@mastra/mysql 0.3.3-alpha.0 → 0.3.3-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,146 @@
 # @mastra/mysql
 
+## 0.3.3-alpha.1
+
+### Patch Changes
+
+- Added optional tenancy arguments to `getDataset`, `updateDataset`, and `deleteDataset`. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  You can now pass `organizationId` and `projectId` to scope dataset reads, updates, and deletes to a specific tenant. Reads and updates against a dataset in a different tenant throw `DATASET_NOT_FOUND` (surfaced as a 404 over HTTP). Deletes silently no-op on a tenancy mismatch — matching the existing "delete non-existent id is a no-op" semantics so cross-tenant existence is never leaked via error timing or status.
+
+  **Example**
+
+  ```ts
+  // Before
+  await client.getDataset('abc123');
+  await client.deleteDataset('abc123');
+  await client.updateDataset({ id: 'abc123', name: 'renamed' });
+
+  // After — scope to a tenant
+  await client.getDataset('abc123', { organizationId: 'org_a', projectId: 'proj_1' });
+  await client.deleteDataset('abc123', { organizationId: 'org_a' });
+  await client.updateDataset({ id: 'abc123', name: 'renamed', organizationId: 'org_a' });
+  ```
+
+- Pushed remaining dataset read filters and pagination down to storage. ([#18710](https://github.com/mastra-ai/mastra/pull/18710))
+
+  `DatasetsManager.list({ filters })` now accepts `targetType`, `targetIds` (overlap/union semantics), and `name` (substring, case-insensitive) in addition to the existing tenancy and candidate filters. Filtering is pushed down to the storage layer so callers no longer have to post-filter results.
+
+  Storage adapters must also be upgraded to the versions listed below to honor the new filters. If a caller is on this version of `@mastra/core` but on an older storage adapter, the new `targetType`/`targetIds`/`name` filter keys are silently ignored by the adapter — no runtime error, but the filter has no effect and every dataset in the tenancy is returned.
+
+  `Dataset.listItems({ version, search, page, perPage })` now applies `search` and pagination at the storage layer when `version` is provided alongside any of those. Previously they were silently dropped whenever `version` was set. The return shape is unchanged: passing only `version` still returns a bare `DatasetItem[]` snapshot; passing `search`, `page`, or `perPage` (with or without `version`) returns the paginated `{ items, pagination }` shape. The bare-array branch is marked `@deprecated`; prefer passing `page` / `perPage` to always receive the paginated shape.
+
+- Tenancy-scope experiments `getById` and `delete*` on `ExperimentsStorage`. ([#18770](https://github.com/mastra-ai/mastra/pull/18770))
+
+  `ExperimentsStorage.getExperimentById`, `getExperimentResultById`, `deleteExperiment`, and `deleteExperimentResults` used to key on the primary id alone, so any caller who knew the id could read or delete the row regardless of tenant. All four now accept an optional `filters: { organizationId?, projectId? }` argument that is enforced on every adapter (inmemory, libsql, pg, mysql, mongodb, spanner):
+  - On tenancy mismatch, `get*` returns `null` at the storage layer.
+  - On tenancy mismatch, `delete*` is a silent no-op.
+  - The tenancy predicate is folded into the destructive DML itself (scoped `WHERE` on the DELETE, an atomic gate + delete inside a transaction, or a scoped subquery for the results cascade). A concurrent tenant swap of the same id between a pre-check and the DELETE cannot let a scoped delete hit another tenant's row.
+
+  Both behaviors match how a missing id already responds, so existence does not leak through error timing or messages.
+
+  The same atomic-DML pattern is also applied to `DatasetsStorage.deleteDataset` across all 5 store adapters, closing a TOCTOU window between the pre-check and the parent DELETE that was introduced when tenancy filters were originally added.
+
+  `Dataset.getExperiment` and the shared experiment-ownership gate on `Dataset` now forward the dataset's tenancy scope to storage, so experiment reads and downstream mutations (list results, update result, delete experiment) reached through a dataset handle are automatically scoped to the owning tenant.
+
+  Legacy calls that omit `filters` are unchanged, so this is fully backwards-compatible.
+
+  ```ts
+  // Before: any caller who knew the id could read/delete across tenants.
+  await store.experiments.getExperimentById({ id: experimentId });
+  await store.experiments.deleteExperiment({ id: experimentId });
+
+  // After: pass the caller's scope; wrong tenant gets null / silent no-op.
+  await store.experiments.getExperimentById({
+    id: experimentId,
+    filters: { organizationId, projectId },
+  });
+  await store.experiments.deleteExperiment({
+    id: experimentId,
+    filters: { organizationId, projectId },
+  });
+  ```
+
+- Filled a pre-existing CRUD gap so the new dataset filter API works end-to-end on MySQL. ([#18710](https://github.com/mastra-ai/mastra/pull/18710))
+
+  `createDataset`, `updateDataset`, and `mapDataset` now persist and hydrate `targetType`, `targetIds`, `scorerIds`, `tags`, and `requestContextSchema`. The columns were already declared by the shared schema but were never written or read, so `listDatasets({ filters: { targetType, targetIds, name } })` would have matched nothing on MySQL before this fix. `alterTable.ifNotExists` was widened so in-place upgrades pick up the columns for older databases.
+
+  Also fixed a `mapItem` row deserialization bug: when the stored input/groundTruth/metadata was a JSON string scalar, the mysql2 driver auto-parses the JSON column to a JS string and the previous `parseJSON` helper then tried to `JSON.parse` it again and silently returned `undefined`. It now falls back to the raw string when re-parsing fails, so versioned `listItems({ search })` results round-trip the original input.
+
+- Fixed a cross-tenant data-access issue on datasets by scoping `DatasetsManager.get` and `DatasetsManager.delete` to tenancy filters. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  Previously `get({ id })` and `delete({ id })` looked up a dataset by its primary key alone. Any caller who knew a dataset id could read or delete it regardless of which `organizationId` / `projectId` it belonged to. This is now closed at the storage layer via a scoped SQL predicate (option (a) — no fetch-then-assert).
+
+  **What changed**
+  - `DatasetsManager.get` and `DatasetsManager.delete` accept optional `organizationId` and `projectId`.
+  - The tenancy is stashed on the returned `Dataset` handle and forwarded to every downstream storage call (`getDetails`, `update`, `addItem`, item batch ops, `startExperimentAsync`).
+  - The abstract storage contract (`getDatasetById`, `deleteDataset`) gained an optional `filters?: DatasetTenancyFilters` arg.
+  - Item-mutation inputs (`AddDatasetItemInput`, `UpdateDatasetItemInput`, `BatchInsertItemsInput`, `BatchDeleteItemsInput`) and `UpdateDatasetInput` accept optional `filters` for the internal existence check.
+
+  **Behavior**
+  - Omitting tenancy preserves the existing behavior (no predicate added) — fully backwards compatible.
+  - On tenancy mismatch, `get` throws NOT_FOUND (returns null at the storage layer) and `delete` is a silent no-op — matching how a missing id already behaves, so existence does not leak through error timing or messages.
+
+  **Example**
+
+  ```ts
+  // Before
+  const ds = await mastra.datasets.get({ id });
+  await mastra.datasets.delete({ id });
+
+  // After — scope to a tenant
+  const ds = await mastra.datasets.get({ id, organizationId, projectId });
+  await mastra.datasets.delete({ id, organizationId, projectId });
+  ```
+
+- Add optional `batchId`, `datasetId`, and `datasetItemId` fields to persisted scores so saved baseline scores can be grouped as one scoring pass and joined back to the dataset items they came from. ([#18331](https://github.com/mastra-ai/mastra/pull/18331))
+  - `scoreTrace()` accepts top-level `batchId`, `datasetId`, and `datasetItemId` when persisting a score for a stored trace.
+  - `ScoreRowData` and score save payloads now include nullable `batchId`, `datasetId`, and `datasetItemId`.
+  - Built-in stores with explicit score schema or attribute mappings now persist these provenance fields on saved scores.
+  - D1, DSQL, MSSQL, and Upstash score stores now apply additive provenance migrations or deterministic score ordering for persisted score reads.
+
+  ```ts
+  await scoreTrace({
+    storage,
+    scorer,
+    target: { traceId },
+    batchId: 'baseline-batch-1',
+    datasetId,
+    datasetItemId,
+  });
+  ```
+
+- Added optional `organizationId` and `projectId` fields to scores for multi-tenant isolation. Scores can now be saved with tenancy metadata and the `listScoresBy*` methods accept a `filters` option to scope results by organization and project. ([#18331](https://github.com/mastra-ai/mastra/pull/18331))
+
+  ```ts
+  await storage.saveScore({ ...score, organizationId: 'org-a', projectId: 'proj-1' });
+
+  const result = await storage.listScoresByScorerId({
+    scorerId,
+    filters: { organizationId: 'org-a', projectId: 'proj-1' },
+  });
+  ```
+
+  `projectId` identifies the project scope, separate from `resourceId` which continues to mean the agent memory resource.
+
+- Scoped `getDatasetById` and `deleteDataset` to tenancy filters when the caller passes `organizationId` / `projectId`. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  The adapters now push the tenancy predicate into the SQL/query when the new optional `filters` argument is present. Legacy calls that omit tenancy are unchanged. On mismatch, `getDatasetById` returns `null` and `deleteDataset` is a silent no-op — the cascade delete (dataset items and versions) is gated by a scoped parent pre-check, so cross-tenant data is never touched.
+
+- Added optional `organizationId` and `projectId` query parameters to the dataset routes. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  `GET /datasets/:datasetId`, `PATCH /datasets/:datasetId`, and `DELETE /datasets/:datasetId` now accept optional tenancy query parameters. When provided, they are forwarded to `mastra.datasets.get` / `.delete` and the operation returns 404 if the dataset does not belong to the requested tenant. Requests that omit the query parameters keep their existing behavior.
+
+  **Example**
+
+  ```
+  GET /datasets/abc123?organizationId=org_a&projectId=proj_1
+  DELETE /datasets/abc123?organizationId=org_a
+  ```
+
+- Updated dependencies [[`9250acd`](https://github.com/mastra-ai/mastra/commit/9250acd1357f0f1f33d0dcca16f9655084c58eca), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`c64c2a8`](https://github.com/mastra-ai/mastra/commit/c64c2a8503a50252f9ca6b8e8c54cadee31b92a2), [`06e2680`](https://github.com/mastra-ai/mastra/commit/06e26806b51d2cbd858afdc66daa2b86ff3ba64a), [`1240f05`](https://github.com/mastra-ai/mastra/commit/1240f051c8e5371f1c014448bf37b1a1b9a05e47), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748)]:
+  - @mastra/core@1.49.0-alpha.5
+
 ## 0.3.3-alpha.0
 
 ### Patch Changes

package/dist/index.cjs

@@ -2052,11 +2052,11 @@ function parseJSON(value) {
     try {
       return JSON.parse(value);
     } catch {
-      return void 0;
+      return value;
     }
   }
   if (typeof value === "object") return value;
-  return void 0;
+  return value;
 }
 function jsonArg(value) {
   return value === void 0 || value === null ? null : JSON.stringify(value);
@@ -2145,7 +2145,17 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
     await this.operations.alterTable({
       tableName: storage.TABLE_DATASETS,
       schema: storage.DATASETS_SCHEMA,
-      ifNotExists: ["organizationId", "projectId", "candidateKey", "candidateId"]
+      ifNotExists: [
+        "organizationId",
+        "projectId",
+        "candidateKey",
+        "candidateId",
+        "requestContextSchema",
+        "tags",
+        "targetType",
+        "targetIds",
+        "scorerIds"
+      ]
     });
     await this.operations.alterTable({
       tableName: storage.TABLE_DATASET_ITEMS,
@@ -2160,6 +2170,19 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
     await this.pool.execute(`DELETE FROM ${formatTableName(storage.TABLE_DATASET_ITEMS)}`);
     await this.pool.execute(`DELETE FROM ${formatTableName(storage.TABLE_DATASETS)}`);
   }
+  async experimentTablesExist() {
+    try {
+      const [rows] = await this.pool.execute(
+        `SELECT COUNT(*) AS c FROM information_schema.tables
+         WHERE table_schema = DATABASE() AND table_name IN (?, ?)`,
+        [storage.TABLE_EXPERIMENTS, storage.TABLE_EXPERIMENT_RESULTS]
+      );
+      const row = Array.isArray(rows) ? rows[0] : void 0;
+      return Number(row?.c ?? 0) === 2;
+    } catch {
+      return false;
+    }
+  }
   // --- Row transformers ---
   mapDataset(row) {
     return {
@@ -2169,6 +2192,11 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
       metadata: parseJSON(row.metadata),
       inputSchema: parseJSON(row.inputSchema),
       groundTruthSchema: parseJSON(row.groundTruthSchema),
+      requestContextSchema: parseJSON(row.requestContextSchema),
+      tags: parseJSON(row.tags) ?? null,
+      targetType: row.targetType ?? null,
+      targetIds: parseJSON(row.targetIds) ?? null,
+      scorerIds: parseJSON(row.scorerIds) ?? null,
       version: row.version,
       organizationId: row.organizationId ?? null,
       projectId: row.projectId ?? null,
@@ -2230,6 +2258,10 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
           metadata: jsonArg(input.metadata),
           inputSchema: jsonArg(input.inputSchema),
           groundTruthSchema: jsonArg(input.groundTruthSchema),
+          requestContextSchema: jsonArg(input.requestContextSchema),
+          targetType: input.targetType ?? null,
+          targetIds: jsonArg(input.targetIds),
+          scorerIds: jsonArg(input.scorerIds),
           version: 0,
           organizationId: input.organizationId ?? null,
           projectId: input.projectId ?? null,
@@ -2246,6 +2278,10 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
         metadata: input.metadata,
         inputSchema: input.inputSchema ?? void 0,
         groundTruthSchema: input.groundTruthSchema ?? void 0,
+        requestContextSchema: input.requestContextSchema ?? void 0,
+        targetType: input.targetType ?? null,
+        targetIds: input.targetIds ?? null,
+        scorerIds: input.scorerIds ?? null,
         version: 0,
         organizationId: input.organizationId ?? null,
         projectId: input.projectId ?? null,
@@ -2265,11 +2301,18 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
       );
     }
   }
-  async getDatasetById({ id }) {
+  async getDatasetById({
+    id,
+    filters
+  }) {
     try {
       const row = await this.operations.load({
         tableName: storage.TABLE_DATASETS,
-        keys: { id }
+        keys: {
+          id,
+          organizationId: filters?.organizationId,
+          projectId: filters?.projectId
+        }
       });
       return row ? this.mapDataset(row) : null;
     } catch (error$1) {
@@ -2285,7 +2328,7 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
   }
   async _doUpdateDataset(args) {
     try {
-      const existing = await this.getDatasetById({ id: args.id });
+      const existing = await this.getDatasetById({ id: args.id, filters: args.filters });
       if (!existing) {
         throw new error.MastraError({
           id: "MYSQL_UPDATE_DATASET_NOT_FOUND",
@@ -2302,6 +2345,14 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
         data.inputSchema = args.inputSchema === null ? null : JSON.stringify(args.inputSchema);
       if (args.groundTruthSchema !== void 0)
         data.groundTruthSchema = args.groundTruthSchema === null ? null : JSON.stringify(args.groundTruthSchema);
+      if (args.requestContextSchema !== void 0)
+        data.requestContextSchema = args.requestContextSchema === null ? null : JSON.stringify(args.requestContextSchema);
+      if (args.tags !== void 0) data.tags = args.tags === null ? null : JSON.stringify(args.tags);
+      if (args.targetType !== void 0) data.targetType = args.targetType;
+      if (args.targetIds !== void 0)
+        data.targetIds = args.targetIds === null ? null : JSON.stringify(args.targetIds);
+      if (args.scorerIds !== void 0)
+        data.scorerIds = args.scorerIds === null ? null : JSON.stringify(args.scorerIds);
       await this.operations.update({
         tableName: storage.TABLE_DATASETS,
         keys: { id: args.id },
@@ -2314,6 +2365,11 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
         metadata: args.metadata ?? existing.metadata,
         inputSchema: (args.inputSchema !== void 0 ? args.inputSchema : existing.inputSchema) ?? void 0,
         groundTruthSchema: (args.groundTruthSchema !== void 0 ? args.groundTruthSchema : existing.groundTruthSchema) ?? void 0,
+        requestContextSchema: (args.requestContextSchema !== void 0 ? args.requestContextSchema : existing.requestContextSchema) ?? void 0,
+        tags: (args.tags !== void 0 ? args.tags : existing.tags) ?? null,
+        targetType: (args.targetType !== void 0 ? args.targetType : existing.targetType) ?? null,
+        targetIds: (args.targetIds !== void 0 ? args.targetIds : existing.targetIds) ?? null,
+        scorerIds: (args.scorerIds !== void 0 ? args.scorerIds : existing.scorerIds) ?? null,
         updatedAt: data.updatedAt
       };
     } catch (error$1) {
@@ -2328,23 +2384,39 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
       );
     }
   }
-  async deleteDataset({ id }) {
+  async deleteDataset({ id, filters }) {
+    const filterCols = [];
+    const filterVals = [];
+    if (filters?.organizationId !== void 0) {
+      filterCols.push(`${quoteIdentifier("organizationId", "column name")} = ?`);
+      filterVals.push(filters.organizationId);
+    }
+    if (filters?.projectId !== void 0) {
+      filterCols.push(`${quoteIdentifier("projectId", "column name")} = ?`);
+      filterVals.push(filters.projectId);
+    }
+    const scopedWhere = ["id = ?", ...filterCols].join(" AND ");
+    const experimentTablesExist = await this.experimentTablesExist();
     const connection = await this.pool.getConnection();
     try {
       await connection.beginTransaction();
-      try {
+      const [rows] = await connection.execute(
+        `SELECT id FROM ${formatTableName(storage.TABLE_DATASETS)} WHERE ${scopedWhere} FOR UPDATE`,
+        [id, ...filterVals]
+      );
+      if (!Array.isArray(rows) || rows.length === 0) {
+        await connection.commit();
+        return;
+      }
+      if (experimentTablesExist) {
         await connection.execute(
           `DELETE FROM ${formatTableName(storage.TABLE_EXPERIMENT_RESULTS)} WHERE ${quoteIdentifier("experimentId", "column name")} IN (SELECT id FROM ${formatTableName(storage.TABLE_EXPERIMENTS)} WHERE ${quoteIdentifier("datasetId", "column name")} = ?)`,
           [id]
         );
-      } catch {
-      }
-      try {
         await connection.execute(
           `UPDATE ${formatTableName(storage.TABLE_EXPERIMENTS)} SET ${quoteIdentifier("datasetId", "column name")} = NULL, ${quoteIdentifier("datasetVersion", "column name")} = NULL WHERE ${quoteIdentifier("datasetId", "column name")} = ?`,
           [id]
         );
-      } catch {
       }
       await connection.execute(
         `DELETE FROM ${formatTableName(storage.TABLE_DATASET_VERSIONS)} WHERE ${quoteIdentifier("datasetId", "column name")} = ?`,
@@ -2354,7 +2426,10 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
         `DELETE FROM ${formatTableName(storage.TABLE_DATASET_ITEMS)} WHERE ${quoteIdentifier("datasetId", "column name")} = ?`,
         [id]
       );
-      await connection.execute(`DELETE FROM ${formatTableName(storage.TABLE_DATASETS)} WHERE id = ?`, [id]);
+      await connection.execute(`DELETE FROM ${formatTableName(storage.TABLE_DATASETS)} WHERE ${scopedWhere}`, [
+        id,
+        ...filterVals
+      ]);
       await connection.commit();
     } catch (error$1) {
       await connection.rollback();
@@ -2391,6 +2466,19 @@ var DatasetsMySQL = class _DatasetsMySQL extends storage.DatasetsStorage {
         filterParts.push(`${quoteIdentifier("candidateId", "column name")} = ?`);
         filterArgs.push(args.filters.candidateId);
       }
+      if (args.filters?.targetType !== void 0) {
+        filterParts.push(`${quoteIdentifier("targetType", "column name")} = ?`);
+        filterArgs.push(args.filters.targetType);
+      }
+      if (args.filters?.targetIds !== void 0 && args.filters.targetIds.length > 0) {
+        const placeholders = args.filters.targetIds.map(() => "?").join(",");
+        filterParts.push(`JSON_OVERLAPS(${quoteIdentifier("targetIds", "column name")}, JSON_ARRAY(${placeholders}))`);
+        filterArgs.push(...args.filters.targetIds);
+      }
+      if (args.filters?.name !== void 0 && args.filters.name.length > 0) {
+        filterParts.push(`LOWER(${quoteIdentifier("name", "column name")}) LIKE LOWER(?)`);
+        filterArgs.push(`%${args.filters.name}%`);
+      }
       const whereClause = {
         sql: filterParts.length > 0 ? `WHERE ${filterParts.join(" AND ")}` : "",
         args: filterArgs
@@ -3282,7 +3370,11 @@ var ExperimentsMySQL = class _ExperimentsMySQL extends storage.ExperimentsStorag
     try {
       const row = await this.operations.load({
         tableName: storage.TABLE_EXPERIMENTS,
-        keys: { id: args.id }
+        keys: {
+          id: args.id,
+          organizationId: args.filters?.organizationId,
+          projectId: args.filters?.projectId
+        }
       });
       return row ? this.mapExperiment(row) : null;
     } catch (error$1) {
@@ -3375,9 +3467,28 @@ var ExperimentsMySQL = class _ExperimentsMySQL extends storage.ExperimentsStorag
   }
   async deleteExperiment(args) {
     try {
+      const tenancyConditions = [];
+      const tenancyParams = [];
+      if (args.filters?.organizationId !== void 0) {
+        tenancyConditions.push(`${quoteIdentifier("organizationId", "column name")} = ?`);
+        tenancyParams.push(args.filters.organizationId);
+      }
+      if (args.filters?.projectId !== void 0) {
+        tenancyConditions.push(`${quoteIdentifier("projectId", "column name")} = ?`);
+        tenancyParams.push(args.filters.projectId);
+      }
+      const gateWhere = ["id = ?", ...tenancyConditions].join(" AND ");
       const connection = await this.pool.getConnection();
       try {
         await connection.beginTransaction();
+        const [gateRows] = await connection.execute(
+          `SELECT id FROM ${formatTableName(storage.TABLE_EXPERIMENTS)} WHERE ${gateWhere} FOR UPDATE`,
+          [args.id, ...tenancyParams]
+        );
+        if (!Array.isArray(gateRows) || gateRows.length === 0) {
+          await connection.commit();
+          return;
+        }
         await connection.execute(
           `DELETE FROM ${formatTableName(storage.TABLE_EXPERIMENT_RESULTS)} WHERE ${quoteIdentifier("experimentId", "column name")} = ?`,
           [args.id]
@@ -3484,7 +3595,11 @@ var ExperimentsMySQL = class _ExperimentsMySQL extends storage.ExperimentsStorag
     try {
       const row = await this.operations.load({
         tableName: storage.TABLE_EXPERIMENT_RESULTS,
-        keys: { id: args.id }
+        keys: {
+          id: args.id,
+          organizationId: args.filters?.organizationId,
+          projectId: args.filters?.projectId
+        }
       });
       return row ? this.mapExperimentResult(row) : null;
     } catch (error$1) {
@@ -3638,6 +3753,24 @@ var ExperimentsMySQL = class _ExperimentsMySQL extends storage.ExperimentsStorag
   }
   async deleteExperimentResults(args) {
     try {
+      if (args.filters?.organizationId !== void 0 || args.filters?.projectId !== void 0) {
+        const tenancyConditions = [];
+        const tenancyParams = [];
+        if (args.filters?.organizationId !== void 0) {
+          tenancyConditions.push(`${quoteIdentifier("organizationId", "column name")} = ?`);
+          tenancyParams.push(args.filters.organizationId);
+        }
+        if (args.filters?.projectId !== void 0) {
+          tenancyConditions.push(`${quoteIdentifier("projectId", "column name")} = ?`);
+          tenancyParams.push(args.filters.projectId);
+        }
+        const parentWhere = ["id = ?", ...tenancyConditions].join(" AND ");
+        await this.pool.execute(
+          `DELETE FROM ${formatTableName(storage.TABLE_EXPERIMENT_RESULTS)} WHERE ${quoteIdentifier("experimentId", "column name")} IN (SELECT id FROM ${formatTableName(storage.TABLE_EXPERIMENTS)} WHERE ${parentWhere})`,
+          [args.experimentId, ...tenancyParams]
+        );
+        return;
+      }
       await this.pool.execute(
         `DELETE FROM ${formatTableName(storage.TABLE_EXPERIMENT_RESULTS)} WHERE ${quoteIdentifier("experimentId", "column name")} = ?`,
         [args.experimentId]
@@ -8787,7 +8920,7 @@ var ScoresMySQL = class _ScoresMySQL extends storage.ScoresStorage {
     await this.operations.alterTable({
       tableName: storage.TABLE_SCORERS,
       schema: storage.SCORERS_SCHEMA,
-      ifNotExists: ["spanId", "requestContext"]
+      ifNotExists: ["spanId", "requestContext", "organizationId", "projectId", "batchId", "datasetId", "datasetItemId"]
     });
     await this.createDefaultIndexes();
     await this.createCustomIndexes();
@@ -8862,6 +8995,11 @@ var ScoresMySQL = class _ScoresMySQL extends storage.ScoresStorage {
       entityId: row.entityId ?? void 0,
       source: row.source ?? void 0,
       resourceId: row.resourceId ?? void 0,
+      organizationId: row.organizationId ?? void 0,
+      projectId: row.projectId ?? void 0,
+      batchId: row.batchId ?? void 0,
+      datasetId: row.datasetId ?? void 0,
+      datasetItemId: row.datasetItemId ?? void 0,
       threadId: row.threadId ?? void 0,
       createdAt: parseDateTime(row.createdAt) ?? /* @__PURE__ */ new Date(),
       updatedAt: parseDateTime(row.updatedAt) ?? /* @__PURE__ */ new Date()
@@ -8897,6 +9035,11 @@ var ScoresMySQL = class _ScoresMySQL extends storage.ScoresStorage {
       entity: toJson(score.entity),
       entityId: score.entityId ?? null,
       resourceId: score.resourceId ?? null,
+      organizationId: score.organizationId ?? null,
+      projectId: score.projectId ?? null,
+      batchId: score.batchId ?? null,
+      datasetId: score.datasetId ?? null,
+      datasetItemId: score.datasetItemId ?? null,
       threadId: score.threadId ?? null,
       source: score.source ?? null,
       createdAt,
@@ -9000,33 +9143,74 @@ var ScoresMySQL = class _ScoresMySQL extends storage.ScoresStorage {
     pagination,
     entityId,
     entityType,
-    source
+    source,
+    filters
   }) {
-    return this.fetchScores(this.buildWhereClause({ scorerId, entityId, entityType, source }), pagination);
+    return this.fetchScores(
+      this.buildWhereClause({
+        scorerId,
+        entityId,
+        entityType,
+        source,
+        organizationId: filters?.organizationId,
+        projectId: filters?.projectId
+      }),
+      pagination
+    );
   }
   async listScoresByRunId({
     runId,
     pagination,
     entityId,
     entityType,
-    source
+    source,
+    filters
   }) {
-    return this.fetchScores(this.buildWhereClause({ runId, entityId, entityType, source }), pagination);
+    return this.fetchScores(
+      this.buildWhereClause({
+        runId,
+        entityId,
+        entityType,
+        source,
+        organizationId: filters?.organizationId,
+        projectId: filters?.projectId
+      }),
+      pagination
+    );
   }
   async listScoresBySpan({
     traceId,
     spanId,
-    pagination
+    pagination,
+    filters
   }) {
-    return this.fetchScores(this.buildWhereClause({ traceId, spanId }), pagination);
+    return this.fetchScores(
+      this.buildWhereClause({
+        traceId,
+        spanId,
+        organizationId: filters?.organizationId,
+        projectId: filters?.projectId
+      }),
+      pagination
+    );
   }
   async listScoresByEntityId({
     entityId,
     pagination,
     entityType,
-    source
+    source,
+    filters
   }) {
-    return this.fetchScores(this.buildWhereClause({ entityId, entityType, source }), pagination);
+    return this.fetchScores(
+      this.buildWhereClause({
+        entityId,
+        entityType,
+        source,
+        organizationId: filters?.organizationId,
+        projectId: filters?.projectId
+      }),
+      pagination
+    );
   }
 };
 var SNAPSHOT_FIELDS = [