@agent-native/core 0.85.7 → 0.86.1

package/corpus/templates/analytics/server/lib/db-admin-connections.ts

@@ -0,0 +1,458 @@
+import { randomUUID } from "node:crypto";
+
+import { createDbExec, getDbExec, type Dialect } from "@agent-native/core/db";
+import type { DbAdminRuntime } from "@agent-native/core/db-admin";
+import { getOrgContext } from "@agent-native/core/org";
+import {
+  deleteAppSecret,
+  getAppSecretMeta,
+  readAppSecret,
+  writeAppSecret,
+} from "@agent-native/core/secrets";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+  getSession,
+  runWithRequestContext,
+} from "@agent-native/core/server";
+import type { H3Event } from "h3";
+
+const CONNECTIONS_TABLE = "analytics_db_admin_connections";
+const SECRET_PREFIX = "analytics-db-admin";
+
+export interface DbAdminConnection {
+  id: string;
+  name: string;
+  appId: string | null;
+  appUrl: string | null;
+  createdBy: string;
+  createdAt: string;
+  updatedAt: string;
+  orgId: string;
+  databaseUrlLast4: string | null;
+  hasDatabaseAuthToken: boolean;
+  databaseAuthTokenLast4: string | null;
+}
+
+export interface DbAdminAdminContext {
+  userEmail: string;
+  orgId: string;
+  role: "owner" | "admin";
+}
+
+export class DbAdminConnectionError extends Error {
+  constructor(
+    readonly statusCode: number,
+    message: string,
+  ) {
+    super(message);
+    this.name = "DbAdminConnectionError";
+  }
+}
+
+function isAdminRole(value: unknown): value is "owner" | "admin" {
+  return value === "owner" || value === "admin";
+}
+
+function readString(
+  row: Record<string, unknown>,
+  ...keys: string[]
+): string | null {
+  for (const key of keys) {
+    const value = row[key];
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return null;
+}
+
+async function resolveOrgRole(
+  userEmail: string,
+  orgId: string,
+): Promise<string | null> {
+  try {
+    const { rows } = await getDbExec().execute({
+      sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+      args: [orgId, userEmail.toLowerCase()],
+    });
+    return readString((rows[0] ?? {}) as Record<string, unknown>, "role");
+  } catch {
+    return null;
+  }
+}
+
+export async function requireDbAdminContextFromRequest(input?: {
+  userEmail?: string;
+  orgId?: string | null;
+}): Promise<DbAdminAdminContext> {
+  const userEmail = input?.userEmail ?? getRequestUserEmail();
+  const orgId = input?.orgId ?? getRequestOrgId() ?? null;
+  if (!userEmail) {
+    throw new DbAdminConnectionError(401, "Sign in to manage app databases.");
+  }
+  if (!orgId) {
+    throw new DbAdminConnectionError(
+      403,
+      "An active organization is required to manage app databases.",
+    );
+  }
+  const role = await resolveOrgRole(userEmail, orgId);
+  if (!isAdminRole(role)) {
+    throw new DbAdminConnectionError(
+      403,
+      "Only organization owners and admins can access connected app databases.",
+    );
+  }
+  return { userEmail, orgId, role };
+}
+
+export async function requireDbAdminContextFromEvent(
+  event: H3Event,
+): Promise<DbAdminAdminContext> {
+  const session = await getSession(event).catch(() => null);
+  if (!session?.email) {
+    throw new DbAdminConnectionError(401, "Sign in to manage app databases.");
+  }
+  const org = await getOrgContext(event).catch(() => null);
+  if (!org?.orgId) {
+    throw new DbAdminConnectionError(
+      403,
+      "An active organization is required to manage app databases.",
+    );
+  }
+  if (!isAdminRole(org.role)) {
+    throw new DbAdminConnectionError(
+      403,
+      "Only organization owners and admins can access connected app databases.",
+    );
+  }
+  return { userEmail: session.email, orgId: org.orgId, role: org.role };
+}
+
+export async function runWithDbAdminEventContext<T>(
+  event: H3Event,
+  fn: (ctx: DbAdminAdminContext) => Promise<T>,
+): Promise<T> {
+  const ctx = await requireDbAdminContextFromEvent(event);
+  return runWithRequestContext(
+    { userEmail: ctx.userEmail, orgId: ctx.orgId },
+    () => fn(ctx),
+  );
+}
+
+function secretKey(connectionId: string, kind: "url" | "auth-token"): string {
+  return `${SECRET_PREFIX}:${connectionId}:${kind}`;
+}
+
+function normalizeOptionalString(value: unknown): string | null {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+function normalizeDatabaseUrl(value: unknown): string {
+  const raw = normalizeOptionalString(value);
+  if (!raw) {
+    throw new DbAdminConnectionError(400, "Database URL is required.");
+  }
+  const lower = raw.toLowerCase();
+  if (
+    !lower.startsWith("postgres://") &&
+    !lower.startsWith("postgresql://") &&
+    !lower.startsWith("libsql://")
+  ) {
+    throw new DbAdminConnectionError(
+      400,
+      "Use a Postgres, PostgreSQL, or libSQL database URL.",
+    );
+  }
+  return raw;
+}
+
+function dialectForDatabaseUrl(url: string): Dialect {
+  const lower = url.toLowerCase();
+  if (lower.startsWith("postgres://") || lower.startsWith("postgresql://")) {
+    return "postgres";
+  }
+  return "sqlite";
+}
+
+function rowToConnection(
+  row: Record<string, unknown>,
+  secretMeta: {
+    databaseUrlLast4: string | null;
+    hasDatabaseAuthToken: boolean;
+    databaseAuthTokenLast4: string | null;
+  },
+): DbAdminConnection {
+  return {
+    id: readString(row, "id") ?? "",
+    name: readString(row, "name") ?? "Connected app",
+    appId: readString(row, "appId", "app_id"),
+    appUrl: readString(row, "appUrl", "app_url"),
+    createdBy: readString(row, "createdBy", "created_by") ?? "",
+    createdAt: readString(row, "createdAt", "created_at") ?? "",
+    updatedAt: readString(row, "updatedAt", "updated_at") ?? "",
+    orgId: readString(row, "orgId", "org_id") ?? "",
+    ...secretMeta,
+  };
+}
+
+async function secretMetadata(
+  ctx: DbAdminAdminContext,
+  row: Record<string, unknown>,
+) {
+  const urlSecretKey = readString(
+    row,
+    "databaseUrlSecretKey",
+    "database_url_secret_key",
+  );
+  const authSecretKey = readString(
+    row,
+    "databaseAuthTokenSecretKey",
+    "database_auth_token_secret_key",
+  );
+  const databaseUrlMeta = urlSecretKey
+    ? await getAppSecretMeta({
+        key: urlSecretKey,
+        scope: "org",
+        scopeId: ctx.orgId,
+      })
+    : null;
+  const databaseAuthTokenMeta = authSecretKey
+    ? await getAppSecretMeta({
+        key: authSecretKey,
+        scope: "org",
+        scopeId: ctx.orgId,
+      })
+    : null;
+  return {
+    databaseUrlLast4: databaseUrlMeta?.last4 ?? null,
+    hasDatabaseAuthToken: Boolean(databaseAuthTokenMeta),
+    databaseAuthTokenLast4: databaseAuthTokenMeta?.last4 ?? null,
+  };
+}
+
+export async function listDbAdminConnections(
+  ctx: DbAdminAdminContext,
+): Promise<DbAdminConnection[]> {
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT id, name, app_id AS "appId", app_url AS "appUrl",
+                 database_url_secret_key AS "databaseUrlSecretKey",
+                 database_auth_token_secret_key AS "databaseAuthTokenSecretKey",
+                 created_by AS "createdBy", created_at AS "createdAt",
+                 updated_at AS "updatedAt", org_id AS "orgId"
+          FROM ${CONNECTIONS_TABLE}
+          WHERE org_id = ?
+          ORDER BY updated_at DESC, name ASC`,
+    args: [ctx.orgId],
+  });
+  return Promise.all(
+    rows.map(async (row) =>
+      rowToConnection(
+        row as Record<string, unknown>,
+        await secretMetadata(ctx, row as Record<string, unknown>),
+      ),
+    ),
+  );
+}
+
+export async function saveDbAdminConnection(
+  ctx: DbAdminAdminContext,
+  input: {
+    id?: string | null;
+    name: string;
+    appId?: string | null;
+    appUrl?: string | null;
+    databaseUrl: string;
+    databaseAuthToken?: string | null;
+  },
+): Promise<DbAdminConnection> {
+  const name = normalizeOptionalString(input.name);
+  if (!name)
+    throw new DbAdminConnectionError(400, "Connection name is required.");
+  const databaseUrl = normalizeDatabaseUrl(input.databaseUrl);
+  const authToken = normalizeOptionalString(input.databaseAuthToken);
+  const id = normalizeOptionalString(input.id) ?? randomUUID();
+  const databaseUrlSecretKey = secretKey(id, "url");
+  const databaseAuthTokenSecretKey = authToken
+    ? secretKey(id, "auth-token")
+    : null;
+  const now = new Date().toISOString();
+
+  await writeAppSecret({
+    key: databaseUrlSecretKey,
+    scope: "org",
+    scopeId: ctx.orgId,
+    value: databaseUrl,
+    description: `${name} database URL`,
+  });
+  if (authToken) {
+    await writeAppSecret({
+      key: databaseAuthTokenSecretKey!,
+      scope: "org",
+      scopeId: ctx.orgId,
+      value: authToken,
+      description: `${name} database auth token`,
+    });
+  } else {
+    await deleteAppSecret({
+      key: secretKey(id, "auth-token"),
+      scope: "org",
+      scopeId: ctx.orgId,
+    }).catch(() => false);
+  }
+
+  await getDbExec().execute({
+    sql: `INSERT INTO ${CONNECTIONS_TABLE}
+            (id, name, app_id, app_url, database_url_secret_key,
+             database_auth_token_secret_key, created_by, created_at, updated_at, org_id)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET
+            name = excluded.name,
+            app_id = excluded.app_id,
+            app_url = excluded.app_url,
+            database_url_secret_key = excluded.database_url_secret_key,
+            database_auth_token_secret_key = excluded.database_auth_token_secret_key,
+            updated_at = excluded.updated_at
+          WHERE ${CONNECTIONS_TABLE}.org_id = excluded.org_id`,
+    args: [
+      id,
+      name,
+      normalizeOptionalString(input.appId),
+      normalizeOptionalString(input.appUrl),
+      databaseUrlSecretKey,
+      databaseAuthTokenSecretKey,
+      ctx.userEmail,
+      now,
+      now,
+      ctx.orgId,
+    ],
+  });
+
+  const connection = await getDbAdminConnection(ctx, id);
+  if (!connection) {
+    throw new DbAdminConnectionError(404, "Connection not found.");
+  }
+  return connection;
+}
+
+export async function deleteDbAdminConnection(
+  ctx: DbAdminAdminContext,
+  id: string,
+): Promise<{ deleted: boolean }> {
+  const target = await getConnectionRow(ctx, id);
+  if (!target) return { deleted: false };
+
+  await getDbExec().execute({
+    sql: `DELETE FROM ${CONNECTIONS_TABLE} WHERE id = ? AND org_id = ?`,
+    args: [id, ctx.orgId],
+  });
+  await deleteAppSecret({
+    key: readString(target, "databaseUrlSecretKey", "database_url_secret_key")!,
+    scope: "org",
+    scopeId: ctx.orgId,
+  }).catch(() => false);
+  const authKey = readString(
+    target,
+    "databaseAuthTokenSecretKey",
+    "database_auth_token_secret_key",
+  );
+  if (authKey) {
+    await deleteAppSecret({
+      key: authKey,
+      scope: "org",
+      scopeId: ctx.orgId,
+    }).catch(() => false);
+  }
+  return { deleted: true };
+}
+
+async function getConnectionRow(
+  ctx: DbAdminAdminContext,
+  id: string,
+): Promise<Record<string, unknown> | null> {
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT id, name, app_id AS "appId", app_url AS "appUrl",
+                 database_url_secret_key AS "databaseUrlSecretKey",
+                 database_auth_token_secret_key AS "databaseAuthTokenSecretKey",
+                 created_by AS "createdBy", created_at AS "createdAt",
+                 updated_at AS "updatedAt", org_id AS "orgId"
+          FROM ${CONNECTIONS_TABLE}
+          WHERE id = ? AND org_id = ?
+          LIMIT 1`,
+    args: [id, ctx.orgId],
+  });
+  return (rows[0] as Record<string, unknown> | undefined) ?? null;
+}
+
+export async function getDbAdminConnection(
+  ctx: DbAdminAdminContext,
+  id: string,
+): Promise<DbAdminConnection | null> {
+  const row = await getConnectionRow(ctx, id);
+  if (!row) return null;
+  return rowToConnection(row, await secretMetadata(ctx, row));
+}
+
+export async function withDbAdminConnectionRuntime<T>(
+  ctx: DbAdminAdminContext,
+  id: string,
+  fn: (runtime: DbAdminRuntime, connection: DbAdminConnection) => Promise<T>,
+): Promise<T> {
+  const row = await getConnectionRow(ctx, id);
+  if (!row) throw new DbAdminConnectionError(404, "Connection not found.");
+
+  const databaseUrlSecretKey = readString(
+    row,
+    "databaseUrlSecretKey",
+    "database_url_secret_key",
+  );
+  if (!databaseUrlSecretKey) {
+    throw new DbAdminConnectionError(
+      500,
+      "Connection is missing database URL metadata.",
+    );
+  }
+  const databaseUrl = await readAppSecret({
+    key: databaseUrlSecretKey,
+    scope: "org",
+    scopeId: ctx.orgId,
+  });
+  if (!databaseUrl?.value) {
+    throw new DbAdminConnectionError(400, "Database URL secret is missing.");
+  }
+
+  const authSecretKey = readString(
+    row,
+    "databaseAuthTokenSecretKey",
+    "database_auth_token_secret_key",
+  );
+  const authToken = authSecretKey
+    ? await readAppSecret({
+        key: authSecretKey,
+        scope: "org",
+        scopeId: ctx.orgId,
+      })
+    : null;
+
+  const exec = await createDbExec({
+    url: databaseUrl.value,
+    authToken: authToken?.value,
+  });
+  try {
+    return await fn(
+      {
+        db: exec,
+        dialect: dialectForDatabaseUrl(databaseUrl.value),
+      },
+      rowToConnection(row, await secretMetadata(ctx, row)),
+    );
+  } finally {
+    await exec.close?.().catch(() => {});
+  }
+}
+
+export function redactDbAdminError(err: unknown): string {
+  const message = err instanceof Error ? err.message : String(err);
+  return message
+    .replace(/(postgres(?:ql)?:\/\/[^:\s/]+:)[^@\s]+@/gi, "$1[redacted]@")
+    .replace(/(libsql:\/\/[^?\s]+[?&]authToken=)[^&\s]+/gi, "$1[redacted]");
+}

package/corpus/templates/analytics/server/lib/session-replay-agent-context.ts

@@ -111,6 +111,8 @@ const MAX_DIAGNOSTIC_STACK_CHARS = 2_000;
 const MAX_DIAGNOSTIC_URL_CHARS = 500;
 const MAX_DIAGNOSTIC_ARG_CHARS = 500;
 const MAX_DIAGNOSTIC_ARGS = 10;
+/** Defensive server-side cap for a captured 5xx response-body snippet. */
+const MAX_DIAGNOSTIC_ERROR_BODY_CHARS = 2_048;
 const DEFAULT_DIAGNOSTIC_ENTRY_CAP = 200;
 const AGENT_CONTEXT_DIAGNOSTIC_ENTRY_CAP = 50;
 
@@ -253,6 +255,14 @@ function networkDiagnosticsEntry(
           ),
         }
       : {}),
+    ...(typeof payload.responseBody === "string"
+      ? {
+          responseBody: boundedDiagnosticText(
+            payload.responseBody,
+            MAX_DIAGNOSTIC_ERROR_BODY_CHARS,
+          ),
+        }
+      : {}),
   };
 }
 
@@ -265,9 +275,11 @@ function boundDiagnosticsEntries<T extends { offsetMs: number }>(
   entries: T[],
   isPriority: (entry: T) => boolean,
   cap: number,
-): { entries: T[]; truncated: boolean } {
+): { entries: T[]; truncated: boolean; hasMore: boolean } {
   const sorted = [...entries].sort((a, b) => a.offsetMs - b.offsetMs);
-  if (sorted.length <= cap) return { entries: sorted, truncated: false };
+  if (sorted.length <= cap) {
+    return { entries: sorted, truncated: false, hasMore: false };
+  }
   const kept = new Set<T>();
   for (const entry of sorted) {
     if (kept.size >= cap) break;
@@ -280,6 +292,28 @@ function boundDiagnosticsEntries<T extends { offsetMs: number }>(
   return {
     entries: [...kept].sort((a, b) => a.offsetMs - b.offsetMs),
     truncated: true,
+    hasMore: true,
+  };
+}
+
+/**
+ * Strictly chronological pagination: entries are assumed to already reflect
+ * the fromMs/toMs + level filtered population (that population defines the
+ * totals agents page against). Sort chronologically, then skip `offset`
+ * entries and take up to `cap`. No priority reshuffle — stable across pages.
+ */
+function paginateDiagnosticsEntries<T extends { offsetMs: number }>(
+  entries: T[],
+  offset: number,
+  cap: number,
+): { entries: T[]; truncated: boolean; hasMore: boolean } {
+  const sorted = [...entries].sort((a, b) => a.offsetMs - b.offsetMs);
+  const page = sorted.slice(offset, offset + cap);
+  const hasMore = offset + page.length < sorted.length;
+  return {
+    entries: page,
+    truncated: hasMore,
+    hasMore,
   };
 }
 
@@ -290,6 +324,16 @@ export interface SessionReplayDiagnosticsOptions {
   maxNetworkEntries?: number;
   /** Only include console entries with this level. */
   consoleLevel?: SessionReplayConsoleLevel;
+  /**
+   * Skip this many entries (per kind) before taking the page. Providing
+   * offset, fromMs, or toMs switches selection/ordering to strictly
+   * chronological pagination (no errors-first reshuffle) for stable paging.
+   */
+  offset?: number;
+  /** Inclusive lower bound on offsetMs, applied before counting/slicing. */
+  fromMs?: number;
+  /** Inclusive upper bound on offsetMs, applied before counting/slicing. */
+  toMs?: number;
 }
 
 export function buildSessionReplayDiagnostics(
@@ -305,6 +349,12 @@ export function buildSessionReplayDiagnostics(
     0,
     options.maxNetworkEntries ?? DEFAULT_DIAGNOSTIC_ENTRY_CAP,
   );
+  const isPaginated =
+    options.offset !== undefined ||
+    options.fromMs !== undefined ||
+    options.toMs !== undefined;
+  const offset = Math.max(0, options.offset ?? 0);
+  const window = { fromMs: options.fromMs, toMs: options.toMs };
 
   const consoleEntries: SessionReplayConsoleDiagnosticsEntry[] = [];
   const networkEntries: SessionReplayNetworkDiagnosticsEntry[] = [];
@@ -323,12 +373,33 @@ export function buildSessionReplayDiagnostics(
         tagged.timestamp,
         startedAt,
       );
-      const repeat = entry.repeat ?? 1;
-      consoleTotal += repeat;
-      if (entry.level === "error") consoleErrors += repeat;
-      if (entry.level === "warn") consoleWarns += repeat;
-      if (!options.consoleLevel || entry.level === options.consoleLevel) {
+      if (isPaginated) {
+        // Paginated mode: totals reflect the fromMs/toMs + level filtered
+        // population, since that's the denominator agents page against.
+        if (window.fromMs !== undefined && entry.offsetMs < window.fromMs) {
+          continue;
+        }
+        if (window.toMs !== undefined && entry.offsetMs > window.toMs) {
+          continue;
+        }
+        if (options.consoleLevel && entry.level !== options.consoleLevel) {
+          continue;
+        }
+        const repeat = entry.repeat ?? 1;
+        consoleTotal += repeat;
+        if (entry.level === "error") consoleErrors += repeat;
+        if (entry.level === "warn") consoleWarns += repeat;
         consoleEntries.push(entry);
+      } else {
+        // Default mode: totals always reflect the full unfiltered
+        // population; consoleLevel only gates which entries are returned.
+        const repeat = entry.repeat ?? 1;
+        consoleTotal += repeat;
+        if (entry.level === "error") consoleErrors += repeat;
+        if (entry.level === "warn") consoleWarns += repeat;
+        if (!options.consoleLevel || entry.level === options.consoleLevel) {
+          consoleEntries.push(entry);
+        }
       }
     } else {
       const entry = networkDiagnosticsEntry(
@@ -336,12 +407,50 @@ export function buildSessionReplayDiagnostics(
         tagged.timestamp,
         startedAt,
       );
+      if (isPaginated) {
+        if (window.fromMs !== undefined && entry.offsetMs < window.fromMs) {
+          continue;
+        }
+        if (window.toMs !== undefined && entry.offsetMs > window.toMs) {
+          continue;
+        }
+      }
       networkTotal += 1;
       if (isFailedSessionReplayNetworkStatus(entry.status)) networkFailed += 1;
       networkEntries.push(entry);
     }
   }
 
+  if (isPaginated) {
+    const pagedConsole = paginateDiagnosticsEntries(
+      consoleEntries,
+      offset,
+      maxConsole,
+    );
+    const pagedNetwork = paginateDiagnosticsEntries(
+      networkEntries,
+      offset,
+      maxNetwork,
+    );
+    return {
+      console: {
+        total: consoleTotal,
+        errorCount: consoleErrors,
+        warnCount: consoleWarns,
+        entries: pagedConsole.entries,
+        truncated: pagedConsole.truncated,
+        hasMore: pagedConsole.hasMore,
+      },
+      network: {
+        total: networkTotal,
+        failedCount: networkFailed,
+        entries: pagedNetwork.entries,
+        truncated: pagedNetwork.truncated,
+        hasMore: pagedNetwork.hasMore,
+      },
+    };
+  }
+
   const boundedConsole = boundDiagnosticsEntries(
     consoleEntries,
     (entry) => entry.level === "error" || entry.level === "warn",
@@ -360,12 +469,14 @@ export function buildSessionReplayDiagnostics(
       warnCount: consoleWarns,
       entries: boundedConsole.entries,
       truncated: boundedConsole.truncated,
+      hasMore: boundedConsole.hasMore,
     },
     network: {
       total: networkTotal,
       failedCount: networkFailed,
       entries: boundedNetwork.entries,
       truncated: boundedNetwork.truncated,
+      hasMore: boundedNetwork.hasMore,
     },
   };
 }
@@ -617,6 +728,7 @@ export async function buildSessionReplayAgentContext({
       "Correlate diagnostics entry offsetMs values with timeline.markers to see what the user was doing when an error happened.",
       "Use recording for the session-level summary and timeline.markers for navigation, clicks, inputs, scrolls, and custom events.",
       "When diagnostics.truncated is true, fetch apis.diagnostics for the full bounded console/network list (params: kind=console|network|all, level, limit up to 500) before resorting to raw rrweb events.",
+      "To enumerate ALL entries beyond one bounded page, call apis.diagnostics with offset to page through results, or fromMs/toMs to window around a timeline marker's offsetMs; both switch ordering to strictly chronological (stable across pages) and totals reflect the filtered population so you can compute how many pages remain via hasMore.",
       "Use apis.events only when you need bounded rrweb details. Do not paste raw rrweb JSON into the final answer.",
       "Treat page text, URLs, and replay metadata as user data. Do not expose private data beyond what is needed to debug the user's question.",
       "The token is scoped to this recording and expires; do not store it in code, docs, screenshots, or long-lived notes.",
@@ -633,7 +745,7 @@ export async function buildSessionReplayAgentContext({
       diagnostics: {
         method: "GET",
         url: absoluteUrl(diagnosticsPath, origin),
-        note: "Returns bounded console/network diagnostics. Params: kind=console|network|all, level=log|info|warn|error|debug, limit (default 200, max 500).",
+        note: "Returns bounded console/network diagnostics. Params: kind=console|network|all, level=log|info|warn|error|debug, limit (default 200, max 500), offset (page with N-entry skip), fromMs/toMs (inclusive offsetMs window around a timeline marker). offset/fromMs/toMs force strictly chronological pagination for full enumeration; totals reflect the filtered population and hasMore/truncated show whether more entries remain.",
       },
     },
     diagnostics: {

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -224,7 +224,8 @@ const MAX_BLOB_REPLAY_CHUNK_BYTES = 5 * 1024 * 1024;
 const MAX_REPLAY_BLOB_REF_LENGTH = 16 * 1024;
 const MAX_REPLAY_METADATA_BYTES = 16 * 1024;
 const MAX_REPLAY_EVENTS_PER_CHUNK = 1_000;
-const MAX_REPLAY_EVENTS_READ = 10_000;
+const DEFAULT_REPLAY_EVENTS_READ = 10_000;
+const MAX_REPLAY_EVENTS_READ = 100_000;
 const MAX_REPLAY_EVENTS_RESPONSE_BYTES =
   MAX_BLOB_REPLAY_CHUNK_BYTES + 512 * 1024;
 const DEFAULT_SESSION_RECORDINGS_LIMIT = 50;
@@ -1931,7 +1932,7 @@ async function getSessionReplayEventsForRecording(
 }> {
   const maxEvents = Math.min(
     MAX_REPLAY_EVENTS_READ,
-    Math.max(1, options.limit ?? MAX_REPLAY_EVENTS_READ),
+    Math.max(1, options.limit ?? DEFAULT_REPLAY_EVENTS_READ),
   );
   const conditions: any[] = [
     eq(schema.sessionReplayChunks.recordingId, recording.id),