@mastra/spanner 1.2.1 → 1.2.2-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,133 @@
 # @mastra/spanner
 
+## 1.2.2-alpha.1
+
+### Patch Changes
+
+- Raise `@mastra/core` peer floor to `>=1.49.0-0` on all storage adapters so the tenancy-related named exports the adapters now consume are guaranteed to exist at install time. ([#18861](https://github.com/mastra-ai/mastra/pull/18861))
+
+## 1.2.2-alpha.0
+
+### Patch Changes
+
+- Added optional tenancy arguments to `getDataset`, `updateDataset`, and `deleteDataset`. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  You can now pass `organizationId` and `projectId` to scope dataset reads, updates, and deletes to a specific tenant. Reads and updates against a dataset in a different tenant throw `DATASET_NOT_FOUND` (surfaced as a 404 over HTTP). Deletes silently no-op on a tenancy mismatch — matching the existing "delete non-existent id is a no-op" semantics so cross-tenant existence is never leaked via error timing or status.
+
+  **Example**
+
+  ```ts
+  // Before
+  await client.getDataset('abc123');
+  await client.deleteDataset('abc123');
+  await client.updateDataset({ id: 'abc123', name: 'renamed' });
+
+  // After — scope to a tenant
+  await client.getDataset('abc123', { organizationId: 'org_a', projectId: 'proj_1' });
+  await client.deleteDataset('abc123', { organizationId: 'org_a' });
+  await client.updateDataset({ id: 'abc123', name: 'renamed', organizationId: 'org_a' });
+  ```
+
+- Pushed remaining dataset read filters and pagination down to storage. ([#18710](https://github.com/mastra-ai/mastra/pull/18710))
+
+  `DatasetsManager.list({ filters })` now accepts `targetType`, `targetIds` (overlap/union semantics), and `name` (substring, case-insensitive) in addition to the existing tenancy and candidate filters. Filtering is pushed down to the storage layer so callers no longer have to post-filter results.
+
+  Storage adapters must also be upgraded to the versions listed below to honor the new filters. If a caller is on this version of `@mastra/core` but on an older storage adapter, the new `targetType`/`targetIds`/`name` filter keys are silently ignored by the adapter — no runtime error, but the filter has no effect and every dataset in the tenancy is returned.
+
+  `Dataset.listItems({ version, search, page, perPage })` now applies `search` and pagination at the storage layer when `version` is provided alongside any of those. Previously they were silently dropped whenever `version` was set. The return shape is unchanged: passing only `version` still returns a bare `DatasetItem[]` snapshot; passing `search`, `page`, or `perPage` (with or without `version`) returns the paginated `{ items, pagination }` shape. The bare-array branch is marked `@deprecated`; prefer passing `page` / `perPage` to always receive the paginated shape.
+
+- Tenancy-scope experiments `getById` and `delete*` on `ExperimentsStorage`. ([#18770](https://github.com/mastra-ai/mastra/pull/18770))
+
+  `ExperimentsStorage.getExperimentById`, `getExperimentResultById`, `deleteExperiment`, and `deleteExperimentResults` used to key on the primary id alone, so any caller who knew the id could read or delete the row regardless of tenant. All four now accept an optional `filters: { organizationId?, projectId? }` argument that is enforced on every adapter (inmemory, libsql, pg, mysql, mongodb, spanner):
+  - On tenancy mismatch, `get*` returns `null` at the storage layer.
+  - On tenancy mismatch, `delete*` is a silent no-op.
+  - The tenancy predicate is folded into the destructive DML itself (scoped `WHERE` on the DELETE, an atomic gate + delete inside a transaction, or a scoped subquery for the results cascade). A concurrent tenant swap of the same id between a pre-check and the DELETE cannot let a scoped delete hit another tenant's row.
+
+  Both behaviors match how a missing id already responds, so existence does not leak through error timing or messages.
+
+  The same atomic-DML pattern is also applied to `DatasetsStorage.deleteDataset` across all 5 store adapters, closing a TOCTOU window between the pre-check and the parent DELETE that was introduced when tenancy filters were originally added.
+
+  `Dataset.getExperiment` and the shared experiment-ownership gate on `Dataset` now forward the dataset's tenancy scope to storage, so experiment reads and downstream mutations (list results, update result, delete experiment) reached through a dataset handle are automatically scoped to the owning tenant.
+
+  Legacy calls that omit `filters` are unchanged, so this is fully backwards-compatible.
+
+  ```ts
+  // Before: any caller who knew the id could read/delete across tenants.
+  await store.experiments.getExperimentById({ id: experimentId });
+  await store.experiments.deleteExperiment({ id: experimentId });
+
+  // After: pass the caller's scope; wrong tenant gets null / silent no-op.
+  await store.experiments.getExperimentById({
+    id: experimentId,
+    filters: { organizationId, projectId },
+  });
+  await store.experiments.deleteExperiment({
+    id: experimentId,
+    filters: { organizationId, projectId },
+  });
+  ```
+
+- Fixed a cross-tenant data-access issue on datasets by scoping `DatasetsManager.get` and `DatasetsManager.delete` to tenancy filters. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  Previously `get({ id })` and `delete({ id })` looked up a dataset by its primary key alone. Any caller who knew a dataset id could read or delete it regardless of which `organizationId` / `projectId` it belonged to. This is now closed at the storage layer via a scoped SQL predicate (option (a) — no fetch-then-assert).
+
+  **What changed**
+  - `DatasetsManager.get` and `DatasetsManager.delete` accept optional `organizationId` and `projectId`.
+  - The tenancy is stashed on the returned `Dataset` handle and forwarded to every downstream storage call (`getDetails`, `update`, `addItem`, item batch ops, `startExperimentAsync`).
+  - The abstract storage contract (`getDatasetById`, `deleteDataset`) gained an optional `filters?: DatasetTenancyFilters` arg.
+  - Item-mutation inputs (`AddDatasetItemInput`, `UpdateDatasetItemInput`, `BatchInsertItemsInput`, `BatchDeleteItemsInput`) and `UpdateDatasetInput` accept optional `filters` for the internal existence check.
+
+  **Behavior**
+  - Omitting tenancy preserves the existing behavior (no predicate added) — fully backwards compatible.
+  - On tenancy mismatch, `get` throws NOT_FOUND (returns null at the storage layer) and `delete` is a silent no-op — matching how a missing id already behaves, so existence does not leak through error timing or messages.
+
+  **Example**
+
+  ```ts
+  // Before
+  const ds = await mastra.datasets.get({ id });
+  await mastra.datasets.delete({ id });
+
+  // After — scope to a tenant
+  const ds = await mastra.datasets.get({ id, organizationId, projectId });
+  await mastra.datasets.delete({ id, organizationId, projectId });
+  ```
+
+- Added optional `organizationId` and `projectId` fields to scores for multi-tenant isolation. Scores can now be saved with tenancy metadata and the `listScoresBy*` methods accept a `filters` option to scope results by organization and project. ([#18331](https://github.com/mastra-ai/mastra/pull/18331))
+
+  ```ts
+  await storage.saveScore({ ...score, organizationId: 'org-a', projectId: 'proj-1' });
+
+  const result = await storage.listScoresByScorerId({
+    scorerId,
+    filters: { organizationId: 'org-a', projectId: 'proj-1' },
+  });
+  ```
+
+  `projectId` identifies the project scope, separate from `resourceId` which continues to mean the agent memory resource.
+
+- Widened `SpannerStore` dataset initialization to backfill `targetType`, `targetIds`, and `scorerIds` on pre-existing `mastra_datasets` tables. The `createDataset` / `updateDataset` write paths and the new `listDatasets` `targetType` / `targetIds` filters reference these columns; deployments that upgraded in place before these columns were declared would otherwise hit column-not-found errors on both writes and the new filter path. ([#18710](https://github.com/mastra-ai/mastra/pull/18710))
+
+  Fresh databases were already unaffected because `createTable` reads the full `DATASETS_SCHEMA`.
+
+- Scoped `getDatasetById` and `deleteDataset` to tenancy filters when the caller passes `organizationId` / `projectId`. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  The adapters now push the tenancy predicate into the SQL/query when the new optional `filters` argument is present. Legacy calls that omit tenancy are unchanged. On mismatch, `getDatasetById` returns `null` and `deleteDataset` is a silent no-op — the cascade delete (dataset items and versions) is gated by a scoped parent pre-check, so cross-tenant data is never touched.
+
+- Added optional `organizationId` and `projectId` query parameters to the dataset routes. ([#18750](https://github.com/mastra-ai/mastra/pull/18750))
+
+  `GET /datasets/:datasetId`, `PATCH /datasets/:datasetId`, and `DELETE /datasets/:datasetId` now accept optional tenancy query parameters. When provided, they are forwarded to `mastra.datasets.get` / `.delete` and the operation returns 404 if the dataset does not belong to the requested tenant. Requests that omit the query parameters keep their existing behavior.
+
+  **Example**
+
+  ```
+  GET /datasets/abc123?organizationId=org_a&projectId=proj_1
+  DELETE /datasets/abc123?organizationId=org_a
+  ```
+
+- Updated dependencies [[`9250acd`](https://github.com/mastra-ai/mastra/commit/9250acd1357f0f1f33d0dcca16f9655084c58eca), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`c64c2a8`](https://github.com/mastra-ai/mastra/commit/c64c2a8503a50252f9ca6b8e8c54cadee31b92a2), [`06e2680`](https://github.com/mastra-ai/mastra/commit/06e26806b51d2cbd858afdc66daa2b86ff3ba64a), [`1240f05`](https://github.com/mastra-ai/mastra/commit/1240f051c8e5371f1c014448bf37b1a1b9a05e47), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`24c10d3`](https://github.com/mastra-ai/mastra/commit/24c10d333e6649ac06075903aeeee13a933db3b3), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748), [`215f9b0`](https://github.com/mastra-ai/mastra/commit/215f9b0f3f3f6fc165edad360582dd4d3d7ea748)]:
+  - @mastra/core@1.49.0-alpha.5
+
 ## 1.2.1
 
 ### Patch Changes

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-spanner
 description: Documentation for @mastra/spanner. Use when working with @mastra/spanner APIs, configuration, or implementation.
 metadata:
   package: "@mastra/spanner"
-  version: "1.2.1"
+  version: "1.2.2-alpha.1"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.2.1",
+  "version": "1.2.2-alpha.1",
   "package": "@mastra/spanner",
   "exports": {},
   "modules": {}

package/dist/docs/references/reference-storage-spanner.md

@@ -1,3 +1,5 @@
+> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
+
 # Google Cloud Spanner storage
 
 The Google Cloud Spanner storage implementation provides a horizontally scalable, strongly consistent storage backend for Mastra. It targets the GoogleSQL dialect of Cloud Spanner.

package/dist/index.cjs

@@ -3034,7 +3034,15 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
     await this.db.alterTable({
       tableName: storage.TABLE_DATASETS,
       schema: storage.TABLE_SCHEMAS[storage.TABLE_DATASETS],
-      ifNotExists: ["organizationId", "projectId", "candidateKey", "candidateId"]
+      ifNotExists: [
+        "organizationId",
+        "projectId",
+        "candidateKey",
+        "candidateId",
+        "targetType",
+        "targetIds",
+        "scorerIds"
+      ]
     });
     await this.db.alterTable({
       tableName: storage.TABLE_DATASET_ITEMS,
@@ -3081,6 +3089,20 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
     await this.db.clearTable({ tableName: storage.TABLE_DATASET_ITEMS });
     await this.db.clearTable({ tableName: storage.TABLE_DATASETS });
   }
+  async experimentTablesExist() {
+    try {
+      const [rows] = await this.database.run({
+        sql: `SELECT COUNT(*) AS c FROM INFORMATION_SCHEMA.TABLES
+              WHERE TABLE_SCHEMA = "" AND TABLE_NAME IN (@a, @b)`,
+        params: { a: storage.TABLE_EXPERIMENTS, b: storage.TABLE_EXPERIMENT_RESULTS },
+        json: true
+      });
+      const row = rows?.[0];
+      return Number(row?.c ?? 0) === 2;
+    } catch {
+      return false;
+    }
+  }
   // ==========================================================================
   // Dataset CRUD
   // ==========================================================================
@@ -3145,7 +3167,27 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
   }
   async getDatasetById(args) {
     try {
-      const row = await this.db.load({ tableName: storage.TABLE_DATASETS, keys: { id: args.id } });
+      const hasTenancy = args.filters?.organizationId !== void 0 || args.filters?.projectId !== void 0;
+      if (!hasTenancy) {
+        const row2 = await this.db.load({ tableName: storage.TABLE_DATASETS, keys: { id: args.id } });
+        return row2 ? rowToDataset(row2) : null;
+      }
+      const conditions = [`${quoteIdent("id", "column name")} = @id`];
+      const params = { id: args.id };
+      if (args.filters?.organizationId !== void 0) {
+        conditions.push(`${quoteIdent("organizationId", "column name")} = @organizationId`);
+        params.organizationId = args.filters.organizationId;
+      }
+      if (args.filters?.projectId !== void 0) {
+        conditions.push(`${quoteIdent("projectId", "column name")} = @projectId`);
+        params.projectId = args.filters.projectId;
+      }
+      const [rows] = await this.database.run({
+        sql: `SELECT * FROM ${quoteIdent(storage.TABLE_DATASETS, "table name")} WHERE ${conditions.join(" AND ")} LIMIT 1`,
+        params,
+        json: true
+      });
+      const row = rows[0];
       return row ? rowToDataset(row) : null;
     } catch (error$1) {
       throw new error.MastraError(
@@ -3174,7 +3216,7 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
       if (args.scorerIds !== void 0) data.scorerIds = args.scorerIds;
       data.updatedAt = /* @__PURE__ */ new Date();
       await this.db.update({ tableName: storage.TABLE_DATASETS, keys: { id: args.id }, data });
-      const updated = await this.getDatasetById({ id: args.id });
+      const updated = await this.getDatasetById({ id: args.id, filters: args.filters });
       if (!updated) {
         throw new error.MastraError({
           id: storage.createStorageErrorId("SPANNER", "UPDATE_DATASET", "NOT_FOUND"),
@@ -3200,26 +3242,46 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
   }
   async deleteDataset(args) {
     try {
-      try {
-        await this.db.runDml({
-          sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENT_RESULTS, "table name")}
-                WHERE ${quoteIdent("experimentId", "column name")} IN (
-                  SELECT ${quoteIdent("id", "column name")} FROM ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")}
-                  WHERE ${quoteIdent("datasetId", "column name")} = @id)`,
-          params: { id: args.id }
-        });
-        await this.db.runDml({
-          sql: `UPDATE ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")}
-                SET ${quoteIdent("datasetId", "column name")} = NULL,
-                    ${quoteIdent("datasetVersion", "column name")} = NULL
-                WHERE ${quoteIdent("datasetId", "column name")} = @id`,
-          params: { id: args.id }
-        });
-      } catch {
+      const tenancyConditions = [];
+      const tenancyParams = {};
+      if (args.filters?.organizationId !== void 0) {
+        tenancyConditions.push(`${quoteIdent("organizationId", "column name")} = @organizationId`);
+        tenancyParams.organizationId = args.filters.organizationId;
+      }
+      if (args.filters?.projectId !== void 0) {
+        tenancyConditions.push(`${quoteIdent("projectId", "column name")} = @projectId`);
+        tenancyParams.projectId = args.filters.projectId;
       }
+      const scopedWhere = [`${quoteIdent("id", "column name")} = @id`, ...tenancyConditions].join(" AND ");
+      const experimentTablesExist = await this.experimentTablesExist();
       await this.db.runWithAbortRetry(
         () => this.database.runTransactionAsync(async (tx) => {
           try {
+            const [rows] = await tx.run({
+              sql: `SELECT ${quoteIdent("id", "column name")} FROM ${quoteIdent(storage.TABLE_DATASETS, "table name")} WHERE ${scopedWhere}`,
+              params: { id: args.id, ...tenancyParams },
+              json: true
+            });
+            if (!rows || rows.length === 0) {
+              await tx.commit();
+              return;
+            }
+            if (experimentTablesExist) {
+              await tx.runUpdate({
+                sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENT_RESULTS, "table name")}
+                      WHERE ${quoteIdent("experimentId", "column name")} IN (
+                        SELECT ${quoteIdent("id", "column name")} FROM ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")}
+                        WHERE ${quoteIdent("datasetId", "column name")} = @id)`,
+                params: { id: args.id }
+              });
+              await tx.runUpdate({
+                sql: `UPDATE ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")}
+                      SET ${quoteIdent("datasetId", "column name")} = NULL,
+                          ${quoteIdent("datasetVersion", "column name")} = NULL
+                      WHERE ${quoteIdent("datasetId", "column name")} = @id`,
+                params: { id: args.id }
+              });
+            }
             for (const table of [storage.TABLE_DATASET_VERSIONS, storage.TABLE_DATASET_ITEMS]) {
               await tx.runUpdate({
                 sql: `DELETE FROM ${quoteIdent(table, "table name")} WHERE ${quoteIdent("datasetId", "column name")} = @id`,
@@ -3227,8 +3289,8 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
               });
             }
             await tx.runUpdate({
-              sql: `DELETE FROM ${quoteIdent(storage.TABLE_DATASETS, "table name")} WHERE ${quoteIdent("id", "column name")} = @id`,
-              params: { id: args.id }
+              sql: `DELETE FROM ${quoteIdent(storage.TABLE_DATASETS, "table name")} WHERE ${scopedWhere}`,
+              params: { id: args.id, ...tenancyParams }
             });
             await tx.commit();
           } catch (err) {
@@ -3274,10 +3336,26 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
         filterConditions.push(`${quoteIdent("candidateId", "column name")} = @candidateId`);
         filterParams.candidateId = args.filters.candidateId;
       }
+      if (args.filters?.targetType !== void 0) {
+        filterConditions.push(`${quoteIdent("targetType", "column name")} = @targetType`);
+        filterParams.targetType = args.filters.targetType;
+      }
+      if (args.filters?.targetIds !== void 0 && args.filters.targetIds.length > 0) {
+        filterConditions.push(
+          `EXISTS (SELECT 1 FROM UNNEST(JSON_QUERY_ARRAY(${quoteIdent("targetIds", "column name")})) AS t WHERE JSON_VALUE(t) IN UNNEST(@targetIds))`
+        );
+        filterParams.targetIds = args.filters.targetIds;
+      }
+      if (args.filters?.name !== void 0 && args.filters.name.length > 0) {
+        filterConditions.push(`LOWER(${quoteIdent("name", "column name")}) LIKE LOWER(@nameSubstring)`);
+        filterParams.nameSubstring = `%${args.filters.name}%`;
+      }
       const whereClause = filterConditions.length > 0 ? `WHERE ${filterConditions.join(" AND ")}` : "";
+      const filterTypes = args.filters?.targetIds !== void 0 && args.filters.targetIds.length > 0 ? { targetIds: { type: "array", child: { type: "string" } } } : {};
       const [countRows] = await this.database.run({
         sql: `SELECT COUNT(*) AS count FROM ${tableName} ${whereClause}`,
         params: filterParams,
+        types: filterTypes,
         json: true
       });
       const total = Number(countRows[0]?.count ?? 0);
@@ -3290,6 +3368,7 @@ var DatasetsSpanner = class _DatasetsSpanner extends storage.DatasetsStorage {
               ORDER BY ${quoteIdent("createdAt", "column name")} DESC, ${quoteIdent("id", "column name")} ASC
               LIMIT @limit OFFSET @offset`,
         params: { ...filterParams, limit, offset },
+        types: filterTypes,
         json: true
       });
       const datasets = rows.map(rowToDataset);
@@ -4214,7 +4293,27 @@ var ExperimentsSpanner = class _ExperimentsSpanner extends storage.ExperimentsSt
   }
   async getExperimentById(args) {
     try {
-      const row = await this.db.load({ tableName: storage.TABLE_EXPERIMENTS, keys: { id: args.id } });
+      const hasTenancy = args.filters?.organizationId !== void 0 || args.filters?.projectId !== void 0;
+      if (!hasTenancy) {
+        const row2 = await this.db.load({ tableName: storage.TABLE_EXPERIMENTS, keys: { id: args.id } });
+        return row2 ? rowToExperiment(row2) : null;
+      }
+      const conditions = [`${quoteIdent("id", "column name")} = @id`];
+      const params = { id: args.id };
+      if (args.filters?.organizationId !== void 0) {
+        conditions.push(`${quoteIdent("organizationId", "column name")} = @organizationId`);
+        params.organizationId = args.filters.organizationId;
+      }
+      if (args.filters?.projectId !== void 0) {
+        conditions.push(`${quoteIdent("projectId", "column name")} = @projectId`);
+        params.projectId = args.filters.projectId;
+      }
+      const [rows] = await this.database.run({
+        sql: `SELECT * FROM ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")} WHERE ${conditions.join(" AND ")} LIMIT 1`,
+        params,
+        json: true
+      });
+      const row = rows[0];
       return row ? rowToExperiment(row) : null;
     } catch (error$1) {
       throw new error.MastraError(
@@ -4308,18 +4407,43 @@ var ExperimentsSpanner = class _ExperimentsSpanner extends storage.ExperimentsSt
   }
   async deleteExperiment(args) {
     try {
+      const tenancyConditions = [];
+      const tenancyParams = {};
+      if (args.filters?.organizationId !== void 0) {
+        tenancyConditions.push(`${quoteIdent("organizationId", "column name")} = @organizationId`);
+        tenancyParams.organizationId = args.filters.organizationId;
+      }
+      if (args.filters?.projectId !== void 0) {
+        tenancyConditions.push(`${quoteIdent("projectId", "column name")} = @projectId`);
+        tenancyParams.projectId = args.filters.projectId;
+      }
+      const gateWhere = [`${quoteIdent("id", "column name")} = @id`, ...tenancyConditions].join(" AND ");
       await this.db.runWithAbortRetry(
         () => this.database.runTransactionAsync(async (tx) => {
           try {
+            const [gateRows] = await tx.run({
+              sql: `SELECT ${quoteIdent("id", "column name")} FROM ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")}
+                    WHERE ${gateWhere} LIMIT 1`,
+              params: { id: args.id, ...tenancyParams },
+              json: true
+            });
+            if (!Array.isArray(gateRows) || gateRows.length === 0) {
+              await tx.commit();
+              return;
+            }
+            const cascadeWhere = [
+              `${quoteIdent("experimentId", "column name")} = @id`,
+              // Result rows carry the same organizationId/projectId as their parent,
+              // so applying tenancy here makes the cascade itself tenant-scoped.
+              ...tenancyConditions
+            ].join(" AND ");
             await tx.runUpdate({
-              sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENT_RESULTS, "table name")}
-                    WHERE ${quoteIdent("experimentId", "column name")} = @id`,
-              params: { id: args.id }
+              sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENT_RESULTS, "table name")} WHERE ${cascadeWhere}`,
+              params: { id: args.id, ...tenancyParams }
             });
             await tx.runUpdate({
-              sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")}
-                    WHERE ${quoteIdent("id", "column name")} = @id`,
-              params: { id: args.id }
+              sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENTS, "table name")} WHERE ${gateWhere}`,
+              params: { id: args.id, ...tenancyParams }
             });
             await tx.commit();
           } catch (err) {
@@ -4475,10 +4599,30 @@ var ExperimentsSpanner = class _ExperimentsSpanner extends storage.ExperimentsSt
   }
   async getExperimentResultById(args) {
     try {
-      const row = await this.db.load({
-        tableName: storage.TABLE_EXPERIMENT_RESULTS,
-        keys: { id: args.id }
+      const hasTenancy = args.filters?.organizationId !== void 0 || args.filters?.projectId !== void 0;
+      if (!hasTenancy) {
+        const row2 = await this.db.load({
+          tableName: storage.TABLE_EXPERIMENT_RESULTS,
+          keys: { id: args.id }
+        });
+        return row2 ? rowToExperimentResult(row2) : null;
+      }
+      const conditions = [`${quoteIdent("id", "column name")} = @id`];
+      const params = { id: args.id };
+      if (args.filters?.organizationId !== void 0) {
+        conditions.push(`${quoteIdent("organizationId", "column name")} = @organizationId`);
+        params.organizationId = args.filters.organizationId;
+      }
+      if (args.filters?.projectId !== void 0) {
+        conditions.push(`${quoteIdent("projectId", "column name")} = @projectId`);
+        params.projectId = args.filters.projectId;
+      }
+      const [rows] = await this.database.run({
+        sql: `SELECT * FROM ${quoteIdent(storage.TABLE_EXPERIMENT_RESULTS, "table name")} WHERE ${conditions.join(" AND ")} LIMIT 1`,
+        params,
+        json: true
       });
+      const row = rows[0];
       return row ? rowToExperimentResult(row) : null;
     } catch (error$1) {
       throw new error.MastraError(
@@ -4561,6 +4705,23 @@ var ExperimentsSpanner = class _ExperimentsSpanner extends storage.ExperimentsSt
   }
   async deleteExperimentResults(args) {
     try {
+      if (args.filters?.organizationId !== void 0 || args.filters?.projectId !== void 0) {
+        const conditions = [`${quoteIdent("experimentId", "column name")} = @experimentId`];
+        const params = { experimentId: args.experimentId };
+        if (args.filters?.organizationId !== void 0) {
+          conditions.push(`${quoteIdent("organizationId", "column name")} = @organizationId`);
+          params.organizationId = args.filters.organizationId;
+        }
+        if (args.filters?.projectId !== void 0) {
+          conditions.push(`${quoteIdent("projectId", "column name")} = @projectId`);
+          params.projectId = args.filters.projectId;
+        }
+        await this.db.runDml({
+          sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENT_RESULTS, "table name")} WHERE ${conditions.join(" AND ")}`,
+          params
+        });
+        return;
+      }
       await this.db.runDml({
         sql: `DELETE FROM ${quoteIdent(storage.TABLE_EXPERIMENT_RESULTS, "table name")}
               WHERE ${quoteIdent("experimentId", "column name")} = @experimentId`,
@@ -10550,6 +10711,16 @@ function transformScoreRow(row) {
   const normalized = transformFromSpannerRow({ tableName: storage.TABLE_SCORERS, row });
   return storage.transformScoreRow(normalized, { convertTimestamps: true });
 }
+function applyTenancyFilters(conditions, params, filters) {
+  if (filters?.organizationId !== void 0) {
+    conditions.push(`${quoteIdent("organizationId", "column name")} = @organizationId`);
+    params.organizationId = filters.organizationId;
+  }
+  if (filters?.projectId !== void 0) {
+    conditions.push(`${quoteIdent("projectId", "column name")} = @projectId`);
+    params.projectId = filters.projectId;
+  }
+}
 var ScoresSpanner = class _ScoresSpanner extends storage.ScoresStorage {
   database;
   db;
@@ -10728,7 +10899,8 @@ var ScoresSpanner = class _ScoresSpanner extends storage.ScoresStorage {
     pagination,
     entityId,
     entityType,
-    source
+    source,
+    filters
   }) {
     try {
       const conditions = [`${quoteIdent("scorerId", "column name")} = @scorerId`];
@@ -10745,6 +10917,7 @@ var ScoresSpanner = class _ScoresSpanner extends storage.ScoresStorage {
         conditions.push(`${quoteIdent("source", "column name")} = @source`);
         params.source = source;
       }
+      applyTenancyFilters(conditions, params, filters);
       return await this.listScoresByConditions(conditions, params, pagination);
     } catch (error$1) {
       throw new error.MastraError(
@@ -10760,14 +10933,14 @@ var ScoresSpanner = class _ScoresSpanner extends storage.ScoresStorage {
   }
   async listScoresByRunId({
     runId,
-    pagination
+    pagination,
+    filters
   }) {
     try {
-      return await this.listScoresByConditions(
-        [`${quoteIdent("runId", "column name")} = @runId`],
-        { runId },
-        pagination
-      );
+      const conditions = [`${quoteIdent("runId", "column name")} = @runId`];
+      const params = { runId };
+      applyTenancyFilters(conditions, params, filters);
+      return await this.listScoresByConditions(conditions, params, pagination);
     } catch (error$1) {
       throw new error.MastraError(
         {
@@ -10783,17 +10956,17 @@ var ScoresSpanner = class _ScoresSpanner extends storage.ScoresStorage {
   async listScoresByEntityId({
     entityId,
     entityType,
-    pagination
+    pagination,
+    filters
   }) {
     try {
-      return await this.listScoresByConditions(
-        [
-          `${quoteIdent("entityId", "column name")} = @entityId`,
-          `${quoteIdent("entityType", "column name")} = @entityType`
-        ],
-        { entityId, entityType },
-        pagination
-      );
+      const conditions = [
+        `${quoteIdent("entityId", "column name")} = @entityId`,
+        `${quoteIdent("entityType", "column name")} = @entityType`
+      ];
+      const params = { entityId, entityType };
+      applyTenancyFilters(conditions, params, filters);
+      return await this.listScoresByConditions(conditions, params, pagination);
     } catch (error$1) {
       throw new error.MastraError(
         {
@@ -10809,14 +10982,17 @@ var ScoresSpanner = class _ScoresSpanner extends storage.ScoresStorage {
   async listScoresBySpan({
     traceId,
     spanId,
-    pagination
+    pagination,
+    filters
   }) {
     try {
-      return await this.listScoresByConditions(
-        [`${quoteIdent("traceId", "column name")} = @traceId`, `${quoteIdent("spanId", "column name")} = @spanId`],
-        { traceId, spanId },
-        pagination
-      );
+      const conditions = [
+        `${quoteIdent("traceId", "column name")} = @traceId`,
+        `${quoteIdent("spanId", "column name")} = @spanId`
+      ];
+      const params = { traceId, spanId };
+      applyTenancyFilters(conditions, params, filters);
+      return await this.listScoresByConditions(conditions, params, pagination);
     } catch (error$1) {
       throw new error.MastraError(
         {