and device bearer requests unless a route sets `sameOrigin: "always"`, because non-browser clients usually do not send `Origin`.
 
 ## Device auth

package/docs/getting-started.md

@@ -190,6 +190,16 @@ reload; `fromEnv` indicates that the server environment locks the value.
 `LoggerAdapter` remains application-owned and can adapt the state to any
 logging library.
 
+### In-memory server logs
+
+Admins can enable temporary server-log capture from Developer Settings next to
+the log-level selector. The framework exposes the current state in
+`/api/config`; it starts disabled on every process start and is never stored in
+the database. Admin clients can retrieve a bounded chronological snapshot from
+`GET /api/server/logs` after enabling capture. The buffer is limited to the
+newest 1,000 framework logger entries or 512 KiB of rendered log lines, and
+turning the setting off clears it.
+
 ### Transient notifications
 
 The standard `renderWebApp` runtime provides the framework notification service

package/docs/server.md

@@ -148,11 +148,13 @@ Built-in endpoints include:
 | `/api/user-setup*` | One-time invite/reset setup links |
 | `/setup` | Browser setup screen for one-time invite/reset links |
 | `/api/users`, `/api/users/:id/*`, `/api/audit-events` | Admin user management and audit log |
-| `/api/api-keys` | Browser-managed API key create/list/delete |
+| `/api/api-keys` | Browser-managed user API-key create/list/delete |
 | `/api/auth/device`, `/api/auth/token`, `/api/auth/refresh`, `/api/auth/revoke` | Device auth and refresh-token flow |
 | `/device` | Browser device-code approval screen |
 | `/.well-known/jwks.json`, `/.well-known/openid-configuration` | Token verification metadata |
 | `/api/preferences/theme`, `/api/preferences/log-level` | Settings persistence |
+| `GET /api/server/logs` | Admin-only snapshot of the in-memory server logs |
+| `PUT /api/server/logs/settings` | Admin-only runtime toggle for in-memory server logs |
 | `/api/server/kill` | Authenticated server shutdown |
 | `/api/ws` | Realtime websocket by default |
 
@@ -162,6 +164,24 @@ The effective log level in `GET /api/config` and `GET
 to `true`. PUT remains an authenticated, same-origin admin mutation and
 returns a conflict when the environment controls the value.
 
+`GET /api/server/logs` is restricted to admin users and returns
+`{ enabled: boolean, logs: ServerLogEntry[] }`. Entries are returned in
+chronological order and contain the timestamp, level, logger scope, message,
+and rendered log line. When capture is disabled, the endpoint returns `200`
+with `enabled: false` and an empty list. `PUT /api/server/logs/settings`
+accepts `{ "enabled": boolean }`, is restricted to admins, and uses the normal
+same-origin policy for browser mutations. API-key and bearer callers continue
+to use the existing token-auth behavior. The in-memory buffer is limited to
+the newest 1,000 entries and 512 KiB of rendered UTF-8 lines; disabling capture
+clears it. These endpoints only expose messages emitted through the framework
+logger and never make the logs durable.
+
+Server-side applications that need credentials for internal runtimes should use
+the server-only `createManagedApiKey`, `listManagedApiKeys`, and
+`revokeManagedApiKey` helpers. Managed keys are persisted in the same API-key
+store, authenticate through the normal bearer path, and are intentionally absent
+from the browser-managed endpoint and Settings summaries.
+
 ## Framework-owned web document and PWA metadata
 
 `createWebAppServer` owns the browser document. Apps do not provide `index.html`; the framework generates a Bun `HTMLBundle` internally so Bun hot reload and asset rewriting keep working. By default the frontend entrypoint is `./web/main.tsx` relative to the Bun entry file. The generated document also initializes the shared `data-wapp-mobile` state before client styles load so CSS and `WebAppRoot` use the same mobile breakpoint. The generated viewport keeps the app at `initial-scale=1` with `maximum-scale=1` and `user-scalable=no`; clients and mobile browsers that honor those viewport scaling tokens, including iPhone and iPad, cannot change the app scale with pinch-to-zoom while normal scrolling remains enabled. Clients that ignore the tokens are unaffected.

package/docs/settings.md

@@ -3,11 +3,13 @@
 Settings is framework-owned so apps stay consistent. It includes:
 
 - Account summary and passkey logout/delete
-- API key create/list/delete for the current user when enabled
+- User API key create/list/delete for the current user when enabled
 - Device-auth sessions for the current user when enabled
 - Theme preference: system/light/dark, stored per user
 - Admin user management
 - Admin log-level preference unless `{PREFIX}_LOG_LEVEL` is set
+- Admin in-memory server-log capture toggle; disabled and cleared on process
+  start or when turned off
 - Admin server kill
 - Version/about
 
@@ -33,7 +35,17 @@ the shared hook state after a successful save, and `fromEnv` is true when
 `{PREFIX}_LOG_LEVEL` locks the value. Applications should not add a separate
 configuration fetch or initializer component.
 
-Security lists only show useful active credentials. Expired API keys are purged before listing, and revoked or expired device-auth refresh sessions are not shown. Revoked refresh sessions may remain in storage when needed for token-reuse protection, but they are hidden from Settings.
+Developer Settings also includes **Store server logs in memory**. It is an
+admin-only, process-local setting and is disabled when the server starts. When
+enabled, the framework logger retains only the newest 1,000 eligible entries
+within a 512 KiB rendered-line limit; disabling it immediately clears the
+buffer. The setting and captured logs are never stored in SQLite.
+
+Security lists only show useful active user credentials. Managed API keys created by
+server-side applications, and their metadata, are not returned by the browser API-key
+list or rendered in Settings. Expired API keys are purged before listing, and revoked
+or expired device-auth refresh sessions are not shown. Revoked refresh sessions may
+remain in storage when needed for token-reuse protection, but they are hidden from Settings.
 
 Destructive actions in Settings use the framework `ConfirmDialog` before mutating. This includes deleting users, deleting API keys, deleting passkeys, revoking device-auth sessions, and killing the server.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pablozaiden/webapp",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "Opinionated Bun + React webapp framework for single-server apps",
   "license": "MIT",
   "type": "module",

package/src/contracts/index.ts

@@ -58,6 +58,8 @@ export interface PasskeyAuthStatusResponse {
   ownerPasskeySetupRequired: boolean;
 }
 
+export type ApiKeyKind = "user" | "managed";
+
 export interface ApiKeySummary {
   id: string;
   name: string;
@@ -112,6 +114,14 @@ export interface AuthSessionSummary {
   active: boolean;
 }
 
+export interface ServerLogEntry {
+  timestamp: string;
+  level: LogLevelName;
+  scope: string;
+  message: string;
+  line: string;
+}
+
 export interface WebAppConfigResponse {
   appName: string;
   version: string;
@@ -125,6 +135,9 @@ export interface WebAppConfigResponse {
     level: LogLevelName;
     fromEnv: boolean;
   };
+  inMemoryLogs: {
+    enabled: boolean;
+  };
   deviceAuth: {
     enabled: boolean;
   };

package/src/server/auth/api-keys.ts

@@ -1,9 +1,30 @@
 import type { ApiKeySummary, CreatedApiKeyResponse, CurrentUser } from "../../contracts";
-import type { WebAppStore } from "./store";
+import type { ApiKeyRecord, WebAppStore } from "./store";
 import { nowIso, randomToken, sha256, secureEqual, isExpired } from "./crypto";
 import { AuthError } from "./types";
 
-function summarize(record: { tokenHash?: string } & ApiKeySummary): ApiKeySummary {
+export interface ManagedApiKeySummary extends ApiKeySummary {
+  kind: "managed";
+  managedBy?: string;
+}
+
+export interface CreatedManagedApiKeyResponse {
+  key: ManagedApiKeySummary;
+  token: string;
+}
+
+export interface ApiKeyCreationOptions {
+  name?: string;
+  scopes?: string[];
+  prefix?: string;
+  expiresAt?: string;
+}
+
+export interface ManagedApiKeyCreationOptions extends ApiKeyCreationOptions {
+  managedBy?: string;
+}
+
+function summarize(record: ApiKeyRecord): ApiKeySummary {
   return {
     id: record.id,
     name: record.name,
@@ -15,17 +36,31 @@ function summarize(record: { tokenHash?: string } & ApiKeySummary): ApiKeySummar
   };
 }
 
+function summarizeManaged(record: ApiKeyRecord): ManagedApiKeySummary {
+  return {
+    ...summarize(record),
+    kind: "managed",
+    managedBy: record.managedBy,
+  };
+}
+
 export function listApiKeys(store: WebAppStore, userId: string): ApiKeySummary[] {
   store.deleteExpiredApiKeys?.(nowIso());
   return store.listApiKeys(userId)
+    .filter((record) => record.userId === userId && record.kind === "user")
     .filter((record) => !record.expiresAt || !isExpired(record.expiresAt))
     .map(summarize);
 }
 
-export function createApiKey(store: WebAppStore, user: CurrentUser, input: { name?: string; scopes?: string[]; prefix?: string; expiresAt?: string }): CreatedApiKeyResponse {
+function createApiKeyRecord(
+  user: CurrentUser,
+  input: ApiKeyCreationOptions,
+  kind: ApiKeyRecord["kind"],
+  managedBy?: string,
+): { record: ApiKeyRecord; token: string } {
   const prefix = input.prefix ?? "wapp";
   const token = `${prefix}_${randomToken(32)}`;
-  const record = {
+  const record: ApiKeyRecord = {
     id: crypto.randomUUID(),
     userId: user.id,
     name: input.name?.trim() || "API key",
@@ -34,15 +69,53 @@ export function createApiKey(store: WebAppStore, user: CurrentUser, input: { nam
     scopes: input.scopes?.length ? input.scopes : ["*"],
     createdAt: nowIso(),
     expiresAt: input.expiresAt,
+    kind,
+    managedBy,
   };
+  return { record, token };
+}
+
+export function createApiKey(store: WebAppStore, user: CurrentUser, input: ApiKeyCreationOptions): CreatedApiKeyResponse {
+  const { record, token } = createApiKeyRecord(user, input, "user");
   store.saveApiKey(record);
   return { key: summarize(record), token };
 }
 
 export function deleteApiKey(store: WebAppStore, userId: string, id: string): boolean {
+  const record = store.listApiKeys(userId).find((candidate) => candidate.id === id && candidate.userId === userId);
+  if (!record || record.kind !== "user") {
+    return false;
+  }
   return store.deleteApiKey(id, userId);
 }
 
+export function createManagedApiKey(store: WebAppStore, user: CurrentUser, input: ManagedApiKeyCreationOptions = {}): CreatedManagedApiKeyResponse {
+  const { record, token } = createApiKeyRecord(user, input, "managed", input.managedBy);
+  store.saveApiKey(record);
+  return { key: summarizeManaged(record), token };
+}
+
+export function listManagedApiKeys(store: WebAppStore, userId: string, managedBy?: string): ManagedApiKeySummary[] {
+  store.deleteExpiredApiKeys?.(nowIso());
+  return store.listApiKeys(userId)
+    .filter((record) => record.userId === userId && record.kind === "managed")
+    .filter((record) => managedBy === undefined || record.managedBy === managedBy)
+    .filter((record) => !record.expiresAt || !isExpired(record.expiresAt))
+    .map(summarizeManaged);
+}
+
+export function revokeManagedApiKey(store: WebAppStore, id: string, userId?: string): boolean {
+  const record = store.listApiKeys(userId).find((candidate) =>
+    candidate.id === id
+    && candidate.kind === "managed"
+    && (userId === undefined || candidate.userId === userId)
+  );
+  if (!record) {
+    return false;
+  }
+  return store.deleteApiKey(id, record.userId);
+}
+
 export function authenticateApiKey(store: WebAppStore, token: string): { user: CurrentUser; apiKeyId: string; scopes: string[] } | undefined {
   const tokenHash = sha256(token);
   const record = store.getApiKeyByHash(tokenHash);
@@ -53,7 +126,7 @@ export function authenticateApiKey(store: WebAppStore, token: string): { user: C
     return undefined;
   }
   const user = store.getUserById(record.userId);
-  if (!user) {
+  if (!user || user.disabledAt) {
     return undefined;
   }
   store.touchApiKey(record.id, nowIso());

package/src/server/auth/sqlite-store.ts

@@ -11,7 +11,7 @@ import type {
   UserSetupLinkRecord,
   WebAppStore,
 } from "./store";
-import type { LogLevelName, ThemePreference, WebAppUserRole } from "../../contracts";
+import type { ApiKeyKind, LogLevelName, ThemePreference, WebAppUserRole } from "../../contracts";
 import { createUserRecord } from "./users";
 
 type Row = Record<string, unknown>;
@@ -132,6 +132,8 @@ export function sqliteWebAppStore(options: { dataDir?: string; fileName?: string
         created_at TEXT NOT NULL,
         last_used_at TEXT,
         expires_at TEXT,
+        kind TEXT NOT NULL DEFAULT 'user',
+        managed_by TEXT,
         FOREIGN KEY (user_id) REFERENCES webapp_users(id) ON DELETE CASCADE
       );
       CREATE TABLE IF NOT EXISTS webapp_device_auth_requests (
@@ -175,6 +177,19 @@ export function sqliteWebAppStore(options: { dataDir?: string; fileName?: string
     `);
   }
 
+  function migrateApiKeySchema(): void {
+    if (!tableExists("webapp_api_keys")) {
+      return;
+    }
+    if (!hasColumn("webapp_api_keys", "kind")) {
+      db.exec("ALTER TABLE webapp_api_keys ADD COLUMN kind TEXT NOT NULL DEFAULT 'user';");
+    }
+    if (!hasColumn("webapp_api_keys", "managed_by")) {
+      db.exec("ALTER TABLE webapp_api_keys ADD COLUMN managed_by TEXT;");
+    }
+    db.exec("CREATE INDEX IF NOT EXISTS idx_webapp_api_keys_managed ON webapp_api_keys(user_id, kind, managed_by);");
+  }
+
   function migrateSingleUserSchema(): void {
     const legacySources = [
       ["webapp_preferences", tableExists("webapp_preferences") && !hasColumn("webapp_preferences", "user_id")],
@@ -277,6 +292,7 @@ export function sqliteWebAppStore(options: { dataDir?: string; fileName?: string
   function initialize(): void {
     migrateSingleUserSchema();
     createSchema();
+    migrateApiKeySchema();
     db.exec("PRAGMA foreign_keys = ON;");
   }
 
@@ -356,6 +372,7 @@ export function sqliteWebAppStore(options: { dataDir?: string; fileName?: string
   }
 
   function mapApiKey(row: Row): ApiKeyRecord {
+    const kind: ApiKeyKind = row["kind"] === "managed" ? "managed" : "user";
     return {
       id: text(row["id"]),
       userId: text(row["user_id"]),
@@ -366,6 +383,8 @@ export function sqliteWebAppStore(options: { dataDir?: string; fileName?: string
       createdAt: text(row["created_at"]),
       lastUsedAt: optionalText(row["last_used_at"]),
       expiresAt: optionalText(row["expires_at"]),
+      kind,
+      managedBy: optionalText(row["managed_by"]),
     };
   }
 
@@ -544,9 +563,22 @@ export function sqliteWebAppStore(options: { dataDir?: string; fileName?: string
     },
     saveApiKey: (record) => {
       db.query(`
-        INSERT INTO webapp_api_keys (id, user_id, name, prefix, token_hash, scopes, created_at, last_used_at, expires_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(record.id, record.userId, record.name, record.prefix, record.tokenHash, JSON.stringify(record.scopes), record.createdAt, record.lastUsedAt ?? null, record.expiresAt ?? null);
+        INSERT INTO webapp_api_keys
+        (id, user_id, name, prefix, token_hash, scopes, created_at, last_used_at, expires_at, kind, managed_by)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        record.id,
+        record.userId,
+        record.name,
+        record.prefix,
+        record.tokenHash,
+        JSON.stringify(record.scopes),
+        record.createdAt,
+        record.lastUsedAt ?? null,
+        record.expiresAt ?? null,
+        record.kind,
+        record.managedBy ?? null,
+      );
     },
     touchApiKey: (id, lastUsedAt) => {
       db.query("UPDATE webapp_api_keys SET last_used_at = ? WHERE id = ?").run(lastUsedAt, id);

package/src/server/auth/store.ts

@@ -1,4 +1,4 @@
-import type { ApiKeySummary, AuditEventSummary, LogLevelName, ThemePreference, WebAppUserRole, WebAppUserSummary } from "../../contracts";
+import type { ApiKeyKind, ApiKeySummary, AuditEventSummary, LogLevelName, ThemePreference, WebAppUserRole, WebAppUserSummary } from "../../contracts";
 
 export interface UserRecord extends WebAppUserSummary {
   authVersion: number;
@@ -36,6 +36,8 @@ export interface StoredPasskey {
 export interface ApiKeyRecord extends ApiKeySummary {
   userId: string;
   tokenHash: string;
+  kind: ApiKeyKind;
+  managedBy?: string;
 }
 
 export interface DeviceAuthRequestRecord {

package/src/server/create-web-app-server.ts

@@ -11,7 +11,7 @@ import {
 import { createAuthentication } from "./authentication";
 import { createFrameworkEndpointHandler } from "./framework-endpoints";
 import { createServerLifecycle } from "./server-lifecycle";
-import { setLogLevel } from "./logger";
+import { inMemoryLogStorage, resetInMemoryLogStorage, setLogLevel } from "./logger";
 import { createWebDocumentProvider, htmlResponse } from "./web-document";
 import { createPublicRouteDispatcher } from "./public-route-dispatch";
 import { createRouteDispatcher } from "./route-dispatch";
@@ -45,6 +45,7 @@ export function createWebAppServer<TEvent = unknown>(input: WebAppServerConfig<T
   if (config.appName !== input.appName || config.envPrefix !== input.envPrefix) {
     throw new Error("runtimeConfig appName and envPrefix must match the createWebAppServer inputs");
   }
+  resetInMemoryLogStorage();
   const store = input.store ?? sqliteWebAppStore({ dataDir: config.dataDir });
   store.initialize();
   const savedLogLevel = store.getLogLevelPreference();
@@ -80,6 +81,7 @@ export function createWebAppServer<TEvent = unknown>(input: WebAppServerConfig<T
     deviceAuthEnabled,
     configResponse: input.configResponse,
     onLogLevelChange: input.logLevel?.onChange,
+    inMemoryLogs: inMemoryLogStorage,
     ensureWebDocument,
   });
   const publicRouteDispatcher = createPublicRouteDispatcher({

package/src/server/framework-endpoints.ts

@@ -48,6 +48,7 @@ import {
   createUserRequestSchema,
   deviceAuthorizationRequestSchema,
   deviceCodeActionRequestSchema,
+  inMemoryLogSettingsRequestSchema,
   logLevelPreferenceRequestSchema,
   passkeyBootstrapOptionsSchema,
   refreshTokenRequestSchema,
@@ -61,7 +62,8 @@ import {
 } from "./request-schemas";
 import { resolveEffectiveLogLevel, type RuntimeConfig } from "./runtime-config";
 import { setLogLevel } from "./logger";
-import { errorResponse, jsonResponse, notFound, parseJson, successResponse } from "./responses";
+import type { InMemoryLogStorage } from "./logger";
+import { errorResponse, jsonResponse, methodNotAllowed, notFound, parseJson, successResponse } from "./responses";
 import type { WebSocketData } from "./realtime/bus";
 
 export interface FrameworkEndpointDependencies {
@@ -75,6 +77,7 @@ export interface FrameworkEndpointDependencies {
   deviceAuthEnabled: boolean;
   configResponse?: WebAppServerConfig["configResponse"];
   onLogLevelChange?: (level: LogLevelName) => void;
+  inMemoryLogs: InMemoryLogStorage;
   ensureWebDocument: () => Promise<WebDocument>;
 }
 
@@ -97,6 +100,7 @@ export function createFrameworkEndpointHandler(dependencies: FrameworkEndpointDe
     deviceAuthEnabled,
     configResponse: extendConfigResponse,
     onLogLevelChange,
+    inMemoryLogs,
     ensureWebDocument,
   } = dependencies;
 
@@ -115,6 +119,9 @@ export function createFrameworkEndpointHandler(dependencies: FrameworkEndpointDe
         level: resolveEffectiveLogLevel(config, store.getLogLevelPreference()),
         fromEnv: config.logLevelFromEnv,
       },
+      inMemoryLogs: {
+        enabled: inMemoryLogs.isEnabled(),
+      },
       apiKeys: { enabled: Boolean(apiKeysEnabled) },
       deviceAuth: { enabled: Boolean(deviceAuthEnabled) },
     } satisfies WebAppConfigResponse;
@@ -386,6 +393,7 @@ export function createFrameworkEndpointHandler(dependencies: FrameworkEndpointDe
         const target = store.getUserById(userId);
         if (!target) return notFound();
         if (target.role === "owner") return errorResponse(409, "owner_immutable", "Owner cannot be deleted");
+        store.deleteApiKeysForUser(userId);
         if (!store.deleteUser(userId)) return notFound();
         audit(store, { eventType: "user_deleted", actorUserId: actor.id, metadata: { deletedUserId: userId, username: target.username } });
         return successResponse();
@@ -432,6 +440,32 @@ export function createFrameworkEndpointHandler(dependencies: FrameworkEndpointDe
           return successResponse({ level: body.level });
         }
       }
+      if (path === "/api/server/logs") {
+        const auth = await authentication.authorize(req, true);
+        if (auth instanceof Response) return auth;
+        ensureAdmin(auth);
+        if (req.method !== "GET") {
+          return methodNotAllowed();
+        }
+        const enabled = inMemoryLogs.isEnabled();
+        return jsonResponse({
+          enabled,
+          logs: enabled ? inMemoryLogs.getEntries() : [],
+        });
+      }
+      if (path === "/api/server/logs/settings") {
+        const auth = await authentication.authorize(req, true);
+        if (auth instanceof Response) return auth;
+        ensureAdmin(auth);
+        if (req.method !== "PUT") {
+          return methodNotAllowed();
+        }
+        const originFailure = checkSameOrigin(req, config, auth, "mutations");
+        if (originFailure) return originFailure;
+        const body = await parseJson(req, inMemoryLogSettingsRequestSchema);
+        inMemoryLogs.setEnabled(body.enabled);
+        return successResponse({ enabled: inMemoryLogs.isEnabled() });
+      }
       if (path === "/api/server/kill" && req.method === "POST") {
         const auth = await authentication.authorize(req, true);
         if (auth instanceof Response) return auth;

package/src/server/index.ts

@@ -5,6 +5,7 @@ export * from "./responses";
 export * from "./public-assets";
 export * from "./create-web-app-server";
 export { getRequestBaseUrl, getRequestOriginInfo, type RequestOriginInfo } from "./auth/request-origin";
+export * from "./auth/api-keys";
 export * from "./auth/store";
 export * from "./auth/sqlite-store";
 export * from "./realtime/bus";

package/src/server/logger.ts

@@ -1,4 +1,4 @@
-import type { LogLevelName } from "../contracts";
+import type { LogLevelName, ServerLogEntry } from "../contracts";
 
 const ORDER: Record<LogLevelName, number> = {
   trace: 10,
@@ -8,7 +8,21 @@ const ORDER: Record<LogLevelName, number> = {
   error: 50,
 };
 
+export const MAX_IN_MEMORY_LOG_ENTRIES = 1_000;
+export const MAX_IN_MEMORY_LOG_BYTES = 512 * 1024;
+
 let currentLevel: LogLevelName = "info";
+let inMemoryLogStorageEnabled = false;
+let inMemoryLogEntries: ServerLogEntry[] = [];
+let inMemoryLogBytes = 0;
+const textEncoder = new TextEncoder();
+
+export interface InMemoryLogStorage {
+  isEnabled(): boolean;
+  setEnabled(enabled: boolean): void;
+  getEntries(): ServerLogEntry[];
+  reset(): void;
+}
 
 export function setLogLevel(level: LogLevelName): void {
   currentLevel = level;
@@ -18,6 +32,58 @@ export function getLogLevel(): LogLevelName {
   return currentLevel;
 }
 
+function lineByteLength(line: string): number {
+  return textEncoder.encode(line).byteLength;
+}
+
+function appendInMemoryLogEntry(entry: ServerLogEntry): void {
+  if (!inMemoryLogStorageEnabled) {
+    return;
+  }
+  const entryBytes = lineByteLength(entry.line);
+  if (entryBytes > MAX_IN_MEMORY_LOG_BYTES) {
+    return;
+  }
+  inMemoryLogEntries.push(entry);
+  inMemoryLogBytes += entryBytes;
+  while (inMemoryLogEntries.length > MAX_IN_MEMORY_LOG_ENTRIES || inMemoryLogBytes > MAX_IN_MEMORY_LOG_BYTES) {
+    const removed = inMemoryLogEntries.shift();
+    if (!removed) {
+      break;
+    }
+    inMemoryLogBytes -= lineByteLength(removed.line);
+  }
+}
+
+export function setInMemoryLogStorageEnabled(enabled: boolean): void {
+  inMemoryLogStorageEnabled = enabled;
+  if (!enabled) {
+    inMemoryLogEntries = [];
+    inMemoryLogBytes = 0;
+  }
+}
+
+export function isInMemoryLogStorageEnabled(): boolean {
+  return inMemoryLogStorageEnabled;
+}
+
+export function getInMemoryLogEntries(): ServerLogEntry[] {
+  return inMemoryLogEntries.map((entry) => ({ ...entry }));
+}
+
+export function resetInMemoryLogStorage(): void {
+  inMemoryLogStorageEnabled = false;
+  inMemoryLogEntries = [];
+  inMemoryLogBytes = 0;
+}
+
+export const inMemoryLogStorage: InMemoryLogStorage = {
+  isEnabled: isInMemoryLogStorageEnabled,
+  setEnabled: setInMemoryLogStorageEnabled,
+  getEntries: getInMemoryLogEntries,
+  reset: resetInMemoryLogStorage,
+};
+
 export function createLogger(scope: string) {
   function log(level: LogLevelName, message: string, fields?: Record<string, unknown>): void {
     if (ORDER[level] < ORDER[currentLevel]) {
@@ -26,6 +92,7 @@ export function createLogger(scope: string) {
     const timestamp = new Date().toISOString();
     const suffix = fields ? ` ${JSON.stringify(fields)}` : "";
     const line = `${timestamp}\t${level.toUpperCase()}\t${scope}\t${message}${suffix}`;
+    appendInMemoryLogEntry({ timestamp, level, scope, message, line });
     if (level === "error") {
       console.error(line);
     } else if (level === "warn") {

package/src/server/request-schemas.ts

@@ -142,3 +142,7 @@ export const themePreferenceRequestSchema = z.object({
 export const logLevelPreferenceRequestSchema = z.object({
   level: z.enum(["trace", "debug", "info", "warn", "error"]),
 });
+
+export const inMemoryLogSettingsRequestSchema = z.object({
+  enabled: z.boolean(),
+});

package/src/web/components/index.tsx

@@ -252,6 +252,18 @@ export function SelectField({ label, children, ...props }: SelectHTMLAttributes<
   );
 }
 
+export function CheckboxField({ label, hint, ...props }: Omit<InputHTMLAttributes<HTMLInputElement>, "type"> & { label: string; hint?: string }) {
+  return (
+    <label className="wapp-checkbox-field">
+      <input {...props} type="checkbox" />
+      <span>
+        {label}
+        {hint ? <small>{hint}</small> : null}
+      </span>
+    </label>
+  );
+}
+
 export function SegmentedControl<T extends string>({ value, options, onChange, label }: { value: T; options: Array<{ value: T; label: string }>; onChange: (value: T) => void; label: string }) {
   return (
     <div className="wapp-segmented" role="group" aria-label={label}>

package/src/web/settings/account-section.tsx

@@ -1,7 +1,7 @@
 import { useState } from "react";
 import type { LogLevelName, WebAppConfigResponse } from "../../contracts";
 import { appJson } from "../api-client";
-import { Badge, Button, ErrorState, FormSection, LoadingState, SelectField } from "../components";
+import { Badge, Button, CheckboxField, ErrorState, FormSection, LoadingState, SelectField } from "../components";
 import { useLogLevel } from "../log-level";
 import { isThemePreference, useTheme } from "../theme";
 
@@ -21,6 +21,7 @@ export function AccountSection({ config, refresh, setError }: AccountSectionProp
   const { preference, setPreference, loading, error, retry } = useTheme();
   const logLevel = useLogLevel();
   const [logLevelSaving, setLogLevelSaving] = useState(false);
+  const [inMemoryLogsSaving, setInMemoryLogsSaving] = useState(false);
 
   async function updateLogLevel(value: string) {
     if (!isLogLevelName(value)) {
@@ -39,6 +40,22 @@ export function AccountSection({ config, refresh, setError }: AccountSectionProp
     }
   }
 
+  async function updateInMemoryLogs(enabled: boolean) {
+    try {
+      setError(undefined);
+      setInMemoryLogsSaving(true);
+      await appJson<unknown>("/api/server/logs/settings", {
+        method: "PUT",
+        body: JSON.stringify({ enabled }),
+      });
+      await refresh();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setInMemoryLogsSaving(false);
+    }
+  }
+
   return (
     <>
       {config.currentUser ? (
@@ -88,6 +105,13 @@ export function AccountSection({ config, refresh, setError }: AccountSectionProp
               {LOG_LEVEL_NAMES.map((level) => <option key={level} value={level}>{level}</option>)}
             </SelectField>
           ) : null}
+          <CheckboxField
+            label="Store server logs in memory"
+            hint="Temporary; disabled and cleared when the server process starts or this setting is turned off."
+            checked={config.inMemoryLogs.enabled}
+            disabled={inMemoryLogsSaving}
+            onChange={(event) => void updateInMemoryLogs(event.currentTarget.checked)}
+          />
         </FormSection>
       ) : null}
     </>

package/src/web/styles.css

@@ -1618,6 +1618,32 @@ textarea::placeholder {
   resize: vertical;
 }
 
+.wapp-checkbox-field {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.5rem;
+}
+
+.wapp-checkbox-field input {
+  width: 1rem;
+  min-height: 1rem;
+  margin-top: 0.125rem;
+  flex: 0 0 auto;
+}
+
+.wapp-checkbox-field span {
+  font-size: 0.8125rem;
+  font-weight: 500;
+}
+
+.wapp-checkbox-field small {
+  display: block;
+  color: var(--wapp-muted);
+  font-size: 0.75rem;
+  font-weight: 400;
+  margin-top: 0.25rem;
+}
+
 .wapp-field small {
   display: block;
   color: var(--wapp-muted);

package/src/web/webapp-config.tsx

@@ -50,6 +50,7 @@ function isWebAppConfigResponse(value: unknown): value is WebAppConfigResponse {
     && isRecord(value["logLevel"])
     && isLogLevelName(value["logLevel"]["level"])
     && typeof value["logLevel"]["fromEnv"] === "boolean"
+    && hasBooleanFields(value["inMemoryLogs"], ["enabled"])
     && hasBooleanFields(value["deviceAuth"], ["enabled"])
     && hasBooleanFields(value["apiKeys"], ["enabled"]);
 }