tempest-express-sdk 0.28.0 → 0.30.0

package/dist/index.cjs

@@ -8673,6 +8673,7 @@ var TaskManager = class {
   broker;
   queue;
   handlers = /* @__PURE__ */ new Map();
+  metadata = /* @__PURE__ */ new Map();
   unsubscribe = null;
   /**
    * @param options - Broker and queue name.
@@ -8686,9 +8687,32 @@ var TaskManager = class {
    *
    * @param name - The task name.
    * @param handler - The handler invoked with the task payload.
+   * @param options - Description and declared schedule, surfaced by
+   *   {@link TaskManager.inventory} and by the admin panel's tasks page.
    */
-  register(name, handler) {
+  register(name, handler, options = {}) {
     this.handlers.set(name, handler);
+    this.metadata.set(name, options);
+  }
+  /**
+   * Return what this process would run, ordered by name.
+   *
+   * This is the **declared** side of background work — the handlers this
+   * process knows about — not queue state. A broker's pending depth is not
+   * something the manager can see, and a screen that implied otherwise would
+   * be worse than one that says nothing.
+   *
+   * @returns One entry per registered task.
+   */
+  inventory() {
+    return [...this.handlers.keys()].sort((left, right) => left.localeCompare(right)).map((name) => {
+      const meta = this.metadata.get(name) ?? {};
+      return {
+        name,
+        description: meta.description ?? null,
+        schedule: meta.schedule ?? null
+      };
+    });
   }
   /**
    * Enqueue a task by name.
@@ -8722,6 +8746,180 @@ var TaskManager = class {
     this.unsubscribe = null;
   }
 };
+var JobStatus = {
+  /** Written, not started. */
+  QUEUED: "queued",
+  /** A worker picked it up. */
+  RUNNING: "running",
+  /** Finished cleanly. */
+  SUCCEEDED: "succeeded",
+  /** Finished with an error. */
+  FAILED: "failed",
+  /** An operator stopped it before it finished. */
+  CANCELLED: "cancelled"
+};
+var TERMINAL = [
+  JobStatus.SUCCEEDED,
+  JobStatus.FAILED,
+  JobStatus.CANCELLED
+];
+var BaseJobModel = class extends BaseModel {
+  /** The task name this run belongs to. */
+  name = tempestDbJs.column.varchar(128).notNull();
+  /** Lifecycle state — a {@link JobStatus} value. */
+  status = tempestDbJs.column.varchar(16).notNull().default(JobStatus.QUEUED);
+  /** The payload the run was started with. */
+  payload = tempestDbJs.column.json();
+  /** Whatever the run produced, for an operator to read afterwards. */
+  result = tempestDbJs.column.json();
+  /** The failure message, when the run failed. */
+  error = tempestDbJs.column.text();
+  /** How many times the run has been attempted. */
+  attempts = tempestDbJs.column.integer().notNull().default(0);
+  /** When a worker picked it up. */
+  startedAt = tempestDbJs.column.datetime();
+  /** When it reached a terminal state. */
+  finishedAt = tempestDbJs.column.datetime();
+};
+var JobStore = class {
+  /**
+   * @param model - The concrete {@link BaseJobModel} subclass.
+   * @param session - The session rows are written on.
+   */
+  constructor(model, session) {
+    this.model = model;
+    this.repository = new tempestDbJs.BaseRepository(model, session);
+  }
+  model;
+  repository;
+  /**
+   * Record a job about to run.
+   *
+   * @param name - The task name.
+   * @param payload - The payload the run was started with.
+   * @returns The created row.
+   */
+  async enqueue(name, payload = {}) {
+    return await this.repository.create({
+      name,
+      status: JobStatus.QUEUED,
+      payload,
+      result: null,
+      error: null,
+      attempts: 0,
+      startedAt: null,
+      finishedAt: null
+    });
+  }
+  /**
+   * Mark a job as picked up, counting the attempt.
+   *
+   * @param id - The job id.
+   * @param attempt - Which attempt this is. Default `1`.
+   * @returns How many rows changed.
+   */
+  async start(id, attempt = 1) {
+    return await this.repository.update(
+      { id },
+      {
+        status: JobStatus.RUNNING,
+        startedAt: /* @__PURE__ */ new Date(),
+        attempts: attempt
+      }
+    );
+  }
+  /**
+   * Mark a job as finished cleanly.
+   *
+   * @param id - The job id.
+   * @param result - Whatever the run produced.
+   * @returns How many rows changed.
+   */
+  async succeed(id, result = {}) {
+    return await this.repository.update(
+      { id },
+      {
+        status: JobStatus.SUCCEEDED,
+        result,
+        error: null,
+        finishedAt: /* @__PURE__ */ new Date()
+      }
+    );
+  }
+  /**
+   * Mark a job as failed.
+   *
+   * @param id - The job id.
+   * @param error - The failure, as an `Error` or a message.
+   * @returns How many rows changed.
+   */
+  async fail(id, error) {
+    return await this.repository.update(
+      { id },
+      {
+        status: JobStatus.FAILED,
+        error: error instanceof Error ? error.message : String(error),
+        finishedAt: /* @__PURE__ */ new Date()
+      }
+    );
+  }
+  /**
+   * Ask a job to stop.
+   *
+   * A job already in a terminal state is left alone and reported as not
+   * cancelled, so an operator clicking cancel on a run that just finished sees
+   * the truth rather than a row rewritten under them.
+   *
+   * @param id - The job id.
+   * @returns Whether the row moved to `cancelled`.
+   */
+  async cancel(id) {
+    const row = await this.repository.getByIdOrNull(id);
+    if (row === null || TERMINAL.includes(String(row.status))) return false;
+    const changed = await this.repository.update(
+      { id },
+      {
+        status: JobStatus.CANCELLED,
+        finishedAt: /* @__PURE__ */ new Date()
+      }
+    );
+    return changed > 0;
+  }
+  /**
+   * Read one job row.
+   *
+   * @param id - The job id.
+   * @returns The row, or `null`.
+   */
+  async get(id) {
+    return await this.repository.getByIdOrNull(id);
+  }
+  /**
+   * Read a page of jobs, newest first.
+   *
+   * @param filter - Page, size and optional `name` / `status` filters.
+   * @returns The page plus its metadata.
+   */
+  async list(filter = {}) {
+    const filters = {};
+    if (filter.name !== void 0 && filter.name !== "") filters.name = filter.name;
+    if (filter.status !== void 0) filters.status = filter.status;
+    const result = await this.repository.paginate({
+      page: filter.page ?? 1,
+      pageSize: filter.pageSize ?? 25,
+      orderBy: "createdAt",
+      ascending: false,
+      ...Object.keys(filters).length === 0 ? {} : { filters }
+    });
+    return {
+      items: result.items,
+      total: result.total,
+      page: result.page,
+      pageSize: result.pageSize,
+      pages: result.pages
+    };
+  }
+};
 
 // src/flags/backends.ts
 function coerceFlag(value) {
@@ -9461,6 +9659,199 @@ function partitionTotal(partition) {
   return partition.segments.reduce((total, segment) => total + segment.value, 0);
 }
 
+// src/admin/logs.ts
+var LIFTED = /* @__PURE__ */ new Set(["level", "logger", "message", "timestamp", "stack"]);
+function toLogEntry(raw) {
+  const context = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (LIFTED.has(key) || value === null || value === void 0) continue;
+    context[key] = value;
+  }
+  return {
+    level: typeof raw.level === "string" ? raw.level : "info",
+    logger: typeof raw.logger === "string" ? raw.logger : "",
+    message: typeof raw.message === "string" ? raw.message : "",
+    timestamp: typeof raw.timestamp === "string" ? raw.timestamp : "",
+    stack: typeof raw.stack === "string" ? raw.stack : null,
+    context,
+    raw
+  };
+}
+function filterLogEntries(entries, term) {
+  const needle = term.trim().toLowerCase();
+  if (needle === "") return entries;
+  return entries.filter(
+    (entry) => `${entry.message} ${entry.logger} ${entry.stack ?? ""}`.toLowerCase().includes(needle)
+  );
+}
+function renderLogEntriesMarkdown(entries, options) {
+  const lines = [
+    "# Application logs",
+    "",
+    `- **Source:** \`${options.source}\``,
+    `- **Search:** ${options.query === "" ? "_none_" : `\`${options.query}\``}`,
+    `- **Exported:** ${entries.length} of ${options.total} matching record(s)`,
+    ""
+  ];
+  if (entries.length < options.total) {
+    lines.push(
+      `> Truncated: the export is capped, so ${options.total - entries.length} older matching record(s) are not included.`,
+      ""
+    );
+  }
+  for (const entry of entries) {
+    lines.push(
+      `## ${entry.level.toUpperCase()} \u2014 ${entry.message || "(no message)"}`,
+      "",
+      `- **When:** ${entry.timestamp || "unknown"}`,
+      `- **Logger:** ${entry.logger || "unknown"}`
+    );
+    for (const [key, value] of Object.entries(entry.context)) {
+      lines.push(
+        `- **${key}:** ${typeof value === "string" ? value : JSON.stringify(value)}`
+      );
+    }
+    lines.push("");
+    if (entry.stack !== null) {
+      lines.push("```text", entry.stack, "```", "");
+    }
+  }
+  return lines.join("\n");
+}
+function renderLogEntriesJson(entries) {
+  return JSON.stringify(
+    entries.map((entry) => entry.raw),
+    null,
+    2
+  );
+}
+
+// src/admin/sqlConsole.ts
+var SqlCapability = {
+  /** `SELECT`, `WITH … SELECT`, `EXPLAIN`, `SHOW`. */
+  READ: "read",
+  /** Adds rows. */
+  INSERT: "insert",
+  /** Changes rows. */
+  UPDATE: "update",
+  /** Removes rows. */
+  DELETE: "delete",
+  /** `CREATE` / `ALTER` / `COMMENT`. */
+  DDL: "ddl",
+  /** `DROP` and `TRUNCATE`: irreversible structure loss. */
+  DROP: "drop",
+  /**
+   * `GRANT` / `REVOKE` / `SET`, and anything the analyser cannot classify.
+   * Unknown statements land here on purpose, so a construct nobody anticipated
+   * needs the most privileged capability rather than the least.
+   */
+  ADMIN: "admin"
+};
+var STATEMENT_CAPABILITIES = {
+  select: SqlCapability.READ,
+  with: SqlCapability.READ,
+  explain: SqlCapability.READ,
+  show: SqlCapability.READ,
+  desc: SqlCapability.READ,
+  describe: SqlCapability.READ,
+  insert: SqlCapability.INSERT,
+  replace: SqlCapability.INSERT,
+  update: SqlCapability.UPDATE,
+  delete: SqlCapability.DELETE,
+  create: SqlCapability.DDL,
+  alter: SqlCapability.DDL,
+  comment: SqlCapability.DDL,
+  rename: SqlCapability.DDL,
+  drop: SqlCapability.DROP,
+  truncate: SqlCapability.DROP
+};
+var PARSER_HINT = "The admin SQL console needs the optional peer `node-sql-parser`. Install it with: npm install node-sql-parser";
+async function loadSqlParser() {
+  try {
+    const module = await import('node-sql-parser');
+    const Parser = module.Parser ?? module.default?.Parser;
+    if (Parser === void 0) throw new Error(PARSER_HINT);
+    return new Parser();
+  } catch {
+    throw new Error(PARSER_HINT);
+  }
+}
+function analyzeSql(sql5, dialect, parser) {
+  const capabilities = /* @__PURE__ */ new Set();
+  const tables = /* @__PURE__ */ new Set();
+  let statements = 0;
+  let parsed = true;
+  let unscopedWrite = false;
+  try {
+    const ast = parser.astify(sql5, { database: dialect });
+    const list = Array.isArray(ast) ? ast : [ast];
+    statements = list.length;
+    for (const statement of list) {
+      const type = String(statement.type ?? "").toLowerCase();
+      capabilities.add(STATEMENT_CAPABILITIES[type] ?? SqlCapability.ADMIN);
+      if ((type === "update" || type === "delete") && !statement.where) {
+        unscopedWrite = true;
+      }
+    }
+  } catch {
+    parsed = false;
+    statements = 1;
+    capabilities.add(SqlCapability.ADMIN);
+  }
+  try {
+    for (const entry of parser.tableList(sql5, { database: dialect })) {
+      const name = entry.split("::").pop();
+      if (name !== void 0 && name !== "null") tables.add(name.toLowerCase());
+    }
+  } catch {
+  }
+  return {
+    statements,
+    capabilities: [...capabilities],
+    tables: [...tables],
+    parsed,
+    unscopedWrite
+  };
+}
+function checkSqlPolicy(analysis, policy) {
+  const granted = new Set(policy.capabilities ?? [SqlCapability.READ]);
+  for (const capability of analysis.capabilities) {
+    if (!granted.has(capability)) {
+      return {
+        allowed: false,
+        reason: analysis.parsed ? `This console may not run ${capability} statements.` : "The statement could not be parsed, so it needs the admin capability."
+      };
+    }
+  }
+  if ((policy.requireWhereOnWrites ?? true) && analysis.unscopedWrite) {
+    return {
+      allowed: false,
+      reason: "An UPDATE or DELETE without a WHERE clause is refused."
+    };
+  }
+  const denied = new Set((policy.denyTables ?? []).map((name) => name.toLowerCase()));
+  for (const table of analysis.tables) {
+    if (denied.has(table)) {
+      return { allowed: false, reason: `Table "${table}" is not available here.` };
+    }
+  }
+  if (policy.allowTables !== void 0) {
+    const allowed = new Set(policy.allowTables.map((name) => name.toLowerCase()));
+    if (analysis.tables.length === 0) {
+      return {
+        allowed: false,
+        reason: "This console only runs statements naming an allowed table."
+      };
+    }
+    for (const table of analysis.tables) {
+      if (!allowed.has(table)) {
+        return { allowed: false, reason: `Table "${table}" is not on the allow list.` };
+      }
+    }
+  }
+  return { allowed: true, reason: null };
+}
+
 // src/admin/inlines.ts
 function adminInline(options) {
   const slug = options.model.tablename;
@@ -9601,8 +9992,8 @@ function humanizeField(name) {
 function adminColumns(model) {
   return tempestDbJs.columnsOf(model);
 }
-function widgetForColumn(column6) {
-  const { kind, meta } = column6.type;
+function widgetForColumn(column7) {
+  const { kind, meta } = column7.type;
   const plain = (widget) => ({
     widget,
     step: null,
@@ -9646,11 +10037,11 @@ function widgetForColumn(column6) {
       return plain("text");
   }
 }
-function isColumnOptional(column6) {
-  return !column6.flags.notNull || column6.flags.hasDefault || column6.flags.primaryKey;
+function isColumnOptional(column7) {
+  return !column7.flags.notNull || column7.flags.hasDefault || column7.flags.primaryKey;
 }
-function filterForColumn(column6) {
-  const { kind, meta } = column6.type;
+function filterForColumn(column7) {
+  const { kind, meta } = column7.type;
   if (kind === "boolean") {
     return {
       kind: "select",
@@ -9674,11 +10065,11 @@ function filterForColumn(column6) {
   }
   return { kind: "text", options: [] };
 }
-function foreignKeyTable(column6) {
-  return column6.reference?.table ?? null;
+function foreignKeyTable(column7) {
+  return column7.reference?.table ?? null;
 }
-function isSearchableColumn(column6) {
-  const { kind } = column6.type;
+function isSearchableColumn(column7) {
+  const { kind } = column7.type;
   return kind === "varchar" || kind === "text" || kind === "char";
 }
 
@@ -9960,8 +10351,8 @@ function formatFieldValue(widget, value) {
   }
   return String(value);
 }
-function literalDefault(column6) {
-  const fallback = column6.defaultValue;
+function literalDefault(column7) {
+  const fallback = column7.defaultValue;
   if (fallback === null || fallback.kind !== "literal") return void 0;
   return fallback.value;
 }
@@ -9974,19 +10365,19 @@ function buildFormFields(admin, options = {}) {
   const autocompleteLabels = options.autocompleteLabels ?? {};
   const uploads = new Set(admin.uploadFields);
   return admin.editableFieldNames().flatMap((name) => {
-    const column6 = columns[name];
-    if (column6 === void 0) return [];
+    const column7 = columns[name];
+    if (column7 === void 0) return [];
     const related = foreignKeys[name];
     const autocompleteUrl = autocompleteUrls[name];
-    const spec = uploads.has(name) ? { widget: "file", step: null, options: [] } : autocompleteUrl !== void 0 ? { widget: "autocomplete", step: null, options: [] } : related === void 0 ? widgetForColumn(column6) : { widget: "select", step: null, options: related };
-    const raw = name in values ? values[name] : literalDefault(column6);
+    const spec = uploads.has(name) ? { widget: "file", step: null, options: [] } : autocompleteUrl !== void 0 ? { widget: "autocomplete", step: null, options: [] } : related === void 0 ? widgetForColumn(column7) : { widget: "select", step: null, options: related };
+    const raw = name in values ? values[name] : literalDefault(column7);
     return [
       {
         name,
         label: humanizeField(name),
         widget: spec.widget,
         value: spec.widget === "checkbox" ? "" : formatFieldValue(spec.widget, raw),
-        required: !isColumnOptional(column6),
+        required: !isColumnOptional(column7),
         checked: spec.widget === "checkbox" && toBoolean(raw),
         step: spec.step,
         options: spec.options,
@@ -10003,8 +10394,8 @@ function toBoolean(value) {
   if (typeof value !== "string") return false;
   return ["true", "on", "yes", "1"].includes(value.trim().toLowerCase());
 }
-function coerceValue(column6, widget, raw) {
-  const { kind, meta } = column6.type;
+function coerceValue(column7, widget, raw) {
+  const { kind, meta } = column7.type;
   switch (widget) {
     case "number": {
       const parsed = Number(raw);
@@ -10048,10 +10439,10 @@ function parseFormBody(admin, body, options = {}) {
   const only = options.only === void 0 ? null : new Set(options.only);
   for (const name of admin.editableFieldNames()) {
     if (only !== null && !only.has(name)) continue;
-    const column6 = columns[name];
-    if (column6 === void 0) continue;
+    const column7 = columns[name];
+    if (column7 === void 0) continue;
     if (uploads.has(name)) continue;
-    const { widget } = widgetForColumn(column6);
+    const { widget } = widgetForColumn(column7);
     if (widget === "checkbox") {
       data[name] = toBoolean(body[name]);
       continue;
@@ -10059,16 +10450,16 @@ function parseFormBody(admin, body, options = {}) {
     const submitted = body[name];
     const raw = typeof submitted === "string" ? submitted.trim() : "";
     if (raw === "") {
-      if (!isColumnOptional(column6)) {
+      if (!isColumnOptional(column7)) {
         errors[name] = "This field is required.";
         continue;
       }
-      if (column6.flags.hasDefault && !(name in body)) continue;
+      if (column7.flags.hasDefault && !(name in body)) continue;
       data[name] = null;
       continue;
     }
     try {
-      data[name] = coerceValue(column6, widget, raw);
+      data[name] = coerceValue(column7, widget, raw);
     } catch (error) {
       errors[name] = error instanceof Error ? error.message : "Invalid value.";
     }
@@ -10086,9 +10477,9 @@ function foreignKeyFields(admin) {
   const columns = adminColumns(admin.model);
   const out = {};
   for (const name of admin.editableFieldNames()) {
-    const column6 = columns[name];
-    if (column6 === void 0) continue;
-    const table = foreignKeyTable(column6);
+    const column7 = columns[name];
+    if (column7 === void 0) continue;
+    const table = foreignKeyTable(column7);
     if (table !== null) out[name] = table;
   }
   return out;
@@ -10474,7 +10865,14 @@ var AdminSite = class {
 };
 
 // src/admin/styles.ts
-var ADMIN_CSS = `:root {
+var ADMIN_CSS_EXTRA = `
+.tempest-log-badge--succeeded { background: #dcfce7; color: #166534; }
+.tempest-log-badge--failed { background: #fee2e2; color: #991b1b; }
+.tempest-log-badge--running { background: #dbeafe; color: #1e40af; }
+.tempest-log-badge--queued { background: #f1f5f9; color: #475569; }
+.tempest-log-badge--cancelled { background: #fef3c7; color: #92400e; }
+`;
+var ADMIN_CSS_BASE = `:root {
   --tempest-bg: #0f172a;
   --tempest-bg-soft: #1e293b;
   --tempest-bg-row: #f8fafc;
@@ -12033,6 +12431,7 @@ a.tempest-admin-list__new:hover {
   }
 }
 `;
+var ADMIN_CSS = `${ADMIN_CSS_BASE}${ADMIN_CSS_EXTRA}`;
 
 // src/admin/theme.ts
 var FORBIDDEN_CHARS = ["<", ">", "{", "}", '"'];
@@ -12112,7 +12511,7 @@ function escapeHtml(value) {
   return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function renderLayout(context, title, body) {
-  const { site, theme, prefix, session, currentPath, navModels, messages } = context;
+  const { site, theme, prefix, session, currentPath, navModels, navSystem, messages } = context;
   const authed = session !== null;
   const indexUrl = `${prefix}/`;
   const navLink = (url, label, active) => `<a href="${escapeHtml(url)}" class="tempest-admin-sidebar__link${active ? " tempest-admin-sidebar__link--active" : ""}">${escapeHtml(label)}</a>`;
@@ -12122,6 +12521,9 @@ function renderLayout(context, title, body) {
         ${navLink(indexUrl, "Dashboard", currentPath === indexUrl)}
         ${navModels.length > 0 ? `<span class="tempest-admin-sidebar__heading">Models</span>${navModels.map(
     (entry) => navLink(entry.url, entry.label, currentPath.startsWith(entry.url))
+  ).join("")}` : ""}
+        ${navSystem.length > 0 ? `<span class="tempest-admin-sidebar__heading">System</span>${navSystem.map(
+    (entry) => navLink(entry.url, entry.label, currentPath.startsWith(entry.url))
   ).join("")}` : ""}
       </nav>
     </aside>` : "";
@@ -12290,11 +12692,11 @@ function renderFilter(filter) {
 function renderListPage(context, view) {
   const bulk = view.bulkActions.length > 0 && context.session !== null;
   const checkColumn = bulk ? 1 : 0;
-  const headers = view.columns.map((column6) => {
-    const state = view.sort[column6];
-    if (state === void 0) return `<th>${escapeHtml(column6)}</th>`;
+  const headers = view.columns.map((column7) => {
+    const state = view.sort[column7];
+    if (state === void 0) return `<th>${escapeHtml(column7)}</th>`;
     const arrow = state.active ? state.ascending ? "\u25B2" : "\u25BC" : "\u2195";
-    return `<th><a class="tempest-sort${state.active ? " tempest-sort--active" : ""}" href="${escapeHtml(state.url)}"><span>${escapeHtml(column6)}</span><span class="tempest-sort__arrow" aria-hidden="true">${arrow}</span></a></th>`;
+    return `<th><a class="tempest-sort${state.active ? " tempest-sort--active" : ""}" href="${escapeHtml(state.url)}"><span>${escapeHtml(column7)}</span><span class="tempest-sort__arrow" aria-hidden="true">${arrow}</span></a></th>`;
   }).join("");
   const rows = view.rows.length > 0 ? view.rows.map((row) => {
     const check = bulk ? `<td class="tempest-admin-list__check"><input type="checkbox" name="ids" value="${escapeHtml(row.identity)}" data-row-check aria-label="Select row"></td>` : "";
@@ -12435,7 +12837,7 @@ function renderInline(inline, csrfToken, error) {
     if (inline.rows.length === 0) {
       return `<section class="tempest-admin-inline">${heading}<p><em>No related records.</em></p></section>`;
     }
-    const head2 = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}<th></th></tr>`;
+    const head2 = `<tr>${inline.columns.map((column7) => `<th>${escapeHtml(column7)}</th>`).join("")}<th></th></tr>`;
     const body = inline.rows.map(
       (row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}<td>${row.url === null ? "" : `<a href="${escapeHtml(row.url)}">View</a>`}</td></tr>`
     ).join("");
@@ -12450,7 +12852,7 @@ function renderInline(inline, csrfToken, error) {
       ${more}
     </section>`;
   }
-  const head = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}${inline.canDelete ? "<th>Delete</th>" : ""}</tr>`;
+  const head = `<tr>${inline.columns.map((column7) => `<th>${escapeHtml(column7)}</th>`).join("")}${inline.canDelete ? "<th>Delete</th>" : ""}</tr>`;
   const renderRow = (row, isNew) => `<tr${isNew ? ' class="tempest-admin-inline__new"' : ""}>${row.fields.map((field) => `<td>${renderInlineCell(field)}</td>`).join("")}${inline.canDelete ? `<td class="tempest-admin-inline__del">${isNew ? "" : `<input type="checkbox" name="row.${escapeHtml(row.key)}.__delete" value="true">`}</td>` : ""}</tr>`;
   const rows = inline.rows.map((row) => renderRow(row, false)).join("");
   const blank = inline.newRow === null ? "" : renderRow(inline.newRow, true);
@@ -12472,11 +12874,11 @@ function renderInline(inline, csrfToken, error) {
     ${more}
   </section>`;
 }
-function renderAuditPanel(audit) {
-  const rows = audit.fields.map(
+function renderAuditPanel(audit2) {
+  const rows = audit2.fields.map(
     (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
   ).join("");
-  const history = audit.history.length > 0 ? `<ol class="tempest-admin-history">${audit.history.map((entry) => {
+  const history = audit2.history.length > 0 ? `<ol class="tempest-admin-history">${audit2.history.map((entry) => {
     const changes = entry.changes.length > 0 ? `<table class="tempest-admin-history__changes"><thead><tr><th>Field</th><th>Before</th><th>After</th></tr></thead><tbody>${entry.changes.map(
       (change) => `<tr><td>${escapeHtml(change.field)}</td><td>${escapeHtml(change.before)}</td><td>${escapeHtml(change.after)}</td></tr>`
     ).join("")}</tbody></table>` : "<p><em>No field changes recorded.</em></p>";
@@ -12574,6 +12976,160 @@ function renderFormPage(context, view) {
 </section>`;
   return renderLayout(context, `${heading} \xB7 ${context.site.title}`, body);
 }
+function renderLogsPage(context, view) {
+  const options = view.sources.map(
+    (source) => `<option value="${escapeHtml(source.value)}"${source.selected ? " selected" : ""}>${escapeHtml(source.label)}</option>`
+  ).join("");
+  const rows = view.rows.length > 0 ? view.rows.map((row) => {
+    const context_ = row.context.map(
+      (entry) => `<span class="tempest-admin-logs__meta"><b>${escapeHtml(entry.key)}</b>: ${escapeHtml(entry.value)}</span>`
+    ).join(" ");
+    const message = row.stack === null ? `${escapeHtml(row.message)}${context_ === "" ? "" : `<br>${context_}`}` : `<details><summary>${escapeHtml(row.message)}</summary>${context_ === "" ? "" : `<p>${context_}</p>`}<pre>${escapeHtml(row.stack)}</pre></details>`;
+    return `<tr>
+        <td data-label="Level"><span class="tempest-log-badge tempest-log-badge--${escapeHtml(row.level)}">${escapeHtml(row.level)}</span></td>
+        <td data-label="When">${escapeHtml(row.timestamp)}</td>
+        <td data-label="Logger">${escapeHtml(row.logger)}</td>
+        <td data-label="Message">${message}</td>
+      </tr>`;
+  }).join("") : `<tr><td colspan="4">No log records yet. Point <code>configureFileLogging</code> at the same directory to populate this page.</td></tr>`;
+  const body = `<section class="tempest-admin-logs">
+  <header class="tempest-admin-list__header">
+    <h1>Logs</h1>
+    <p>${escapeHtml(view.total)} record${view.total === 1 ? "" : "s"}.</p>
+  </header>
+  <div class="tempest-admin-list__toolbar">
+    <form method="get" class="tempest-admin-list__filters">
+      <label><span>Source</span><select name="source">${options}</select></label>
+      <input type="search" name="q" value="${escapeHtml(view.query)}" placeholder="Search\u2026" aria-label="Search">
+      <button type="submit">Apply</button>
+    </form>
+    <div class="tempest-admin-list__actions">
+      <a href="${escapeHtml(view.exportMarkdownUrl)}">Export Markdown</a>
+      <a href="${escapeHtml(view.exportJsonUrl)}">Export JSON</a>
+    </div>
+  </div>
+  <div class="tempest-admin-table-wrap">
+    <table class="tempest-admin-list__table">
+      <thead><tr><th>Level</th><th>When</th><th>Logger</th><th>Message</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>
+  ${view.pages > 1 ? `<nav class="tempest-admin-list__pagination" aria-label="Pagination">
+    ${view.prevUrl !== null ? `<a href="${escapeHtml(view.prevUrl)}">\u2190 Prev</a>` : ""}
+    <span>Page ${escapeHtml(view.page)} of ${escapeHtml(view.pages)}</span>
+    ${view.nextUrl !== null ? `<a href="${escapeHtml(view.nextUrl)}">Next \u2192</a>` : ""}
+  </nav>` : ""}
+  <p class="tempest-admin-form__hint">Exports carry at most ${escapeHtml(view.exportMax)} records, newest first, honouring the filters above.</p>
+</section>`;
+  return renderLayout(context, `Logs \xB7 ${context.site.title}`, body);
+}
+function renderTasksPage(context, view) {
+  const declared = view.inventory === null ? "" : `<section class="tempest-admin-tasks__declared">
+    <h2>Declared</h2>
+    ${view.inventory.length === 0 ? "<p><em>No tasks registered in this process.</em></p>" : `<div class="tempest-admin-table-wrap"><table class="tempest-admin-list__table">
+      <thead><tr><th>Task</th><th>Schedule</th><th>Description</th></tr></thead>
+      <tbody>${view.inventory.map(
+    (entry) => `<tr><td>${escapeHtml(entry.name)}</td><td>${escapeHtml(entry.schedule)}</td><td>${escapeHtml(entry.description)}</td></tr>`
+  ).join("")}</tbody>
+    </table></div>`}
+  </section>`;
+  const runs = view.runs === null ? "" : `<section class="tempest-admin-tasks__runs">
+    <h2>Runs</h2>
+    <div class="tempest-admin-list__toolbar">
+      <form method="get" class="tempest-admin-list__filters">
+        <label><span>Status</span><select name="status">${view.runs.statuses.map(
+    (status) => `<option value="${escapeHtml(status.value)}"${status.selected ? " selected" : ""}>${escapeHtml(status.label)}</option>`
+  ).join("")}</select></label>
+        <input type="search" name="task" value="${escapeHtml(view.runs.nameQuery)}" placeholder="Task name\u2026" aria-label="Task name">
+        <button type="submit">Apply</button>
+      </form>
+    </div>
+    <div class="tempest-admin-table-wrap"><table class="tempest-admin-list__table">
+      <thead><tr><th>Task</th><th>Status</th><th>Started</th><th>Finished</th><th>Attempts</th><th></th></tr></thead>
+      <tbody>${view.runs.rows.length === 0 ? '<tr><td colspan="6">No runs recorded yet.</td></tr>' : view.runs.rows.map(
+    (row) => `<tr>
+          <td>${escapeHtml(row.name)}</td>
+          <td><span class="tempest-log-badge tempest-log-badge--${escapeHtml(row.status)}">${escapeHtml(row.status)}</span></td>
+          <td>${escapeHtml(row.startedAt)}</td>
+          <td>${escapeHtml(row.finishedAt)}</td>
+          <td>${escapeHtml(row.attempts)}</td>
+          <td><a href="${escapeHtml(row.url)}">View</a></td>
+        </tr>`
+  ).join("")}</tbody>
+    </table></div>
+    ${view.runs.pages > 1 ? `<nav class="tempest-admin-list__pagination" aria-label="Pagination">
+      ${view.runs.prevUrl !== null ? `<a href="${escapeHtml(view.runs.prevUrl)}">\u2190 Prev</a>` : ""}
+      <span>Page ${escapeHtml(view.runs.page)} of ${escapeHtml(view.runs.pages)}</span>
+      ${view.runs.nextUrl !== null ? `<a href="${escapeHtml(view.runs.nextUrl)}">Next \u2192</a>` : ""}
+    </nav>` : ""}
+  </section>`;
+  const body = `<section class="tempest-admin-tasks">
+  <header class="tempest-admin-list__header">
+    <h1>Tasks</h1>
+    <p>What this process declares, and what its workers recorded.</p>
+  </header>
+  ${declared}
+  ${runs}
+  <p class="tempest-admin-form__hint">Live queue depth is not shown: a broker does not expose it, and a number that looked like one would be worse than none.</p>
+</section>`;
+  return renderLayout(context, `Tasks \xB7 ${context.site.title}`, body);
+}
+function renderTaskDetailPage(context, view) {
+  if (context.session === null) throw new Error("The task detail requires a session");
+  const block = (label, content) => content === null ? "" : `<h2>${escapeHtml(label)}</h2><pre class="tempest-admin-detail__json">${escapeHtml(content)}</pre>`;
+  const body = `<section class="tempest-admin-detail">
+  <header class="tempest-admin-detail__header">
+    <h1>${escapeHtml(view.name)} \xB7 <span class="tempest-log-badge tempest-log-badge--${escapeHtml(view.status)}">${escapeHtml(view.status)}</span></h1>
+    <div class="tempest-admin-detail__actions">
+      <a href="${escapeHtml(view.backUrl)}">\u2190 Back to tasks</a>
+      ${view.cancelUrl !== null ? `<form method="post" action="${escapeHtml(view.cancelUrl)}" class="tempest-admin-detail__delete" onsubmit="return confirm('Ask this run to stop?');">
+        <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+        <button type="submit" class="tempest-admin-btn--danger">Cancel</button>
+      </form>` : ""}
+    </div>
+  </header>
+  <dl class="tempest-admin-detail__fields">${view.fields.map(
+    (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
+  ).join("")}</dl>
+  ${view.error === null ? "" : `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>`}
+  ${block("Payload", view.payload)}
+  ${block("Result", view.result)}
+</section>`;
+  return renderLayout(context, `${view.name} \xB7 ${context.site.title}`, body);
+}
+function renderSqlPage(context, view) {
+  if (context.session === null) throw new Error("The SQL console requires a session");
+  const result = view.rowCount === null ? "" : `<p class="tempest-admin-form__hint">${escapeHtml(view.rowCount)} row${view.rowCount === 1 ? "" : "s"}${view.durationMs === null ? "" : ` in ${escapeHtml(view.durationMs)} ms`}${view.truncated ? " (truncated by the row cap)" : ""}.</p>
+      <div class="tempest-admin-table-wrap">
+        <table class="tempest-admin-list__table">
+          <thead><tr>${view.columns.map((column7) => `<th>${escapeHtml(column7)}</th>`).join("")}</tr></thead>
+          <tbody>${view.rows.map(
+    (row) => `<tr>${row.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}</tr>`
+  ).join("")}</tbody>
+        </table>
+      </div>`;
+  const body = `<section class="tempest-admin-sql">
+  <header class="tempest-admin-list__header">
+    <h1>SQL console</h1>
+    <p>Capabilities: <code>${escapeHtml(view.capabilities.join(", "))}</code></p>
+  </header>
+  ${view.error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(view.error)}</p>` : ""}
+  <form method="post" action="${escapeHtml(`${context.prefix}/sql`)}" class="tempest-admin-form__form">
+    <input type="hidden" name="csrf_token" value="${escapeHtml(context.session.csrfToken)}">
+    <div class="tempest-admin-form__field">
+      <label>
+        <span>Statement</span>
+        <textarea name="sql" rows="6" spellcheck="false" required>${escapeHtml(view.sql)}</textarea>
+      </label>
+    </div>
+    <div class="tempest-admin-form__actions">
+      <button type="submit">Run</button>
+    </div>
+  </form>
+  ${result}
+</section>`;
+  return renderLayout(context, `SQL console \xB7 ${context.site.title}`, body);
+}
 function renderImportPage(context, view) {
   if (context.session === null) throw new Error("The import page requires a session");
   const summary = view.created === null ? "" : `<p class="tempest-admin-import__summary">Created ${escapeHtml(view.created)} record${view.created === 1 ? "" : "s"}.</p>`;
@@ -12659,7 +13215,75 @@ var AUTOCOMPLETE_SCRIPT = `<script>
   });
 })();
 </script>`;
+function filesFor(dir, source) {
+  if (source === "500") return [path.join(dir, HTTP_500_LOG_FILE)];
+  if (source === "all") return Object.values(LEVEL_LOG_FILES).map((f) => path.join(dir, f));
+  return [path.join(dir, LEVEL_LOG_FILES[source])];
+}
+async function readLogEntries(dir, source) {
+  return await readEntries(filesFor(dir, source));
+}
+async function readEntries(files) {
+  const entries = [];
+  for (const file of files) {
+    let content;
+    try {
+      content = await promises.readFile(file, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of content.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        entries.push(JSON.parse(line));
+      } catch {
+      }
+    }
+  }
+  return entries;
+}
+function makeLogsRouter(options) {
+  const router = express3.Router();
+  const path = options.path ?? "/logs";
+  const guards = options.guards ?? [];
+  const handler = (req, res, next) => {
+    const source = req.query.source ?? "all";
+    const validSources = ["all", "debug", "info", "warning", "error", "500"];
+    if (!validSources.includes(source)) {
+      res.status(422).json({ detail: "Invalid log source", code: "VALIDATION_ERROR", details: {} });
+      return;
+    }
+    const page2 = Math.max(1, Number(req.query.page) || 1);
+    const pageSize = Math.min(500, Math.max(1, Number(req.query.pageSize) || 50));
+    readEntries(filesFor(options.dir, source)).then((entries) => {
+      entries.reverse();
+      const total = entries.length;
+      const start = (page2 - 1) * pageSize;
+      res.json({
+        items: entries.slice(start, start + pageSize),
+        total,
+        page: page2,
+        pageSize,
+        pages: Math.ceil(total / pageSize)
+      });
+    }).catch(next);
+  };
+  router.get(path, ...guards, handler);
+  return router;
+}
 var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var JOB_STATUSES = [
+  "queued",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled"
+];
+var TERMINAL_JOB_STATUSES = ["succeeded", "failed", "cancelled"];
+var TASK_PAGE_SIZE = 25;
+var LOG_SOURCES = ["all", "debug", "info", "warning", "error", "500"];
+var LOG_PAGE_SIZE = 50;
+var LOG_EXPORT_MAX = 500;
 var INLINE_ROW_LIMIT = 50;
 var AUTOCOMPLETE_LIMIT = 20;
 var AUDIT_HISTORY_LIMIT = 50;
@@ -12691,6 +13315,16 @@ function makeAdminRouter(site, options) {
   const theme = resolveAdminTheme(site.theme);
   const showMetrics = options.showMetrics ?? true;
   const exportMaxRows = options.exportMaxRows ?? 5e3;
+  const systemNav = [];
+  if (options.logDir !== void 0) {
+    systemNav.push({ label: "Logs", url: `${prefix}/logs` });
+  }
+  if (options.sqlConsole !== void 0) {
+    systemNav.push({ label: "SQL console", url: `${prefix}/sql` });
+  }
+  if (options.tasks !== void 0) {
+    systemNav.push({ label: "Tasks", url: `${prefix}/tasks` });
+  }
   const maxUploadBytes = options.maxUploadBytes ?? 10 * 1024 * 1024;
   const sessions = new AdminSessionStore({
     secret: options.secretKey,
@@ -12712,6 +13346,7 @@ function makeAdminRouter(site, options) {
       label: admin.verboseNamePlural(),
       url: `${prefix}/m/${admin.slug()}`
     })),
+    navSystem: systemNav,
     messages: flashFor(req)
   });
   const allows = async (principal, admin, action) => {
@@ -12922,6 +13557,296 @@ function makeAdminRouter(site, options) {
       );
     })
   );
+  if (options.logDir !== void 0) {
+    const logDir = options.logDir;
+    router.get(
+      `${prefix}/logs`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        const { entries, source, search } = await readLogs(req, logDir);
+        const page2 = Math.max(1, Number.parseInt(queryString(req.query.page), 10) || 1);
+        const start = (page2 - 1) * LOG_PAGE_SIZE;
+        const pages = Math.max(1, Math.ceil(entries.length / LOG_PAGE_SIZE));
+        const exportUrl = (format) => `${prefix}/logs/export?${buildQuery({ source, q: search, format })}`;
+        const pageUrl = (target) => `?${buildQuery({ source, q: search, page: target })}`;
+        html(
+          res,
+          renderLogsPage(context(req, state.session, state.visible), {
+            sources: LOG_SOURCES.map((value) => ({
+              value,
+              label: value === "500" ? "HTTP 500" : humanizeField(value),
+              selected: value === source
+            })),
+            query: search,
+            rows: entries.slice(start, start + LOG_PAGE_SIZE).map((entry) => ({
+              level: entry.level,
+              timestamp: entry.timestamp,
+              logger: entry.logger,
+              message: entry.message,
+              stack: entry.stack,
+              context: Object.entries(entry.context).map(([key, value]) => ({
+                key,
+                value: typeof value === "string" ? value : JSON.stringify(value)
+              }))
+            })),
+            total: entries.length,
+            page: page2,
+            pages,
+            prevUrl: page2 > 1 ? pageUrl(page2 - 1) : null,
+            nextUrl: page2 < pages ? pageUrl(page2 + 1) : null,
+            exportMarkdownUrl: exportUrl("md"),
+            exportJsonUrl: exportUrl("json"),
+            exportMax: LOG_EXPORT_MAX
+          })
+        );
+      })
+    );
+    router.get(
+      `${prefix}/logs/export`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        const format = queryString(req.query.format) === "json" ? "json" : "md";
+        const { entries, source, search } = await readLogs(req, logDir);
+        const window = entries.slice(0, LOG_EXPORT_MAX);
+        const payload = format === "json" ? renderLogEntriesJson(window) : renderLogEntriesMarkdown(window, {
+          source,
+          query: search,
+          total: entries.length
+        });
+        res.status(200).type(format === "json" ? "application/json" : "text/markdown; charset=utf-8").set("content-disposition", `attachment; filename="logs.${format}"`).send(payload);
+      })
+    );
+  }
+  if (options.sqlConsole !== void 0) {
+    const console_ = options.sqlConsole;
+    const policy = console_.policy ?? {};
+    const dialect = console_.dialect ?? "postgresql";
+    const capabilities = policy.capabilities ?? [SqlCapability.READ];
+    const maxRows = policy.maxRows ?? 200;
+    router.get(
+      `${prefix}/sql`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        html(
+          res,
+          renderSqlPage(context(req, state.session, state.visible), {
+            sql: "",
+            capabilities: [...capabilities],
+            error: null,
+            columns: [],
+            rows: [],
+            rowCount: null,
+            truncated: false,
+            durationMs: null
+          })
+        );
+      })
+    );
+    router.post(
+      `${prefix}/sql`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        if (!checkCsrf(req, res, state)) return;
+        const body = req.body;
+        const sql5 = typeof body.sql === "string" ? body.sql : "";
+        const principal = backend.displayName(state.principal);
+        const render = (view) => {
+          html(
+            res,
+            renderSqlPage(context(req, state.session, state.visible), {
+              sql: sql5,
+              capabilities: [...capabilities],
+              ...view
+            }),
+            view.error === null ? 200 : 400
+          );
+        };
+        const parser = await loadSqlParser();
+        const analysis = analyzeSql(sql5, dialect, parser);
+        const verdict = checkSqlPolicy(analysis, policy);
+        if (!verdict.allowed) {
+          await audit(console_.onAudit, {
+            sql: sql5,
+            principal,
+            allowed: false,
+            reason: verdict.reason,
+            analysis,
+            durationMs: null,
+            rowCount: null
+          });
+          render({
+            error: verdict.reason,
+            columns: [],
+            rows: [],
+            rowCount: null,
+            truncated: false,
+            durationMs: null
+          });
+          return;
+        }
+        const started = Date.now();
+        let rows;
+        try {
+          rows = console_.run === void 0 ? await state.dbSession.raw(sql5).all() : await console_.run(sql5, state.dbSession);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          await audit(console_.onAudit, {
+            sql: sql5,
+            principal,
+            allowed: true,
+            reason: message,
+            analysis,
+            durationMs: Date.now() - started,
+            rowCount: null
+          });
+          render({
+            error: message,
+            columns: [],
+            rows: [],
+            rowCount: null,
+            truncated: false,
+            durationMs: null
+          });
+          return;
+        }
+        const durationMs = Date.now() - started;
+        await audit(console_.onAudit, {
+          sql: sql5,
+          principal,
+          allowed: true,
+          reason: null,
+          analysis,
+          durationMs,
+          rowCount: rows.length
+        });
+        const window = rows.slice(0, maxRows);
+        const columns = window.length === 0 ? [] : Object.keys(window[0] ?? {});
+        render({
+          error: null,
+          columns,
+          rows: window.map(
+            (row) => columns.map((column7) => formatCellValue(row[column7]))
+          ),
+          rowCount: rows.length,
+          truncated: rows.length > window.length,
+          durationMs
+        });
+      })
+    );
+  }
+  if (options.tasks !== void 0) {
+    const tasks = options.tasks;
+    router.get(
+      `${prefix}/tasks`,
+      guarded(async (req, res) => {
+        const state = await authenticate(req, res);
+        if (state === null) return;
+        const inventory = tasks.manager === void 0 ? null : tasks.manager.inventory().map((entry) => ({
+          name: entry.name,
+          description: entry.description ?? "",
+          schedule: entry.schedule ?? "\u2014"
+        }));
+        let runs = null;
+        if (tasks.jobs !== void 0) {
+          const store = tasks.jobs(state.dbSession);
+          const page2 = Math.max(1, Number.parseInt(queryString(req.query.page), 10) || 1);
+          const status = queryString(req.query.status);
+          const name = queryString(req.query.task);
+          const result = await store.list({
+            page: page2,
+            pageSize: TASK_PAGE_SIZE,
+            ...name === "" ? {} : { name },
+            ...JOB_STATUSES.includes(status) ? { status } : {}
+          });
+          const pageUrl = (target) => `?${buildQuery({ status, task: name, page: target })}`;
+          runs = {
+            rows: result.items.map((row) => ({
+              id: String(row.id),
+              name: String(row.name ?? ""),
+              status: String(row.status ?? ""),
+              startedAt: formatCellValue(row.startedAt),
+              finishedAt: formatCellValue(row.finishedAt),
+              attempts: formatCellValue(row.attempts),
+              url: `${prefix}/tasks/${String(row.id)}`
+            })),
+            total: result.total,
+            page: result.page,
+            pages: result.pages,
+            prevUrl: result.page > 1 ? pageUrl(result.page - 1) : null,
+            nextUrl: result.page < result.pages ? pageUrl(result.page + 1) : null,
+            statuses: ["", ...JOB_STATUSES].map((value) => ({
+              value,
+              label: value === "" ? "\u2014 any \u2014" : humanizeField(value),
+              selected: value === status
+            })),
+            nameQuery: name
+          };
+        }
+        html(
+          res,
+          renderTasksPage(context(req, state.session, state.visible), {
+            inventory,
+            runs
+          })
+        );
+      })
+    );
+    if (tasks.jobs !== void 0) {
+      const jobs = tasks.jobs;
+      router.get(
+        `${prefix}/tasks/:id`,
+        guarded(async (req, res) => {
+          const state = await authenticate(req, res);
+          if (state === null) return;
+          const row = await jobs(state.dbSession).get(String(req.params.id));
+          if (row === null) {
+            html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+            return;
+          }
+          const status = String(row.status ?? "");
+          html(
+            res,
+            renderTaskDetailPage(context(req, state.session, state.visible), {
+              id: String(row.id),
+              name: String(row.name ?? ""),
+              status,
+              fields: [
+                { label: "Created At", value: formatCellValue(row.createdAt) },
+                { label: "Started At", value: formatCellValue(row.startedAt) },
+                { label: "Finished At", value: formatCellValue(row.finishedAt) },
+                { label: "Attempts", value: formatCellValue(row.attempts) }
+              ],
+              payload: jsonBlock(row.payload),
+              result: jsonBlock(row.result),
+              error: typeof row.error === "string" && row.error !== "" ? row.error : null,
+              backUrl: `${prefix}/tasks`,
+              cancelUrl: TERMINAL_JOB_STATUSES.includes(status) ? null : `${prefix}/tasks/${String(row.id)}/cancel`
+            })
+          );
+        })
+      );
+      router.post(
+        `${prefix}/tasks/:id/cancel`,
+        guarded(async (req, res) => {
+          const state = await authenticate(req, res);
+          if (state === null) return;
+          if (!checkCsrf(req, res, state)) return;
+          const id = String(req.params.id);
+          const cancelled = await jobs(state.dbSession).cancel(id);
+          res.redirect(
+            `${prefix}/tasks/${id}?${buildQuery({
+              flash: cancelled ? "The run was asked to stop." : "That run had already finished.",
+              level: cancelled ? "success" : "warning"
+            })}`
+          );
+        })
+      );
+    }
+  }
   router.get(
     `${prefix}/m/:slug`,
     guarded(async (req, res) => {
@@ -13232,8 +14157,8 @@ function makeAdminRouter(site, options) {
         res.status(404).json({ options: [] });
         return;
       }
-      const column6 = adminColumns(admin.model)[field];
-      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const column7 = adminColumns(admin.model)[field];
+      const table = column7 === void 0 ? null : foreignKeyTable(column7);
       const referenced = table === null ? null : site.get(table);
       if (referenced === null) {
         res.json({ options: [] });
@@ -13542,7 +14467,7 @@ function makeAdminRouter(site, options) {
           formAction: "",
           rows: visible.map((child) => ({
             key: String(child[childAdmin?.identityField ?? "id"]),
-            cells: columns.map((column6) => formatCellValue(child[column6])),
+            cells: columns.map((column7) => formatCellValue(child[column7])),
             fields: [],
             url: childAdmin === null ? null : `${prefix}/m/${inline.slug}/${String(child[childAdmin.identityField])}`
           })),
@@ -13639,6 +14564,15 @@ function makeAdminRouter(site, options) {
     const row = await admin.repository(dbSession).first({ [admin.identityField]: identity });
     return row ?? null;
   }
+  async function readLogs(req, dir) {
+    const requested = queryString(req.query.source);
+    const source = LOG_SOURCES.includes(requested) ? requested : "all";
+    const search = queryString(req.query.q);
+    const raw = await readLogEntries(dir, source);
+    const entries = filterLogEntries(raw.map(toLogEntry), search);
+    entries.reverse();
+    return { entries, source, search };
+  }
   function renderImport(req, state, admin, error, created, rowErrors) {
     return renderImportPage(context(req, state.session, state.visible), {
       title: admin.verboseNamePlural(),
@@ -13665,8 +14599,8 @@ function makeAdminRouter(site, options) {
     for (const field of admin.uploadFields) {
       const file = files.find((candidate) => candidate.field === field);
       if (file === void 0) {
-        const column6 = columns[field];
-        if (creating && column6 !== void 0 && !isColumnOptional(column6)) {
+        const column7 = columns[field];
+        if (creating && column7 !== void 0 && !isColumnOptional(column7)) {
           errors[field] = "This field is required.";
         }
         continue;
@@ -13698,14 +14632,14 @@ function makeAdminRouter(site, options) {
     });
     const displayed = admin.listDisplayNames();
     const sort = {};
-    for (const column6 of displayed) {
-      if (!(column6 in columns)) continue;
-      const active = (query.sortColumn ?? admin.orderKey) === column6;
+    for (const column7 of displayed) {
+      if (!(column7 in columns)) continue;
+      const active = (query.sortColumn ?? admin.orderKey) === column7;
       const nextAscending = active ? !query.ascending : true;
-      sort[column6] = {
+      sort[column7] = {
         url: `?${buildQuery({
           ...query.baseQuery,
-          sort: column6,
+          sort: column7,
           dir: nextAscending ? "asc" : "desc"
         })}`,
         active,
@@ -13726,7 +14660,7 @@ function makeAdminRouter(site, options) {
         const identity = String(row[admin.identityField]);
         return {
           identity,
-          cells: displayed.map((column6) => formatCellValue(row[column6])),
+          cells: displayed.map((column7) => formatCellValue(row[column7])),
           url: `${prefix}/m/${admin.slug()}/${identity}`
         };
       }),
@@ -13772,9 +14706,9 @@ function makeAdminRouter(site, options) {
     }
     const filterViews = [];
     for (const field of admin.listFilter) {
-      const column6 = columns[field];
-      if (column6 === void 0) continue;
-      const spec = filterForColumn(column6);
+      const column7 = columns[field];
+      if (column7 === void 0) continue;
+      const spec = filterForColumn(column7);
       if (spec.kind === "daterange") {
         const from = queryString(req.query[`filter_${field}_from`]);
         const to = queryString(req.query[`filter_${field}_to`]);
@@ -13793,12 +14727,12 @@ function makeAdminRouter(site, options) {
         });
         continue;
       }
-      const related = await relatedOptions(column6, dbSession);
+      const related = await relatedOptions(column7, dbSession);
       const options2 = related ?? spec.options;
       const value = queryString(req.query[`filter_${field}`]);
       if (value !== "") {
         conditions.push({
-          [field]: column6.type.kind === "boolean" ? value === "true" : value
+          [field]: column7.type.kind === "boolean" ? value === "true" : value
         });
       }
       filterViews.push({
@@ -13816,8 +14750,8 @@ function makeAdminRouter(site, options) {
       });
     }
     const searchable = admin.searchFields.filter((field) => {
-      const column6 = columns[field];
-      return column6 !== void 0 && isSearchableColumn(column6);
+      const column7 = columns[field];
+      return column7 !== void 0 && isSearchableColumn(column7);
     });
     if (search !== "" && searchable.length > 0) {
       conditions.push(
@@ -13850,8 +14784,8 @@ function makeAdminRouter(site, options) {
       lens: lens?.slug ?? ""
     };
   }
-  async function relatedOptions(column6, dbSession) {
-    const table = foreignKeyTable(column6);
+  async function relatedOptions(column7, dbSession) {
+    const table = foreignKeyTable(column7);
     if (table === null) return null;
     const referenced = site.get(table);
     if (referenced === null) return null;
@@ -13866,9 +14800,9 @@ function makeAdminRouter(site, options) {
     const options2 = {};
     for (const field of Object.keys(foreignKeyFields(admin))) {
       if (admin.autocompleteFields.includes(field)) continue;
-      const column6 = columns[field];
-      if (column6 === void 0) continue;
-      const related = await relatedOptions(column6, dbSession);
+      const column7 = columns[field];
+      if (column7 === void 0) continue;
+      const related = await relatedOptions(column7, dbSession);
       if (related !== null) options2[field] = related;
     }
     return options2;
@@ -13887,8 +14821,8 @@ function makeAdminRouter(site, options) {
     for (const field of admin.autocompleteFields) {
       const value = row[field];
       if (value === null || value === void 0 || value === "") continue;
-      const column6 = columns[field];
-      const table = column6 === void 0 ? null : foreignKeyTable(column6);
+      const column7 = columns[field];
+      const table = column7 === void 0 ? null : foreignKeyTable(column7);
       const referenced = table === null ? null : site.get(table);
       if (referenced === null) continue;
       const related = await referenced.repository(dbSession).first({ [referenced.identityField]: value });
@@ -13927,6 +14861,21 @@ function inlineFieldNames(childAdmin, inline) {
 function inlineFields(childAdmin, names, key, values, errors) {
   return buildFormFields(childAdmin, { values, errors }).filter((field) => names.includes(field.name)).map((field) => ({ ...field, name: `row.${key}.${field.name}` }));
 }
+function jsonBlock(value) {
+  if (value === null || value === void 0) return null;
+  if (typeof value === "object" && Object.keys(value).length === 0) return null;
+  return JSON.stringify(value, null, 2);
+}
+async function audit(hook, entry) {
+  if (hook === void 0) return;
+  try {
+    await hook(entry);
+  } catch (error) {
+    logger2.error("Admin SQL audit hook failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
 function flagAllows(admin, action) {
   if (action === AdminPermission.CREATE) return admin.canCreate;
   if (action === AdminPermission.EDIT) return admin.canEdit;
@@ -14080,7 +15029,7 @@ function csvField(value) {
 function toCsv(columns, rows) {
   const lines = [columns.map(csvField).join(",")];
   for (const row of rows) {
-    lines.push(columns.map((column6) => csvField(exportValue(row[column6]))).join(","));
+    lines.push(columns.map((column7) => csvField(exportValue(row[column7]))).join(","));
   }
   return `${lines.join("\r\n")}\r
 `;
@@ -14088,7 +15037,7 @@ function toCsv(columns, rows) {
 function toJson(columns, rows) {
   return JSON.stringify(
     rows.map(
-      (row) => Object.fromEntries(columns.map((column6) => [column6, exportValue(row[column6])]))
+      (row) => Object.fromEntries(columns.map((column7) => [column7, exportValue(row[column7])]))
     ),
     null,
     2
@@ -16013,59 +16962,6 @@ function makeToolSpecRouter(spec, options = {}) {
   });
   return router;
 }
-function filesFor(dir, source) {
-  if (source === "500") return [path.join(dir, HTTP_500_LOG_FILE)];
-  if (source === "all") return Object.values(LEVEL_LOG_FILES).map((f) => path.join(dir, f));
-  return [path.join(dir, LEVEL_LOG_FILES[source])];
-}
-async function readEntries(files) {
-  const entries = [];
-  for (const file of files) {
-    let content;
-    try {
-      content = await promises.readFile(file, "utf8");
-    } catch {
-      continue;
-    }
-    for (const line of content.split("\n")) {
-      if (!line.trim()) continue;
-      try {
-        entries.push(JSON.parse(line));
-      } catch {
-      }
-    }
-  }
-  return entries;
-}
-function makeLogsRouter(options) {
-  const router = express3.Router();
-  const path = options.path ?? "/logs";
-  const guards = options.guards ?? [];
-  const handler = (req, res, next) => {
-    const source = req.query.source ?? "all";
-    const validSources = ["all", "debug", "info", "warning", "error", "500"];
-    if (!validSources.includes(source)) {
-      res.status(422).json({ detail: "Invalid log source", code: "VALIDATION_ERROR", details: {} });
-      return;
-    }
-    const page2 = Math.max(1, Number(req.query.page) || 1);
-    const pageSize = Math.min(500, Math.max(1, Number(req.query.pageSize) || 50));
-    readEntries(filesFor(options.dir, source)).then((entries) => {
-      entries.reverse();
-      const total = entries.length;
-      const start = (page2 - 1) * pageSize;
-      res.json({
-        items: entries.slice(start, start + pageSize),
-        total,
-        page: page2,
-        pageSize,
-        pages: Math.ceil(total / pageSize)
-      });
-    }).catch(next);
-  };
-  router.get(path, ...guards, handler);
-  return router;
-}
 function createTestDatabase(models) {
   const driver = tempestDbJs.NodeSqliteDriver.open(":memory:");
   for (const model of models) {
@@ -16098,7 +16994,7 @@ async function withTestDatabase(models, fn) {
 }
 
 // src/version.ts
-var VERSION = "0.28.0";
+var VERSION = "0.30.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -16264,6 +17160,7 @@ exports.AttemptThrottle = AttemptThrottle;
 exports.AuditAction = AuditAction;
 exports.BaseAuditLogModel = BaseAuditLogModel;
 exports.BaseController = BaseController;
+exports.BaseJobModel = BaseJobModel;
 exports.BaseModel = BaseModel;
 exports.BaseOAuthClient = BaseOAuthClient;
 exports.BaseOutboxModel = BaseOutboxModel;
@@ -16299,6 +17196,8 @@ exports.IDEMPOTENCY_HEADER = IDEMPOTENCY_HEADER;
 exports.InvalidTokenException = InvalidTokenException;
 exports.JSONLogger = JSONLogger;
 exports.JWTUtils = JWTUtils;
+exports.JobStatus = JobStatus;
+exports.JobStore = JobStore;
 exports.LEVEL_LOG_FILES = LEVEL_LOG_FILES;
 exports.LocalUploadStorage = LocalUploadStorage;
 exports.MemoryBroker = MemoryBroker;
@@ -16335,6 +17234,7 @@ exports.S3UploadStorage = S3UploadStorage;
 exports.SSEBroker = SSEBroker;
 exports.ServerSentEvent = ServerSentEvent;
 exports.SessionService = SessionService;
+exports.SqlCapability = SqlCapability;
 exports.TOTPHelper = TOTPHelper;
 exports.TaskManager = TaskManager;
 exports.TelegramProvider = TelegramProvider;
@@ -16361,6 +17261,7 @@ exports.adminColumns = adminColumns;
 exports.adminInline = adminInline;
 exports.adminLens = adminLens;
 exports.adminThemeCss = adminThemeCss;
+exports.analyzeSql = analyzeSql;
 exports.attachWebSocketHub = attachWebSocketHub;
 exports.authResponseSchema = authResponseSchema;
 exports.authSettingsShape = authSettingsShape;
@@ -16377,6 +17278,7 @@ exports.buildPaginationLinkHeader = buildPaginationLinkHeader;
 exports.cached = cached3;
 exports.centsField = centsField;
 exports.cepField = cepField;
+exports.checkSqlPolicy = checkSqlPolicy;
 exports.citiesByUf = citiesByUf;
 exports.cnpjField = cnpjField;
 exports.coerceFlag = coerceFlag;
@@ -16405,6 +17307,7 @@ exports.envBoolean = looseBoolean;
 exports.envList = envList;
 exports.escapeHtml = escapeHtml;
 exports.filterForColumn = filterForColumn;
+exports.filterLogEntries = filterLogEntries;
 exports.foreignKeyFields = foreignKeyFields;
 exports.foreignKeyLabel = foreignKeyLabel;
 exports.foreignKeyTable = foreignKeyTable;
@@ -16444,6 +17347,7 @@ exports.keyByJwtSubject = keyByJwtSubject;
 exports.latitudeField = latitudeField;
 exports.listStates = listStates;
 exports.loadSettings = loadSettings;
+exports.loadSqlParser = loadSqlParser;
 exports.logEntrySchema = logEntrySchema;
 exports.logSettingsShape = logSettingsShape;
 exports.loginSchema = loginSchema;
@@ -16504,6 +17408,7 @@ exports.rabbitmqSettingsShape = rabbitmqSettingsShape;
 exports.rateLimitMiddleware = rateLimitMiddleware;
 exports.ratingField = ratingField;
 exports.ratioField = ratioField;
+exports.readLogEntries = readLogEntries;
 exports.redisSettingsShape = redisSettingsShape;
 exports.refreshSchema = refreshSchema;
 exports.registerExceptionHandlers = registerExceptionHandlers;
@@ -16514,9 +17419,15 @@ exports.renderFormPage = renderFormPage;
 exports.renderImportPage = renderImportPage;
 exports.renderLayout = renderLayout;
 exports.renderListPage = renderListPage;
+exports.renderLogEntriesJson = renderLogEntriesJson;
+exports.renderLogEntriesMarkdown = renderLogEntriesMarkdown;
 exports.renderLoginPage = renderLoginPage;
+exports.renderLogsPage = renderLogsPage;
 exports.renderMfaPage = renderMfaPage;
 exports.renderPasswordResetFormPage = renderPasswordResetFormPage;
+exports.renderSqlPage = renderSqlPage;
+exports.renderTaskDetailPage = renderTaskDetailPage;
+exports.renderTasksPage = renderTasksPage;
 exports.requestIdMiddleware = requestIdMiddleware;
 exports.requestTracingMiddleware = requestTracingMiddleware;
 exports.requireRoles = requireRoles;
@@ -16540,6 +17451,7 @@ exports.syncFilterSchema = syncFilterSchema;
 exports.syncPaginationSchema = syncPaginationSchema;
 exports.tableNameFor = tableNameFor;
 exports.toDict = toDict;
+exports.toLogEntry = toLogEntry;
 exports.toUtc = toUtc;
 exports.tokenFromUrl = tokenFromUrl;
 exports.tokenPairSchema = tokenPairSchema;