sqlite-hub 1.2.0 → 1.5.0

package/server/services/storage/appStateStore.js

@@ -27,12 +27,10 @@ const {
 const DEFAULT_STATE = {
   recentConnections: [],
   activeConnectionId: null,
-  sqlHistory: [],
   settings: {
     defaultPageSize: 50,
     maxPageSize: 200,
     maxRecentConnections: 12,
-    maxSqlHistory: 100,
     busyTimeoutMs: 5000,
     csvDelimiter: ",",
   },
@@ -45,6 +43,14 @@ const MAX_CONNECTION_LOGO_SIZE_BYTES = 5 * 1024 * 1024;
 const MAX_DOCUMENT_CONTENT_BYTES = 5 * 1024 * 1024;
 const MAX_DOCUMENT_FILENAME_LENGTH = 160;
 const QUERY_EXECUTION_SOURCES = new Set(["api", "cli", "user", "mcp"]);
+const ACCESS_LOG_SOURCES = new Set(["api", "cli"]);
+const ACCESS_LOG_STATUSES = new Set(["success", "error"]);
+const MAX_ACCESS_LOG_TEXT_LENGTH = 500;
+const MAX_ACCESS_LOG_METADATA_BYTES = 16 * 1024;
+const ACTIVITY_LOG_KINDS = new Set(["all", "query", "access"]);
+const ACTIVITY_LOG_ACTORS = new Set(["user", "cli", "api", "mcp"]);
+const ACTIVITY_LOG_DESTRUCTIVE_FILTERS = new Set(["all", "yes", "no"]);
+const REMOVED_SETTING_KEYS = new Set(["maxSqlHistory"]);
 const CONNECTION_LOGO_EXTENSION_BY_MIME_TYPE = {
   "image/jpeg": "jpg",
   "image/png": "png",
@@ -144,6 +150,80 @@ function requireQueryExecutionSource(value) {
   return normalized;
 }
 
+function normalizeAccessLogText(value, fallback = null) {
+  const normalized = String(value ?? fallback ?? "")
+    .replace(/[\u0000-\u001f\u007f]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+
+  return normalized ? normalized.slice(0, MAX_ACCESS_LOG_TEXT_LENGTH) : null;
+}
+
+function requireAccessLogText(value, label) {
+  const normalized = normalizeAccessLogText(value);
+
+  if (!normalized) {
+    throw new ValidationError(`${label} is required.`);
+  }
+
+  return normalized;
+}
+
+function normalizeAccessLogSource(value) {
+  const normalized = String(value ?? "").trim().toLowerCase();
+
+  if (!ACCESS_LOG_SOURCES.has(normalized)) {
+    throw new ValidationError(`Unsupported access log source: ${value}`);
+  }
+
+  return normalized;
+}
+
+function normalizeAccessLogStatus(value) {
+  const normalized = String(value ?? "success").trim().toLowerCase();
+
+  if (!ACCESS_LOG_STATUSES.has(normalized)) {
+    throw new ValidationError(`Unsupported access log status: ${value}`);
+  }
+
+  return normalized;
+}
+
+function normalizeAccessLogInteger(value) {
+  if (value === null || value === undefined || value === "") {
+    return null;
+  }
+
+  const normalized = Number(value);
+  return Number.isInteger(normalized) && normalized >= 0 ? normalized : null;
+}
+
+function normalizeAccessLogMetadata(metadata = {}) {
+  const safeMetadata =
+    metadata && typeof metadata === "object" && !Array.isArray(metadata)
+      ? metadata
+      : {};
+
+  let serialized = "{}";
+
+  try {
+    serialized = JSON.stringify(safeMetadata, (_key, value) =>
+      typeof value === "bigint" ? String(value) : value
+    );
+  } catch {
+    serialized = JSON.stringify({ serializationError: true });
+  }
+
+  if (Buffer.byteLength(serialized, "utf8") <= MAX_ACCESS_LOG_METADATA_BYTES) {
+    return serialized;
+  }
+
+  return JSON.stringify({
+    truncated: true,
+    originalBytes: Buffer.byteLength(serialized, "utf8"),
+  });
+}
+
 function normalizeDocumentTitle(value, filename) {
   const title = String(value ?? "").trim();
 
@@ -283,6 +363,30 @@ function readUtf8File(fileUrl) {
   }
 }
 
+function pickLatestTimestamp(...timestamps) {
+  return timestamps.reduce((latest, timestamp) => {
+    const normalizedTimestamp = String(timestamp ?? "").trim();
+
+    if (!normalizedTimestamp) {
+      return latest;
+    }
+
+    const timestampMs = Date.parse(normalizedTimestamp);
+
+    if (!Number.isFinite(timestampMs)) {
+      return latest ?? normalizedTimestamp;
+    }
+
+    const latestMs = Date.parse(latest ?? "");
+
+    if (!latest || !Number.isFinite(latestMs) || timestampMs > latestMs) {
+      return normalizedTimestamp;
+    }
+
+    return latest;
+  }, null);
+}
+
 class AppStateStore {
   constructor(filePath, options = {}) {
     this.filePath = normalizeStateStorePath(filePath, "App state database path");
@@ -350,25 +454,16 @@ class AppStateStore {
         logoPath TEXT
       );
 
-      CREATE TABLE IF NOT EXISTS sql_history (
-        id TEXT PRIMARY KEY,
-        connectionId TEXT,
-        connectionLabel TEXT,
-        sql TEXT NOT NULL,
-        statementCount INTEGER NOT NULL DEFAULT 0,
-        resultKind TEXT,
-        affectedRowCount INTEGER NOT NULL DEFAULT 0,
-        rowCount INTEGER NOT NULL DEFAULT 0,
-        timingMs INTEGER NOT NULL DEFAULT 0,
-        executedAt TEXT NOT NULL
-      );
+      DROP INDEX IF EXISTS idx_sql_history_executed_at;
+
+      DROP TABLE IF EXISTS sql_history;
+
+      DELETE FROM settings
+      WHERE key = 'maxSqlHistory';
 
       CREATE INDEX IF NOT EXISTS idx_recent_connections_last_opened
       ON recent_connections(lastOpenedAt DESC, id ASC);
 
-      CREATE INDEX IF NOT EXISTS idx_sql_history_executed_at
-      ON sql_history(executedAt DESC, id ASC);
-
       CREATE TABLE IF NOT EXISTS query_history (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
         database_key TEXT NOT NULL,
@@ -488,6 +583,29 @@ class AppStateStore {
       CREATE INDEX IF NOT EXISTS idx_api_tokens_database_created
       ON api_tokens(database_key, created_at DESC, id ASC);
 
+      CREATE TABLE IF NOT EXISTS access_log (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        source TEXT NOT NULL CHECK(source IN ('api', 'cli')),
+        action TEXT NOT NULL,
+        database_key TEXT,
+        target_type TEXT,
+        target_name TEXT,
+        status TEXT NOT NULL CHECK(status IN ('success', 'error')),
+        started_at TEXT NOT NULL,
+        duration_ms INTEGER,
+        error_message TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}'
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_access_log_started
+      ON access_log(started_at DESC, id DESC);
+
+      CREATE INDEX IF NOT EXISTS idx_access_log_source_started
+      ON access_log(source, started_at DESC, id DESC);
+
+      CREATE INDEX IF NOT EXISTS idx_access_log_database_started
+      ON access_log(database_key, started_at DESC, id DESC);
+
       CREATE TABLE IF NOT EXISTS backups (
         id TEXT PRIMARY KEY,
         connectionId TEXT,
@@ -672,25 +790,6 @@ class AppStateStore {
               )
               .all()
           : [],
-        sqlHistory: tables.has("sql_history")
-          ? legacyDb
-              .prepare(`
-                SELECT
-                  id,
-                  connectionId,
-                  connectionLabel,
-                  sql,
-                  statementCount,
-                  resultKind,
-                  affectedRowCount,
-                  rowCount,
-                  timingMs,
-                  executedAt
-                FROM sql_history
-                ORDER BY executedAt DESC, id ASC
-              `)
-              .all()
-          : [],
         activeConnectionId: tables.has("app_meta")
           ? legacyDb
               .prepare("SELECT value FROM app_meta WHERE key = ?")
@@ -729,34 +828,13 @@ class AppStateStore {
         readOnly = excluded.readOnly,
         logoPath = excluded.logoPath
     `);
-    const insertHistory = this.db.prepare(`
-      INSERT INTO sql_history (
-        id,
-        connectionId,
-        connectionLabel,
-        sql,
-        statementCount,
-        resultKind,
-        affectedRowCount,
-        rowCount,
-        timingMs,
-        executedAt
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(id) DO UPDATE SET
-        connectionId = excluded.connectionId,
-        connectionLabel = excluded.connectionLabel,
-        sql = excluded.sql,
-        statementCount = excluded.statementCount,
-        resultKind = excluded.resultKind,
-        affectedRowCount = excluded.affectedRowCount,
-        rowCount = excluded.rowCount,
-        timingMs = excluded.timingMs,
-        executedAt = excluded.executedAt
-    `);
 
     this.db.transaction(() => {
       for (const [key, value] of Object.entries(legacyState.settings ?? {})) {
+        if (REMOVED_SETTING_KEYS.has(key)) {
+          continue;
+        }
+
         const normalizedValue =
           typeof value === "string" ? this.parseStoredValue(value) : value;
 
@@ -776,21 +854,6 @@ class AppStateStore {
         );
       }
 
-      for (const entry of legacyState.sqlHistory ?? []) {
-        insertHistory.run(
-          entry.id,
-          entry.connectionId ?? null,
-          entry.connectionLabel ?? null,
-          entry.sql ?? "",
-          Number(entry.statementCount ?? 0),
-          entry.resultKind ?? null,
-          Number(entry.affectedRowCount ?? 0),
-          Number(entry.rowCount ?? 0),
-          Number(entry.timingMs ?? 0),
-          entry.executedAt ?? new Date().toISOString()
-        );
-      }
-
       this.setMetaValue("activeConnectionId", legacyState.activeConnectionId ?? null);
       this.setMetaValue(
         "legacyImportSource",
@@ -1710,6 +1773,532 @@ class AppStateStore {
     };
   }
 
+  decorateAccessLogRow(row = {}) {
+    let metadata = {};
+
+    try {
+      metadata = JSON.parse(row.metadata_json ?? row.metadataJson ?? "{}");
+    } catch {
+      metadata = {};
+    }
+
+    return {
+      id: Number(row.id ?? 0),
+      source: String(row.source ?? ""),
+      action: String(row.action ?? ""),
+      databaseKey: row.database_key ?? row.databaseKey ?? null,
+      targetType: row.target_type ?? row.targetType ?? null,
+      targetName: row.target_name ?? row.targetName ?? null,
+      status: String(row.status ?? ""),
+      startedAt: row.started_at ?? row.startedAt ?? null,
+      durationMs:
+        row.duration_ms === null || row.duration_ms === undefined
+          ? null
+          : Number(row.duration_ms),
+      errorMessage: row.error_message ?? row.errorMessage ?? null,
+      metadata,
+    };
+  }
+
+  recordAccessLog(entry = {}) {
+    const source = normalizeAccessLogSource(entry.source);
+    const action = requireAccessLogText(entry.action, "Access log action");
+    const databaseKey = normalizeAccessLogText(entry.databaseKey);
+    const targetType = normalizeAccessLogText(entry.targetType);
+    const targetName = normalizeAccessLogText(entry.targetName);
+    const status = normalizeAccessLogStatus(entry.status);
+    const startedAt = normalizeAccessLogText(entry.startedAt) ?? new Date().toISOString();
+    const durationMs = normalizeAccessLogInteger(entry.durationMs);
+    const errorMessage = normalizeAccessLogText(entry.errorMessage);
+    const metadataJson = normalizeAccessLogMetadata(entry.metadata);
+
+    const result = this.db
+      .prepare(`
+        INSERT INTO access_log (
+          source,
+          action,
+          database_key,
+          target_type,
+          target_name,
+          status,
+          started_at,
+          duration_ms,
+          error_message,
+          metadata_json
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `)
+      .run(
+        source,
+        action,
+        databaseKey,
+        targetType,
+        targetName,
+        status,
+        startedAt,
+        durationMs,
+        errorMessage,
+        metadataJson
+      );
+
+    return this.getAccessLogEntry(result.lastInsertRowid);
+  }
+
+  getAccessLogEntry(logId) {
+    const row = this.db
+      .prepare(`
+        SELECT
+          id,
+          source,
+          action,
+          database_key,
+          target_type,
+          target_name,
+          status,
+          started_at,
+          duration_ms,
+          error_message,
+          metadata_json
+        FROM access_log
+        WHERE id = ?
+      `)
+      .get(Number(logId));
+
+    if (!row) {
+      throw new NotFoundError(`Access log entry not found: ${logId}`);
+    }
+
+    return this.decorateAccessLogRow(row);
+  }
+
+  listAccessLogs(options = {}) {
+    const filters = [];
+    const params = [];
+    const source = options.source ? normalizeAccessLogSource(options.source) : null;
+    const status = options.status ? normalizeAccessLogStatus(options.status) : null;
+    const databaseKey = normalizeAccessLogText(options.databaseKey);
+    const limit = Math.max(1, Math.min(200, Number(options.limit) || 100));
+    const offset = Math.max(0, Number(options.offset) || 0);
+
+    if (source) {
+      filters.push("source = ?");
+      params.push(source);
+    }
+
+    if (status) {
+      filters.push("status = ?");
+      params.push(status);
+    }
+
+    if (databaseKey) {
+      filters.push("database_key = ?");
+      params.push(databaseKey);
+    }
+
+    const whereClause = filters.length ? `WHERE ${filters.join(" AND ")}` : "";
+    const rows = this.db
+      .prepare(`
+        SELECT
+          id,
+          source,
+          action,
+          database_key,
+          target_type,
+          target_name,
+          status,
+          started_at,
+          duration_ms,
+          error_message,
+          metadata_json
+        FROM access_log
+        ${whereClause}
+        ORDER BY started_at DESC, id DESC
+        LIMIT ? OFFSET ?
+      `)
+      .all(...params, limit, offset)
+      .map((row) => this.decorateAccessLogRow(row));
+    const total = Number(
+      this.db
+        .prepare(`SELECT COUNT(*) AS count FROM access_log ${whereClause}`)
+        .get(...params)?.count ?? 0
+    );
+
+    return {
+      items: rows,
+      total,
+      limit,
+      offset,
+      hasMore: offset + rows.length < total,
+    };
+  }
+
+  normalizeActivityLogKind(value) {
+    const normalized = String(value ?? "all").trim().toLowerCase();
+    return ACTIVITY_LOG_KINDS.has(normalized) ? normalized : "all";
+  }
+
+  normalizeActivityLogActor(value) {
+    const normalized = String(value ?? "all").trim().toLowerCase();
+    return ACTIVITY_LOG_ACTORS.has(normalized) ? normalized : null;
+  }
+
+  normalizeActivityLogDestructive(value) {
+    const normalized = String(value ?? "all").trim().toLowerCase();
+    return ACTIVITY_LOG_DESTRUCTIVE_FILTERS.has(normalized) ? normalized : "all";
+  }
+
+  normalizeActivityLogTimestamp(value) {
+    const normalized = normalizeAccessLogText(value);
+
+    if (!normalized) {
+      return null;
+    }
+
+    const timestamp = new Date(normalized).getTime();
+    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+  }
+
+  decorateQueryRunLogRow(row = {}) {
+    let tablesDetected = [];
+
+    try {
+      tablesDetected = JSON.parse(row.tables_detected ?? "[]");
+    } catch {
+      tablesDetected = [];
+    }
+
+    return {
+      id: `query:${Number(row.run_id ?? 0)}`,
+      kind: "query",
+      source: "query_history",
+      action: "query.execute",
+      databaseKey: row.database_key ?? null,
+      targetType: "query",
+      targetName: row.title || buildAutoTitle(row.raw_sql ?? "", {
+        queryType: row.query_type ?? "other",
+        tablesDetected,
+      }),
+      status: String(row.status ?? ""),
+      occurredAt: row.executed_at ?? null,
+      durationMs:
+        row.duration_ms === null || row.duration_ms === undefined
+          ? null
+          : Number(row.duration_ms),
+      errorMessage: row.error_message ?? null,
+      executedBy: normalizeQueryExecutionSource(row.executed_by ?? "user"),
+      queryType: row.query_type ?? "other",
+      destructive: Boolean(row.is_destructive),
+      historyId: Number(row.history_id ?? 0),
+      runId: Number(row.run_id ?? 0),
+      rowCount:
+        row.row_count === null || row.row_count === undefined
+          ? null
+          : Number(row.row_count),
+      affectedRows:
+        row.affected_rows === null || row.affected_rows === undefined
+          ? null
+          : Number(row.affected_rows),
+      preview: buildSqlPreview(row.raw_sql ?? ""),
+      rawSql: row.raw_sql ?? "",
+      metadata: {
+        tablesDetected,
+        saved: Boolean(row.is_saved),
+        favorite: Boolean(row.is_favorite),
+      },
+    };
+  }
+
+  decorateAccessLogForActivity(row = {}) {
+    const entry = this.decorateAccessLogRow(row);
+
+    return {
+      id: `access:${entry.id}`,
+      kind: "access",
+      source: entry.source,
+      action: entry.action,
+      databaseKey: entry.databaseKey,
+      targetType: entry.targetType,
+      targetName: entry.targetName,
+      status: entry.status,
+      occurredAt: entry.startedAt,
+      durationMs: entry.durationMs,
+      errorMessage: entry.errorMessage,
+      executedBy: null,
+      queryType: null,
+      destructive: null,
+      historyId: null,
+      runId: null,
+      rowCount: null,
+      affectedRows: null,
+      preview: entry.action,
+      rawSql: "",
+      metadata: entry.metadata,
+    };
+  }
+
+  buildActivityQueryFilters(options = {}) {
+    const filters = [];
+    const params = [];
+    const databaseKey = normalizeAccessLogText(options.databaseKey);
+    const status = options.status ? normalizeAccessLogStatus(options.status) : null;
+    const actor = this.normalizeActivityLogActor(options.actor);
+    const queryType = normalizeAccessLogText(options.queryType);
+    const destructive = this.normalizeActivityLogDestructive(options.destructive);
+    const from = this.normalizeActivityLogTimestamp(options.from);
+    const to = this.normalizeActivityLogTimestamp(options.to);
+    const search = normalizeAccessLogText(options.search);
+
+    if (databaseKey) {
+      filters.push("q.database_key = ?");
+      params.push(databaseKey);
+    }
+
+    if (status) {
+      filters.push("runs.status = ?");
+      params.push(status);
+    }
+
+    if (actor) {
+      filters.push("runs.executed_by = ?");
+      params.push(actor);
+    }
+
+    if (queryType) {
+      filters.push("q.query_type = ?");
+      params.push(queryType);
+    }
+
+    if (destructive === "yes") {
+      filters.push("q.is_destructive = 1");
+    } else if (destructive === "no") {
+      filters.push("q.is_destructive = 0");
+    }
+
+    if (from) {
+      filters.push("runs.executed_at >= ?");
+      params.push(from);
+    }
+
+    if (to) {
+      filters.push("runs.executed_at <= ?");
+      params.push(to);
+    }
+
+    if (search) {
+      const searchPattern = `%${search.toLowerCase()}%`;
+      filters.push(`
+        (
+          LOWER(COALESCE(q.title, '')) LIKE ?
+          OR LOWER(q.raw_sql) LIKE ?
+          OR LOWER(COALESCE(q.notes, '')) LIKE ?
+          OR LOWER(q.tables_detected) LIKE ?
+          OR LOWER(COALESCE(runs.error_message, '')) LIKE ?
+        )
+      `);
+      params.push(searchPattern, searchPattern, searchPattern, searchPattern, searchPattern);
+    }
+
+    return {
+      whereSql: filters.length ? `WHERE ${filters.join(" AND ")}` : "",
+      params,
+    };
+  }
+
+  buildActivityAccessFilters(options = {}) {
+    const filters = [];
+    const params = [];
+    const databaseKey = normalizeAccessLogText(options.databaseKey);
+    const status = options.status ? normalizeAccessLogStatus(options.status) : null;
+    const actor = this.normalizeActivityLogActor(options.actor);
+    const queryType = normalizeAccessLogText(options.queryType);
+    const destructive = this.normalizeActivityLogDestructive(options.destructive);
+    const from = this.normalizeActivityLogTimestamp(options.from);
+    const to = this.normalizeActivityLogTimestamp(options.to);
+    const search = normalizeAccessLogText(options.search);
+
+    if (queryType || destructive !== "all") {
+      return {
+        whereSql: "WHERE 1 = 0",
+        params: [],
+      };
+    }
+
+    if (databaseKey) {
+      filters.push("database_key = ?");
+      params.push(databaseKey);
+    }
+
+    if (status) {
+      filters.push("status = ?");
+      params.push(status);
+    }
+
+    if (actor) {
+      if (actor !== "api" && actor !== "cli") {
+        return {
+          whereSql: "WHERE 1 = 0",
+          params: [],
+        };
+      }
+
+      filters.push("source = ?");
+      params.push(actor);
+    }
+
+    if (from) {
+      filters.push("started_at >= ?");
+      params.push(from);
+    }
+
+    if (to) {
+      filters.push("started_at <= ?");
+      params.push(to);
+    }
+
+    if (search) {
+      const searchPattern = `%${search.toLowerCase()}%`;
+      filters.push(`
+        (
+          LOWER(action) LIKE ?
+          OR LOWER(COALESCE(target_type, '')) LIKE ?
+          OR LOWER(COALESCE(target_name, '')) LIKE ?
+          OR LOWER(COALESCE(error_message, '')) LIKE ?
+          OR LOWER(metadata_json) LIKE ?
+        )
+      `);
+      params.push(searchPattern, searchPattern, searchPattern, searchPattern, searchPattern);
+    }
+
+    return {
+      whereSql: filters.length ? `WHERE ${filters.join(" AND ")}` : "",
+      params,
+    };
+  }
+
+  listQueryRunLogs(options = {}) {
+    const { whereSql, params } = this.buildActivityQueryFilters(options);
+
+    return {
+      items: this.db
+        .prepare(`
+          SELECT
+            runs.id AS run_id,
+            runs.history_id,
+            runs.executed_at,
+            runs.executed_by,
+            runs.duration_ms,
+            runs.row_count,
+            runs.status,
+            runs.error_message,
+            runs.affected_rows,
+            q.database_key,
+            q.raw_sql,
+            q.title,
+            q.notes,
+            q.query_type,
+            q.tables_detected,
+            q.is_favorite,
+            q.is_saved,
+            q.is_destructive
+          FROM query_runs runs
+          INNER JOIN query_history q
+            ON q.id = runs.history_id
+          ${whereSql}
+          ORDER BY runs.executed_at DESC, runs.id DESC
+        `)
+        .all(...params)
+        .map((row) => this.decorateQueryRunLogRow(row)),
+      total: Number(
+        this.db
+          .prepare(`
+            SELECT COUNT(*) AS count
+            FROM query_runs runs
+            INNER JOIN query_history q
+              ON q.id = runs.history_id
+            ${whereSql}
+          `)
+          .get(...params)?.count ?? 0
+      ),
+    };
+  }
+
+  listAccessActivityLogs(options = {}) {
+    const { whereSql, params } = this.buildActivityAccessFilters(options);
+
+    return {
+      items: this.db
+        .prepare(`
+          SELECT
+            id,
+            source,
+            action,
+            database_key,
+            target_type,
+            target_name,
+            status,
+            started_at,
+            duration_ms,
+            error_message,
+            metadata_json
+          FROM access_log
+          ${whereSql}
+          ORDER BY started_at DESC, id DESC
+        `)
+        .all(...params)
+        .map((row) => this.decorateAccessLogForActivity(row)),
+      total: Number(
+        this.db
+          .prepare(`SELECT COUNT(*) AS count FROM access_log ${whereSql}`)
+          .get(...params)?.count ?? 0
+      ),
+    };
+  }
+
+  listActivityLogs(options = {}) {
+    const kind = this.normalizeActivityLogKind(options.kind);
+    const limit = Math.max(1, Math.min(200, Number(options.limit) || 100));
+    const offset = Math.max(0, Number(options.offset) || 0);
+    const queryLogs =
+      kind === "access"
+        ? { items: [], total: 0 }
+        : this.listQueryRunLogs(options);
+    const accessLogs =
+      kind === "query"
+        ? { items: [], total: 0 }
+        : this.listAccessActivityLogs(options);
+    const allItems = [...queryLogs.items, ...accessLogs.items].sort((left, right) => {
+      const leftTime = Date.parse(left.occurredAt ?? "") || 0;
+      const rightTime = Date.parse(right.occurredAt ?? "") || 0;
+
+      if (rightTime !== leftTime) {
+        return rightTime - leftTime;
+      }
+
+      return String(right.id).localeCompare(String(left.id));
+    });
+    const items = allItems.slice(offset, offset + limit);
+    const total = queryLogs.total + accessLogs.total;
+
+    return {
+      items,
+      total,
+      limit,
+      offset,
+      hasMore: offset + items.length < total,
+      filters: {
+        kind,
+        actor: this.normalizeActivityLogActor(options.actor) ?? "all",
+        status: options.status ? normalizeAccessLogStatus(options.status) : "all",
+        databaseKey: normalizeAccessLogText(options.databaseKey),
+        queryType: normalizeAccessLogText(options.queryType) ?? "all",
+        destructive: this.normalizeActivityLogDestructive(options.destructive),
+        from: this.normalizeActivityLogTimestamp(options.from),
+        to: this.normalizeActivityLogTimestamp(options.to),
+        search: normalizeAccessLogText(options.search) ?? "",
+      },
+    };
+  }
+
   updateQueryHistoryField(historyId, fieldName, value, databaseKey) {
     const normalizedDatabaseKey = this.normalizeQueryHistoryText(databaseKey);
 
@@ -2272,30 +2861,10 @@ class AppStateStore {
     });
   }
 
-  trimSqlHistory() {
-    const maxSqlHistory = Number(
-      this.getSettings().maxSqlHistory ?? DEFAULT_STATE.settings.maxSqlHistory
-    );
-
-    const staleRows = this.db
-      .prepare(`
-        SELECT id
-        FROM sql_history
-        ORDER BY executedAt DESC, id ASC
-        LIMIT -1 OFFSET ?
-      `)
-      .all(maxSqlHistory);
-
-    for (const row of staleRows) {
-      this.db.prepare("DELETE FROM sql_history WHERE id = ?").run(row.id);
-    }
-  }
-
   getState() {
     return structuredClone({
       recentConnections: this.getRecentConnections(),
       activeConnectionId: this.getActiveConnectionId(),
-      sqlHistory: this.getSqlHistory(),
       settings: this.getSettings(),
     });
   }
@@ -2540,75 +3109,6 @@ class AppStateStore {
     return this.getMetaValue("activeConnectionId");
   }
 
-  addSqlHistory(entry) {
-    this.db.transaction(() => {
-      this.db
-        .prepare(`
-          INSERT INTO sql_history (
-            id,
-            connectionId,
-            connectionLabel,
-            sql,
-            statementCount,
-            resultKind,
-            affectedRowCount,
-            rowCount,
-            timingMs,
-            executedAt
-          )
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `)
-        .run(
-          entry.id,
-          entry.connectionId ?? null,
-          entry.connectionLabel ?? null,
-          entry.sql,
-          Number(entry.statementCount ?? 0),
-          entry.resultKind ?? null,
-          Number(entry.affectedRowCount ?? 0),
-          Number(entry.rowCount ?? 0),
-          Number(entry.timingMs ?? 0),
-          entry.executedAt
-        );
-
-      this.trimSqlHistory();
-    })();
-
-    return this.getSqlHistory();
-  }
-
-  clearSqlHistory() {
-    this.db.prepare("DELETE FROM sql_history").run();
-    return [];
-  }
-
-  getSqlHistory() {
-    return this.db
-      .prepare(`
-        SELECT
-          id,
-          connectionId,
-          connectionLabel,
-          sql,
-          statementCount,
-          resultKind,
-          affectedRowCount,
-          rowCount,
-          timingMs,
-          executedAt
-        FROM sql_history
-        ORDER BY executedAt DESC, id ASC
-      `)
-      .all()
-      .map((entry) => ({
-        ...entry,
-        statementCount: Number(entry.statementCount ?? 0),
-        affectedRowCount: Number(entry.affectedRowCount ?? 0),
-        rowCount: Number(entry.rowCount ?? 0),
-        timingMs: Number(entry.timingMs ?? 0),
-      }));
-  }
-
   getSettings() {
     const rows = this.db.prepare("SELECT key, value FROM settings").all();
     const parsedSettings = Object.fromEntries(
@@ -2647,13 +3147,87 @@ class AppStateStore {
       tokenPrefix: String(row.token_prefix ?? row.tokenPrefix ?? ""),
       createdAt: row.created_at ?? row.createdAt ?? null,
       lastUsedAt: row.last_used_at ?? row.lastUsedAt ?? null,
+      callCount: Number(row.callCount ?? 0),
+      lastCallAt: row.lastCallAt ?? null,
     };
   }
 
-  listApiTokens(databaseKey) {
+  listApiTokenUsageStats(databaseKey) {
     const normalizedDatabaseKey = normalizeDocumentDatabaseKey(databaseKey);
+    const statsByTokenId = new Map();
+    const rows = this.db
+      .prepare(
+        `
+          SELECT started_at, metadata_json
+          FROM access_log
+          WHERE source = 'api'
+            AND database_key = ?
+          ORDER BY started_at DESC, id DESC
+        `
+      )
+      .all(normalizedDatabaseKey);
 
-    return this.db
+    rows.forEach((row) => {
+      let metadata = {};
+
+      try {
+        metadata = JSON.parse(row.metadata_json ?? "{}");
+      } catch {
+        metadata = {};
+      }
+
+      const tokenId = String(metadata.apiTokenId ?? "").trim();
+
+      if (!tokenId) {
+        return;
+      }
+
+      const current = statsByTokenId.get(tokenId) ?? {
+        callCount: 0,
+        lastCallAt: null,
+      };
+      const startedAt = row.started_at ?? null;
+
+      current.callCount += 1;
+
+      if (
+        startedAt &&
+        (!current.lastCallAt || Date.parse(startedAt) > Date.parse(current.lastCallAt))
+      ) {
+        current.lastCallAt = startedAt;
+      }
+
+      statsByTokenId.set(tokenId, current);
+    });
+
+    return statsByTokenId;
+  }
+
+  getDatabaseApiQueryRunUsageStats(databaseKey) {
+    const normalizedDatabaseKey = normalizeDocumentDatabaseKey(databaseKey);
+    const row = this.db
+      .prepare(
+        `
+          SELECT COUNT(*) AS call_count, MAX(runs.executed_at) AS last_call_at
+          FROM query_runs runs
+          INNER JOIN query_history q
+            ON q.id = runs.history_id
+          WHERE runs.executed_by = 'api'
+            AND q.database_key = ?
+        `
+      )
+      .get(normalizedDatabaseKey);
+
+    return {
+      callCount: Number(row?.call_count ?? 0),
+      lastCallAt: row?.last_call_at ?? null,
+    };
+  }
+
+  listApiTokens(databaseKey) {
+    const normalizedDatabaseKey = normalizeDocumentDatabaseKey(databaseKey);
+    const usageStatsByTokenId = this.listApiTokenUsageStats(normalizedDatabaseKey);
+    const rows = this.db
       .prepare(
         `
           SELECT id, database_key, name, token_prefix, created_at, last_used_at
@@ -2662,8 +3236,38 @@ class AppStateStore {
           ORDER BY created_at DESC, id ASC
         `
       )
-      .all(normalizedDatabaseKey)
-      .map((row) => this.decorateApiTokenRow(row));
+      .all(normalizedDatabaseKey);
+    const accessLogCallCount = Array.from(usageStatsByTokenId.values()).reduce(
+      (total, stats) => total + Number(stats.callCount ?? 0),
+      0
+    );
+    const apiQueryRunUsageStats = this.getDatabaseApiQueryRunUsageStats(normalizedDatabaseKey);
+    const useSingleTokenQueryRunFallback =
+      rows.length === 1 &&
+      accessLogCallCount === 0 &&
+      apiQueryRunUsageStats.callCount > 0;
+
+    return rows.map((row) => {
+      const tokenId = String(row.id ?? "");
+      const usageStats = usageStatsByTokenId.get(tokenId) ?? {};
+      let callCount = Number(usageStats.callCount ?? 0);
+      let lastCallAt = pickLatestTimestamp(usageStats.lastCallAt, row.last_used_at);
+
+      if (!callCount && row.last_used_at) {
+        callCount = 1;
+      }
+
+      if (useSingleTokenQueryRunFallback) {
+        callCount = Math.max(callCount, apiQueryRunUsageStats.callCount);
+        lastCallAt = pickLatestTimestamp(lastCallAt, apiQueryRunUsageStats.lastCallAt);
+      }
+
+      return this.decorateApiTokenRow({
+        ...row,
+        callCount,
+        lastCallAt,
+      });
+    });
   }
 
   createApiToken({ databaseKey, name, tokenHash, tokenPrefix }) {