@agent-native/core 0.85.6 → 0.86.0

package/corpus/templates/analytics/server/lib/analytics-alerts.ts

@@ -2,7 +2,18 @@ import { createHash, randomUUID } from "node:crypto";
 
 import { notifyWithDelivery } from "@agent-native/core/notifications";
 import { recordChange } from "@agent-native/core/server";
-import { and, asc, desc, eq, gte, isNull, lte, or, sql } from "drizzle-orm";
+import {
+  and,
+  asc,
+  desc,
+  eq,
+  gte,
+  inArray,
+  isNull,
+  lte,
+  or,
+  sql,
+} from "drizzle-orm";
 
 import { getDb, schema } from "../db/index.js";
 
@@ -435,6 +446,16 @@ export async function deleteAnalyticsAlertRule(
   });
 }
 
+const DEFAULT_ALERT_SEED_CHUNK_SIZE = 500;
+
+function chunkArray<T>(items: T[], size: number): T[][] {
+  const chunks: T[][] = [];
+  for (let i = 0; i < items.length; i += size) {
+    chunks.push(items.slice(i, i + size));
+  }
+  return chunks;
+}
+
 export async function ensureDefaultHttp5xxSpikeAlertRules(): Promise<{
   checked: number;
   created: number;
@@ -442,8 +463,9 @@ export async function ensureDefaultHttp5xxSpikeAlertRules(): Promise<{
   if (!defaultHttp5xxAlertEnabled()) return { checked: 0, created: 0 };
 
   const scopes = await defaultHttp5xxAlertScopes();
+  if (!scopes.length) return { checked: 0, created: 0 };
+
   const db = getDb() as any;
-  let created = 0;
   const threshold = envInt(
     "ANALYTICS_DEFAULT_HTTP_5XX_ALERT_THRESHOLD",
     5,
@@ -463,17 +485,28 @@ export async function ensureDefaultHttp5xxSpikeAlertRules(): Promise<{
     24 * 60,
   );
 
+  const scopesById = new Map<string, AccessCtx>();
   for (const scope of scopes) {
-    const id = defaultHttp5xxAlertId(scope.email, scope.orgId);
-    const [existing] = await db
+    scopesById.set(defaultHttp5xxAlertId(scope.email, scope.orgId), scope);
+  }
+  const allIds = Array.from(scopesById.keys());
+
+  const existingIds = new Set<string>();
+  for (const idChunk of chunkArray(allIds, DEFAULT_ALERT_SEED_CHUNK_SIZE)) {
+    const rows = await db
       .select({ id: schema.analyticsAlertRules.id })
       .from(schema.analyticsAlertRules)
-      .where(eq(schema.analyticsAlertRules.id, id))
-      .limit(1);
-    if (existing) continue;
+      .where(inArray(schema.analyticsAlertRules.id, idChunk));
+    for (const row of rows) existingIds.add(row.id);
+  }
 
-    const now = nowIso();
-    await db.insert(schema.analyticsAlertRules).values({
+  const missingIds = allIds.filter((id) => !existingIds.has(id));
+  if (!missingIds.length) return { checked: scopes.length, created: 0 };
+
+  const now = nowIso();
+  const rowsToInsert = missingIds.map((id) => {
+    const scope = scopesById.get(id)!;
+    return {
       id,
       name: "Hosted app HTTP 5xx spike",
       description:
@@ -482,12 +515,12 @@ export async function ensureDefaultHttp5xxSpikeAlertRules(): Promise<{
       filters: JSON.stringify([
         { field: "properties.status_class", value: "5xx" },
       ]),
-      thresholdMode: "event_count",
+      thresholdMode: "event_count" as const,
       distinctBy: null,
       threshold,
       windowMinutes,
       cooldownMinutes,
-      severity: "critical",
+      severity: "critical" as const,
       channels: JSON.stringify(["inbox"]),
       emailRecipients: JSON.stringify([]),
       enabled: true,
@@ -495,8 +528,20 @@ export async function ensureDefaultHttp5xxSpikeAlertRules(): Promise<{
       updatedAt: now,
       ownerEmail: scope.email,
       orgId: scope.orgId,
-    });
-    created++;
+    };
+  });
+
+  let created = 0;
+  for (const rowChunk of chunkArray(
+    rowsToInsert,
+    DEFAULT_ALERT_SEED_CHUNK_SIZE,
+  )) {
+    const inserted = await db
+      .insert(schema.analyticsAlertRules)
+      .values(rowChunk)
+      .onConflictDoNothing()
+      .returning({ id: schema.analyticsAlertRules.id });
+    created += inserted.length;
   }
 
   return { checked: scopes.length, created };

package/corpus/templates/analytics/server/lib/dashboard-catalog.ts

@@ -944,6 +944,29 @@ export const dashboardCatalogEntries: DashboardCatalogEntry[] = [
     visibleInCatalog: false,
     buildConfig: () => seedConfig("agent-native-templates-first-party"),
   },
+  {
+    id: "agent-observability-llm",
+    name: "Agent LLM Observability",
+    description:
+      "LLM generation volume, latency, errors, token usage, and cost captured as first-party `$ai_generation` tracking events.",
+    category: "Observability",
+    defaultDashboardId: "agent-observability-llm",
+    dataSources: ["first-party"],
+    tags: [
+      "ai",
+      "llm",
+      "observability",
+      "cost",
+      "tokens",
+      "latency",
+      "posthog",
+      "first-party",
+    ],
+    panelCount: 10,
+    version: CATALOG_VERSION,
+    recommended: true,
+    buildConfig: () => seedConfig("agent-observability-llm"),
+  },
   {
     id: "skills-cli-funnel",
     name: "Skills CLI Funnel",

package/corpus/templates/analytics/server/lib/dashboard-seeds.ts

@@ -3,11 +3,16 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import firstPartyTemplateTrafficSeed from "../../seeds/dashboards/agent-native-templates-first-party.json" with { type: "json" };
+import agentObservabilityLlmSeed from "../../seeds/dashboards/agent-observability-llm.json" with { type: "json" };
 import googleAnalyticsSeed from "../../seeds/dashboards/google-analytics.json" with { type: "json" };
 import nodeExporterFullSeed from "../../seeds/dashboards/node-exporter-full.json" with { type: "json" };
 import skillsCliFunnelSeed from "../../seeds/dashboards/skills-cli-funnel.json" with { type: "json" };
 
 const shippedSeeds: Record<string, Record<string, unknown>> = {
+  "agent-observability-llm": agentObservabilityLlmSeed as Record<
+    string,
+    unknown
+  >,
   "agent-native-templates-first-party": firstPartyTemplateTrafficSeed as Record<
     string,
     unknown

package/corpus/templates/analytics/server/lib/session-replay-agent-context.ts

@@ -111,6 +111,8 @@ const MAX_DIAGNOSTIC_STACK_CHARS = 2_000;
 const MAX_DIAGNOSTIC_URL_CHARS = 500;
 const MAX_DIAGNOSTIC_ARG_CHARS = 500;
 const MAX_DIAGNOSTIC_ARGS = 10;
+/** Defensive server-side cap for a captured 5xx response-body snippet. */
+const MAX_DIAGNOSTIC_ERROR_BODY_CHARS = 2_048;
 const DEFAULT_DIAGNOSTIC_ENTRY_CAP = 200;
 const AGENT_CONTEXT_DIAGNOSTIC_ENTRY_CAP = 50;
 
@@ -253,6 +255,14 @@ function networkDiagnosticsEntry(
           ),
         }
       : {}),
+    ...(typeof payload.responseBody === "string"
+      ? {
+          responseBody: boundedDiagnosticText(
+            payload.responseBody,
+            MAX_DIAGNOSTIC_ERROR_BODY_CHARS,
+          ),
+        }
+      : {}),
   };
 }
 
@@ -265,9 +275,11 @@ function boundDiagnosticsEntries<T extends { offsetMs: number }>(
   entries: T[],
   isPriority: (entry: T) => boolean,
   cap: number,
-): { entries: T[]; truncated: boolean } {
+): { entries: T[]; truncated: boolean; hasMore: boolean } {
   const sorted = [...entries].sort((a, b) => a.offsetMs - b.offsetMs);
-  if (sorted.length <= cap) return { entries: sorted, truncated: false };
+  if (sorted.length <= cap) {
+    return { entries: sorted, truncated: false, hasMore: false };
+  }
   const kept = new Set<T>();
   for (const entry of sorted) {
     if (kept.size >= cap) break;
@@ -280,6 +292,28 @@ function boundDiagnosticsEntries<T extends { offsetMs: number }>(
   return {
     entries: [...kept].sort((a, b) => a.offsetMs - b.offsetMs),
     truncated: true,
+    hasMore: true,
+  };
+}
+
+/**
+ * Strictly chronological pagination: entries are assumed to already reflect
+ * the fromMs/toMs + level filtered population (that population defines the
+ * totals agents page against). Sort chronologically, then skip `offset`
+ * entries and take up to `cap`. No priority reshuffle — stable across pages.
+ */
+function paginateDiagnosticsEntries<T extends { offsetMs: number }>(
+  entries: T[],
+  offset: number,
+  cap: number,
+): { entries: T[]; truncated: boolean; hasMore: boolean } {
+  const sorted = [...entries].sort((a, b) => a.offsetMs - b.offsetMs);
+  const page = sorted.slice(offset, offset + cap);
+  const hasMore = offset + page.length < sorted.length;
+  return {
+    entries: page,
+    truncated: hasMore,
+    hasMore,
   };
 }
 
@@ -290,6 +324,16 @@ export interface SessionReplayDiagnosticsOptions {
   maxNetworkEntries?: number;
   /** Only include console entries with this level. */
   consoleLevel?: SessionReplayConsoleLevel;
+  /**
+   * Skip this many entries (per kind) before taking the page. Providing
+   * offset, fromMs, or toMs switches selection/ordering to strictly
+   * chronological pagination (no errors-first reshuffle) for stable paging.
+   */
+  offset?: number;
+  /** Inclusive lower bound on offsetMs, applied before counting/slicing. */
+  fromMs?: number;
+  /** Inclusive upper bound on offsetMs, applied before counting/slicing. */
+  toMs?: number;
 }
 
 export function buildSessionReplayDiagnostics(
@@ -305,6 +349,12 @@ export function buildSessionReplayDiagnostics(
     0,
     options.maxNetworkEntries ?? DEFAULT_DIAGNOSTIC_ENTRY_CAP,
   );
+  const isPaginated =
+    options.offset !== undefined ||
+    options.fromMs !== undefined ||
+    options.toMs !== undefined;
+  const offset = Math.max(0, options.offset ?? 0);
+  const window = { fromMs: options.fromMs, toMs: options.toMs };
 
   const consoleEntries: SessionReplayConsoleDiagnosticsEntry[] = [];
   const networkEntries: SessionReplayNetworkDiagnosticsEntry[] = [];
@@ -323,12 +373,33 @@ export function buildSessionReplayDiagnostics(
         tagged.timestamp,
         startedAt,
       );
-      const repeat = entry.repeat ?? 1;
-      consoleTotal += repeat;
-      if (entry.level === "error") consoleErrors += repeat;
-      if (entry.level === "warn") consoleWarns += repeat;
-      if (!options.consoleLevel || entry.level === options.consoleLevel) {
+      if (isPaginated) {
+        // Paginated mode: totals reflect the fromMs/toMs + level filtered
+        // population, since that's the denominator agents page against.
+        if (window.fromMs !== undefined && entry.offsetMs < window.fromMs) {
+          continue;
+        }
+        if (window.toMs !== undefined && entry.offsetMs > window.toMs) {
+          continue;
+        }
+        if (options.consoleLevel && entry.level !== options.consoleLevel) {
+          continue;
+        }
+        const repeat = entry.repeat ?? 1;
+        consoleTotal += repeat;
+        if (entry.level === "error") consoleErrors += repeat;
+        if (entry.level === "warn") consoleWarns += repeat;
         consoleEntries.push(entry);
+      } else {
+        // Default mode: totals always reflect the full unfiltered
+        // population; consoleLevel only gates which entries are returned.
+        const repeat = entry.repeat ?? 1;
+        consoleTotal += repeat;
+        if (entry.level === "error") consoleErrors += repeat;
+        if (entry.level === "warn") consoleWarns += repeat;
+        if (!options.consoleLevel || entry.level === options.consoleLevel) {
+          consoleEntries.push(entry);
+        }
       }
     } else {
       const entry = networkDiagnosticsEntry(
@@ -336,12 +407,50 @@ export function buildSessionReplayDiagnostics(
         tagged.timestamp,
         startedAt,
       );
+      if (isPaginated) {
+        if (window.fromMs !== undefined && entry.offsetMs < window.fromMs) {
+          continue;
+        }
+        if (window.toMs !== undefined && entry.offsetMs > window.toMs) {
+          continue;
+        }
+      }
       networkTotal += 1;
       if (isFailedSessionReplayNetworkStatus(entry.status)) networkFailed += 1;
       networkEntries.push(entry);
     }
   }
 
+  if (isPaginated) {
+    const pagedConsole = paginateDiagnosticsEntries(
+      consoleEntries,
+      offset,
+      maxConsole,
+    );
+    const pagedNetwork = paginateDiagnosticsEntries(
+      networkEntries,
+      offset,
+      maxNetwork,
+    );
+    return {
+      console: {
+        total: consoleTotal,
+        errorCount: consoleErrors,
+        warnCount: consoleWarns,
+        entries: pagedConsole.entries,
+        truncated: pagedConsole.truncated,
+        hasMore: pagedConsole.hasMore,
+      },
+      network: {
+        total: networkTotal,
+        failedCount: networkFailed,
+        entries: pagedNetwork.entries,
+        truncated: pagedNetwork.truncated,
+        hasMore: pagedNetwork.hasMore,
+      },
+    };
+  }
+
   const boundedConsole = boundDiagnosticsEntries(
     consoleEntries,
     (entry) => entry.level === "error" || entry.level === "warn",
@@ -360,12 +469,14 @@ export function buildSessionReplayDiagnostics(
       warnCount: consoleWarns,
       entries: boundedConsole.entries,
       truncated: boundedConsole.truncated,
+      hasMore: boundedConsole.hasMore,
     },
     network: {
       total: networkTotal,
       failedCount: networkFailed,
       entries: boundedNetwork.entries,
       truncated: boundedNetwork.truncated,
+      hasMore: boundedNetwork.hasMore,
     },
   };
 }
@@ -617,6 +728,7 @@ export async function buildSessionReplayAgentContext({
       "Correlate diagnostics entry offsetMs values with timeline.markers to see what the user was doing when an error happened.",
       "Use recording for the session-level summary and timeline.markers for navigation, clicks, inputs, scrolls, and custom events.",
       "When diagnostics.truncated is true, fetch apis.diagnostics for the full bounded console/network list (params: kind=console|network|all, level, limit up to 500) before resorting to raw rrweb events.",
+      "To enumerate ALL entries beyond one bounded page, call apis.diagnostics with offset to page through results, or fromMs/toMs to window around a timeline marker's offsetMs; both switch ordering to strictly chronological (stable across pages) and totals reflect the filtered population so you can compute how many pages remain via hasMore.",
       "Use apis.events only when you need bounded rrweb details. Do not paste raw rrweb JSON into the final answer.",
       "Treat page text, URLs, and replay metadata as user data. Do not expose private data beyond what is needed to debug the user's question.",
       "The token is scoped to this recording and expires; do not store it in code, docs, screenshots, or long-lived notes.",
@@ -633,7 +745,7 @@ export async function buildSessionReplayAgentContext({
       diagnostics: {
         method: "GET",
         url: absoluteUrl(diagnosticsPath, origin),
-        note: "Returns bounded console/network diagnostics. Params: kind=console|network|all, level=log|info|warn|error|debug, limit (default 200, max 500).",
+        note: "Returns bounded console/network diagnostics. Params: kind=console|network|all, level=log|info|warn|error|debug, limit (default 200, max 500), offset (page with N-entry skip), fromMs/toMs (inclusive offsetMs window around a timeline marker). offset/fromMs/toMs force strictly chronological pagination for full enumeration; totals reflect the filtered population and hasMore/truncated show whether more entries remain.",
       },
     },
     diagnostics: {

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -224,7 +224,8 @@ const MAX_BLOB_REPLAY_CHUNK_BYTES = 5 * 1024 * 1024;
 const MAX_REPLAY_BLOB_REF_LENGTH = 16 * 1024;
 const MAX_REPLAY_METADATA_BYTES = 16 * 1024;
 const MAX_REPLAY_EVENTS_PER_CHUNK = 1_000;
-const MAX_REPLAY_EVENTS_READ = 10_000;
+const DEFAULT_REPLAY_EVENTS_READ = 10_000;
+const MAX_REPLAY_EVENTS_READ = 100_000;
 const MAX_REPLAY_EVENTS_RESPONSE_BYTES =
   MAX_BLOB_REPLAY_CHUNK_BYTES + 512 * 1024;
 const DEFAULT_SESSION_RECORDINGS_LIMIT = 50;
@@ -1931,7 +1932,7 @@ async function getSessionReplayEventsForRecording(
 }> {
   const maxEvents = Math.min(
     MAX_REPLAY_EVENTS_READ,
-    Math.max(1, options.limit ?? MAX_REPLAY_EVENTS_READ),
+    Math.max(1, options.limit ?? DEFAULT_REPLAY_EVENTS_READ),
   );
   const conditions: any[] = [
     eq(schema.sessionReplayChunks.recordingId, recording.id),

package/corpus/templates/analytics/server/plugins/db.ts

@@ -1,10 +1,37 @@
-import { runMigrations } from "@agent-native/core/db";
+import {
+  ensureAdditiveColumns,
+  getDbExec,
+  runMigrations,
+} from "@agent-native/core/db";
 
 // Side-effect import: ensures registerShareableResource runs on server
 // startup so the dashboard / analysis share actions know where to dispatch.
 import "../db/index.js";
+import * as schema from "../db/schema.js";
 
-export default runMigrations(
+/**
+ * Every Drizzle table exported from schema.ts. Filters out type-only and
+ * helper exports (e.g. re-exported `eq`/`sql`) the same way db.spec.ts's
+ * `isDrizzleTable` regression guard does: a real table carries a
+ * Symbol-keyed drizzle metadata bag, plain exports don't.
+ */
+function isDrizzleTable(value: unknown): value is object {
+  return (
+    !!value &&
+    typeof value === "object" &&
+    Object.getOwnPropertySymbols(value).some((s) =>
+      s.toString().includes("drizzle"),
+    )
+  );
+}
+
+const schemaTables = Object.values(schema).filter(isDrizzleTable);
+
+// Convention: every new migration below MUST set a unique `name:` slug (see
+// packages/core/src/db/migrations.ts for the full rationale). Version numbers
+// alone are not a safe identity across parallel branches that each extend
+// this list independently — see the v75-v83 incident documented on v75 below.
+const runAnalyticsMigrations = runMigrations(
   [
     {
       version: 1,
@@ -513,8 +540,19 @@ export default runMigrations(
         sqlite: `UPDATE session_replay_chunks SET started_at = CASE WHEN started_at IS NOT NULL AND substr(started_at, 1, 10) > date('now') THEN min(COALESCE(NULLIF(created_at, ''), datetime('now')), datetime('now')) ELSE started_at END, ended_at = CASE WHEN ended_at IS NOT NULL AND substr(ended_at, 1, 10) > date('now') THEN min(COALESCE(NULLIF(created_at, ''), datetime('now')), datetime('now')) ELSE ended_at END WHERE (started_at IS NOT NULL AND substr(started_at, 1, 10) > date('now')) OR (ended_at IS NOT NULL AND substr(ended_at, 1, 10) > date('now'))`,
       },
     },
+    // v75-v83: a parallel branch shipped unrelated DDL under these SAME version
+    // numbers, so whichever branch deployed first "used up" v75-v83 in
+    // `analytics_migrations` and the other branch's DDL below was silently
+    // never applied on any database that had already advanced past v83 — the
+    // exact version-collision failure class `runMigrations` name-based
+    // tracking exists to fix (see packages/core/src/db/migrations.ts). v75-v80
+    // below now carry a `name:` so they apply by name on every database
+    // regardless of what its recorded MAX(version) already is. All SQL here
+    // is untouched (still the original IF NOT EXISTS / ADD COLUMN IF NOT
+    // EXISTS DDL) — only the `name:` field was added.
     {
       version: 75,
+      name: "analytics-alert-rules-table",
       sql: {
         postgres: `CREATE TABLE IF NOT EXISTS analytics_alert_rules (
       id TEXT PRIMARY KEY,
@@ -568,6 +606,7 @@ export default runMigrations(
     },
     {
       version: 76,
+      name: "analytics-alert-incidents-table",
       sql: {
         postgres: `CREATE TABLE IF NOT EXISTS analytics_alert_incidents (
       id TEXT PRIMARY KEY,
@@ -607,12 +646,64 @@ export default runMigrations(
     },
     {
       version: 77,
+      name: "analytics-alert-rules-scope-enabled-idx",
       sql: `CREATE INDEX IF NOT EXISTS analytics_alert_rules_scope_enabled_idx ON analytics_alert_rules (org_id, owner_email, enabled, updated_at)`,
     },
     {
       version: 78,
+      name: "analytics-alert-incidents-rule-triggered-idx",
       sql: `CREATE INDEX IF NOT EXISTS analytics_alert_incidents_rule_triggered_idx ON analytics_alert_incidents (rule_id, triggered_at)`,
     },
+    // v79: session_recordings gained `network_error_count` in schema.ts (failed
+    // network requests observed in captured replay diagnostics events) without
+    // a matching migration, so pre-existing production tables never got the
+    // column — every read/write touching it 42703'd. Backfill it the same way
+    // page_count/error_count/rage_click_count/privacy_mode were added (v61-64).
+    // Also caught by the v75-v83 version-collision incident described above —
+    // named so it applies regardless of a database's recorded MAX(version).
+    {
+      version: 79,
+      name: "session-recordings-network-error-count",
+      sql: `ALTER TABLE session_recordings ADD COLUMN IF NOT EXISTS network_error_count INTEGER NOT NULL DEFAULT 0`,
+    },
+    {
+      version: 80,
+      name: "analytics-alert-rules-enabled-eval-idx",
+      sql: `CREATE INDEX IF NOT EXISTS analytics_alert_rules_enabled_eval_idx ON analytics_alert_rules (enabled, last_status, last_evaluated_at, created_at)`,
+    },
   ],
   { table: "analytics_migrations" },
 );
+
+/**
+ * The migration list above is the authoritative source for tables, indexes,
+ * and data transforms. `ensureAdditiveColumns` runs after it as a
+ * belt-and-braces safety net for the specific failure mode that caused the
+ * v79 migration above: a column added to schema.ts without a matching
+ * hand-written ALTER migration, which silently 500s every query touching a
+ * pre-existing production table. It only ever adds missing columns — never
+ * drops, renames, or retypes anything — and any failure here is logged and
+ * swallowed so it can never fail boot.
+ */
+export default async (nitroApp: any): Promise<void> => {
+  await runAnalyticsMigrations(nitroApp);
+  try {
+    const summary = await ensureAdditiveColumns({
+      db: getDbExec(),
+      tables: schemaTables,
+    });
+    if (summary.errors.length > 0) {
+      console.warn(
+        "[db] ensureAdditiveColumns completed with errors:",
+        summary.errors,
+      );
+    }
+  } catch (err) {
+    // Never fail boot over the safety net itself — the authoritative
+    // migrations above already ran.
+    console.warn(
+      "[db] ensureAdditiveColumns failed (non-fatal):",
+      err instanceof Error ? err.message : err,
+    );
+  }
+};

package/corpus/templates/analytics/server/routes/api/session-replay/agent-diagnostics.json.get.ts

@@ -15,6 +15,8 @@ import { getSessionReplayTokenizedEvents } from "../../../lib/session-replay.js"
 
 const DEFAULT_DIAGNOSTICS_LIMIT = 200;
 const MAX_DIAGNOSTICS_LIMIT = 500;
+const DEFAULT_REPLAY_EVENT_READ_LIMIT = 10_000;
+const MAX_REPLAY_EVENT_READ_LIMIT = 100_000;
 const CONSOLE_LEVELS = new Set(["log", "info", "warn", "error", "debug"]);
 
 function queryString(value: unknown): string {
@@ -69,9 +71,45 @@ export default defineEventHandler(async (event) => {
     Math.max(1, queryInt(query.limit) ?? DEFAULT_DIAGNOSTICS_LIMIT),
   );
 
+  const rawOffset = queryString(query.offset);
+  if (rawOffset && queryInt(query.offset) === undefined) {
+    setResponseStatus(event, 400);
+    return { error: "offset must be a non-negative integer" };
+  }
+  const offset = Math.max(0, queryInt(query.offset) ?? 0);
+
+  const rawFromMs = queryString(query.fromMs);
+  if (rawFromMs && queryInt(query.fromMs) === undefined) {
+    setResponseStatus(event, 400);
+    return { error: "fromMs must be a non-negative integer" };
+  }
+  const fromMs = queryInt(query.fromMs);
+
+  const rawToMs = queryString(query.toMs);
+  if (rawToMs && queryInt(query.toMs) === undefined) {
+    setResponseStatus(event, 400);
+    return { error: "toMs must be a non-negative integer" };
+  }
+  const toMs = queryInt(query.toMs);
+
+  if (fromMs !== undefined && toMs !== undefined && fromMs > toMs) {
+    setResponseStatus(event, 400);
+    return { error: "fromMs must be less than or equal to toMs" };
+  }
+
   try {
+    const timeWindowed = fromMs !== undefined || toMs !== undefined;
+    const replayEventReadLimit = Math.min(
+      MAX_REPLAY_EVENT_READ_LIMIT,
+      Math.max(
+        DEFAULT_REPLAY_EVENT_READ_LIMIT,
+        timeWindowed
+          ? MAX_REPLAY_EVENT_READ_LIMIT
+          : (rawOffset ? offset : 0) + limit,
+      ),
+    );
     const eventsResponse = await getSessionReplayTokenizedEvents(id, {
-      limit: 10_000,
+      limit: replayEventReadLimit,
     });
     const events = eventsResponse.chunks.flatMap((chunk) =>
       chunk.events.filter(
@@ -83,12 +121,18 @@ export default defineEventHandler(async (event) => {
       maxConsoleEntries: kind === "network" ? 0 : limit,
       maxNetworkEntries: kind === "console" ? 0 : limit,
       consoleLevel: level,
+      ...(rawOffset ? { offset } : {}),
+      ...(fromMs !== undefined ? { fromMs } : {}),
+      ...(toMs !== undefined ? { toMs } : {}),
     });
     return {
       recordingId: eventsResponse.recording.id,
       kind,
       ...(level ? { level } : {}),
       limit,
+      ...(rawOffset ? { offset } : {}),
+      ...(fromMs !== undefined ? { fromMs } : {}),
+      ...(toMs !== undefined ? { toMs } : {}),
       ...(kind !== "network" ? { console: diagnostics.console } : {}),
       ...(kind !== "console" ? { network: diagnostics.network } : {}),
       eventsTruncated: eventsResponse.truncated,

package/corpus/templates/analytics/shared/session-replay-diagnostics.ts

@@ -41,6 +41,12 @@ export interface SessionReplayNetworkEventPayload {
   ok: boolean;
   durationMs: number;
   error?: string;
+  /**
+   * Bounded, redacted response-body snippet. Present only for 5xx
+   * responses -- request bodies and headers are never captured, and
+   * non-5xx/network-failure responses never carry a body.
+   */
+  responseBody?: string;
 }
 
 export interface SessionReplayConsoleDiagnosticsEntry extends SessionReplayConsoleEventPayload {
@@ -64,12 +70,16 @@ export interface SessionReplayDiagnostics {
     warnCount: number;
     entries: SessionReplayConsoleDiagnosticsEntry[];
     truncated: boolean;
+    /** True when more console entries remain after this page/response. */
+    hasMore: boolean;
   };
   network: {
     total: number;
     failedCount: number;
     entries: SessionReplayNetworkDiagnosticsEntry[];
     truncated: boolean;
+    /** True when more network entries remain after this page/response. */
+    hasMore: boolean;
   };
 }