railwatch 0.1.0

data/lib/railwatch/sql_normalizer.rb

@@ -0,0 +1,398 @@
+# frozen_string_literal: true
+
+module Railwatch
+  # Turns a SQL string into its shape so identical queries with different
+  # literals group together. Adapter-aware where syntax differs (SQLite,
+  # Postgres, MySQL/Trilogy).
+  module SqlNormalizer
+    IN_LIST = /\bIN\s*\(\s*(?:\?|\$\d+|\d+)(?:\s*,\s*(?:\?|\$\d+|\d+))*\s*\)/i
+    WHITESPACE = /\s+/
+    LITERAL_PREFIX_BYTES = [ 66, 69, 78, 88, 98, 101, 110, 120 ].freeze # B, E, N, X (both cases)
+    BASE_PREFIX_BYTES = [ 66, 79, 88, 98, 111, 120 ].freeze # B, O, X (both cases)
+
+    # Query payloads are eventually capped at 16,384 characters. Scan enough
+    # bytes to preserve substantially more diagnostic shape than can be sent,
+    # but never let a hostile or accidentally enormous SQL comment monopolize
+    # the notification thread. The scanner below is byte-oriented and linear.
+    MAX_NORMALIZE_BYTES = 262_144
+    MAX_CACHE_KEY_BYTES = 65_536
+    TRUNCATED = " [SQL TRUNCATED]"
+
+    CACHE_LIMIT = 2_048
+    # Three-level cache (adapter => connection_name => SQL => value) avoids a
+    # composite-key allocation on every query. Adapter is part of the lookup:
+    # identical SQL can mean a quoted identifier on Postgres and a string
+    # literal on MySQL, so sharing a cached normalization would leak values.
+    @cache = Hash.new { |adapters, adapter| adapters[adapter] = Hash.new { |connections, name| connections[name] = {} } }
+    @cache_mutex = Mutex.new
+
+    module_function
+
+    # Same SQL text always maps to the same group, so the regex passes and the
+    # digest run once per distinct statement per process.
+    def group(sql, adapter: nil, connection_name: nil)
+      group_and_normalized(sql, adapter: adapter, connection_name: connection_name)[0]
+    end
+
+    # Returns [group_hash, normalized_sql] from a single cache lookup, so
+    # callers that need both (the query record and its possible n+1 sibling)
+    # never normalize or digest the same SQL twice.
+    def group_and_normalized(sql, adapter: nil, connection_name: nil)
+      unless sql.is_a?(String) && sql.bytesize <= MAX_CACHE_KEY_BYTES
+        normalized = normalize(sql, adapter: adapter).freeze
+        return [ Record.group_hash(connection_name, normalized).freeze, normalized ].freeze
+      end
+
+      bucket = @cache[adapter.to_s][connection_name]
+      cached = bucket[sql]
+      return cached if cached
+
+      normalized = normalize(sql, adapter: adapter).freeze
+      value = [ Record.group_hash(connection_name, normalized).freeze, normalized ].freeze
+      @cache_mutex.synchronize do
+        bucket.clear if bucket.size >= CACHE_LIMIT
+        bucket[sql] = value
+      end
+      value
+    end
+
+    def normalize(sql, adapter: nil)
+      input, truncated = safe_utf8_prefix(sql, MAX_NORMALIZE_BYTES)
+      s = mask_literals_and_comments(input, adapter: adapter)
+      s = s.gsub(IN_LIST, "IN (?)")
+      s = s.gsub(WHITESPACE, " ").strip
+      truncated ? "#{s}#{TRUNCATED}" : s
+    end
+
+    # Returns a valid UTF-8 prefix without transcoding an unbounded input. A
+    # byteslice may end inside a multibyte codepoint; scrub/encode replaces that
+    # incomplete tail rather than letting observability raise while unwinding a
+    # database error.
+    def safe_utf8_prefix(value, max_bytes)
+      string = value.to_s
+      truncated = string.bytesize > max_bytes
+      prefix = truncated ? string.byteslice(0, max_bytes) : string
+      utf8 = if prefix.encoding == Encoding::UTF_8
+        prefix.scrub
+      else
+        prefix.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "�")
+      end
+      [ utf8, truncated ]
+    rescue EncodingError
+      [ prefix.to_s.b.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "�"), truncated ]
+    end
+
+    # Safe text for the explicit raw-value mode. It is still bounded and valid
+    # UTF-8 so malformed driver strings cannot break JSON generation.
+    def raw_for_record(sql, max_characters:)
+      text, = safe_utf8_prefix(sql, max_characters * 4)
+      text[0, max_characters]
+    end
+
+    # A byte-oriented lexical pass keeps the cold/dynamic query path linear for
+    # UTF-8 and malformed encodings. It masks values and comments while keeping
+    # useful SQL shape. Unterminated value tokens fail closed.
+    def mask_literals_and_comments(sql, adapter: nil)
+      adapter_name = adapter.to_s.downcase
+      mysql = adapter_name.include?("mysql") || adapter_name.include?("trilogy")
+      # PostgreSQL-compatible adapters do not all expose "postgres" in
+      # adapter_name. In particular activerecord-postgis-adapter reports
+      # "PostGIS", and CockroachDB adapters commonly report "CockroachDB".
+      postgres = adapter_name.include?("postgres") || adapter_name.include?("postgis") ||
+        adapter_name.include?("cockroach")
+      sqlite = adapter_name.include?("sqlite")
+      unknown_adapter = !mysql && !postgres && !sqlite
+      mysql_ambiguous = mysql || unknown_adapter
+      bytes = sql.b
+      length = bytes.bytesize
+      out = +"".b
+      i = 0
+
+      while i < length
+        byte = bytes.getbyte(i)
+        following = bytes.getbyte(i + 1)
+        if (byte == 45 && following == 45) || (mysql_ambiguous && byte == 35) # -- or MySQL #
+          i += (byte == 35 ? 1 : 2)
+          i += 1 while i < length && bytes.getbyte(i) != 10 && bytes.getbyte(i) != 13
+          out << " "
+        elsif byte == 47 && following == 42 # /*
+          depth = 1
+          i += 2
+          while i < length && depth.positive?
+            if bytes.getbyte(i) == 47 && bytes.getbyte(i + 1) == 42
+              depth += 1
+              i += 2
+            elsif bytes.getbyte(i) == 42 && bytes.getbyte(i + 1) == 47
+              depth -= 1
+              i += 2
+            else
+              i += 1
+            end
+          end
+          out << " "
+        elsif byte == 39 # '
+          # E'', N'', B'', and X'' are value introducers rather than part of
+          # the query shape. Other introducers (for example _utf8mb4'') stay
+          # visible, but their contents are still hidden.
+          prefix = literal_prefix_byte(bytes, i)
+          out.chop! if prefix
+          explicit_escape_string = prefix == 69 || prefix == 101
+          # Whether a backslash escapes the quote after it is a per-dialect
+          # default the notification does not carry: MySQL escapes (unless the
+          # session sets NO_BACKSLASH_ESCAPES), PostgreSQL does not (unless it
+          # sets standard_conforming_strings off, deprecated since 9.1), E''
+          # always does, SQLite never does. Scan with each dialect's default,
+          # and treat an unknown adapter as MySQL-like -- getting that wrong
+          # only masks more than necessary, while the other way round exposes
+          # the tail of the value currently being masked.
+          #
+          # This deliberately no longer abandons the rest of the statement on
+          # seeing \'. That was safe but destroyed the shape, and on MySQL --
+          # where backslash escaping IS the quoting Active Record emits --
+          # every string containing an apostrophe truncated the statement, so
+          # `... WHERE name = 'O\'Brien' AND id = 1` and `... AND state = 'x'`
+          # hashed into one query group. Values are masked either way; only
+          # the tail's shape was being thrown away.
+          backslash_escapes = mysql || unknown_adapter || explicit_escape_string
+          i += 1
+          while i < length
+            if backslash_escapes && bytes.getbyte(i) == 92
+              i += 2
+            elsif bytes.getbyte(i) == 39
+              if bytes.getbyte(i + 1) == 39
+                i += 2
+              else
+                i += 1
+                break
+              end
+            else
+              i += 1
+            end
+          end
+          out << "?"
+        # When adapter metadata is unavailable, privacy wins over preserving
+        # ANSI quoted-identifier shape: this may be a MySQL-compatible string.
+        elsif mysql_ambiguous && byte == 34 # MySQL/Trilogy default: "..." is a string.
+          i = skip_quoted_value(bytes, i, 34, backslash_escapes: true)
+          out << "?"
+        elsif sqlite && byte == 34 # SQLite DQS is ambiguous; mask unless syntax proves identifier use.
+          close_at = quoted_identifier_end(bytes, i, 34)
+          if close_at && sqlite_identifier_position?(bytes, i, close_at)
+            out << bytes.byteslice(i, close_at - i)
+          else
+            out << "?"
+          end
+          i = close_at || length
+        elsif byte == 34 || byte == 96 || (sqlite && byte == 91) # ANSI, backtick, or SQLite [identifier]
+          closer = byte == 91 ? 93 : byte
+          close_at = quoted_identifier_end(bytes, i, closer)
+          if close_at
+            out << bytes.byteslice(i, close_at - i)
+            i = close_at
+          else
+            out << "?"
+            i = length
+          end
+        elsif byte == 36 && (delimiter_end = dollar_delimiter_end(bytes, i))
+          delimiter = bytes.byteslice(i, delimiter_end - i)
+          close_at = bytes.index(delimiter, delimiter_end)
+          i = close_at ? close_at + delimiter.bytesize : length
+          out << "?"
+        elsif byte == 36 && digit?(following) # PostgreSQL/SQLite $1 bind
+          i += 2
+          i += 1 while digit?(bytes.getbyte(i))
+          out << "?"
+        elsif byte == 63 && digit?(following) # SQLite ?NNN bind
+          i += 2
+          i += 1 while digit?(bytes.getbyte(i))
+          out << "?"
+        elsif numeric_boundary?(bytes, i) && (number_end = numeric_end(bytes, i))
+          out << "?"
+          i = number_end
+        else
+          out << byte
+          i += 1
+        end
+      end
+
+      out.force_encoding(Encoding::UTF_8)
+    end
+
+    def skip_quoted_value(bytes, index, quote, backslash_escapes:)
+      length = bytes.bytesize
+      i = index + 1
+      while i < length
+        if backslash_escapes && bytes.getbyte(i) == 92
+          i += 2
+        elsif bytes.getbyte(i) == quote
+          if bytes.getbyte(i + 1) == quote
+            i += 2
+          else
+            return i + 1
+          end
+        else
+          i += 1
+        end
+      end
+      length
+    end
+
+    def quoted_identifier_end(bytes, index, closer)
+      length = bytes.bytesize
+      i = index + 1
+      while i < length
+        if bytes.getbyte(i) == closer
+          if bytes.getbyte(i + 1) == closer
+            i += 2
+          else
+            return i + 1
+          end
+        else
+          i += 1
+        end
+      end
+      nil
+    end
+
+    SQLITE_IDENTIFIER_PRECEDERS = %w[as alter create delete drop from index into join table trigger update vacuum].freeze
+
+    # SQLite retains a legacy double-quoted-string fallback when a token does
+    # not resolve as an identifier. Qualification and object-name grammar are
+    # unambiguous; a bare expression token is not, so privacy wins and it is
+    # masked. Rails-generated `"table"."column"` and `FROM "table"` keep their
+    # diagnostic value.
+    def sqlite_identifier_position?(bytes, opening, after_closing)
+      before = previous_nonspace(bytes, opening - 1)
+      after = next_nonspace(bytes, after_closing)
+      return true if before && bytes.getbyte(before) == 46
+      return true if after && bytes.getbyte(after) == 46
+
+      word = previous_word(bytes, opening - 1)
+      SQLITE_IDENTIFIER_PRECEDERS.include?(word)
+    end
+
+    def previous_nonspace(bytes, index)
+      index -= 1 while index >= 0 && whitespace_byte?(bytes.getbyte(index))
+      index >= 0 ? index : nil
+    end
+
+    def next_nonspace(bytes, index)
+      length = bytes.bytesize
+      index += 1 while index < length && whitespace_byte?(bytes.getbyte(index))
+      index < length ? index : nil
+    end
+
+    def previous_word(bytes, index)
+      finish = previous_nonspace(bytes, index)
+      return nil unless finish
+      start = finish
+      start -= 1 while start >= 0 && ascii_identifier_byte?(bytes.getbyte(start))
+      bytes.byteslice(start + 1, finish - start).downcase
+    end
+
+    def dollar_delimiter_end(bytes, index)
+      following = bytes.getbyte(index + 1)
+      return index + 2 if following == 36
+      # PostgreSQL dollar-quote tags follow unquoted-identifier rules, whose
+      # letters include non-ASCII characters. The input is valid UTF-8 by the
+      # time it reaches this scanner. Treat every high byte conservatively as
+      # an identifier byte: accepting a little more than PostgreSQL does can
+      # only hide extra text, while rejecting a valid tag can expose its body.
+      return nil unless ascii_letter?(following) || following == 95 || non_ascii_byte?(following)
+
+      i = index + 2
+      i += 1 while ascii_identifier_byte?(bytes.getbyte(i)) || non_ascii_byte?(bytes.getbyte(i))
+      bytes.getbyte(i) == 36 ? i + 1 : nil
+    end
+
+    def literal_prefix_byte(bytes, quote_index)
+      return nil if quote_index.zero?
+      prefix = bytes.getbyte(quote_index - 1)
+      return nil unless LITERAL_PREFIX_BYTES.include?(prefix)
+      return prefix if quote_index == 1
+      ascii_identifier_byte?(bytes.getbyte(quote_index - 2)) || bytes.getbyte(quote_index - 2) == 36 ? nil : prefix
+    end
+
+    def numeric_end(bytes, index)
+      length = bytes.bytesize
+      i = index
+      i += 1 if bytes.getbyte(i) == 45
+      return nil if i >= length
+
+      base_prefix = bytes.getbyte(i + 1)
+      if bytes.getbyte(i) == 48 && BASE_PREFIX_BYTES.include?(base_prefix)
+        base = base_prefix
+        i += 2
+        digits_start = i
+        i += 1 while base_digit_or_underscore?(bytes.getbyte(i), base)
+        return i > digits_start ? i : nil
+      end
+
+      digits = false
+      while digit?(bytes.getbyte(i)) || bytes.getbyte(i) == 95
+        digits ||= digit?(bytes.getbyte(i))
+        i += 1
+      end
+      if bytes.getbyte(i) == 46
+        i += 1
+        while digit?(bytes.getbyte(i)) || bytes.getbyte(i) == 95
+          digits ||= digit?(bytes.getbyte(i))
+          i += 1
+        end
+      end
+      return nil unless digits
+
+      if bytes.getbyte(i) == 69 || bytes.getbyte(i) == 101
+        exponent = i
+        i += 1
+        i += 1 if bytes.getbyte(i) == 43 || bytes.getbyte(i) == 45
+        exponent_digits = false
+        while digit?(bytes.getbyte(i)) || bytes.getbyte(i) == 95
+          exponent_digits ||= digit?(bytes.getbyte(i))
+          i += 1
+        end
+        i = exponent unless exponent_digits
+      end
+      i
+    end
+
+    def base_digit_or_underscore?(byte, base)
+      return true if byte == 95
+      case base
+      when 88, 120 then digit?(byte) || (byte && ((65..70).cover?(byte) || (97..102).cover?(byte)))
+      when 66, 98 then byte == 48 || byte == 49
+      when 79, 111 then byte && (48..55).cover?(byte)
+      else false
+      end
+    end
+
+    def numeric_boundary?(bytes, index)
+      byte = bytes.getbyte(index)
+      return false unless digit?(byte) || byte == 46 || byte == 45
+      return true if index.zero?
+
+      previous = bytes.getbyte(index - 1)
+      !ascii_identifier_byte?(previous) && previous != 36 && previous != 46
+    end
+
+    def digit?(byte)
+      byte && (48..57).cover?(byte)
+    end
+
+    def ascii_letter?(byte)
+      byte && ((65..90).cover?(byte) || (97..122).cover?(byte))
+    end
+
+    def ascii_identifier_byte?(byte)
+      ascii_letter?(byte) || digit?(byte) || byte == 95
+    end
+
+    def non_ascii_byte?(byte)
+      byte && byte >= 128
+    end
+
+    def whitespace_byte?(byte)
+      byte == 32 || (byte && (9..13).cover?(byte))
+    end
+  end
+end

data/lib/railwatch/subscribers/base.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Railwatch
+  module Subscribers
+    # Shared helpers. Subscribers use ActiveSupport::Notifications event
+    # objects (duration in ms, allocations) and must do no I/O.
+    module Base
+      def subscribe(name, &block)
+        ActiveSupport::Notifications.subscribe(name) do |event|
+          block.call(event)
+        rescue StandardError => e
+          subscriber_failed(name, e)
+        end
+      end
+
+      # For a subscriber that only reads the payload (a counter, say). The
+      # five-argument block form makes Rails skip building an Event object
+      # -- six clock and GC reads -- for every notification it delivers.
+      def subscribe_payload(name, &block)
+        ActiveSupport::Notifications.monotonic_subscribe(name) do |_name, _start, _finish, _id, payload|
+          block.call(payload)
+        rescue StandardError => e
+          subscriber_failed(name, e)
+        end
+      end
+
+      def subscriber_failed(name, error)
+        Railwatch.debug { "#{name} subscriber raised #{error.class}: #{error.message}" }
+        Railwatch.notify_unrecoverable(error)
+      end
+
+      def execution
+        Railwatch.execution
+      end
+
+      # Whether a child record built now would be kept. With no execution
+      # there is nothing to attach it to and Railwatch.push drops it, so the
+      # subscriber should not build it in the first place.
+      def recording?
+        exe = Railwatch.execution
+        !exe.nil? && exe.recording?
+      end
+
+      def micros(event)
+        Clock.ms_to_micros(event.duration)
+      end
+
+      def started_at(event)
+        # event.time is monotonic in Rails >= 7; derive wall time from now minus duration.
+        Clock.now - (event.duration / 1_000.0)
+      end
+    end
+  end
+end

data/lib/railwatch/subscribers/broadcasts.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Railwatch
+  module Subscribers
+    # Action Cable broadcasts and transmits. Covers inertia_cable and Turbo
+    # Streams since both go through broadcast.action_cable.
+    module Broadcasts
+      extend Base
+
+      EXECUTION_KEY = :__railwatch_channel_execution
+
+      # An event-object subscriber receives #start before Action Cable invokes
+      # the channel method and #finish after it returns or raises. A normal
+      # notification block runs only at the end, which is too late for SQL,
+      # logs, broadcasts, and transmits inside the action to have a parent.
+      class ActionExecution
+        def start(_name, _id, payload)
+          channel = payload[:channel_class].to_s
+          action = payload[:action].to_s
+          exe = Railwatch.start_execution(source: :channel_action, sample_kind: :channels,
+                                        preview: "#{channel}##{action}")
+          # Handed to #finish before anything that could raise. Action Cable
+          # workers are a pool: an execution started here and not closed there
+          # would stay on Current for whichever channel action that thread
+          # picks up next, silently adopting its records.
+          payload[EXECUTION_KEY] = exe
+          exe.enter_stage(:action)
+          exe.user_id = Users.resolve_from_current
+        rescue StandardError => e
+          Railwatch.debug { "perform_action.action_cable start subscriber raised #{e.class}: #{e.message}" }
+          Railwatch.notify_unrecoverable(e)
+        end
+
+        def finish(_name, _id, payload)
+          exe = payload.delete(EXECUTION_KEY)
+          return unless exe
+
+          Railwatch::Current.execution = exe
+          exe.finish_stages
+          channel = payload[:channel_class].to_s
+          action = payload[:action].to_s
+          error = payload[:exception_object]
+          if error
+            Exceptions.capture(error, handled: false, severity: :error,
+                               source: "application.action_cable",
+                               context: { channel: channel, action: action })
+          end
+          exe.count(:broadcasts)
+          Railwatch.record(:broadcast, group: Record.group_hash(channel, action),
+                         timestamp: exe.started_at, kind: "perform_action", channel: channel,
+                         action: action, duration: exe.duration, failed: error ? true : false)
+          Railwatch.finish_execution(:channel_action, group: Record.group_hash(channel, action),
+                                   channel: channel, action: action,
+                                   status: error ? "failed" : "processed", failed: error ? true : false)
+        rescue StandardError => e
+          Railwatch.debug { "perform_action.action_cable finish subscriber raised #{e.class}: #{e.message}" }
+          Railwatch.notify_unrecoverable(e)
+        ensure
+          # ActiveSupport guards subscriber errors, so an internal failure
+          # must also restore the execution explicitly rather than leave the
+          # worker fiber attached to a completed channel action.
+          Railwatch::Current.execution = exe.parent_execution if exe && Railwatch.execution.equal?(exe)
+        end
+      end
+
+      module_function
+
+      def install!(_app)
+        subscribe("broadcast.action_cable") do |event|
+          exe = execution
+          exe&.count(:broadcasts)
+          next unless recording?
+          p = event.payload
+          stream = p[:broadcasting].to_s
+          Railwatch.record(:broadcast,
+            group: Record.group_hash(stream_shape(stream)),
+            timestamp: started_at(event),
+            kind: "broadcast",
+            stream: stream[0, 255],
+            bytes: (p[:message].to_s.bytesize rescue nil),
+            coder: p[:coder]&.name,
+            duration: micros(event))
+        end
+
+        subscribe("transmit.action_cable") do |event|
+          exe = execution
+          # Before the recording? gate, like every other counter here: the
+          # parent's counters are meant to be true even for a sampled-out
+          # execution, so aggregate rates do not depend on the sample rate
+          # (docs/records.md, `counters`).
+          exe&.count(:broadcasts)
+          next unless recording?
+          p = event.payload
+          Railwatch.record(:broadcast, group: Record.group_hash(p[:channel_class].to_s),
+                         timestamp: started_at(event), kind: "transmit", channel: p[:channel_class].to_s,
+                         via: p[:via].to_s[0, 255], bytes: (p[:data].to_s.bytesize rescue nil), duration: micros(event))
+        end
+
+        ActiveSupport::Notifications.subscribe("perform_action.action_cable", ActionExecution.new)
+      end
+
+      def stream_shape(stream)
+        stream.gsub(/\b\d+\b/, "?").gsub(/[0-9a-f]{16,}/i, "?")
+      end
+    end
+  end
+end

data/lib/railwatch/subscribers/cache.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Railwatch
+  module Subscribers
+    # Every cache_*.active_support event. Keys are truncated and vendor
+    # prefixes (rack-attack, flipper, solid_cable) are rejected by default.
+    module Cache
+      extend Base
+
+      EVENTS = {
+        "cache_read.active_support" => ->(p) { p[:hit] ? "hit" : "miss" },
+        "cache_read_multi.active_support" => ->(_p) { "read_multi" },
+        "cache_fetch_hit.active_support" => ->(_p) { "hit" },
+        "cache_generate.active_support" => ->(_p) { "generate" },
+        "cache_write.active_support" => ->(_p) { "write" },
+        "cache_write_multi.active_support" => ->(_p) { "write_multi" },
+        "cache_delete.active_support" => ->(_p) { "delete" },
+        "cache_delete_multi.active_support" => ->(_p) { "delete_multi" },
+        "cache_delete_matched.active_support" => ->(_p) { "delete_matched" },
+        "cache_increment.active_support" => ->(_p) { "increment" },
+        "cache_decrement.active_support" => ->(_p) { "decrement" },
+        "cache_exist?.active_support" => ->(_p) { "exist" }
+      }.freeze
+
+      # Bounded cache of store -> key -> group hash (see group_for).
+      GROUP_CACHE_LIMIT = 2_048
+      @group_cache = Hash.new { |h, k| h[k] = {} }
+      @group_mutex = Mutex.new
+
+      # Computed once so the hot cache_event record doesn't look this up per call.
+      CACHE_EVENT_VERSION = Record::VERSIONS.fetch(:cache_event)
+
+      module_function
+
+      def install!(_app)
+        EVENTS.each do |name, type_of|
+          subscribe(name) do |event|
+            p = event.payload
+            # cache_read inside a fetch is reported by cache_fetch_hit/generate; skip the inner read.
+            next if name == "cache_read.active_support" && p[:super_operation] == :fetch
+            key = key_string(p[:key])
+            next if ignored_key?(key)
+            exe = execution
+            exe&.count(:cache_events)
+            next unless recording?
+
+            store = p[:store].to_s.demodulize
+            cfg = Railwatch.config
+            # One hash literal instead of kwargs-packing into Railwatch.record --
+            # cache_event is a high-frequency type.
+            Railwatch.push(:cache_event, {
+              v: CACHE_EVENT_VERSION,
+              t: "cache_event",
+              timestamp: started_at(event),
+              deploy: cfg.deploy,
+              server: cfg.server,
+              _group: group_for(store, key),
+              **(exe ? exe.envelope : Record::EMPTY_ENVELOPE),
+              store: store,
+              key: key[0, 255],
+              type: p[:exception] ? "fail" : type_of.call(p),
+              duration: micros(event),
+              ttl: p[:expires_in].to_i,
+              hits: p[:hits].is_a?(Array) ? p[:hits].size : nil
+            })
+          end
+        end
+      end
+
+      def key_string(key)
+        case key
+        when Array then key.map { |k| key_string(k) }.join("/")
+        when Hash then key.map { |k, v| "#{k}=#{key_string(v)}" }.join("&")
+        else
+          key.respond_to?(:cache_key) ? key.cache_key : key.to_s
+        end
+      end
+
+      # Group hash for a (store, key): ids are stripped so "users/123" and
+      # "users/456" share a group, then the digest is taken. Both run once per
+      # distinct key; keys repeat heavily (the same fetch in a loop). The
+      # cached string is frozen because it is handed to every record as
+      # _group, and a redactor that mutated it in place would poison every
+      # later record for that key.
+      def group_for(store, key)
+        bucket = @group_cache[store]
+        cached = bucket[key]
+        return cached if cached
+
+        shape = key.gsub(/\b\d+\b/, "?").gsub(/[0-9a-f]{16,}/i, "?")
+        group = Record.group_hash(store, shape).freeze
+        @group_mutex.synchronize do
+          bucket.clear if bucket.size >= GROUP_CACHE_LIMIT
+          bucket[key] = group
+        end
+        group
+      end
+
+      def ignored_key?(key)
+        config = Railwatch.config
+        return true if config.ignored_cache_key_prefixes.any? { |pattern| Configuration.match_cache_key?(pattern, key) }
+        return false if config.capture_default_vendor_cache_keys
+        Configuration::DEFAULT_VENDOR_CACHE_KEY.match?(key)
+      end
+    end
+  end
+end

data/lib/railwatch/subscribers/deprecations.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Railwatch
+  module Subscribers
+    module Deprecations
+      extend Base
+
+      module_function
+
+      def install!(_app)
+        subscribe("deprecation.rails") do |event|
+          exe = execution
+          exe&.count(:deprecations)
+          next unless recording?
+          p = event.payload
+          Railwatch.record(:deprecation,
+            group: Record.group_hash(p[:gem_name], p[:message].to_s[0, 120]),
+            message: p[:message].to_s[0, 2048],
+            gem_name: p[:gem_name].to_s,
+            horizon: p[:deprecation_horizon].to_s,
+            source: Array(p[:callstack]).find { |f| f.to_s.start_with?(Backtrace.app_root) }&.to_s&.delete_prefix(Backtrace.app_root))
+        end
+      end
+    end
+  end
+end