adonisjs-server-stats 1.16.1 → 1.18.0

package/dist/src/dashboard/migrator.js

@@ -27,15 +27,20 @@ export async function autoMigrate(db) {
     await migrateSavedFilters(db);
 }
 /**
- * Delete records older than `retentionDays` from all tables.
+ * Delete records older than `retentionDays` from all tables, then enforce
+ * the database size cap.
  *
  * Foreign-key cascades on `server_stats_requests` handle the child
  * tables (queries, events, traces).  Standalone tables (logs, emails,
  * metrics, saved_filters) are pruned individually.
  *
+ * `maxDbSizeMb` bounds the *live* data size: when exceeded, the globally
+ * oldest rows are deleted — regardless of age — until usage drops below
+ * ~90% of the cap. `0` disables the cap.
+ *
  * Yields between each DELETE so the event loop stays responsive.
  */
-export async function runRetentionCleanup(db, retentionDays) {
+export async function runRetentionCleanup(db, retentionDays, maxDbSizeMb = 0) {
     // Use string interpolation instead of parameterized bindings.
     // Knex + better-sqlite3 can hang on parameterized db.raw() calls,
     // while non-parameterized queries (used in migrations) work fine.
@@ -53,7 +58,12 @@ export async function runRetentionCleanup(db, retentionDays) {
         await yieldToEventLoop();
         await batchDelete(db, 'server_stats_metrics', cutoff);
         await yieldToEventLoop();
-        // Reclaim space and update query planner statistics
+        if (maxDbSizeMb > 0)
+            await enforceSizeCap(db, maxDbSizeMb);
+        // Return deleted pages to the OS — PRAGMA optimize alone only updates
+        // planner stats, leaving the file at its high-water mark forever.
+        await reclaimFreeSpace(db);
+        // Update query planner statistics
         await db.raw('PRAGMA optimize');
     }
     catch (err) {
@@ -72,10 +82,134 @@ async function batchDelete(db, table, cutoff) {
     let hasMore = true;
     while (hasMore) {
         await db.raw(`DELETE FROM ${table} WHERE rowid IN (SELECT rowid FROM ${table} WHERE created_at < ${cutoff} LIMIT 1000)`);
-        const remaining = await db.raw(`SELECT COUNT(*) as cnt FROM ${table} WHERE created_at < ${cutoff} LIMIT 1`);
-        const cnt = remaining?.[0]?.cnt ?? 0;
-        hasMore = cnt > 0;
+        // changes() reports the last DELETE's row count on this connection
+        // (pool is min:1/max:1). Re-counting the remaining backlog here instead
+        // made total work quadratic in backlog size.
+        const deleted = await pragmaNumber(db, 'SELECT changes() AS n');
+        hasMore = deleted === 1000;
         if (hasMore)
             await yieldToEventLoop();
     }
 }
+/** Root tables pruned by the size cap; requests cascades to queries/events/traces. */
+const SIZE_CAP_TABLES = [
+    'server_stats_requests',
+    'server_stats_logs',
+    'server_stats_emails',
+    'server_stats_metrics',
+];
+/**
+ * Bytes of live data: total pages minus freelist pages. Freed pages are
+ * excluded because reclaimFreeSpace returns them to the OS afterwards.
+ */
+async function liveSizeBytes(db, pageSize) {
+    const pages = await pragmaNumber(db, 'PRAGMA page_count');
+    const freelist = await pragmaNumber(db, 'PRAGMA freelist_count');
+    return (pages - freelist) * pageSize;
+}
+/**
+ * Keep live data under `maxSizeMb` by deleting the globally oldest rows,
+ * whatever their age — a size cap effectively shortens the retention
+ * window when write volume outruns `retentionDays`.
+ *
+ * Prunes down to ~90% of the cap so the hourly cleanup doesn't re-trigger
+ * on every pass. Each round deletes 1000 rows from whichever root table
+ * currently holds the oldest data, so mixed workloads (trace-heavy vs
+ * log-heavy) shed their actual oldest history first.
+ */
+async function enforceSizeCap(db, maxSizeMb) {
+    const budget = maxSizeMb * 1024 * 1024;
+    const pageSize = await pragmaNumber(db, 'PRAGMA page_size');
+    if ((await liveSizeBytes(db, pageSize)) <= budget)
+        return;
+    const { log } = await import('../utils/logger.js');
+    log.info(`dashboard: database over the ${maxSizeMb} MB size cap — pruning oldest records`);
+    const target = budget * 0.9;
+    // 10k rounds × 1000 rows bounds one pass; the next hourly pass continues.
+    let guard = 10_000;
+    while (guard-- > 0 && (await liveSizeBytes(db, pageSize)) > target) {
+        const table = await findTableWithOldestRow(db);
+        if (!table)
+            break;
+        await db.raw(`DELETE FROM ${table} WHERE rowid IN (SELECT rowid FROM ${table} ORDER BY created_at LIMIT 1000)`);
+        const deleted = await pragmaNumber(db, 'SELECT changes() AS n');
+        if (deleted === 0)
+            break;
+        await yieldToEventLoop();
+    }
+}
+/** The root table whose oldest row is globally oldest, or null when all are empty. */
+async function findTableWithOldestRow(db) {
+    let best = null;
+    let bestTs = '';
+    for (const table of SIZE_CAP_TABLES) {
+        const rows = (await db.raw(`SELECT MIN(created_at) AS ts FROM ${table}`));
+        const ts = rows?.[0]?.ts;
+        if (ts && (best === null || ts < bestTs)) {
+            best = table;
+            bestTs = ts;
+        }
+    }
+    return best;
+}
+/**
+ * Return freelist pages to the OS after a cleanup pass.
+ *
+ * Databases created with `auto_vacuum=INCREMENTAL` are trimmed in bounded
+ * chunks so each synchronous step stays short. Legacy databases (created
+ * before the pragma existed) can't be trimmed incrementally, so when dead
+ * pages exceed ~30% of the file a one-time VACUUM rewrites it — which also
+ * converts it to incremental mode, since `auto_vacuum=INCREMENTAL` is set
+ * on this connection.
+ */
+async function reclaimFreeSpace(db) {
+    const mode = await pragmaNumber(db, 'PRAGMA auto_vacuum');
+    if (mode === 2) {
+        // Chunks of ~2000 pages (~8 MB at the 4 KB default) keep each synchronous
+        // call short; guard bounds one pass at ~8 GB in case freelist_count
+        // misbehaves.
+        let guard = 1000;
+        while (guard-- > 0) {
+            const freelist = await pragmaNumber(db, 'PRAGMA freelist_count');
+            if (freelist <= 0)
+                break;
+            if (!(await incrementalVacuumChunk(db)))
+                break;
+            await yieldToEventLoop();
+        }
+        return;
+    }
+    const pageCount = await pragmaNumber(db, 'PRAGMA page_count');
+    const freelistCount = await pragmaNumber(db, 'PRAGMA freelist_count');
+    if (pageCount > 0 && freelistCount / pageCount > 0.3) {
+        const { log } = await import('../utils/logger.js');
+        log.info(`dashboard: reclaiming ${freelistCount} of ${pageCount} pages via one-time VACUUM (may pause briefly)`);
+        await db.raw('VACUUM');
+        log.info('dashboard: VACUUM complete — database converted to incremental auto-vacuum');
+    }
+}
+/**
+ * Free up to 2000 freelist pages. incremental_vacuum frees ONE page per
+ * sqlite3_step, and knex's raw() steps no-result pragmas exactly once — so
+ * it must run on the underlying better-sqlite3 handle, whose .pragma()
+ * steps to completion. Returns false if the handle has no pragma method.
+ */
+async function incrementalVacuumChunk(db) {
+    const client = db.client;
+    const conn = (await client.acquireConnection());
+    try {
+        if (typeof conn.pragma !== 'function')
+            return false;
+        conn.pragma('incremental_vacuum(2000)');
+        return true;
+    }
+    finally {
+        client.releaseConnection(conn);
+    }
+}
+/** Run a single-row/single-column statement and return its value as a number. */
+async function pragmaNumber(db, statement) {
+    const rows = (await db.raw(statement));
+    const value = Object.values(rows?.[0] ?? {})[0];
+    return Number(value ?? 0);
+}

package/dist/src/dashboard/migrator_tables.js

@@ -28,6 +28,10 @@ export async function migrateRequests(db) {
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_created ON server_stats_requests(created_at)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_url ON server_stats_requests(url)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_duration ON server_stats_requests(duration)`);
+    // Covers the overview p95 query (WHERE created_at >= ? ORDER BY duration):
+    // with only the single-column indexes SQLite sorts the whole filtered range
+    // on every 2s cache miss.
+    await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_created_duration ON server_stats_requests(created_at, duration)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_status ON server_stats_requests(status_code)`);
     try {
         await db.raw('ALTER TABLE server_stats_requests ADD COLUMN http_request_id TEXT');
@@ -68,6 +72,10 @@ export async function migrateEvents(db) {
   `);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_events_created ON server_stats_events(created_at)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_events_name ON server_stats_events(event_name)`);
+    // Without this index every cascaded delete from server_stats_requests
+    // full-scans the events table (synchronously, on the host event loop) —
+    // the other FK children (queries, traces, logs) all have one.
+    await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_events_request ON server_stats_events(request_id)`);
 }
 export async function migrateEmails(db) {
     await db.raw(`

package/dist/src/dashboard/paginate_helper.js

@@ -15,31 +15,41 @@ export function clampPerPage(value) {
         return 25;
     return clamp(Math.trunc(n), 1, 200);
 }
+/**
+ * Rows the COUNT is allowed to scan. Filters include leading-wildcard LIKEs
+ * that no index can serve, so an uncapped COUNT walks the entire table twice
+ * per request (count + data). Past this many matches the exact total stops
+ * being interesting — the UI just needs "lots of pages".
+ */
+const COUNT_SCAN_CAP = 10_000;
 /**
  * Execute a paginated query within a transaction.
  */
 export async function executePaginate(db, opts) {
     const perPage = clampPerPage(opts.perPage);
     return db.transaction(async (trx) => {
-        const countQuery = trx(opts.table);
+        const countSub = trx(opts.table).select(trx.raw('1')).limit(COUNT_SCAN_CAP);
         if (opts.applyFilters)
-            opts.applyFilters(countQuery);
-        const [{ count: totalRaw }] = await countQuery.count('* as count');
-        const total = Number(totalRaw);
-        const offset = (opts.page - 1) * perPage;
-        const dataQuery = trx(opts.table)
-            .orderBy('created_at', 'desc')
-            .limit(perPage)
-            .offset(offset);
+            opts.applyFilters(countSub);
+        const countRows = (await trx.count('* as count').from(countSub.as('t')));
+        const total = Number(countRows[0]?.count ?? 0);
+        // Clamp the page into the real range: an arbitrary ?page= forces a
+        // full-scan-sized OFFSET on the single sqlite connection, blocking every
+        // other dashboard read for nothing.
+        const lastPage = Math.ceil(total / perPage);
+        const requested = Number.isFinite(Number(opts.page)) ? Math.trunc(Number(opts.page)) : 1;
+        const page = clamp(requested, 1, Math.max(1, lastPage));
+        const offset = (page - 1) * perPage;
+        const dataQuery = trx(opts.table).orderBy('created_at', 'desc').limit(perPage).offset(offset);
         if (opts.applyFilters)
             opts.applyFilters(dataQuery);
         const data = await dataQuery;
         return {
             data,
             total,
-            page: opts.page,
+            page,
             perPage,
-            lastPage: Math.ceil(total / perPage),
+            lastPage,
         };
     });
 }

package/dist/src/dashboard/sensitive_patterns.d.ts

@@ -37,3 +37,40 @@ export declare function isSensitiveConfigName(name: string): boolean;
  */
 export declare function sqlMentionsSecret(sql: string): boolean;
 export declare function looksLikeCredentialValue(value: string): boolean;
+/**
+ * Redact and truncate SQL bindings before persistence.
+ *
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
+ */
+export declare function sanitizeBindings(bindings: unknown, sqlText?: string): unknown;
+/**
+ * Redact a structured record (a pino log entry, an event payload) with the
+ * same key/shape rules as bindings but WITHOUT length truncation — log data
+ * carries stack traces and payload context that must stay whole.
+ */
+export declare function sanitizeRecordValues(record: unknown): unknown;
+/**
+ * Redact credential-bearing query parameters from a URL before it is stored.
+ *
+ * Request URLs are persisted with their query strings (useful for debugging
+ * pagination and filters), but a `?token=…` password-reset link or a
+ * `?signature=…` signed URL must not land in SQLite in the clear. Parameters
+ * are redacted by name (see {@link isSecretName}) or when the value itself
+ * looks like a credential; everything else passes through untouched.
+ */
+export declare function sanitizeUrlQuery(url: string): string;

package/dist/src/dashboard/sensitive_patterns.js

@@ -9,9 +9,22 @@
  */
 // Custom word boundaries: `\b` does not match between `CLIENT` and `SECRET` in
 // `GOOGLE_CLIENT_SECRET`, because `_` is a word character. These treat `_`,
-// `.`, and `-` as separators, and also match a bare token on its own.
+// `.`, and `-` as separators, and also match a bare token on its own. The
+// trailing boundary tolerates a plural `s` so `tokens`/`secrets` match too.
+// camelCase is handled by normalizing the name BEFORE testing (see
+// `splitCamelCase`), not by the boundaries themselves.
 const B = '(?:^|[_.\\-])'; // boundary before
-const A = '(?:$|[_.\\-])'; // boundary after
+const A = 's?(?:$|[_.\\-])'; // boundary after (optional plural)
+/**
+ * Insert `_` at lower/digit→UPPER transitions so the separator-based patterns
+ * above see camelCase the same way they see snake_case. Without this,
+ * `passwordHash` and `clientSecret` — the *normal* shape for AdonisJS config
+ * keys and camelCase column strategies — sail past every pattern while their
+ * snake_case twins are redacted.
+ */
+function splitCamelCase(name) {
+    return name.replace(/([a-z0-9])([A-Z])/g, '$1_$2');
+}
 /**
  * Names that identify a credential — applies to env vars, config keys, and SQL
  * identifiers alike.
@@ -23,6 +36,9 @@ export const SECRET_NAME_PATTERNS = [
     new RegExp(`${B}credential${A}`, 'i'),
     new RegExp(`${B}private${A}`, 'i'),
     new RegExp(`${B}auth${A}`, 'i'),
+    // HTTP credential carriers — log records embed request headers
+    new RegExp(`${B}authorization${A}`, 'i'),
+    new RegExp(`${B}cookie${A}`, 'i'),
     // API keys: `api_key`, `apiKey`, `API_KEY`
     /api[_-]?key/i,
     // `_KEY` at end or `_KEY_` in middle (AWS_ACCESS_KEY_ID, ENCRYPTION_KEY, etc.)
@@ -41,8 +57,18 @@ export const SECRET_NAME_PATTERNS = [
     new RegExp(`${B}encryption${A}`, 'i'),
     // App key / app secret
     /app[_-]key/i,
-    // One-time codes
+    // One-time codes and second factors
     new RegExp(`${B}otp${A}`, 'i'),
+    new RegExp(`${B}totp${A}`, 'i'),
+    new RegExp(`${B}mfa${A}`, 'i'),
+    // Password abbreviations
+    new RegExp(`${B}passwd${A}`, 'i'),
+    new RegExp(`${B}pwd${A}`, 'i'),
+    // Card / identity numbers
+    new RegExp(`${B}cvv${A}`, 'i'),
+    new RegExp(`${B}cvc${A}`, 'i'),
+    new RegExp(`${B}pin${A}`, 'i'),
+    new RegExp(`${B}ssn${A}`, 'i'),
 ];
 /**
  * Names that matter for env vars and config keys but NOT for SQL identifiers.
@@ -60,11 +86,15 @@ export const CONFIG_ONLY_NAME_PATTERNS = [
 ];
 /** Whether a name identifies a credential. */
 export function isSecretName(name) {
-    return SECRET_NAME_PATTERNS.some((pattern) => pattern.test(name));
+    const normalized = splitCamelCase(name);
+    return SECRET_NAME_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 /** Whether a name is sensitive in a config/env context (credentials plus contact/service names). */
 export function isSensitiveConfigName(name) {
-    return isSecretName(name) || CONFIG_ONLY_NAME_PATTERNS.some((pattern) => pattern.test(name));
+    if (isSecretName(name))
+        return true;
+    const normalized = splitCamelCase(name);
+    return CONFIG_ONLY_NAME_PATTERNS.some((pattern) => pattern.test(normalized));
 }
 /** Identifier-ish tokens in a SQL statement: table names, column names, aliases. */
 const SQL_IDENTIFIER_RE = /[A-Za-z_][A-Za-z0-9_$]*/g;
@@ -116,3 +146,114 @@ export function looksLikeCredentialValue(value) {
         return true;
     return CREDENTIAL_VALUE_PATTERNS.some((pattern) => pattern.test(value));
 }
+// ---------------------------------------------------------------------------
+// Binding hygiene
+// ---------------------------------------------------------------------------
+/** Max length for a stored string binding before it is truncated. */
+const MAX_BINDING_LEN = 256;
+/** Placeholder stored in place of a binding that looks like a credential. */
+const REDACTED_BINDING = '[redacted]';
+/**
+ * Redact and truncate SQL bindings before persistence.
+ *
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
+ */
+export function sanitizeBindings(bindings, sqlText) {
+    const redactAll = sqlText !== undefined && sqlMentionsSecret(sqlText);
+    return sanitizeBindingValue(bindings, redactAll, true);
+}
+/**
+ * Redact a structured record (a pino log entry, an event payload) with the
+ * same key/shape rules as bindings but WITHOUT length truncation — log data
+ * carries stack traces and payload context that must stay whole.
+ */
+export function sanitizeRecordValues(record) {
+    return sanitizeBindingValue(record, false, false);
+}
+function sanitizeBindingValue(value, redactAll, truncate) {
+    if (Array.isArray(value))
+        return value.map((v) => sanitizeBindingValue(v, redactAll, truncate));
+    if (value !== null && typeof value === 'object') {
+        return sanitizeNamedBindings(value, redactAll, truncate);
+    }
+    if (typeof value === 'string')
+        return sanitizeStringBinding(value, redactAll, truncate);
+    // A statement touching a secret column may bind it as a non-string — a numeric
+    // OTP, for instance — so redact those too rather than only masking strings.
+    // Booleans and null carry nothing worth hiding.
+    const redactable = value !== null && value !== undefined && typeof value !== 'boolean';
+    return redactAll && redactable ? REDACTED_BINDING : value;
+}
+/** Named bindings carry their own key, so use it when it is telling. */
+function sanitizeNamedBindings(value, redactAll, truncate) {
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+        out[key] = sanitizeBindingValue(nested, redactAll || isSecretName(key), truncate);
+    }
+    return out;
+}
+/** Matches a value this module already truncated, so a second pass is a no-op. */
+const TRUNCATION_MARKER_RE = /…\[truncated \d+ chars\]$/;
+function sanitizeStringBinding(value, redactAll, truncate) {
+    if (redactAll || looksLikeCredentialValue(value))
+        return REDACTED_BINDING;
+    if (truncate && value.length > MAX_BINDING_LEN && !TRUNCATION_MARKER_RE.test(value)) {
+        return value.slice(0, MAX_BINDING_LEN) + `…[truncated ${value.length} chars]`;
+    }
+    return value;
+}
+// ---------------------------------------------------------------------------
+// URL hygiene
+// ---------------------------------------------------------------------------
+/**
+ * Redact credential-bearing query parameters from a URL before it is stored.
+ *
+ * Request URLs are persisted with their query strings (useful for debugging
+ * pagination and filters), but a `?token=…` password-reset link or a
+ * `?signature=…` signed URL must not land in SQLite in the clear. Parameters
+ * are redacted by name (see {@link isSecretName}) or when the value itself
+ * looks like a credential; everything else passes through untouched.
+ */
+export function sanitizeUrlQuery(url) {
+    const qIdx = url.indexOf('?');
+    if (qIdx === -1)
+        return url;
+    const sanitized = url
+        .slice(qIdx + 1)
+        .split('&')
+        .map((pair) => {
+        if (pair === '')
+            return pair;
+        const eq = pair.indexOf('=');
+        const name = eq === -1 ? pair : pair.slice(0, eq);
+        const rawValue = eq === -1 ? '' : pair.slice(eq + 1);
+        let value = rawValue;
+        try {
+            value = decodeURIComponent(rawValue);
+        }
+        catch {
+            // Malformed escape — judge the raw text instead.
+        }
+        if (isSecretName(name) || (value !== '' && looksLikeCredentialValue(value))) {
+            return `${name}=[redacted]`;
+        }
+        return pair;
+    })
+        .join('&');
+    return url.slice(0, qIdx) + '?' + sanitized;
+}

package/dist/src/dashboard/storage_stats.d.ts

@@ -20,18 +20,23 @@ export interface StorageStatsResult {
     fileSizeMb: number;
     walSizeMb: number;
     retentionDays: number;
+    /** Configured live-data size cap in MB; `0` means the cap is disabled. */
+    maxDbSizeMb: number;
     tables: Array<{
         name: string;
         rowCount: number;
     }>;
     lastCleanupAt: number | null;
 }
+/** The not-ready result returned before the SQLite connection exists. */
+export declare function emptyStorageStats(dbPath: string, retentionDays: number, maxDbSizeMb: number): StorageStatsResult;
 export interface StorageStatsOpts {
     db: Knex;
     cache: CoalesceCache;
     dbFilePath: string;
     dbPath: string;
     retentionDays: number;
+    maxDbSizeMb: number;
     lastCleanupAt: number | null;
     onResult: (stats: StorageStatsResult) => void;
 }

package/dist/src/dashboard/storage_stats.js

@@ -58,11 +58,24 @@ export async function countAllTables(db) {
         return result;
     });
 }
+/** The not-ready result returned before the SQLite connection exists. */
+export function emptyStorageStats(dbPath, retentionDays, maxDbSizeMb) {
+    return {
+        ready: false,
+        dbPath,
+        fileSizeMb: 0,
+        walSizeMb: 0,
+        retentionDays,
+        maxDbSizeMb,
+        tables: [],
+        lastCleanupAt: null,
+    };
+}
 /**
  * Build storage stats by querying file sizes and table row counts.
  */
 export function fetchStorageStats(opts) {
-    const { db, cache, dbFilePath, dbPath, retentionDays, lastCleanupAt, onResult } = opts;
+    const { db, cache, dbFilePath, dbPath, retentionDays, maxDbSizeMb, lastCleanupAt, onResult } = opts;
     return cache.coalesce('storageStats', async () => {
         const [fileSizeMb, walSizeMb] = await getFileSizes(dbFilePath);
         const tables = await countAllTables(db);
@@ -72,6 +85,7 @@ export function fetchStorageStats(opts) {
             fileSizeMb,
             walSizeMb,
             retentionDays,
+            maxDbSizeMb,
             tables,
             lastCleanupAt,
         };

package/dist/src/dashboard/write_queue.d.ts

@@ -5,11 +5,18 @@
  * objects. They are pure (no I/O, no Knex dependency) so they can
  * be tested in isolation.
  */
+import { sanitizeBindings } from './sensitive_patterns.js';
 import type { EventRecord, EmailRecord } from '../debug/types.js';
 import type { PersistRequestInput } from './dashboard_types.js';
 import type { Knex } from 'knex';
 export declare function hasWarned(path: string): boolean;
 export declare function markWarned(path: string): void;
+/**
+ * Forget which write paths have warned. Called when a DashboardStore stops so
+ * a re-initialized store in the same process warns afresh instead of
+ * inheriting a spent latch from its predecessor.
+ */
+export declare function resetWriteWarnings(): void;
 /**
  * Normalize a SQL query by replacing literal values with `?` placeholders.
  * Used for grouping identical query patterns.
@@ -20,27 +27,7 @@ export declare function markWarned(path: string): void;
  * merged together.
  */
 export declare function normalizeSql(sql: string): string;
-/**
- * Redact and truncate SQL bindings before persistence.
- *
- * Two independent rules, because neither catches everything on its own:
- *
- * 1. **By statement.** If the SQL mentions a credential-shaped identifier
- *    (`password`, `remember_token`, `otp`, ...), every binding for that
- *    statement is redacted. Positional bindings cannot be mapped back to
- *    columns reliably, so this is all-or-nothing per statement — coarse, but
- *    it is the only thing that catches a short secret like a 6-digit OTP.
- * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
- *    digests, and URLs with embedded credentials are redacted wherever they
- *    appear, regardless of the statement.
- *
- * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
- * oversized payload cannot bloat the row.
- *
- * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
- * the query pane stays useful for debugging.
- */
-export declare function sanitizeBindings(bindings: unknown, sqlText?: string): unknown;
+export { sanitizeBindings };
 export interface PreparedQuery {
     sql_text: string;
     sql_normalized: string;
@@ -100,6 +87,13 @@ export interface EventRow {
 export declare function prepareRequestRows(requests: PersistRequestInput[]): PreparedRequest[];
 /**
  * Transform raw log entries into SQLite-ready row objects.
+ *
+ * The full pino record lands in `data`, and log lines routinely carry bound
+ * request context — authorization headers, cookies, tokens in payloads — so
+ * the record is run through the shared redaction rules (secret-named keys and
+ * credential-shaped values) before it is stringified. The `message` column is
+ * kept verbatim: it is free text, and the shape rules are anchored to whole
+ * values, so prose stays readable.
  */
 export declare function prepareLogRows(logs: Record<string, unknown>[]): PreparedLog[];
 /**
@@ -118,6 +112,11 @@ export declare function buildEmailRow(record: EmailRecord): EmailRow;
 export declare function buildEventRows(events: EventRecord[]): EventRow[];
 /**
  * Insert rows into a table in batches of 50.
+ *
+ * Yields to the event loop between chunks: better-sqlite3 is fully
+ * synchronous, so without a real macrotask hop a large batch would execute
+ * back-to-back on microtask continuations and stall the host app — the exact
+ * failure mode `migrator_tables.ts` documents and guards against.
  */
 export declare function batchInsert(trx: Knex.Transaction, table: string, rows: Record<string, unknown>[]): Promise<void>;
 export declare function flushRequests(trx: Knex.Transaction, preparedRequests: PreparedRequest[]): Promise<void>;