@agentlensai/server 0.2.0 → 0.5.0

package/dist/db/sqlite-store.js

@@ -13,9 +13,9 @@
  * - listAgents(), getAgent()
  * - getAnalytics(), getStats()
  */
-import { eq, and, gte, lte, inArray, desc, asc, sql, like, count as drizzleCount } from 'drizzle-orm';
-import { computeEventHash } from '@agentlens/core';
-import { events, sessions, agents, alertRules } from './schema.sqlite.js';
+import { eq, and, gte, lte, inArray, desc, asc, sql, count as drizzleCount } from 'drizzle-orm';
+import { computeEventHash } from '@agentlensai/core';
+import { events, sessions, agents, alertRules, alertHistory } from './schema.sqlite.js';
 import { HashChainError, NotFoundError } from './errors.js';
 // ─── Helpers ───────────────────────────────────────────────
 /**
@@ -42,6 +42,7 @@ export class SqliteEventStore {
         this.db.transaction((tx) => {
             // CRITICAL 3: Validate hash chain before inserting
             const firstEvent = eventList[0];
+            const tenantId = firstEvent.tenantId ?? 'default';
             // Check if the first event already exists (idempotent re-insert)
             const existingFirst = tx
                 .select({ id: events.id })
@@ -53,7 +54,7 @@ export class SqliteEventStore {
                 const lastStoredEvent = tx
                     .select({ hash: events.hash })
                     .from(events)
-                    .where(eq(events.sessionId, firstEvent.sessionId))
+                    .where(and(eq(events.sessionId, firstEvent.sessionId), eq(events.tenantId, tenantId)))
                     .orderBy(desc(events.timestamp), desc(events.id))
                     .limit(1)
                     .get();
@@ -103,17 +104,18 @@ export class SqliteEventStore {
                     metadata: JSON.stringify(event.metadata),
                     prevHash: event.prevHash,
                     hash: event.hash,
+                    tenantId,
                 })
                     .onConflictDoNothing({ target: events.id })
                     .run();
                 // Handle session management
-                this._handleSessionUpdate(tx, event);
+                this._handleSessionUpdate(tx, event, tenantId);
                 // Handle agent auto-creation
-                this._handleAgentUpsert(tx, event);
+                this._handleAgentUpsert(tx, event, tenantId);
             }
         });
     }
-    _handleSessionUpdate(tx, event) {
+    _handleSessionUpdate(tx, event, tenantId) {
         if (event.eventType === 'session_started') {
             // Create new session
             const payload = event.payload;
@@ -132,9 +134,10 @@ export class SqliteEventStore {
                 errorCount: 0,
                 totalCostUsd: 0,
                 tags: JSON.stringify(tags),
+                tenantId,
             })
                 .onConflictDoUpdate({
-                target: sessions.id,
+                target: [sessions.id, sessions.tenantId],
                 set: {
                     agentName: agentName ?? sql `coalesce(${sessions.agentName}, NULL)`,
                     status: 'active',
@@ -157,8 +160,9 @@ export class SqliteEventStore {
             errorCount: 0,
             totalCostUsd: 0,
             tags: '[]',
+            tenantId,
         })
-            .onConflictDoNothing({ target: sessions.id })
+            .onConflictDoNothing({ target: [sessions.id, sessions.tenantId] })
             .run();
         // Build incremental updates
         const isToolCall = event.eventType === 'tool_call';
@@ -166,8 +170,13 @@ export class SqliteEventStore {
             event.severity === 'critical' ||
             event.eventType === 'tool_error';
         const isCost = event.eventType === 'cost_tracked';
+        const isLlmResponse = event.eventType === 'llm_response';
         const costPayload = event.payload;
         const costUsd = isCost ? (Number(costPayload.costUsd) || 0) : 0;
+        const llmCostUsd = isLlmResponse ? (Number(costPayload.costUsd) || 0) : 0;
+        const llmUsage = isLlmResponse ? costPayload.usage : undefined;
+        const llmInputTokens = llmUsage ? (Number(llmUsage.inputTokens) || 0) : 0;
+        const llmOutputTokens = llmUsage ? (Number(llmUsage.outputTokens) || 0) : 0;
         if (event.eventType === 'session_ended') {
             const payload = event.payload;
             const reason = payload.reason;
@@ -181,7 +190,7 @@ export class SqliteEventStore {
                     ? sql `${sessions.errorCount} + 1`
                     : sessions.errorCount,
             })
-                .where(eq(sessions.id, event.sessionId))
+                .where(and(eq(sessions.id, event.sessionId), eq(sessions.tenantId, tenantId)))
                 .run();
             return;
         }
@@ -197,13 +206,25 @@ export class SqliteEventStore {
                 : sessions.errorCount,
             totalCostUsd: isCost
                 ? sql `${sessions.totalCostUsd} + ${costUsd}`
-                : sessions.totalCostUsd,
+                : isLlmResponse
+                    ? sql `${sessions.totalCostUsd} + ${llmCostUsd}`
+                    : sessions.totalCostUsd,
+            llmCallCount: isLlmResponse
+                ? sql `${sessions.llmCallCount} + 1`
+                : sessions.llmCallCount,
+            totalInputTokens: isLlmResponse
+                ? sql `${sessions.totalInputTokens} + ${llmInputTokens}`
+                : sessions.totalInputTokens,
+            totalOutputTokens: isLlmResponse
+                ? sql `${sessions.totalOutputTokens} + ${llmOutputTokens}`
+                : sessions.totalOutputTokens,
         })
-            .where(eq(sessions.id, event.sessionId))
+            .where(and(eq(sessions.id, event.sessionId), eq(sessions.tenantId, tenantId)))
             .run();
     }
-    _handleAgentUpsert(tx, event) {
+    _handleAgentUpsert(tx, event, tenantId) {
         // CRITICAL 4: Use INSERT ... ON CONFLICT DO UPDATE for agents
+        // Agents are scoped per tenant — use composite key (id + tenant_id)
         const payload = event.payload;
         const agentName = payload.agentName ?? event.agentId;
         tx.insert(agents)
@@ -213,9 +234,10 @@ export class SqliteEventStore {
             firstSeenAt: event.timestamp,
             lastSeenAt: event.timestamp,
             sessionCount: event.eventType === 'session_started' ? 1 : 0,
+            tenantId,
         })
             .onConflictDoUpdate({
-            target: agents.id,
+            target: [agents.id, agents.tenantId],
             set: {
                 lastSeenAt: event.timestamp,
                 sessionCount: event.eventType === 'session_started'
@@ -227,10 +249,11 @@ export class SqliteEventStore {
     }
     // ─── Sessions — Write ──────────────────────────────────────
     async upsertSession(session) {
+        const tenantId = session.tenantId ?? 'default';
         const existing = this.db
             .select()
             .from(sessions)
-            .where(eq(sessions.id, session.id))
+            .where(and(eq(sessions.id, session.id), eq(sessions.tenantId, tenantId)))
             .get();
         if (existing) {
             const updates = {};
@@ -252,13 +275,19 @@ export class SqliteEventStore {
                 updates.errorCount = session.errorCount;
             if (session.totalCostUsd !== undefined)
                 updates.totalCostUsd = session.totalCostUsd;
+            if (session.llmCallCount !== undefined)
+                updates.llmCallCount = session.llmCallCount;
+            if (session.totalInputTokens !== undefined)
+                updates.totalInputTokens = session.totalInputTokens;
+            if (session.totalOutputTokens !== undefined)
+                updates.totalOutputTokens = session.totalOutputTokens;
             if (session.tags !== undefined)
                 updates.tags = JSON.stringify(session.tags);
             if (Object.keys(updates).length > 0) {
                 this.db
                     .update(sessions)
                     .set(updates)
-                    .where(eq(sessions.id, session.id))
+                    .where(and(eq(sessions.id, session.id), eq(sessions.tenantId, tenantId)))
                     .run();
             }
         }
@@ -276,17 +305,22 @@ export class SqliteEventStore {
                 toolCallCount: session.toolCallCount ?? 0,
                 errorCount: session.errorCount ?? 0,
                 totalCostUsd: session.totalCostUsd ?? 0,
+                llmCallCount: session.llmCallCount ?? 0,
+                totalInputTokens: session.totalInputTokens ?? 0,
+                totalOutputTokens: session.totalOutputTokens ?? 0,
                 tags: JSON.stringify(session.tags ?? []),
+                tenantId,
             })
                 .run();
         }
     }
     // ─── Agents — Write ────────────────────────────────────────
     async upsertAgent(agent) {
+        const tenantId = agent.tenantId ?? 'default';
         const existing = this.db
             .select()
             .from(agents)
-            .where(eq(agents.id, agent.id))
+            .where(and(eq(agents.id, agent.id), eq(agents.tenantId, tenantId)))
             .get();
         if (existing) {
             const updates = {};
@@ -302,7 +336,7 @@ export class SqliteEventStore {
                 this.db
                     .update(agents)
                     .set(updates)
-                    .where(eq(agents.id, agent.id))
+                    .where(and(eq(agents.id, agent.id), eq(agents.tenantId, tenantId)))
                     .run();
             }
         }
@@ -317,6 +351,7 @@ export class SqliteEventStore {
                 firstSeenAt: agent.firstSeenAt ?? now,
                 lastSeenAt: agent.lastSeenAt ?? now,
                 sessionCount: agent.sessionCount ?? 0,
+                tenantId,
             })
                 .run();
         }
@@ -342,23 +377,42 @@ export class SqliteEventStore {
             hasMore: offset + rows.length < total,
         };
     }
-    async getEvent(id) {
+    async getEvent(id, tenantId) {
+        const conditions = [eq(events.id, id)];
+        if (tenantId)
+            conditions.push(eq(events.tenantId, tenantId));
         const row = this.db
             .select()
             .from(events)
-            .where(eq(events.id, id))
+            .where(and(...conditions))
             .get();
         return row ? this._mapEventRow(row) : null;
     }
-    async getSessionTimeline(sessionId) {
+    async getSessionTimeline(sessionId, tenantId) {
+        const conditions = [eq(events.sessionId, sessionId)];
+        if (tenantId)
+            conditions.push(eq(events.tenantId, tenantId));
         const rows = this.db
             .select()
             .from(events)
-            .where(eq(events.sessionId, sessionId))
+            .where(and(...conditions))
             .orderBy(asc(events.timestamp))
             .all();
         return rows.map(this._mapEventRow);
     }
+    async getLastEventHash(sessionId, tenantId) {
+        const conditions = [eq(events.sessionId, sessionId)];
+        if (tenantId)
+            conditions.push(eq(events.tenantId, tenantId));
+        const row = this.db
+            .select({ hash: events.hash })
+            .from(events)
+            .where(and(...conditions))
+            .orderBy(desc(events.timestamp), desc(events.id))
+            .limit(1)
+            .get();
+        return row?.hash ?? null;
+    }
     async countEvents(query) {
         const conditions = this._buildEventConditions(query);
         const result = this.db
@@ -391,28 +445,36 @@ export class SqliteEventStore {
             total: totalResult?.count ?? 0,
         };
     }
-    async getSession(id) {
+    async getSession(id, tenantId) {
+        const conditions = [eq(sessions.id, id)];
+        if (tenantId)
+            conditions.push(eq(sessions.tenantId, tenantId));
         const row = this.db
             .select()
             .from(sessions)
-            .where(eq(sessions.id, id))
+            .where(and(...conditions))
             .get();
         return row ? this._mapSessionRow(row) : null;
     }
     // ─── Agents — Read ─────────────────────────────────────────
-    async listAgents() {
+    async listAgents(tenantId) {
+        const conditions = tenantId ? [eq(agents.tenantId, tenantId)] : [];
         const rows = this.db
             .select()
             .from(agents)
+            .where(conditions.length > 0 ? and(...conditions) : undefined)
             .orderBy(desc(agents.lastSeenAt))
             .all();
         return rows.map(this._mapAgentRow);
     }
-    async getAgent(id) {
+    async getAgent(id, tenantId) {
+        const conditions = [eq(agents.id, id)];
+        if (tenantId)
+            conditions.push(eq(agents.tenantId, tenantId));
         const row = this.db
             .select()
             .from(agents)
-            .where(eq(agents.id, id))
+            .where(and(...conditions))
             .get();
         return row ? this._mapAgentRow(row) : null;
     }
@@ -447,6 +509,7 @@ export class SqliteEventStore {
           WHERE timestamp >= ${params.from}
             AND timestamp <= ${params.to}
             ${params.agentId ? sql `AND agent_id = ${params.agentId}` : sql ``}
+            ${params.tenantId ? sql `AND tenant_id = ${params.tenantId}` : sql ``}
           GROUP BY bucket
           ORDER BY bucket ASC
         `);
@@ -464,6 +527,7 @@ export class SqliteEventStore {
         WHERE timestamp >= ${params.from}
           AND timestamp <= ${params.to}
           ${params.agentId ? sql `AND agent_id = ${params.agentId}` : sql ``}
+          ${params.tenantId ? sql `AND tenant_id = ${params.tenantId}` : sql ``}
       `);
         return {
             buckets: bucketRows.map((row) => ({
@@ -501,11 +565,12 @@ export class SqliteEventStore {
             notifyChannels: JSON.stringify(rule.notifyChannels),
             createdAt: rule.createdAt,
             updatedAt: rule.updatedAt,
+            tenantId: rule.tenantId ?? 'default',
         })
             .run();
     }
     // HIGH 8: Check affected row count and throw NotFoundError when zero
-    async updateAlertRule(id, updates) {
+    async updateAlertRule(id, updates, tenantId) {
         const setValues = {};
         if (updates.name !== undefined)
             setValues.name = updates.name;
@@ -523,12 +588,15 @@ export class SqliteEventStore {
             setValues.notifyChannels = JSON.stringify(updates.notifyChannels);
         if (updates.updatedAt !== undefined)
             setValues.updatedAt = updates.updatedAt;
+        const whereConditions = [eq(alertRules.id, id)];
+        if (tenantId)
+            whereConditions.push(eq(alertRules.tenantId, tenantId));
         if (Object.keys(setValues).length === 0) {
             // Even with no actual updates, verify the rule exists
             const existing = this.db
                 .select({ id: alertRules.id })
                 .from(alertRules)
-                .where(eq(alertRules.id, id))
+                .where(and(...whereConditions))
                 .get();
             if (!existing) {
                 throw new NotFoundError(`Alert rule not found: ${id}`);
@@ -538,74 +606,165 @@ export class SqliteEventStore {
         const result = this.db
             .update(alertRules)
             .set(setValues)
-            .where(eq(alertRules.id, id))
+            .where(and(...whereConditions))
             .run();
         if (result.changes === 0) {
             throw new NotFoundError(`Alert rule not found: ${id}`);
         }
     }
-    async deleteAlertRule(id) {
-        const result = this.db.delete(alertRules).where(eq(alertRules.id, id)).run();
+    async deleteAlertRule(id, tenantId) {
+        const whereConditions = [eq(alertRules.id, id)];
+        if (tenantId)
+            whereConditions.push(eq(alertRules.tenantId, tenantId));
+        const result = this.db.delete(alertRules).where(and(...whereConditions)).run();
         if (result.changes === 0) {
             throw new NotFoundError(`Alert rule not found: ${id}`);
         }
     }
-    async listAlertRules() {
-        const rows = this.db.select().from(alertRules).all();
+    async listAlertRules(tenantId) {
+        const conditions = tenantId ? [eq(alertRules.tenantId, tenantId)] : [];
+        const rows = this.db
+            .select()
+            .from(alertRules)
+            .where(conditions.length > 0 ? and(...conditions) : undefined)
+            .all();
         return rows.map(this._mapAlertRuleRow);
     }
-    async getAlertRule(id) {
+    async getAlertRule(id, tenantId) {
+        const conditions = [eq(alertRules.id, id)];
+        if (tenantId)
+            conditions.push(eq(alertRules.tenantId, tenantId));
         const row = this.db
             .select()
             .from(alertRules)
-            .where(eq(alertRules.id, id))
+            .where(and(...conditions))
             .get();
         return row ? this._mapAlertRuleRow(row) : null;
     }
+    // ─── Alert History ─────────────────────────────────────────
+    async insertAlertHistory(entry) {
+        this.db
+            .insert(alertHistory)
+            .values({
+            id: entry.id,
+            ruleId: entry.ruleId,
+            triggeredAt: entry.triggeredAt,
+            resolvedAt: entry.resolvedAt ?? null,
+            currentValue: entry.currentValue,
+            threshold: entry.threshold,
+            message: entry.message,
+            tenantId: entry.tenantId ?? 'default',
+        })
+            .run();
+    }
+    async listAlertHistory(opts) {
+        const limit = Math.min(opts?.limit ?? 50, 500);
+        const offset = opts?.offset ?? 0;
+        const conditions = [];
+        if (opts?.ruleId) {
+            conditions.push(eq(alertHistory.ruleId, opts.ruleId));
+        }
+        if (opts?.tenantId) {
+            conditions.push(eq(alertHistory.tenantId, opts.tenantId));
+        }
+        const rows = this.db
+            .select()
+            .from(alertHistory)
+            .where(conditions.length > 0 ? and(...conditions) : undefined)
+            .orderBy(desc(alertHistory.triggeredAt))
+            .limit(limit)
+            .offset(offset)
+            .all();
+        const totalResult = this.db
+            .select({ count: drizzleCount() })
+            .from(alertHistory)
+            .where(conditions.length > 0 ? and(...conditions) : undefined)
+            .get();
+        return {
+            entries: rows.map((row) => ({
+                id: row.id,
+                ruleId: row.ruleId,
+                triggeredAt: row.triggeredAt,
+                resolvedAt: row.resolvedAt ?? undefined,
+                currentValue: row.currentValue,
+                threshold: row.threshold,
+                message: row.message,
+                tenantId: row.tenantId,
+            })),
+            total: totalResult?.count ?? 0,
+        };
+    }
     // ─── Maintenance ───────────────────────────────────────────
-    async applyRetention(olderThan) {
+    async applyRetention(olderThan, tenantId) {
+        // Build conditions — always filter by timestamp, optionally by tenant
+        const countConditions = [lte(events.timestamp, olderThan)];
+        if (tenantId)
+            countConditions.push(eq(events.tenantId, tenantId));
         // Count events to be deleted
         const countResult = this.db
             .select({ count: drizzleCount() })
             .from(events)
-            .where(lte(events.timestamp, olderThan))
+            .where(and(...countConditions))
             .get();
         const deletedCount = countResult?.count ?? 0;
         if (deletedCount === 0)
             return { deletedCount: 0 };
         this.db.transaction((tx) => {
-            // Delete old events
-            tx.delete(events).where(lte(events.timestamp, olderThan)).run();
-            // Clean up sessions with no remaining events
-            tx.run(sql `
-        DELETE FROM sessions
-        WHERE id NOT IN (SELECT DISTINCT session_id FROM events)
-      `);
+            if (tenantId) {
+                // Tenant-scoped retention: only delete this tenant's old events
+                tx.delete(events)
+                    .where(and(lte(events.timestamp, olderThan), eq(events.tenantId, tenantId)))
+                    .run();
+                // Clean up this tenant's sessions that have no remaining events
+                tx.run(sql `
+          DELETE FROM sessions
+          WHERE tenant_id = ${tenantId}
+            AND id NOT IN (
+              SELECT DISTINCT session_id FROM events WHERE tenant_id = ${tenantId}
+            )
+        `);
+            }
+            else {
+                // Global retention (system-level, not exposed through TenantScopedStore)
+                tx.delete(events).where(lte(events.timestamp, olderThan)).run();
+                tx.run(sql `
+          DELETE FROM sessions
+          WHERE id NOT IN (SELECT DISTINCT session_id FROM events)
+        `);
+            }
         });
         return { deletedCount };
     }
-    async getStats() {
+    async getStats(tenantId) {
+        const eventConditions = tenantId ? [eq(events.tenantId, tenantId)] : [];
+        const sessionConditions = tenantId ? [eq(sessions.tenantId, tenantId)] : [];
+        const agentConditions = tenantId ? [eq(agents.tenantId, tenantId)] : [];
         const eventCount = this.db
             .select({ count: drizzleCount() })
             .from(events)
+            .where(eventConditions.length > 0 ? and(...eventConditions) : undefined)
             .get()?.count ?? 0;
         const sessionCount = this.db
             .select({ count: drizzleCount() })
             .from(sessions)
+            .where(sessionConditions.length > 0 ? and(...sessionConditions) : undefined)
             .get()?.count ?? 0;
         const agentCount = this.db
             .select({ count: drizzleCount() })
             .from(agents)
+            .where(agentConditions.length > 0 ? and(...agentConditions) : undefined)
             .get()?.count ?? 0;
         const oldest = this.db
             .select({ timestamp: events.timestamp })
             .from(events)
+            .where(eventConditions.length > 0 ? and(...eventConditions) : undefined)
             .orderBy(asc(events.timestamp))
             .limit(1)
             .get();
         const newest = this.db
             .select({ timestamp: events.timestamp })
             .from(events)
+            .where(eventConditions.length > 0 ? and(...eventConditions) : undefined)
             .orderBy(desc(events.timestamp))
             .limit(1)
             .get();
@@ -626,6 +785,9 @@ export class SqliteEventStore {
     // ─── Private Helpers ───────────────────────────────────────
     _buildEventConditions(query) {
         const conditions = [];
+        if (query.tenantId) {
+            conditions.push(eq(events.tenantId, query.tenantId));
+        }
         if (query.sessionId) {
             conditions.push(eq(events.sessionId, query.sessionId));
         }
@@ -655,13 +817,21 @@ export class SqliteEventStore {
             conditions.push(lte(events.timestamp, query.to));
         }
         if (query.search) {
-            conditions.push(like(events.payload, `%${query.search}%`));
+            // H1 fix: Escape LIKE wildcards to prevent wildcard abuse
+            const escaped = query.search
+                .replace(/\\/g, '\\\\')
+                .replace(/%/g, '\\%')
+                .replace(/_/g, '\\_');
+            conditions.push(sql `${events.payload} LIKE ${'%' + escaped + '%'} ESCAPE '\\'`);
         }
         return conditions;
     }
     // HIGH 4: Use json_each() for exact tag matching with OR semantics
     _buildSessionConditions(query) {
         const conditions = [];
+        if (query.tenantId) {
+            conditions.push(eq(sessions.tenantId, query.tenantId));
+        }
         if (query.agentId) {
             conditions.push(eq(sessions.agentId, query.agentId));
         }
@@ -708,6 +878,7 @@ export class SqliteEventStore {
             metadata: safeJsonParse(row.metadata, {}),
             prevHash: row.prevHash,
             hash: row.hash,
+            tenantId: row.tenantId,
         };
     }
     _mapSessionRow(row) {
@@ -722,7 +893,11 @@ export class SqliteEventStore {
             toolCallCount: row.toolCallCount,
             errorCount: row.errorCount,
             totalCostUsd: row.totalCostUsd,
+            llmCallCount: row.llmCallCount,
+            totalInputTokens: row.totalInputTokens,
+            totalOutputTokens: row.totalOutputTokens,
             tags: safeJsonParse(row.tags, []),
+            tenantId: row.tenantId,
         };
     }
     _mapAgentRow(row) {
@@ -733,6 +908,7 @@ export class SqliteEventStore {
             firstSeenAt: row.firstSeenAt,
             lastSeenAt: row.lastSeenAt,
             sessionCount: row.sessionCount,
+            tenantId: row.tenantId,
         };
     }
     _mapAlertRuleRow(row) {
@@ -747,6 +923,7 @@ export class SqliteEventStore {
             notifyChannels: safeJsonParse(row.notifyChannels, []),
             createdAt: row.createdAt,
             updatedAt: row.updatedAt,
+            tenantId: row.tenantId,
         };
     }
 }