tempest-express-sdk 0.28.0 → 0.29.0

package/dist/index.cjs

@@ -9461,6 +9461,199 @@ function partitionTotal(partition) {
   return partition.segments.reduce((total, segment) => total + segment.value, 0);
 }
 
+// src/admin/logs.ts
+var LIFTED = /* @__PURE__ */ new Set(["level", "logger", "message", "timestamp", "stack"]);
+function toLogEntry(raw) {
+  const context = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (LIFTED.has(key) || value === null || value === void 0) continue;
+    context[key] = value;
+  }
+  return {
+    level: typeof raw.level === "string" ? raw.level : "info",
+    logger: typeof raw.logger === "string" ? raw.logger : "",
+    message: typeof raw.message === "string" ? raw.message : "",
+    timestamp: typeof raw.timestamp === "string" ? raw.timestamp : "",
+    stack: typeof raw.stack === "string" ? raw.stack : null,
+    context,
+    raw
+  };
+}
+function filterLogEntries(entries, term) {
+  const needle = term.trim().toLowerCase();
+  if (needle === "") return entries;
+  return entries.filter(
+    (entry) => `${entry.message} ${entry.logger} ${entry.stack ?? ""}`.toLowerCase().includes(needle)
+  );
+}
+function renderLogEntriesMarkdown(entries, options) {
+  const lines = [
+    "# Application logs",
+    "",
+    `- **Source:** \`${options.source}\``,
+    `- **Search:** ${options.query === "" ? "_none_" : `\`${options.query}\``}`,
+    `- **Exported:** ${entries.length} of ${options.total} matching record(s)`,
+    ""
+  ];
+  if (entries.length < options.total) {
+    lines.push(
+      `> Truncated: the export is capped, so ${options.total - entries.length} older matching record(s) are not included.`,
+      ""
+    );
+  }
+  for (const entry of entries) {
+    lines.push(
+      `## ${entry.level.toUpperCase()} \u2014 ${entry.message || "(no message)"}`,
+      "",
+      `- **When:** ${entry.timestamp || "unknown"}`,
+      `- **Logger:** ${entry.logger || "unknown"}`
+    );
+    for (const [key, value] of Object.entries(entry.context)) {
+      lines.push(
+        `- **${key}:** ${typeof value === "string" ? value : JSON.stringify(value)}`
+      );
+    }
+    lines.push("");
+    if (entry.stack !== null) {
+      lines.push("```text", entry.stack, "```", "");
+    }
+  }
+  return lines.join("\n");
+}
+function renderLogEntriesJson(entries) {
+  return JSON.stringify(
+    entries.map((entry) => entry.raw),
+    null,
+    2
+  );
+}
+
+// src/admin/sqlConsole.ts
+var SqlCapability = {
+  /** `SELECT`, `WITH … SELECT`, `EXPLAIN`, `SHOW`. */
+  READ: "read",
+  /** Adds rows. */
+  INSERT: "insert",
+  /** Changes rows. */
+  UPDATE: "update",
+  /** Removes rows. */
+  DELETE: "delete",
+  /** `CREATE` / `ALTER` / `COMMENT`. */
+  DDL: "ddl",
+  /** `DROP` and `TRUNCATE`: irreversible structure loss. */
+  DROP: "drop",
+  /**
+   * `GRANT` / `REVOKE` / `SET`, and anything the analyser cannot classify.
+   * Unknown statements land here on purpose, so a construct nobody anticipated
+   * needs the most privileged capability rather than the least.
+   */
+  ADMIN: "admin"
+};
+var STATEMENT_CAPABILITIES = {
+  select: SqlCapability.READ,
+  with: SqlCapability.READ,
+  explain: SqlCapability.READ,
+  show: SqlCapability.READ,
+  desc: SqlCapability.READ,
+  describe: SqlCapability.READ,
+  insert: SqlCapability.INSERT,
+  replace: SqlCapability.INSERT,
+  update: SqlCapability.UPDATE,
+  delete: SqlCapability.DELETE,
+  create: SqlCapability.DDL,
+  alter: SqlCapability.DDL,
+  comment: SqlCapability.DDL,
+  rename: SqlCapability.DDL,
+  drop: SqlCapability.DROP,
+  truncate: SqlCapability.DROP
+};
+var PARSER_HINT = "The admin SQL console needs the optional peer `node-sql-parser`. Install it with: npm install node-sql-parser";
+async function loadSqlParser() {
+  try {
+    const module = await import('node-sql-parser');
+    const Parser = module.Parser ?? module.default?.Parser;
+    if (Parser === void 0) throw new Error(PARSER_HINT);
+    return new Parser();
+  } catch {
+    throw new Error(PARSER_HINT);
+  }
+}
+function analyzeSql(sql5, dialect, parser) {
+  const capabilities = /* @__PURE__ */ new Set();
+  const tables = /* @__PURE__ */ new Set();
+  let statements = 0;
+  let parsed = true;
+  let unscopedWrite = false;
+  try {
+    const ast = parser.astify(sql5, { database: dialect });
+    const list = Array.isArray(ast) ? ast : [ast];
+    statements = list.length;
+    for (const statement of list) {
+      const type = String(statement.type ?? "").toLowerCase();
+      capabilities.add(STATEMENT_CAPABILITIES[type] ?? SqlCapability.ADMIN);
+      if ((type === "update" || type === "delete") && !statement.where) {
+        unscopedWrite = true;
+      }
+    }
+  } catch {
+    parsed = false;
+    statements = 1;
+    capabilities.add(SqlCapability.ADMIN);
+  }
+  try {
+    for (const entry of parser.tableList(sql5, { database: dialect })) {
+      const name = entry.split("::").pop();
+      if (name !== void 0 && name !== "null") tables.add(name.toLowerCase());
+    }
+  } catch {
+  }
+  return {
+    statements,
+    capabilities: [...capabilities],
+    tables: [...tables],
+    parsed,
+    unscopedWrite
+  };
+}
+function checkSqlPolicy(analysis, policy) {
+  const granted = new Set(policy.capabilities ?? [SqlCapability.READ]);
+  for (const capability of analysis.capabilities) {
+    if (!granted.has(capability)) {
+      return {
+        allowed: false,
+        reason: analysis.parsed ? `This console may not run ${capability} statements.` : "The statement could not be parsed, so it needs the admin capability."
+      };
+    }
+  }
+  if ((policy.requireWhereOnWrites ?? true) && analysis.unscopedWrite) {
+    return {
+      allowed: false,
+      reason: "An UPDATE or DELETE without a WHERE clause is refused."
+    };
+  }
+  const denied = new Set((policy.denyTables ?? []).map((name) => name.toLowerCase()));
+  for (const table of analysis.tables) {
+    if (denied.has(table)) {
+      return { allowed: false, reason: `Table "${table}" is not available here.` };
+    }
+  }
+  if (policy.allowTables !== void 0) {
+    const allowed = new Set(policy.allowTables.map((name) => name.toLowerCase()));
+    if (analysis.tables.length === 0) {
+      return {
+        allowed: false,
+        reason: "This console only runs statements naming an allowed table."
+      };
+    }
+    for (const table of analysis.tables) {
+      if (!allowed.has(table)) {
+        return { allowed: false, reason: `Table "${table}" is not on the allow list.` };
+      }
+    }
+  }
+  return { allowed: true, reason: null };
+}
+
 // src/admin/inlines.ts
 function adminInline(options) {
   const slug = options.model.tablename;
@@ -12112,7 +12305,7 @@ function escapeHtml(value) {
   return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function renderLayout(context, title, body) {
-  const { site, theme, prefix, session, currentPath, navModels, messages } = context;
+  const { site, theme, prefix, session, currentPath, navModels, navSystem, messages } = context;
   const authed = session !== null;
   const indexUrl = `${prefix}/`;
   const navLink = (url, label, active) => `<a href="${escapeHtml(url)}" class="tempest-admin-sidebar__link${active ? " tempest-admin-sidebar__link--active" : ""}">${escapeHtml(label)}</a>`;
@@ -12122,6 +12315,9 @@ function renderLayout(context, title, body) {
         ${navLink(indexUrl, "Dashboard", currentPath === indexUrl)}
         ${navModels.length > 0 ? `<span class="tempest-admin-sidebar__heading">Models</span>${navModels.map(
     (entry) => navLink(entry.url, entry.label, currentPath.startsWith(entry.url))
+  ).join("")}` : ""}
+        ${navSystem.length > 0 ? `<span class="tempest-admin-sidebar__heading">System</span>${navSystem.map(
+    (entry) => navLink(entry.url, entry.label, currentPath.startsWith(entry.url))
   ).join("")}` : ""}
       </nav>
     </aside>` : "";
@@ -12472,11 +12668,11 @@ function renderInline(inline, csrfToken, error) {
     ${more}
   </section>`;
 }
-function renderAuditPanel(audit) {
-  const rows = audit.fields.map(
+function renderAuditPanel(audit2) {
+  const rows = audit2.fields.map(
     (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
   ).join("");
-  const history = audit.history.length > 0 ? `<ol class="tempest-admin-history">${audit.history.map((entry) => {
+  const history = audit2.history.length > 0 ? `<ol class="tempest-admin-history">${audit2.history.map((entry) => {
     const changes = entry.changes.length > 0 ? `<table class="tempest-admin-history__changes"><thead><tr><th>Field</th><th>Before</th><th>After</th></tr></thead><tbody>${entry.changes.map(
       (change) => `<tr><td>${escapeHtml(change.field)}</td><td>${escapeHtml(change.before)}</td><td>${escapeHtml(change.after)}</td></tr>`
     ).join("")}</tbody></table>` : "<p><em>No field changes recorded.</em></p>";
@@ -12574,6 +12770,86 @@ function renderFormPage(context, view) {
 </section>`;
   return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
 }
+function renderLogsPage(context, view) {
+  const options = view.sources.map(
+    (source) => `<option value="${escapeHtml(source.value)}"${source.selected ? " selected" : ""}>${escapeHtml(source.label)}</option>`
+  ).join("");
+  const rows = view.rows.length > 0 ? view.rows.map((row) => {
+    const context_ = row.context.map(
+      (entry) => `<span class="tempest-admin-logs__meta"><b>${escapeHtml(entry.key)}</b>: ${escapeHtml(entry.value)}</span>`
+    ).join(" ");
+    const message = row.stack === null ? `${escapeHtml(row.message)}${context_ === "" ? "" : `<br>${context_}`}` : `<details><summary>${escapeHtml(row.message)}</summary>${context_ === "" ? "" : `<p>${context_}</p>`}<pre>${escapeHtml(row.stack)}</pre></details>`;
+    return `<tr>
+        <td data-label="Level"><span class="tempest-log-badge tempest-log-badge--${escapeHtml(row.level)}">${escapeHtml(row.level)}</span></td>
+        <td data-label="When">${escapeHtml(row.timestamp)}</td>
+        <td data-label="Logger">${escapeHtml(row.logger)}</td>
+        <td data-label="Message">${message}</td>
+      </tr>`;
+  }).join("") : `<tr><td colspan="4">No log records yet. Point <code>configureFileLogging</code> at the same directory to populate this page.</td></tr>`;
+  const body = `<section class="tempest-admin-logs">
+  <header class="tempest-admin-list__header">
+    <h1>Logs</h1>
+    <p>${escapeHtml(view.total)} record${view.total === 1 ? "" : "s"}.</p>
+  </header>
+  <div class="tempest-admin-list__toolbar">
+    <form method="get" class="tempest-admin-list__filters">
+      <label><span>Source</span><select name="source">${options}</select></label>
+      <input type="search" name="q" value="${escapeHtml(view.query)}" placeholder="Search\u2026" aria-label="Search">
+      <button type="submit">Apply</button>
+    </form>
+    <div class="tempest-admin-list__actions">
+      <a href="${escapeHtml(view.exportMarkdownUrl)}">Export Markdown</a>
+      <a href="${escapeHtml(view.exportJsonUrl)}">Export JSON</a>
+    </div>
+  </div>
+  <div class="tempest-admin-table-wrap">
+    <table class="tempest-admin-list__table">
+      <thead><tr><th>Level</th><th>When</th><th>Logger</th><th>Message</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>
+  ${view.pages > 1 ? `<nav class="tempest-admin-list__pagination" aria-label="Pagination">
+    ${view.prevUrl !== null ? `<a href="${escapeHtml(view.prevUrl)}">\u2190 Prev</a>` : ""}
+    <span>Page ${escapeHtml(view.page)} of ${escapeHtml(view.pages)}</span>
+    ${view.nextUrl !== null ? `<a href="${escapeHtml(view.nextUrl)}">Next \u2192</a>` : ""}
+  </nav>` : ""}
+  <p class="tempest-admin-form__hint">Exports carry at most ${escapeHtml(view.exportMax)} records, newest first, honouring the filters above.</p>
+</section>`;
+  return renderLayout(context, `Logs \xB7 ${context.site.title}`, body);
+}
+function renderSqlPage(context, view) {
+  if (context.session === null) throw new Error("The SQL console requires a session");
+  const result = view.rowCount === null ? "" : `<p class="tempest-admin-form__hint">${escapeHtml(view.rowCount)} row${view.rowCount === 1 ? "" : "s"}${view.durationMs === null ? "" : ` in ${escapeHtml(view.durationMs)} ms`}${view.truncated ? " (truncated by the row cap)" : ""}.</p>
+      <div class="tempest-admin-table-wrap">
+        <table class="tempest-admin-list__table">
+          <thead><tr>${view.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}</tr></thead>
+          <tbody>${view.rows.map(
+    (row) => `<tr>${row.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}</tr>`
+  ).join("")}</tbody>
+        </table>
+      </div>`;
+  const body = `<section class="tempest-admin-sql">
+  <header class="tempest-admin-list__header">
+    <h1>SQL console</h1>
+    <p>Capabilities: <code>${escapeHtml(view.capabilities.join(", "))}</code></p>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/sql`)}" class="tempest-admin-form__form">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    <div class="tempest-admin-form__field">
+      <label>
+        <span>Statement</span>
+        <textarea name="sql" rows="6" spellcheck="false" required>${escapeHtml(view.sql)}</textarea>
+      </label>
+    </div>
+    <div class="tempest-admin-form__actions">
+      <button type="submit">Run</button>
+    </div>
+  </form>
+  ${result}
+</section>`;
+  return renderLayout(context, `SQL console \xB7 ${context.site.title}`, body);
+}
 function renderImportPage(context, view) {
   if (context.session === null) throw new Error("The import page requires a session");
   const summary = view.created === null ? "" : `<p class="tempest-admin-import__summary">Created ${escapeHtml(view.created)} record${view.created === 1 ? "" : "s"}.</p>`;
@@ -12659,7 +12935,66 @@ var AUTOCOMPLETE_SCRIPT = `<script>
   });
 })();
 </script>`;
+function filesFor(dir, source) {
+  if (source === "500") return [path.join(dir, HTTP_500_LOG_FILE)];
+  if (source === "all") return Object.values(LEVEL_LOG_FILES).map((f) => path.join(dir, f));
+  return [path.join(dir, LEVEL_LOG_FILES[source])];
+}
+async function readLogEntries(dir, source) {
+  return await readEntries(filesFor(dir, source));
+}
+async function readEntries(files) {
+  const entries = [];
+  for (const file of files) {
+    let content;
+    try {
+      content = await promises.readFile(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of content.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        entries.push(JSON.parse(line));
+      } catch {
+      }
+    }
+  }
+  return entries;
+}
+function makeLogsRouter(options) {
+  const router = express3.Router();
+  const path = options.path ?? "/logs";
+  const guards = options.guards ?? [];
+  const handler = (req, res, next) => {
+    const source = req.query.source ?? "all";
+    const validSources = ["all", "debug", "info", "warning", "error", "500"];
+    if (!validSources.includes(source)) {
+      res.status(422).json({ detail: "Invalid log source", code: "VALIDATION_ERROR", details: {} });
+      return;
+    }
+    const page2 = Math.max(1, Number(req.query.page) || 1);
+    const pageSize = Math.min(500, Math.max(1, Number(req.query.pageSize) || 50));
+    readEntries(filesFor(options.dir, source)).then((entries) => {
+      entries.reverse();
+      const total = entries.length;
+      const start = (page2 - 1) * pageSize;
+      res.json({
+        items: entries.slice(start, start + pageSize),
+        total,
+        page: page2,
+        pageSize,
+        pages: Math.ceil(total / pageSize)
+      });
+    }).catch(next);
+  };
+  router.get(path, ...guards, handler);
+  return router;
+}
 var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var LOG_SOURCES = ["all", "debug", "info", "warning", "error", "500"];
+var LOG_PAGE_SIZE = 50;
+var LOG_EXPORT_MAX = 500;
 var INLINE_ROW_LIMIT = 50;
 var AUTOCOMPLETE_LIMIT = 20;
 var AUDIT_HISTORY_LIMIT = 50;
@@ -12691,6 +13026,13 @@ function makeAdminRouter(site, options) {
   const theme = resolveAdminTheme(site.theme);
   const showMetrics = options.showMetrics ?? true;
   const exportMaxRows = options.exportMaxRows ?? 5e3;
+  const systemNav = [];
+  if (options.logDir !== void 0) {
+    systemNav.push({ label: "Logs", url: `${prefix}/logs` });
+  }
+  if (options.sqlConsole !== void 0) {
+    systemNav.push({ label: "SQL console", url: `${prefix}/sql` });
+  }
   const maxUploadBytes = options.maxUploadBytes ?? 10 * 1024 * 1024;
   const sessions = new AdminSessionStore({
     secret: options.secretKey,
@@ -12712,6 +13054,7 @@ function makeAdminRouter(site, options) {
       label: admin.verboseNamePlural(),
       url: `${prefix}/m/${admin.slug()}`
     })),
+    navSystem: systemNav,
     messages: flashFor(req)
   });
   const allows = async (principal, admin, action) => {
@@ -12922,6 +13265,187 @@ function makeAdminRouter(site, options) {
       );
     })
   );
+  if (options.logDir !== void 0) {
+    const logDir = options.logDir;
+    router.get(
+      `${prefix}/logs`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        const { entries, source, search } = await readLogs(req, logDir);
+        const page2 = Math.max(1, Number.parseInt(queryString(req.query.page), 10) || 1);
+        const start = (page2 - 1) * LOG_PAGE_SIZE;
+        const pages = Math.max(1, Math.ceil(entries.length / LOG_PAGE_SIZE));
+        const exportUrl = (format) => `${prefix}/logs/export?${buildQuery({ source, q: search, format })}`;
+        const pageUrl = (target) => `?${buildQuery({ source, q: search, page: target })}`;
+        html(
+          res,
+          renderLogsPage(context(req, state.session, state.visible), {
+            sources: LOG_SOURCES.map((value) => ({
+              value,
+              label: value === "500" ? "HTTP 500" : humanizeField(value),
+              selected: value === source
+            })),
+            query: search,
+            rows: entries.slice(start, start + LOG_PAGE_SIZE).map((entry) => ({
+              level: entry.level,
+              timestamp: entry.timestamp,
+              logger: entry.logger,
+              message: entry.message,
+              stack: entry.stack,
+              context: Object.entries(entry.context).map(([key, value]) => ({
+                key,
+                value: typeof value === "string" ? value : JSON.stringify(value)
+              }))
+            })),
+            total: entries.length,
+            page: page2,
+            pages,
+            prevUrl: page2 > 1 ? pageUrl(page2 - 1) : null,
+            nextUrl: page2 < pages ? pageUrl(page2 + 1) : null,
+            exportMarkdownUrl: exportUrl("md"),
+            exportJsonUrl: exportUrl("json"),
+            exportMax: LOG_EXPORT_MAX
+          })
+        );
+      })
+    );
+    router.get(
+      `${prefix}/logs/export`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        const format = queryString(req.query.format) === "json" ? "json" : "md";
+        const { entries, source, search } = await readLogs(req, logDir);
+        const window = entries.slice(0, LOG_EXPORT_MAX);
+        const payload = format === "json" ? renderLogEntriesJson(window) : renderLogEntriesMarkdown(window, {
+          source,
+          query: search,
+          total: entries.length
+        });
+        res.status(200).type(format === "json" ? "application/json" : "text/markdown; charset=utf-8").set("content-disposition", `attachment; filename="logs.${format}"`).send(payload);
+      })
+    );
+  }
+  if (options.sqlConsole !== void 0) {
+    const console_ = options.sqlConsole;
+    const policy = console_.policy ?? {};
+    const dialect = console_.dialect ?? "postgresql";
+    const capabilities = policy.capabilities ?? [SqlCapability.READ];
+    const maxRows = policy.maxRows ?? 200;
+    router.get(
+      `${prefix}/sql`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        html(
+          res,
+          renderSqlPage(context(req, state.session, state.visible), {
+            sql: "",
+            capabilities: [...capabilities],
+            error: null,
+            columns: [],
+            rows: [],
+            rowCount: null,
+            truncated: false,
+            durationMs: null
+          })
+        );
+      })
+    );
+    router.post(
+      `${prefix}/sql`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        if (!checkCsrf(req, res, state)) return;
+        const body = req.body;
+        const sql5 = typeof body.sql === "string" ? body.sql : "";
+        const principal = backend.displayName(state.principal);
+        const render = (view) => {
+          html(
+            res,
+            renderSqlPage(context(req, state.session, state.visible), {
+              sql: sql5,
+              capabilities: [...capabilities],
+              ...view
+            }),
+            view.error === null ? 200 : 400
+          );
+        };
+        const parser = await loadSqlParser();
+        const analysis = analyzeSql(sql5, dialect, parser);
+        const verdict = checkSqlPolicy(analysis, policy);
+        if (!verdict.allowed) {
+          await audit(console_.onAudit, {
+            sql: sql5,
+            principal,
+            allowed: false,
+            reason: verdict.reason,
+            analysis,
+            durationMs: null,
+            rowCount: null
+          });
+          render({
+            error: verdict.reason,
+            columns: [],
+            rows: [],
+            rowCount: null,
+            truncated: false,
+            durationMs: null
+          });
+          return;
+        }
+        const started = Date.now();
+        let rows;
+        try {
+          rows = console_.run === void 0 ? await state.dbSession.raw(sql5).all() : await console_.run(sql5, state.dbSession);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          await audit(console_.onAudit, {
+            sql: sql5,
+            principal,
+            allowed: true,
+            reason: message,
+            analysis,
+            durationMs: Date.now() - started,
+            rowCount: null
+          });
+          render({
+            error: message,
+            columns: [],
+            rows: [],
+            rowCount: null,
+            truncated: false,
+            durationMs: null
+          });
+          return;
+        }
+        const durationMs = Date.now() - started;
+        await audit(console_.onAudit, {
+          sql: sql5,
+          principal,
+          allowed: true,
+          reason: null,
+          analysis,
+          durationMs,
+          rowCount: rows.length
+        });
+        const window = rows.slice(0, maxRows);
+        const columns = window.length === 0 ? [] : Object.keys(window[0] ?? {});
+        render({
+          error: null,
+          columns,
+          rows: window.map(
+            (row) => columns.map((column6) => formatCellValue(row[column6]))
+          ),
+          rowCount: rows.length,
+          truncated: rows.length > window.length,
+          durationMs
+        });
+      })
+    );
+  }
   router.get(
     `${prefix}/m/:slug`,
     guarded(async (req, res) => {
@@ -13639,6 +14163,15 @@ function makeAdminRouter(site, options) {
     const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
     return row ?? null;
   }
+  async function readLogs(req, dir) {
+    const requested = queryString(req.query.source);
+    const source = LOG_SOURCES.includes(requested) ? requested : "all";
+    const search = queryString(req.query.q);
+    const raw = await readLogEntries(dir, source);
+    const entries = filterLogEntries(raw.map(toLogEntry), search);
+    entries.reverse();
+    return { entries, source, search };
+  }
   function renderImport(req, state, admin, error, created, rowErrors) {
     return renderImportPage(context(req, state.session, state.visible), {
       title: admin.verboseNamePlural(),
@@ -13927,6 +14460,16 @@ function inlineFieldNames(childAdmin, inline) {
 function inlineFields(childAdmin, names, key, values, errors) {
   return buildFormFields(childAdmin, { values, errors }).filter((field) => names.includes(field.name)).map((field) => ({ ...field, name: `row.${key}.${field.name}` }));
 }
+async function audit(hook, entry) {
+  if (hook === void 0) return;
+  try {
+    await hook(entry);
+  } catch (error) {
+    logger2.error("Admin SQL audit hook failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
 function flagAllows(admin, action) {
   if (action === AdminPermission.CREATE) return admin.canCreate;
   if (action === AdminPermission.EDIT) return admin.canEdit;
@@ -16013,59 +16556,6 @@ function makeToolSpecRouter(spec, options = {}) {
   });
   return router;
 }
-function filesFor(dir, source) {
-  if (source === "500") return [path.join(dir, HTTP_500_LOG_FILE)];
-  if (source === "all") return Object.values(LEVEL_LOG_FILES).map((f) => path.join(dir, f));
-  return [path.join(dir, LEVEL_LOG_FILES[source])];
-}
-async function readEntries(files) {
-  const entries = [];
-  for (const file of files) {
-    let content;
-    try {
-      content = await promises.readFile(file, "utf8");
-    } catch {
-      continue;
-    }
-    for (const line of content.split("\n")) {
-      if (!line.trim()) continue;
-      try {
-        entries.push(JSON.parse(line));
-      } catch {
-      }
-    }
-  }
-  return entries;
-}
-function makeLogsRouter(options) {
-  const router = express3.Router();
-  const path = options.path ?? "/logs";
-  const guards = options.guards ?? [];
-  const handler = (req, res, next) => {
-    const source = req.query.source ?? "all";
-    const validSources = ["all", "debug", "info", "warning", "error", "500"];
-    if (!validSources.includes(source)) {
-      res.status(422).json({ detail: "Invalid log source", code: "VALIDATION_ERROR", details: {} });
-      return;
-    }
-    const page2 = Math.max(1, Number(req.query.page) || 1);
-    const pageSize = Math.min(500, Math.max(1, Number(req.query.pageSize) || 50));
-    readEntries(filesFor(options.dir, source)).then((entries) => {
-      entries.reverse();
-      const total = entries.length;
-      const start = (page2 - 1) * pageSize;
-      res.json({
-        items: entries.slice(start, start + pageSize),
-        total,
-        page: page2,
-        pageSize,
-        pages: Math.ceil(total / pageSize)
-      });
-    }).catch(next);
-  };
-  router.get(path, ...guards, handler);
-  return router;
-}
 function createTestDatabase(models) {
   const driver = tempestDbJs.NodeSqliteDriver.open(":memory:");
   for (const model of models) {
@@ -16098,7 +16588,7 @@ async function withTestDatabase(models, fn) {
 }
 
 // src/version.ts
-var VERSION = "0.28.0";
+var VERSION = "0.29.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -16335,6 +16825,7 @@ exports.S3UploadStorage = S3UploadStorage;
 exports.SSEBroker = SSEBroker;
 exports.ServerSentEvent = ServerSentEvent;
 exports.SessionService = SessionService;
+exports.SqlCapability = SqlCapability;
 exports.TOTPHelper = TOTPHelper;
 exports.TaskManager = TaskManager;
 exports.TelegramProvider = TelegramProvider;
@@ -16361,6 +16852,7 @@ exports.adminColumns = adminColumns;
 exports.adminInline = adminInline;
 exports.adminLens = adminLens;
 exports.adminThemeCss = adminThemeCss;
+exports.analyzeSql = analyzeSql;
 exports.attachWebSocketHub = attachWebSocketHub;
 exports.authResponseSchema = authResponseSchema;
 exports.authSettingsShape = authSettingsShape;
@@ -16377,6 +16869,7 @@ exports.buildPaginationLinkHeader = buildPaginationLinkHeader;
 exports.cached = cached3;
 exports.centsField = centsField;
 exports.cepField = cepField;
+exports.checkSqlPolicy = checkSqlPolicy;
 exports.citiesByUf = citiesByUf;
 exports.cnpjField = cnpjField;
 exports.coerceFlag = coerceFlag;
@@ -16405,6 +16898,7 @@ exports.envBoolean = looseBoolean;
 exports.envList = envList;
 exports.escapeHtml = escapeHtml;
 exports.filterForColumn = filterForColumn;
+exports.filterLogEntries = filterLogEntries;
 exports.foreignKeyFields = foreignKeyFields;
 exports.foreignKeyLabel = foreignKeyLabel;
 exports.foreignKeyTable = foreignKeyTable;
@@ -16444,6 +16938,7 @@ exports.keyByJwtSubject = keyByJwtSubject;
 exports.latitudeField = latitudeField;
 exports.listStates = listStates;
 exports.loadSettings = loadSettings;
+exports.loadSqlParser = loadSqlParser;
 exports.logEntrySchema = logEntrySchema;
 exports.logSettingsShape = logSettingsShape;
 exports.loginSchema = loginSchema;
@@ -16504,6 +16999,7 @@ exports.rabbitmqSettingsShape = rabbitmqSettingsShape;
 exports.rateLimitMiddleware = rateLimitMiddleware;
 exports.ratingField = ratingField;
 exports.ratioField = ratioField;
+exports.readLogEntries = readLogEntries;
 exports.redisSettingsShape = redisSettingsShape;
 exports.refreshSchema = refreshSchema;
 exports.registerExceptionHandlers = registerExceptionHandlers;
@@ -16514,9 +17010,13 @@ exports.renderFormPage = renderFormPage;
 exports.renderImportPage = renderImportPage;
 exports.renderLayout = renderLayout;
 exports.renderListPage = renderListPage;
+exports.renderLogEntriesJson = renderLogEntriesJson;
+exports.renderLogEntriesMarkdown = renderLogEntriesMarkdown;
 exports.renderLoginPage = renderLoginPage;
+exports.renderLogsPage = renderLogsPage;
 exports.renderMfaPage = renderMfaPage;
 exports.renderPasswordResetFormPage = renderPasswordResetFormPage;
+exports.renderSqlPage = renderSqlPage;
 exports.requestIdMiddleware = requestIdMiddleware;
 exports.requestTracingMiddleware = requestTracingMiddleware;
 exports.requireRoles = requireRoles;
@@ -16540,6 +17040,7 @@ exports.syncFilterSchema = syncFilterSchema;
 exports.syncPaginationSchema = syncPaginationSchema;
 exports.tableNameFor = tableNameFor;
 exports.toDict = toDict;
+exports.toLogEntry = toLogEntry;
 exports.toUtc = toUtc;
 exports.tokenFromUrl = tokenFromUrl;
 exports.tokenPairSchema = tokenPairSchema;