adonisjs-server-stats 1.16.0 → 1.17.0

package/dist/src/dashboard/integrations/config_inspector.js

@@ -1,48 +1,9 @@
+import { isSensitiveConfigName, looksLikeCredentialValue } from '../sensitive_patterns.js';
 // ---------------------------------------------------------------------------
-// Sensitive key patterns
+// Sensitive key detection
 // ---------------------------------------------------------------------------
-/**
- * Patterns matched against key names (case-insensitive) to detect secrets.
- *
- * Uses `(?:^|[_.-])` and `(?:$|[_.-])` as boundaries instead of `\b`
- * because env vars use `_` as separators and `_` is a word character
- * in regex, so `\b` won't match between `CLIENT` and `SECRET` in
- * `GOOGLE_CLIENT_SECRET`.
- */
-const B = '(?:^|[_.\\-])'; // boundary before
-const A = '(?:$|[_.\\-])'; // boundary after
-const SENSITIVE_PATTERNS = [
-    new RegExp(`${B}password${A}`, 'i'),
-    new RegExp(`${B}secret${A}`, 'i'),
-    new RegExp(`${B}token${A}`, 'i'),
-    new RegExp(`${B}credential${A}`, 'i'),
-    new RegExp(`${B}private${A}`, 'i'),
-    new RegExp(`${B}auth${A}`, 'i'),
-    // API keys: `api_key`, `apiKey`, `API_KEY`
-    /api[_-]?key/i,
-    // `_KEY` at end or `_KEY_` in middle (AWS_ACCESS_KEY_ID, ENCRYPTION_KEY, etc.)
-    /[_-]key([_-]|$)/i,
-    // ACCESS_KEY pattern (AWS credentials)
-    /access[_-]?key/i,
-    // Exact match for just "key" (standalone)
-    /^key$/i,
-    // Connection strings and DSNs
-    new RegExp(`${B}dsn${A}`, 'i'),
-    /connection[_-]?string/i,
-    // Email addresses in env var names
-    new RegExp(`${B}email${A}`, 'i'),
-    new RegExp(`${B}smtp${A}`, 'i'),
-    // Database/service URLs (often contain embedded credentials)
-    /database[_-]?url/i,
-    /redis[_-]?url/i,
-    // Webhook secrets
-    /webhook[_-]?secret/i,
-    // Signing / encryption
-    new RegExp(`${B}signing${A}`, 'i'),
-    new RegExp(`${B}encryption${A}`, 'i'),
-    // App key / app secret
-    /app[_-]key/i,
-];
+// The name patterns live in `../sensitive_patterns.js` so the config inspector
+// and the SQL-binding writer share one definition of "looks like a secret".
 const REDACTED_DISPLAY = '••••••••';
 function redact(_value) {
     // Never include the plaintext value: the redacted object is serialized
@@ -121,20 +82,19 @@ export class ConfigInspector {
  * Check if a key name matches any sensitive pattern.
  */
 function isSensitiveKey(key) {
-    return SENSITIVE_PATTERNS.some((pattern) => pattern.test(key));
+    return isSensitiveConfigName(key);
 }
 /**
  * Check if a value looks sensitive based on its content.
  * Catches email addresses and URLs with embedded credentials.
  */
 function isSensitiveValue(value) {
-    // Email addresses
+    // Email addresses are config-sensitive (SMTP accounts) even though they are
+    // ordinary data as a query binding — hence the check lives here, not in the
+    // shared shape helper.
     if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value))
         return true;
-    // URLs with userinfo (credentials embedded in URL)
-    if (/^[a-z][a-z0-9+.-]*:\/\/[^/]*:[^/]*@/i.test(value))
-        return true;
-    return false;
+    return looksLikeCredentialValue(value);
 }
 /** Sanitize a single key-value pair, redacting sensitive strings. */
 function sanitizeValue(key, value, seen) {
@@ -142,7 +102,7 @@ function sanitizeValue(key, value, seen) {
         return redact(value);
     }
     if (typeof value === 'object' && value !== null) {
-        return sanitizeObject(value, seen);
+        return sanitizeObject(value, seen, key);
     }
     return value;
 }
@@ -150,7 +110,7 @@ function sanitizeValue(key, value, seen) {
  * Recursively sanitize an object, redacting string values whose keys
  * match sensitive patterns. Booleans and numbers are never redacted.
  */
-function sanitizeObject(obj, seen = new WeakSet()) {
+function sanitizeObject(obj, seen = new WeakSet(), parentKey = '') {
     if (obj === null || obj === undefined)
         return obj;
     if (typeof obj !== 'object')
@@ -159,7 +119,10 @@ function sanitizeObject(obj, seen = new WeakSet()) {
         return '[Circular]';
     seen.add(obj);
     if (Array.isArray(obj)) {
-        return obj.map((item) => sanitizeObject(item, seen));
+        // Route items through sanitizeValue (under the array's own key) so string
+        // elements get the value-shape checks — previously a credential inside an
+        // array survived because sanitizeObject passes primitives through.
+        return obj.map((item) => sanitizeValue(parentKey, item, seen));
     }
     const record = obj;
     const result = {};

package/dist/src/dashboard/migrator_tables.js

@@ -28,6 +28,10 @@ export async function migrateRequests(db) {
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_created ON server_stats_requests(created_at)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_url ON server_stats_requests(url)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_duration ON server_stats_requests(duration)`);
+    // Covers the overview p95 query (WHERE created_at >= ? ORDER BY duration):
+    // with only the single-column indexes SQLite sorts the whole filtered range
+    // on every 2s cache miss.
+    await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_created_duration ON server_stats_requests(created_at, duration)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_status ON server_stats_requests(status_code)`);
     try {
         await db.raw('ALTER TABLE server_stats_requests ADD COLUMN http_request_id TEXT');

package/dist/src/dashboard/paginate_helper.js

@@ -15,31 +15,41 @@ export function clampPerPage(value) {
         return 25;
     return clamp(Math.trunc(n), 1, 200);
 }
+/**
+ * Rows the COUNT is allowed to scan. Filters include leading-wildcard LIKEs
+ * that no index can serve, so an uncapped COUNT walks the entire table twice
+ * per request (count + data). Past this many matches the exact total stops
+ * being interesting — the UI just needs "lots of pages".
+ */
+const COUNT_SCAN_CAP = 10_000;
 /**
  * Execute a paginated query within a transaction.
  */
 export async function executePaginate(db, opts) {
     const perPage = clampPerPage(opts.perPage);
     return db.transaction(async (trx) => {
-        const countQuery = trx(opts.table);
+        const countSub = trx(opts.table).select(trx.raw('1')).limit(COUNT_SCAN_CAP);
         if (opts.applyFilters)
-            opts.applyFilters(countQuery);
-        const [{ count: totalRaw }] = await countQuery.count('* as count');
-        const total = Number(totalRaw);
-        const offset = (opts.page - 1) * perPage;
-        const dataQuery = trx(opts.table)
-            .orderBy('created_at', 'desc')
-            .limit(perPage)
-            .offset(offset);
+            opts.applyFilters(countSub);
+        const countRows = (await trx.count('* as count').from(countSub.as('t')));
+        const total = Number(countRows[0]?.count ?? 0);
+        // Clamp the page into the real range: an arbitrary ?page= forces a
+        // full-scan-sized OFFSET on the single sqlite connection, blocking every
+        // other dashboard read for nothing.
+        const lastPage = Math.ceil(total / perPage);
+        const requested = Number.isFinite(Number(opts.page)) ? Math.trunc(Number(opts.page)) : 1;
+        const page = clamp(requested, 1, Math.max(1, lastPage));
+        const offset = (page - 1) * perPage;
+        const dataQuery = trx(opts.table).orderBy('created_at', 'desc').limit(perPage).offset(offset);
         if (opts.applyFilters)
             opts.applyFilters(dataQuery);
         const data = await dataQuery;
         return {
             data,
             total,
-            page: opts.page,
+            page,
             perPage,
-            lastPage: Math.ceil(total / perPage),
+            lastPage,
         };
     });
 }

package/dist/src/dashboard/sensitive_patterns.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared server-side rules for recognising credentials.
+ *
+ * Both the config inspector and the SQL-binding writer need to answer "does
+ * this look like a secret?", and they used to answer it differently — config
+ * values were redacted against a real word list while query bindings were only
+ * truncated by length. One list, used by both, so the same secret cannot be
+ * masked in one view and printed in full in another.
+ */
+/**
+ * Names that identify a credential — applies to env vars, config keys, and SQL
+ * identifiers alike.
+ */
+export declare const SECRET_NAME_PATTERNS: RegExp[];
+/**
+ * Names that matter for env vars and config keys but NOT for SQL identifiers.
+ *
+ * An `email` env var is usually an SMTP account; an `email` *column* is ordinary
+ * application data, and redacting every binding of every query that touches it
+ * would make the query pane useless for debugging auth. Same for the service
+ * URLs, which are env-shaped names rather than column names.
+ */
+export declare const CONFIG_ONLY_NAME_PATTERNS: RegExp[];
+/** Whether a name identifies a credential. */
+export declare function isSecretName(name: string): boolean;
+/** Whether a name is sensitive in a config/env context (credentials plus contact/service names). */
+export declare function isSensitiveConfigName(name: string): boolean;
+/**
+ * Whether a SQL statement mentions a credential-shaped identifier.
+ *
+ * Tokenised first: the name patterns above use `_`/`.`/`-` boundaries, so
+ * running them across raw SQL would miss `password` sitting between spaces.
+ *
+ * Positional bindings cannot be mapped back to specific columns reliably, so a
+ * hit means every binding for that statement is redacted. Coarse on purpose —
+ * over-redacting one statement's parameters beats storing a password.
+ */
+export declare function sqlMentionsSecret(sql: string): boolean;
+export declare function looksLikeCredentialValue(value: string): boolean;
+/**
+ * Redact and truncate SQL bindings before persistence.
+ *
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
+ */
+export declare function sanitizeBindings(bindings: unknown, sqlText?: string): unknown;
+/**
+ * Redact a structured record (a pino log entry, an event payload) with the
+ * same key/shape rules as bindings but WITHOUT length truncation — log data
+ * carries stack traces and payload context that must stay whole.
+ */
+export declare function sanitizeRecordValues(record: unknown): unknown;
+/**
+ * Redact credential-bearing query parameters from a URL before it is stored.
+ *
+ * Request URLs are persisted with their query strings (useful for debugging
+ * pagination and filters), but a `?token=…` password-reset link or a
+ * `?signature=…` signed URL must not land in SQLite in the clear. Parameters
+ * are redacted by name (see {@link isSecretName}) or when the value itself
+ * looks like a credential; everything else passes through untouched.
+ */
+export declare function sanitizeUrlQuery(url: string): string;

package/dist/src/dashboard/sensitive_patterns.js

@@ -0,0 +1,259 @@
+/**
+ * Shared server-side rules for recognising credentials.
+ *
+ * Both the config inspector and the SQL-binding writer need to answer "does
+ * this look like a secret?", and they used to answer it differently — config
+ * values were redacted against a real word list while query bindings were only
+ * truncated by length. One list, used by both, so the same secret cannot be
+ * masked in one view and printed in full in another.
+ */
+// Custom word boundaries: `\b` does not match between `CLIENT` and `SECRET` in
+// `GOOGLE_CLIENT_SECRET`, because `_` is a word character. These treat `_`,
+// `.`, and `-` as separators, and also match a bare token on its own. The
+// trailing boundary tolerates a plural `s` so `tokens`/`secrets` match too.
+// camelCase is handled by normalizing the name BEFORE testing (see
+// `splitCamelCase`), not by the boundaries themselves.
+const B = '(?:^|[_.\\-])'; // boundary before
+const A = 's?(?:$|[_.\\-])'; // boundary after (optional plural)
+/**
+ * Insert `_` at lower/digit→UPPER transitions so the separator-based patterns
+ * above see camelCase the same way they see snake_case. Without this,
+ * `passwordHash` and `clientSecret` — the *normal* shape for AdonisJS config
+ * keys and camelCase column strategies — sail past every pattern while their
+ * snake_case twins are redacted.
+ */
+function splitCamelCase(name) {
+    return name.replace(/([a-z0-9])([A-Z])/g, '$1_$2');
+}
+/**
+ * Names that identify a credential — applies to env vars, config keys, and SQL
+ * identifiers alike.
+ */
+export const SECRET_NAME_PATTERNS = [
+    new RegExp(`${B}password${A}`, 'i'),
+    new RegExp(`${B}secret${A}`, 'i'),
+    new RegExp(`${B}token${A}`, 'i'),
+    new RegExp(`${B}credential${A}`, 'i'),
+    new RegExp(`${B}private${A}`, 'i'),
+    new RegExp(`${B}auth${A}`, 'i'),
+    // HTTP credential carriers — log records embed request headers
+    new RegExp(`${B}authorization${A}`, 'i'),
+    new RegExp(`${B}cookie${A}`, 'i'),
+    // API keys: `api_key`, `apiKey`, `API_KEY`
+    /api[_-]?key/i,
+    // `_KEY` at end or `_KEY_` in middle (AWS_ACCESS_KEY_ID, ENCRYPTION_KEY, etc.)
+    /[_-]key([_-]|$)/i,
+    // ACCESS_KEY pattern (AWS credentials)
+    /access[_-]?key/i,
+    // Exact match for just "key" (standalone)
+    /^key$/i,
+    // Connection strings and DSNs
+    new RegExp(`${B}dsn${A}`, 'i'),
+    /connection[_-]?string/i,
+    // Webhook secrets
+    /webhook[_-]?secret/i,
+    // Signing / encryption
+    new RegExp(`${B}signing${A}`, 'i'),
+    new RegExp(`${B}encryption${A}`, 'i'),
+    // App key / app secret
+    /app[_-]key/i,
+    // One-time codes and second factors
+    new RegExp(`${B}otp${A}`, 'i'),
+    new RegExp(`${B}totp${A}`, 'i'),
+    new RegExp(`${B}mfa${A}`, 'i'),
+    // Password abbreviations
+    new RegExp(`${B}passwd${A}`, 'i'),
+    new RegExp(`${B}pwd${A}`, 'i'),
+    // Card / identity numbers
+    new RegExp(`${B}cvv${A}`, 'i'),
+    new RegExp(`${B}cvc${A}`, 'i'),
+    new RegExp(`${B}pin${A}`, 'i'),
+    new RegExp(`${B}ssn${A}`, 'i'),
+];
+/**
+ * Names that matter for env vars and config keys but NOT for SQL identifiers.
+ *
+ * An `email` env var is usually an SMTP account; an `email` *column* is ordinary
+ * application data, and redacting every binding of every query that touches it
+ * would make the query pane useless for debugging auth. Same for the service
+ * URLs, which are env-shaped names rather than column names.
+ */
+export const CONFIG_ONLY_NAME_PATTERNS = [
+    new RegExp(`${B}email${A}`, 'i'),
+    new RegExp(`${B}smtp${A}`, 'i'),
+    /database[_-]?url/i,
+    /redis[_-]?url/i,
+];
+/** Whether a name identifies a credential. */
+export function isSecretName(name) {
+    const normalized = splitCamelCase(name);
+    return SECRET_NAME_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+/** Whether a name is sensitive in a config/env context (credentials plus contact/service names). */
+export function isSensitiveConfigName(name) {
+    if (isSecretName(name))
+        return true;
+    const normalized = splitCamelCase(name);
+    return CONFIG_ONLY_NAME_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+/** Identifier-ish tokens in a SQL statement: table names, column names, aliases. */
+const SQL_IDENTIFIER_RE = /[A-Za-z_][A-Za-z0-9_$]*/g;
+/**
+ * Whether a SQL statement mentions a credential-shaped identifier.
+ *
+ * Tokenised first: the name patterns above use `_`/`.`/`-` boundaries, so
+ * running them across raw SQL would miss `password` sitting between spaces.
+ *
+ * Positional bindings cannot be mapped back to specific columns reliably, so a
+ * hit means every binding for that statement is redacted. Coarse on purpose —
+ * over-redacting one statement's parameters beats storing a password.
+ */
+export function sqlMentionsSecret(sql) {
+    for (const match of sql.matchAll(SQL_IDENTIFIER_RE)) {
+        if (isSecretName(match[0]))
+            return true;
+    }
+    return false;
+}
+/**
+ * Whether a value looks like a credential from its shape alone, independent of
+ * any name.
+ *
+ * Deliberately excludes bare email addresses: they are sensitive as *config*
+ * (see {@link CONFIG_ONLY_NAME_PATTERNS}) but are ordinary query parameters.
+ */
+const CREDENTIAL_VALUE_PATTERNS = [
+    // URL with userinfo — credentials embedded in the URL
+    /^[a-z][a-z0-9+.-]*:\/\/[^/]*:[^/]*@/i,
+    // bcrypt / argon2 / scrypt password hashes
+    /^\$(?:2[aby]|argon2[a-z]*|scrypt|s?crypt)\$/i,
+    // JWT
+    /^ey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\./,
+    // Well-known provider key prefixes. Underscores allowed in the tail so
+    // `sk_live_…` / `pk_test_…` match (Stripe, GitHub, Slack, AWS).
+    /^(?:sk|pk|rk|whsec)_[A-Za-z0-9_]{8,}/,
+    /^gh[pousr]_[A-Za-z0-9]{8,}/,
+    /^xox[baprs]-[A-Za-z0-9-]{8,}/,
+    /^(?:AKIA|ASIA)[A-Z0-9]{12,}$/,
+    // Long hex digests — session ids, reset tokens, sha hashes
+    /^[0-9a-f]{32,}$/i,
+];
+/** Minimum length before a base64url-shaped blob is treated as high-entropy. */
+const MIN_BLOB_LEN = 40;
+export function looksLikeCredentialValue(value) {
+    // Long high-entropy base64url blobs — length-gated, so kept out of the table.
+    if (value.length >= MIN_BLOB_LEN && /^[A-Za-z0-9_-]+={0,2}$/.test(value))
+        return true;
+    return CREDENTIAL_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
+// ---------------------------------------------------------------------------
+// Binding hygiene
+// ---------------------------------------------------------------------------
+/** Max length for a stored string binding before it is truncated. */
+const MAX_BINDING_LEN = 256;
+/** Placeholder stored in place of a binding that looks like a credential. */
+const REDACTED_BINDING = '[redacted]';
+/**
+ * Redact and truncate SQL bindings before persistence.
+ *
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
+ */
+export function sanitizeBindings(bindings, sqlText) {
+    const redactAll = sqlText !== undefined && sqlMentionsSecret(sqlText);
+    return sanitizeBindingValue(bindings, redactAll, true);
+}
+/**
+ * Redact a structured record (a pino log entry, an event payload) with the
+ * same key/shape rules as bindings but WITHOUT length truncation — log data
+ * carries stack traces and payload context that must stay whole.
+ */
+export function sanitizeRecordValues(record) {
+    return sanitizeBindingValue(record, false, false);
+}
+function sanitizeBindingValue(value, redactAll, truncate) {
+    if (Array.isArray(value))
+        return value.map((v) => sanitizeBindingValue(v, redactAll, truncate));
+    if (value !== null && typeof value === 'object') {
+        return sanitizeNamedBindings(value, redactAll, truncate);
+    }
+    if (typeof value === 'string')
+        return sanitizeStringBinding(value, redactAll, truncate);
+    // A statement touching a secret column may bind it as a non-string — a numeric
+    // OTP, for instance — so redact those too rather than only masking strings.
+    // Booleans and null carry nothing worth hiding.
+    const redactable = value !== null && value !== undefined && typeof value !== 'boolean';
+    return redactAll && redactable ? REDACTED_BINDING : value;
+}
+/** Named bindings carry their own key, so use it when it is telling. */
+function sanitizeNamedBindings(value, redactAll, truncate) {
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+        out[key] = sanitizeBindingValue(nested, redactAll || isSecretName(key), truncate);
+    }
+    return out;
+}
+/** Matches a value this module already truncated, so a second pass is a no-op. */
+const TRUNCATION_MARKER_RE = /…\[truncated \d+ chars\]$/;
+function sanitizeStringBinding(value, redactAll, truncate) {
+    if (redactAll || looksLikeCredentialValue(value))
+        return REDACTED_BINDING;
+    if (truncate && value.length > MAX_BINDING_LEN && !TRUNCATION_MARKER_RE.test(value)) {
+        return value.slice(0, MAX_BINDING_LEN) + `…[truncated ${value.length} chars]`;
+    }
+    return value;
+}
+// ---------------------------------------------------------------------------
+// URL hygiene
+// ---------------------------------------------------------------------------
+/**
+ * Redact credential-bearing query parameters from a URL before it is stored.
+ *
+ * Request URLs are persisted with their query strings (useful for debugging
+ * pagination and filters), but a `?token=…` password-reset link or a
+ * `?signature=…` signed URL must not land in SQLite in the clear. Parameters
+ * are redacted by name (see {@link isSecretName}) or when the value itself
+ * looks like a credential; everything else passes through untouched.
+ */
+export function sanitizeUrlQuery(url) {
+    const qIdx = url.indexOf('?');
+    if (qIdx === -1)
+        return url;
+    const sanitized = url
+        .slice(qIdx + 1)
+        .split('&')
+        .map((pair) => {
+        if (pair === '')
+            return pair;
+        const eq = pair.indexOf('=');
+        const name = eq === -1 ? pair : pair.slice(0, eq);
+        const rawValue = eq === -1 ? '' : pair.slice(eq + 1);
+        let value = rawValue;
+        try {
+            value = decodeURIComponent(rawValue);
+        }
+        catch {
+            // Malformed escape — judge the raw text instead.
+        }
+        if (isSecretName(name) || (value !== '' && looksLikeCredentialValue(value))) {
+            return `${name}=[redacted]`;
+        }
+        return pair;
+    })
+        .join('&');
+    return url.slice(0, qIdx) + '?' + sanitized;
+}

package/dist/src/dashboard/write_queue.d.ts

@@ -5,11 +5,18 @@
  * objects. They are pure (no I/O, no Knex dependency) so they can
  * be tested in isolation.
  */
+import { sanitizeBindings } from './sensitive_patterns.js';
 import type { EventRecord, EmailRecord } from '../debug/types.js';
 import type { PersistRequestInput } from './dashboard_types.js';
 import type { Knex } from 'knex';
 export declare function hasWarned(path: string): boolean;
 export declare function markWarned(path: string): void;
+/**
+ * Forget which write paths have warned. Called when a DashboardStore stops so
+ * a re-initialized store in the same process warns afresh instead of
+ * inheriting a spent latch from its predecessor.
+ */
+export declare function resetWriteWarnings(): void;
 /**
  * Normalize a SQL query by replacing literal values with `?` placeholders.
  * Used for grouping identical query patterns.
@@ -20,14 +27,7 @@ export declare function markWarned(path: string): void;
  * merged together.
  */
 export declare function normalizeSql(sql: string): string;
-/**
- * Redact/truncate SQL bindings before persistence so secret-looking values
- * (long tokens, hashes, keys) are not stored in cleartext.
- *
- * Conservative: only long strings are truncated; short values (ids, flags,
- * emails, ordinary params) pass through so normal capture is unaffected.
- */
-export declare function sanitizeBindings(bindings: unknown): unknown;
+export { sanitizeBindings };
 export interface PreparedQuery {
     sql_text: string;
     sql_normalized: string;
@@ -51,6 +51,7 @@ export interface PreparedRequest {
     input: PersistRequestInput;
     filteredQueries: PreparedQuery[];
     traceRow: PreparedTraceRow | null;
+    eventRows: EventRow[];
 }
 export interface PreparedLog {
     [key: string]: unknown;
@@ -75,7 +76,6 @@ export interface EmailRow {
 }
 export interface EventRow {
     [key: string]: unknown;
-    request_id: null;
     event_name: string;
     data: string | null;
 }
@@ -87,6 +87,13 @@ export interface EventRow {
 export declare function prepareRequestRows(requests: PersistRequestInput[]): PreparedRequest[];
 /**
  * Transform raw log entries into SQLite-ready row objects.
+ *
+ * The full pino record lands in `data`, and log lines routinely carry bound
+ * request context — authorization headers, cookies, tokens in payloads — so
+ * the record is run through the shared redaction rules (secret-named keys and
+ * credential-shaped values) before it is stringified. The `message` column is
+ * kept verbatim: it is free text, and the shape rules are anchored to whole
+ * values, so prose stays readable.
  */
 export declare function prepareLogRows(logs: Record<string, unknown>[]): PreparedLog[];
 /**
@@ -96,19 +103,23 @@ export declare function buildEmailRow(record: EmailRecord): EmailRow;
 /**
  * Transform EventRecords into SQLite-ready row objects.
  */
+/**
+ * Build event rows. `request_id` is attached at insert time, once the owning
+ * request row has an id — leaving it null here (as this did previously) meant
+ * retention never reclaimed them, since events are only pruned via the
+ * `server_stats_requests` foreign-key cascade.
+ */
 export declare function buildEventRows(events: EventRecord[]): EventRow[];
 /**
  * Insert rows into a table in batches of 50.
+ *
+ * Yields to the event loop between chunks: better-sqlite3 is fully
+ * synchronous, so without a real macrotask hop a large batch would execute
+ * back-to-back on microtask continuations and stall the host app — the exact
+ * failure mode `migrator_tables.ts` documents and guards against.
  */
 export declare function batchInsert(trx: Knex.Transaction, table: string, rows: Record<string, unknown>[]): Promise<void>;
 export declare function flushRequests(trx: Knex.Transaction, preparedRequests: PreparedRequest[]): Promise<void>;
-/**
- * Flush pending events into the database.
- */
-export declare function flushEvents(trx: Knex.Transaction, events: {
-    requestIndex: number;
-    events: EventRecord[];
-}[]): Promise<void>;
 /**
  * Flush pending emails into the database.
  */