adonisjs-server-stats 1.16.0 → 1.16.1

package/dist/src/dashboard/dashboard_store.d.ts

@@ -1,4 +1,4 @@
-import type { DevToolbarConfig, EventRecord, EmailRecord } from '../debug/types.js';
+import type { DevToolbarConfig, EmailRecord } from '../debug/types.js';
 import type { StorageStatsResult } from './storage_stats.js';
 import type { Knex } from 'knex';
 export type { RequestInput, PersistRequestInput, RequestFilters, QueryFilters, EventFilters, EmailFilters, LogFilters, TraceFilters, PaginatedResult, PaginateOptions, } from './dashboard_types.js';
@@ -26,7 +26,6 @@ export declare class DashboardStore {
     isReady(): boolean;
     getStorageStats(): Promise<StorageStatsResult>;
     persistRequest(input: PersistRequestInput): Promise<number | null>;
-    queueEvents(requestIndex: number, events: EventRecord[]): void;
     recordLog(entry: Record<string, unknown>): void;
     recordEmail(record: EmailRecord): void;
     flushWriteQueue(): Promise<void>;

package/dist/src/dashboard/dashboard_store.js

@@ -139,9 +139,6 @@ export class DashboardStore {
         this.flushMgr.persistRequest(input, this.dashboardPath);
         return Promise.resolve(null);
     }
-    queueEvents(requestIndex, events) {
-        this.flushMgr.queueEvents(requestIndex, events);
-    }
     recordLog(entry) {
         this.flushMgr.recordLog(entry);
     }

package/dist/src/dashboard/dashboard_types.d.ts

@@ -16,6 +16,8 @@ export interface RequestInput {
 }
 export interface PersistRequestInput extends RequestInput {
     queries: import('../debug/types.js').QueryRecord[];
+    /** Events emitted since the previous request completed. */
+    events?: import('../debug/types.js').EventRecord[];
     trace: import('../debug/types.js').TraceRecord | null;
     httpRequestId?: string | null;
 }

package/dist/src/dashboard/flush_manager.d.ts

@@ -1,12 +1,8 @@
-import type { EventRecord, EmailRecord } from '../debug/types.js';
+import type { EmailRecord } from '../debug/types.js';
 import type { PersistRequestInput } from './dashboard_types.js';
 import type { Knex } from 'knex';
 export declare class FlushManager {
     writeQueue: PersistRequestInput[];
-    pendingEvents: {
-        requestIndex: number;
-        events: EventRecord[];
-    }[];
     pendingLogs: Record<string, unknown>[];
     pendingEmails: EmailRecord[];
     private flushTimer;
@@ -15,7 +11,6 @@ export declare class FlushManager {
     private db;
     constructor(getDb: () => Knex | null);
     persistRequest(input: PersistRequestInput, dashboardPath: string): void;
-    queueEvents(requestIndex: number, events: EventRecord[]): void;
     recordLog(entry: Record<string, unknown>): void;
     recordEmail(record: EmailRecord): void;
     stop(): Promise<void>;

package/dist/src/dashboard/flush_manager.js

@@ -1,10 +1,9 @@
 import { log } from '../utils/logger.js';
-import { prepareRequestRows, prepareLogRows, flushRequests, flushEvents, flushEmails, flushLogs, hasWarned, markWarned, } from './write_queue.js';
+import { prepareRequestRows, prepareLogRows, flushRequests, flushEmails, flushLogs, hasWarned, markWarned, } from './write_queue.js';
 const FLUSH_MS = 500;
 const MAX_Q = 200;
 export class FlushManager {
     writeQueue = [];
-    pendingEvents = [];
     pendingLogs = [];
     pendingEmails = [];
     flushTimer = null;
@@ -21,10 +20,6 @@ export class FlushManager {
         this.writeQueue.push(input);
         this.scheduleFlush();
     }
-    queueEvents(requestIndex, events) {
-        if (events.length > 0)
-            this.pendingEvents.push({ requestIndex, events });
-    }
     recordLog(entry) {
         if (!this.db())
             return;
@@ -94,7 +89,6 @@ export class FlushManager {
             const pl = prepareLogRows(snap.logs);
             await db.transaction(async (trx) => {
                 await flushRequests(trx, pr);
-                await flushEvents(trx, snap.events);
                 await flushEmails(trx, snap.emails);
                 await flushLogs(trx, pl);
             });
@@ -115,10 +109,9 @@ export class FlushManager {
     takeSnapshot() {
         const requests = this.writeQueue.splice(0);
         const logs = this.pendingLogs.splice(0);
-        const events = this.pendingEvents.splice(0);
         const emails = this.pendingEmails.splice(0);
-        if (requests.length === 0 && logs.length === 0 && events.length === 0 && emails.length === 0)
+        if (requests.length === 0 && logs.length === 0 && emails.length === 0)
             return null;
-        return { requests, logs, events, emails };
+        return { requests, logs, emails };
     }
 }

package/dist/src/dashboard/integrations/config_inspector.js

@@ -1,48 +1,9 @@
+import { isSensitiveConfigName, looksLikeCredentialValue } from '../sensitive_patterns.js';
 // ---------------------------------------------------------------------------
-// Sensitive key patterns
+// Sensitive key detection
 // ---------------------------------------------------------------------------
-/**
- * Patterns matched against key names (case-insensitive) to detect secrets.
- *
- * Uses `(?:^|[_.-])` and `(?:$|[_.-])` as boundaries instead of `\b`
- * because env vars use `_` as separators and `_` is a word character
- * in regex, so `\b` won't match between `CLIENT` and `SECRET` in
- * `GOOGLE_CLIENT_SECRET`.
- */
-const B = '(?:^|[_.\\-])'; // boundary before
-const A = '(?:$|[_.\\-])'; // boundary after
-const SENSITIVE_PATTERNS = [
-    new RegExp(`${B}password${A}`, 'i'),
-    new RegExp(`${B}secret${A}`, 'i'),
-    new RegExp(`${B}token${A}`, 'i'),
-    new RegExp(`${B}credential${A}`, 'i'),
-    new RegExp(`${B}private${A}`, 'i'),
-    new RegExp(`${B}auth${A}`, 'i'),
-    // API keys: `api_key`, `apiKey`, `API_KEY`
-    /api[_-]?key/i,
-    // `_KEY` at end or `_KEY_` in middle (AWS_ACCESS_KEY_ID, ENCRYPTION_KEY, etc.)
-    /[_-]key([_-]|$)/i,
-    // ACCESS_KEY pattern (AWS credentials)
-    /access[_-]?key/i,
-    // Exact match for just "key" (standalone)
-    /^key$/i,
-    // Connection strings and DSNs
-    new RegExp(`${B}dsn${A}`, 'i'),
-    /connection[_-]?string/i,
-    // Email addresses in env var names
-    new RegExp(`${B}email${A}`, 'i'),
-    new RegExp(`${B}smtp${A}`, 'i'),
-    // Database/service URLs (often contain embedded credentials)
-    /database[_-]?url/i,
-    /redis[_-]?url/i,
-    // Webhook secrets
-    /webhook[_-]?secret/i,
-    // Signing / encryption
-    new RegExp(`${B}signing${A}`, 'i'),
-    new RegExp(`${B}encryption${A}`, 'i'),
-    // App key / app secret
-    /app[_-]key/i,
-];
+// The name patterns live in `../sensitive_patterns.js` so the config inspector
+// and the SQL-binding writer share one definition of "looks like a secret".
 const REDACTED_DISPLAY = '••••••••';
 function redact(_value) {
     // Never include the plaintext value: the redacted object is serialized
@@ -121,20 +82,19 @@ export class ConfigInspector {
  * Check if a key name matches any sensitive pattern.
  */
 function isSensitiveKey(key) {
-    return SENSITIVE_PATTERNS.some((pattern) => pattern.test(key));
+    return isSensitiveConfigName(key);
 }
 /**
  * Check if a value looks sensitive based on its content.
  * Catches email addresses and URLs with embedded credentials.
  */
 function isSensitiveValue(value) {
-    // Email addresses
+    // Email addresses are config-sensitive (SMTP accounts) even though they are
+    // ordinary data as a query binding — hence the check lives here, not in the
+    // shared shape helper.
     if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value))
         return true;
-    // URLs with userinfo (credentials embedded in URL)
-    if (/^[a-z][a-z0-9+.-]*:\/\/[^/]*:[^/]*@/i.test(value))
-        return true;
-    return false;
+    return looksLikeCredentialValue(value);
 }
 /** Sanitize a single key-value pair, redacting sensitive strings. */
 function sanitizeValue(key, value, seen) {

package/dist/src/dashboard/sensitive_patterns.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared server-side rules for recognising credentials.
+ *
+ * Both the config inspector and the SQL-binding writer need to answer "does
+ * this look like a secret?", and they used to answer it differently — config
+ * values were redacted against a real word list while query bindings were only
+ * truncated by length. One list, used by both, so the same secret cannot be
+ * masked in one view and printed in full in another.
+ */
+/**
+ * Names that identify a credential — applies to env vars, config keys, and SQL
+ * identifiers alike.
+ */
+export declare const SECRET_NAME_PATTERNS: RegExp[];
+/**
+ * Names that matter for env vars and config keys but NOT for SQL identifiers.
+ *
+ * An `email` env var is usually an SMTP account; an `email` *column* is ordinary
+ * application data, and redacting every binding of every query that touches it
+ * would make the query pane useless for debugging auth. Same for the service
+ * URLs, which are env-shaped names rather than column names.
+ */
+export declare const CONFIG_ONLY_NAME_PATTERNS: RegExp[];
+/** Whether a name identifies a credential. */
+export declare function isSecretName(name: string): boolean;
+/** Whether a name is sensitive in a config/env context (credentials plus contact/service names). */
+export declare function isSensitiveConfigName(name: string): boolean;
+/**
+ * Whether a SQL statement mentions a credential-shaped identifier.
+ *
+ * Tokenised first: the name patterns above use `_`/`.`/`-` boundaries, so
+ * running them across raw SQL would miss `password` sitting between spaces.
+ *
+ * Positional bindings cannot be mapped back to specific columns reliably, so a
+ * hit means every binding for that statement is redacted. Coarse on purpose —
+ * over-redacting one statement's parameters beats storing a password.
+ */
+export declare function sqlMentionsSecret(sql: string): boolean;
+export declare function looksLikeCredentialValue(value: string): boolean;

package/dist/src/dashboard/sensitive_patterns.js

@@ -0,0 +1,118 @@
+/**
+ * Shared server-side rules for recognising credentials.
+ *
+ * Both the config inspector and the SQL-binding writer need to answer "does
+ * this look like a secret?", and they used to answer it differently — config
+ * values were redacted against a real word list while query bindings were only
+ * truncated by length. One list, used by both, so the same secret cannot be
+ * masked in one view and printed in full in another.
+ */
+// Custom word boundaries: `\b` does not match between `CLIENT` and `SECRET` in
+// `GOOGLE_CLIENT_SECRET`, because `_` is a word character. These treat `_`,
+// `.`, and `-` as separators, and also match a bare token on its own.
+const B = '(?:^|[_.\\-])'; // boundary before
+const A = '(?:$|[_.\\-])'; // boundary after
+/**
+ * Names that identify a credential — applies to env vars, config keys, and SQL
+ * identifiers alike.
+ */
+export const SECRET_NAME_PATTERNS = [
+    new RegExp(`${B}password${A}`, 'i'),
+    new RegExp(`${B}secret${A}`, 'i'),
+    new RegExp(`${B}token${A}`, 'i'),
+    new RegExp(`${B}credential${A}`, 'i'),
+    new RegExp(`${B}private${A}`, 'i'),
+    new RegExp(`${B}auth${A}`, 'i'),
+    // API keys: `api_key`, `apiKey`, `API_KEY`
+    /api[_-]?key/i,
+    // `_KEY` at end or `_KEY_` in middle (AWS_ACCESS_KEY_ID, ENCRYPTION_KEY, etc.)
+    /[_-]key([_-]|$)/i,
+    // ACCESS_KEY pattern (AWS credentials)
+    /access[_-]?key/i,
+    // Exact match for just "key" (standalone)
+    /^key$/i,
+    // Connection strings and DSNs
+    new RegExp(`${B}dsn${A}`, 'i'),
+    /connection[_-]?string/i,
+    // Webhook secrets
+    /webhook[_-]?secret/i,
+    // Signing / encryption
+    new RegExp(`${B}signing${A}`, 'i'),
+    new RegExp(`${B}encryption${A}`, 'i'),
+    // App key / app secret
+    /app[_-]key/i,
+    // One-time codes
+    new RegExp(`${B}otp${A}`, 'i'),
+];
+/**
+ * Names that matter for env vars and config keys but NOT for SQL identifiers.
+ *
+ * An `email` env var is usually an SMTP account; an `email` *column* is ordinary
+ * application data, and redacting every binding of every query that touches it
+ * would make the query pane useless for debugging auth. Same for the service
+ * URLs, which are env-shaped names rather than column names.
+ */
+export const CONFIG_ONLY_NAME_PATTERNS = [
+    new RegExp(`${B}email${A}`, 'i'),
+    new RegExp(`${B}smtp${A}`, 'i'),
+    /database[_-]?url/i,
+    /redis[_-]?url/i,
+];
+/** Whether a name identifies a credential. */
+export function isSecretName(name) {
+    return SECRET_NAME_PATTERNS.some((pattern) => pattern.test(name));
+}
+/** Whether a name is sensitive in a config/env context (credentials plus contact/service names). */
+export function isSensitiveConfigName(name) {
+    return isSecretName(name) || CONFIG_ONLY_NAME_PATTERNS.some((pattern) => pattern.test(name));
+}
+/** Identifier-ish tokens in a SQL statement: table names, column names, aliases. */
+const SQL_IDENTIFIER_RE = /[A-Za-z_][A-Za-z0-9_$]*/g;
+/**
+ * Whether a SQL statement mentions a credential-shaped identifier.
+ *
+ * Tokenised first: the name patterns above use `_`/`.`/`-` boundaries, so
+ * running them across raw SQL would miss `password` sitting between spaces.
+ *
+ * Positional bindings cannot be mapped back to specific columns reliably, so a
+ * hit means every binding for that statement is redacted. Coarse on purpose —
+ * over-redacting one statement's parameters beats storing a password.
+ */
+export function sqlMentionsSecret(sql) {
+    for (const match of sql.matchAll(SQL_IDENTIFIER_RE)) {
+        if (isSecretName(match[0]))
+            return true;
+    }
+    return false;
+}
+/**
+ * Whether a value looks like a credential from its shape alone, independent of
+ * any name.
+ *
+ * Deliberately excludes bare email addresses: they are sensitive as *config*
+ * (see {@link CONFIG_ONLY_NAME_PATTERNS}) but are ordinary query parameters.
+ */
+const CREDENTIAL_VALUE_PATTERNS = [
+    // URL with userinfo — credentials embedded in the URL
+    /^[a-z][a-z0-9+.-]*:\/\/[^/]*:[^/]*@/i,
+    // bcrypt / argon2 / scrypt password hashes
+    /^\$(?:2[aby]|argon2[a-z]*|scrypt|s?crypt)\$/i,
+    // JWT
+    /^ey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\./,
+    // Well-known provider key prefixes. Underscores allowed in the tail so
+    // `sk_live_…` / `pk_test_…` match (Stripe, GitHub, Slack, AWS).
+    /^(?:sk|pk|rk|whsec)_[A-Za-z0-9_]{8,}/,
+    /^gh[pousr]_[A-Za-z0-9]{8,}/,
+    /^xox[baprs]-[A-Za-z0-9-]{8,}/,
+    /^(?:AKIA|ASIA)[A-Z0-9]{12,}$/,
+    // Long hex digests — session ids, reset tokens, sha hashes
+    /^[0-9a-f]{32,}$/i,
+];
+/** Minimum length before a base64url-shaped blob is treated as high-entropy. */
+const MIN_BLOB_LEN = 40;
+export function looksLikeCredentialValue(value) {
+    // Long high-entropy base64url blobs — length-gated, so kept out of the table.
+    if (value.length >= MIN_BLOB_LEN && /^[A-Za-z0-9_-]+={0,2}$/.test(value))
+        return true;
+    return CREDENTIAL_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}

package/dist/src/dashboard/write_queue.d.ts

@@ -21,13 +21,26 @@ export declare function markWarned(path: string): void;
  */
 export declare function normalizeSql(sql: string): string;
 /**
- * Redact/truncate SQL bindings before persistence so secret-looking values
- * (long tokens, hashes, keys) are not stored in cleartext.
+ * Redact and truncate SQL bindings before persistence.
  *
- * Conservative: only long strings are truncated; short values (ids, flags,
- * emails, ordinary params) pass through so normal capture is unaffected.
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
  */
-export declare function sanitizeBindings(bindings: unknown): unknown;
+export declare function sanitizeBindings(bindings: unknown, sqlText?: string): unknown;
 export interface PreparedQuery {
     sql_text: string;
     sql_normalized: string;
@@ -51,6 +64,7 @@ export interface PreparedRequest {
     input: PersistRequestInput;
     filteredQueries: PreparedQuery[];
     traceRow: PreparedTraceRow | null;
+    eventRows: EventRow[];
 }
 export interface PreparedLog {
     [key: string]: unknown;
@@ -75,7 +89,6 @@ export interface EmailRow {
 }
 export interface EventRow {
     [key: string]: unknown;
-    request_id: null;
     event_name: string;
     data: string | null;
 }
@@ -96,19 +109,18 @@ export declare function buildEmailRow(record: EmailRecord): EmailRow;
 /**
  * Transform EventRecords into SQLite-ready row objects.
  */
+/**
+ * Build event rows. `request_id` is attached at insert time, once the owning
+ * request row has an id — leaving it null here (as this did previously) meant
+ * retention never reclaimed them, since events are only pruned via the
+ * `server_stats_requests` foreign-key cascade.
+ */
 export declare function buildEventRows(events: EventRecord[]): EventRow[];
 /**
  * Insert rows into a table in batches of 50.
  */
 export declare function batchInsert(trx: Knex.Transaction, table: string, rows: Record<string, unknown>[]): Promise<void>;
 export declare function flushRequests(trx: Knex.Transaction, preparedRequests: PreparedRequest[]): Promise<void>;
-/**
- * Flush pending events into the database.
- */
-export declare function flushEvents(trx: Knex.Transaction, events: {
-    requestIndex: number;
-    events: EventRecord[];
-}[]): Promise<void>;
 /**
  * Flush pending emails into the database.
  */

package/dist/src/dashboard/write_queue.js

@@ -6,6 +6,7 @@
  * be tested in isolation.
  */
 import { round } from '../utils/math_helpers.js';
+import { isSecretName, looksLikeCredentialValue, sqlMentionsSecret } from './sensitive_patterns.js';
 // ---------------------------------------------------------------------------
 // Warn-once tracking for write-path catch blocks
 // ---------------------------------------------------------------------------
@@ -40,27 +41,60 @@ export function normalizeSql(sql) {
 // ---------------------------------------------------------------------------
 /** Max length for a persisted string binding before it is truncated. */
 const MAX_BINDING_LEN = 256;
+/** Placeholder stored in place of a binding that looks like a credential. */
+const REDACTED_BINDING = '[redacted]';
 /**
- * Redact/truncate SQL bindings before persistence so secret-looking values
- * (long tokens, hashes, keys) are not stored in cleartext.
+ * Redact and truncate SQL bindings before persistence.
  *
- * Conservative: only long strings are truncated; short values (ids, flags,
- * emails, ordinary params) pass through so normal capture is unaffected.
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
  */
-export function sanitizeBindings(bindings) {
-    if (Array.isArray(bindings))
-        return bindings.map(sanitizeBindings);
-    if (typeof bindings === 'string' && bindings.length > MAX_BINDING_LEN) {
-        return bindings.slice(0, MAX_BINDING_LEN) + `…[truncated ${bindings.length} chars]`;
+export function sanitizeBindings(bindings, sqlText) {
+    const redactAll = sqlText !== undefined && sqlMentionsSecret(sqlText);
+    return sanitizeBindingValue(bindings, redactAll);
+}
+function sanitizeBindingValue(value, redactAll) {
+    if (Array.isArray(value))
+        return value.map((v) => sanitizeBindingValue(v, redactAll));
+    if (value !== null && typeof value === 'object')
+        return sanitizeNamedBindings(value, redactAll);
+    if (typeof value === 'string')
+        return sanitizeStringBinding(value, redactAll);
+    // A statement touching a secret column may bind it as a non-string — a numeric
+    // OTP, for instance — so redact those too rather than only masking strings.
+    // Booleans and null carry nothing worth hiding.
+    const redactable = value !== null && value !== undefined && typeof value !== 'boolean';
+    return redactAll && redactable ? REDACTED_BINDING : value;
+}
+/** Named bindings carry their own key, so use it when it is telling. */
+function sanitizeNamedBindings(value, redactAll) {
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+        out[key] = sanitizeBindingValue(nested, redactAll || isSecretName(key));
     }
-    if (bindings && typeof bindings === 'object') {
-        const out = {};
-        for (const [k, v] of Object.entries(bindings)) {
-            out[k] = sanitizeBindings(v);
-        }
-        return out;
+    return out;
+}
+function sanitizeStringBinding(value, redactAll) {
+    if (redactAll || looksLikeCredentialValue(value))
+        return REDACTED_BINDING;
+    if (value.length > MAX_BINDING_LEN) {
+        return value.slice(0, MAX_BINDING_LEN) + `…[truncated ${value.length} chars]`;
     }
-    return bindings;
+    return value;
 }
 // ---------------------------------------------------------------------------
 // Pure data-prep functions
@@ -78,13 +112,14 @@ export function prepareRequestRows(requests) {
             .map((q) => ({
             sql_text: q.sql,
             sql_normalized: normalizeSql(q.sql),
-            bindings: q.bindings ? JSON.stringify(sanitizeBindings(q.bindings)) : null,
+            bindings: q.bindings ? JSON.stringify(sanitizeBindings(q.bindings, q.sql)) : null,
             duration: round(q.duration),
             method: q.method,
             model: q.model,
             connection: q.connection,
             in_transaction: q.inTransaction ? 1 : 0,
         })),
+        eventRows: buildEventRows(input.events ?? []),
         traceRow: input.trace
             ? {
                 method: input.trace.method,
@@ -135,9 +170,14 @@ export function buildEmailRow(record) {
 /**
  * Transform EventRecords into SQLite-ready row objects.
  */
+/**
+ * Build event rows. `request_id` is attached at insert time, once the owning
+ * request row has an id — leaving it null here (as this did previously) meant
+ * retention never reclaimed them, since events are only pruned via the
+ * `server_stats_requests` foreign-key cascade.
+ */
 export function buildEventRows(events) {
     return events.map((e) => ({
-        request_id: null,
         event_name: e.event,
         data: e.data,
     }));
@@ -176,7 +216,7 @@ function buildRequestRow(input) {
 }
 /** Insert a single prepared request with its queries and trace. */
 async function insertOneRequest(trx, prepared) {
-    const { input, filteredQueries, traceRow } = prepared;
+    const { input, filteredQueries, traceRow, eventRows } = prepared;
     const row = buildRequestRow(input);
     const [requestId] = await trx('server_stats_requests').insert(row);
     const hasId = requestId !== null && requestId !== undefined;
@@ -184,6 +224,10 @@ async function insertOneRequest(trx, prepared) {
         const rows = filteredQueries.map((q) => ({ ...q, request_id: requestId }));
         await batchInsert(trx, 'server_stats_queries', rows);
     }
+    if (hasId && eventRows.length > 0) {
+        const rows = eventRows.map((e) => ({ ...e, request_id: requestId }));
+        await batchInsert(trx, 'server_stats_events', rows);
+    }
     if (hasId && traceRow) {
         await trx('server_stats_traces').insert({ ...traceRow, request_id: requestId });
     }
@@ -202,24 +246,6 @@ export async function flushRequests(trx, preparedRequests) {
         }
     }
 }
-/**
- * Flush pending events into the database.
- */
-export async function flushEvents(trx, events) {
-    for (const { events: evts } of events) {
-        try {
-            const rows = buildEventRows(evts);
-            await batchInsert(trx, 'server_stats_events', rows);
-        }
-        catch (err) {
-            if (!hasWarned('recordEvents')) {
-                markWarned('recordEvents');
-                const { log } = await import('../utils/logger.js');
-                log.warn(`dashboard: recordEvents failed — ${err?.message}`);
-            }
-        }
-    }
-}
 /**
  * Flush pending emails into the database.
  */

package/dist/src/debug/event_collector.d.ts

@@ -12,6 +12,14 @@ export declare class EventCollector {
     private circulars;
     private summarizeData;
     getEvents(): EventRecord[];
+    /**
+     * Events recorded after `lastId`, oldest first.
+     *
+     * Mirrors `QueryCollector.getQueriesSince` and drives the dashboard's
+     * request pipe, which persists whatever accumulated since the previous
+     * request completed.
+     */
+    getEventsSince(lastId: number): EventRecord[];
     getLatest(n?: number): EventRecord[];
     getTotalCount(): number;
     getBufferInfo(): {

package/dist/src/debug/event_collector.js

@@ -135,6 +135,18 @@ export class EventCollector {
     getEvents() {
         return this.buffer.toArray().reverse();
     }
+    /**
+     * Events recorded after `lastId`, oldest first.
+     *
+     * Mirrors `QueryCollector.getQueriesSince` and drives the dashboard's
+     * request pipe, which persists whatever accumulated since the previous
+     * request completed.
+     */
+    getEventsSince(lastId) {
+        if (lastId <= 0)
+            return this.buffer.toArray();
+        return this.buffer.collectFromEnd((e) => e.id > lastId);
+    }
     getLatest(n = 100) {
         return this.buffer.latest(n);
     }

package/dist/src/provider/dashboard_init.js

@@ -118,18 +118,27 @@ function pipeDashRequests(debugStore, dashboardStore) {
     }
     dashRequestPipeInstalled = true;
     let lastQueryId = 0;
+    let lastEventId = 0;
     setOnRequestComplete(({ method, url, statusCode, duration, trace, httpRequestId }) => {
         if (!dashboardStore.isReady())
             return;
         const q = debugStore.queries.getQueriesSince(lastQueryId);
         if (q.length > 0)
             lastQueryId = q[q.length - 1].id;
+        // Events are collected globally rather than per-request, so — exactly like
+        // queries above — anything emitted outside a request is attributed to
+        // whichever request finishes next. Imprecise, but it keeps events linked to
+        // a request row, which is what retention prunes on.
+        const events = debugStore.capture.events ? debugStore.events.getEventsSince(lastEventId) : [];
+        if (events.length > 0)
+            lastEventId = events[events.length - 1].id;
         dashboardStore.persistRequest({
             method,
             url,
             statusCode,
             duration,
             queries: q,
+            events,
             trace: trace ?? null,
             httpRequestId: httpRequestId ?? null,
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adonisjs-server-stats",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "description": "Real-time server monitoring for AdonisJS v6 applications",
   "keywords": [
     "adonisjs",