@obsunified/collector 2.0.1 → 2.1.1

package/src/lib/alerts-store.ts

@@ -21,6 +21,12 @@ import { EVIDENCE_REFERENCE_CONTRACT } from "@obsunified/types";
 import { alertEvidenceReferences } from "./evidence-references";
 import { randomHex } from "./hash";
 import type { SqlDb } from "./sql-db";
+import { assertSafeWebhookUrl, WebhookUrlError } from "./webhook-url";
+
+export interface AlertsStoreOptions {
+	/** Permit webhook targets on loopback / private / link-local hosts. */
+	allowPrivateWebhookTargets?: boolean;
+}
 
 const parseJsonField = <T>(value: unknown): T => {
 	if (typeof value === "string") return JSON.parse(value) as T;
@@ -79,7 +85,10 @@ export function compareValue(
 }
 
 export class AlertsStore {
-	constructor(private readonly db: SqlDb) {}
+	constructor(
+		private readonly db: SqlDb,
+		private readonly options: AlertsStoreOptions = {},
+	) {}
 
 	validateInput(input: AlertRuleInput): void {
 		if (!input.name?.trim()) throw new Error("name is required");
@@ -96,8 +105,16 @@ export class AlertsStore {
 		for (const ch of input.channels) {
 			if (ch.type !== "webhook")
 				throw new Error(`unknown channel type: ${ch.type}`);
-			if (!ch.url || !/^https?:\/\//.test(ch.url))
+			if (!ch.url || typeof ch.url !== "string")
 				throw new Error("channel.url must be http(s)://");
+			try {
+				assertSafeWebhookUrl(ch.url, {
+					allowPrivateNetworks: this.options.allowPrivateWebhookTargets,
+				});
+			} catch (err) {
+				if (err instanceof WebhookUrlError) throw new Error(err.message);
+				throw err;
+			}
 		}
 	}
 
@@ -217,18 +234,30 @@ export class AlertsStore {
 	}
 
 	async deleteRule(id: string, projectId: string): Promise<boolean> {
-		const result = await this.db
-			.prepare(`DELETE FROM alert_rules WHERE id = ? AND project_id = ?`)
+		// Only a rule the caller's project owns takes its state and
+		// evaluations with it; a miss must not touch another project's rows.
+		// Children go first because alert_state / alert_evaluations reference
+		// alert_rules(id) and SQLite enforces that on D1 and node:sqlite.
+		const owned = await this.db
+			.prepare(
+				`SELECT 1 AS ok FROM alert_rules WHERE id = ? AND project_id = ?`,
+			)
 			.bind(id, projectId)
-			.run();
-		// Also clean up state and evaluations for this rule.
+			.first<{ ok: number }>();
+		if (!owned) return false;
 		await this.db
-			.prepare(`DELETE FROM alert_state WHERE rule_id = ?`)
-			.bind(id)
+			.prepare(`DELETE FROM alert_state WHERE rule_id = ? AND project_id = ?`)
+			.bind(id, projectId)
 			.run();
 		await this.db
-			.prepare(`DELETE FROM alert_evaluations WHERE rule_id = ?`)
-			.bind(id)
+			.prepare(
+				`DELETE FROM alert_evaluations WHERE rule_id = ? AND project_id = ?`,
+			)
+			.bind(id, projectId)
+			.run();
+		const result = await this.db
+			.prepare(`DELETE FROM alert_rules WHERE id = ? AND project_id = ?`)
+			.bind(id, projectId)
 			.run();
 		return (result.meta?.changes ?? 0) > 0;
 	}
@@ -242,28 +271,85 @@ export class AlertsStore {
 
 	// ── State ──
 
-	async getState(ruleId: string): Promise<AlertStateRow | null> {
+	async getState(
+		ruleId: string,
+		projectId: string,
+	): Promise<AlertStateRow | null> {
 		const row = await this.db
-			.prepare(`SELECT * FROM alert_state WHERE rule_id = ?`)
-			.bind(ruleId)
+			.prepare(`SELECT * FROM alert_state WHERE rule_id = ? AND project_id = ?`)
+			.bind(ruleId, projectId)
 			.first<AlertStateRow>();
 		return row ?? null;
 	}
 
+	/**
+	 * Record a state transition with its notification still outstanding
+	 * (`notified = 0`); `markNotified` flips it once a channel accepts the
+	 * alert. On a database that has not applied migration 049 the column is
+	 * missing: the transition is still written (legacy statement) so alerting
+	 * keeps working through a rolling deploy, and the evaluator treats a row
+	 * without the column as delivered.
+	 */
 	async transitionState(
 		ruleId: string,
 		projectId: string,
 		newState: AlertState,
 		now: string,
 	): Promise<void> {
-		await this.db
-			.prepare(
-				`INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change)
+		try {
+			await this.db
+				.prepare(
+					`INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change, notified)
+         VALUES (?, ?, ?, ?, 0)
+         ON CONFLICT(rule_id) DO UPDATE SET
+           current_state = excluded.current_state,
+           last_state_change = excluded.last_state_change,
+           notified = 0`,
+				)
+				.bind(ruleId, projectId, newState, now)
+				.run();
+		} catch (err) {
+			if (!isMissingNotifiedColumn(err)) throw err;
+			await this.db
+				.prepare(
+					`INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change)
          VALUES (?, ?, ?, ?)
-         ON CONFLICT(rule_id) DO UPDATE SET current_state = excluded.current_state, last_state_change = excluded.last_state_change`,
-			)
-			.bind(ruleId, projectId, newState, now)
-			.run();
+         ON CONFLICT(rule_id) DO UPDATE SET
+           current_state = excluded.current_state,
+           last_state_change = excluded.last_state_change`,
+				)
+				.bind(ruleId, projectId, newState, now)
+				.run();
+		}
+	}
+
+	/**
+	 * Mark the transition `(state, lastStateChange)` as delivered. Scoped to
+	 * the exact transition the caller notified for: if the rule changed state
+	 * again while the webhook was in flight, the newer transition keeps its
+	 * own outstanding flag. Returns false when nothing matched (stale or
+	 * already marked). On a pre-049 schema there is nothing to mark.
+	 */
+	async markNotified(
+		ruleId: string,
+		projectId: string,
+		state: AlertState,
+		lastStateChange: string,
+	): Promise<boolean> {
+		try {
+			const result = await this.db
+				.prepare(
+					`UPDATE alert_state SET notified = 1
+				 WHERE rule_id = ? AND project_id = ? AND current_state = ?
+				   AND last_state_change = ? AND notified = 0`,
+				)
+				.bind(ruleId, projectId, state, lastStateChange)
+				.run();
+			return (result.meta?.changes ?? 0) > 0;
+		} catch (err) {
+			if (isMissingNotifiedColumn(err)) return false;
+			throw err;
+		}
 	}
 
 	async recordEvaluation(
@@ -448,7 +534,9 @@ export class AlertsStore {
 			sql += ` AND model_name = ?`;
 			binds.push(q.model);
 		}
-		if (q.isError === true) sql += ` AND is_error = 1`;
+		// Bare boolean test: INTEGER 0/1 on D1, BOOLEAN on Postgres (where
+		// `is_error = 1` is a type error).
+		if (q.isError === true) sql += ` AND is_error`;
 		const row = await this.db
 			.prepare(sql)
 			.bind(...binds)
@@ -456,3 +544,16 @@ export class AlertsStore {
 		return row?.c ?? 0;
 	}
 }
+
+/**
+ * SQLite: "table alert_state has no column named notified" / "no such column:
+ * notified"; Postgres: `column "notified" of relation "alert_state" does not
+ * exist` (42703). Anything else is a real failure.
+ */
+const isMissingNotifiedColumn = (err: unknown): boolean => {
+	const message = err instanceof Error ? err.message : String(err);
+	return (
+		/notified/i.test(message) &&
+		/no such column|has no column|does not exist/i.test(message)
+	);
+};

package/src/lib/analyses-runner.test.ts

@@ -0,0 +1,75 @@
+/**
+ * `runAllDueAnalyses` used to hard-code project `default`, so analyses for
+ * every other project never refreshed and alert rules bound to them always
+ * evaluated against nothing. These tests run the orchestrator against the
+ * real migrated schema and against a database whose projects table fails.
+ */
+
+import { describe, expect, it } from "vitest";
+import type { CollectorEnv } from "../framework/env";
+import { runAllDueAnalyses } from "./analyses-runner";
+import { ProjectsStore } from "./projects-store";
+import { MemSqlDb } from "./test-utils/mem-sql-db";
+import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
+
+const silent = { debug() {}, info() {}, warn() {}, error() {} };
+
+describe("runAllDueAnalyses", () => {
+	it("refreshes and runs analyses for every project, not just default", async () => {
+		const db = createMigratedSqliteDb();
+		const beta = await new ProjectsStore(db).createProject({
+			name: "Beta",
+			slug: "beta",
+		});
+
+		const summary = await runAllDueAnalyses({
+			env: { DB: db } as unknown as CollectorEnv,
+			retentionHours: 24,
+			logger: silent,
+		});
+
+		expect(summary.failed).toBe(0);
+		expect(summary.ran).toBeGreaterThan(0);
+		const projects = await db
+			.prepare(
+				`SELECT DISTINCT project_id FROM analysis_results ORDER BY project_id`,
+			)
+			.all<{ project_id: string }>();
+		const ids = projects.results.map((r) => r.project_id);
+		// 011 seeds `default`, 026 seeds `obs-dashboard`.
+		expect(ids).toEqual(
+			expect.arrayContaining(["default", "obs-dashboard", beta.id]),
+		);
+
+		const perProject = await db
+			.prepare(
+				`SELECT project_id, COUNT(*) AS n FROM analysis_results GROUP BY project_id`,
+			)
+			.all<{ project_id: string; n: number }>();
+		const counts = new Map(perProject.results.map((r) => [r.project_id, r.n]));
+		expect(counts.get(beta.id)).toBe(counts.get("default"));
+		db.close();
+	});
+
+	it("falls back to the default project when projects cannot be listed", async () => {
+		const db = new MemSqlDb({
+			all: (sql) => {
+				if (sql.includes("FROM projects")) throw new Error("no projects table");
+				return [];
+			},
+			first: () => null,
+		});
+
+		const summary = await runAllDueAnalyses({
+			env: { DB: db } as unknown as CollectorEnv,
+			retentionHours: 24,
+			logger: silent,
+		});
+
+		expect(summary).toMatchObject({ ran: 0, failed: 0 });
+		expect(summary.refreshed).toBeGreaterThan(0);
+		const due = db.callsMatching("FROM analysis_definitions");
+		expect(due.length).toBeGreaterThan(0);
+		expect(due.every((c) => c.binds[0] === "default")).toBe(true);
+	});
+});

package/src/lib/analyses-runner.ts

@@ -42,6 +42,7 @@ import {
 	evaluateGate,
 	type NarrativeIntent,
 } from "./narrate-gate";
+import { ProjectsStore } from "./projects-store";
 import { type SqlDb, sqlDbFor } from "./sql-db";
 
 export interface AnalysisRunContext {
@@ -253,8 +254,10 @@ async function narratePass(
  * in-process registry (so newly-derived Tier 1 analyses become visible
  * to the dashboard within one tick), then runs whatever's due.
  *
- * Stage 1 has a single project ("default"). When a projects table is
- * available we'll iterate it here.
+ * Runs once per project in the `projects` table (falling back to the
+ * `default` project when the table is empty or unreadable), so analyses and
+ * the alert rules bound to them refresh for every tenant, not just the
+ * first one.
  */
 export async function runAllDueAnalyses(
 	ctx: {
@@ -274,7 +277,61 @@ export async function runAllDueAnalyses(
 	const logger = ctx.logger ?? consoleLogger;
 	const db = sqlDbFor(ctx.env);
 	const store = new AnalysesStore(db);
-	const projectId = "default";
+	const totals = { ran: 0, failed: 0, refreshed: 0, narrated: 0, skipped: 0 };
+	for (const projectId of await listAnalysisProjects(db, logger)) {
+		const summary = await runDueAnalysesForProject(projectId, {
+			ctx,
+			db,
+			store,
+			logger,
+		});
+		totals.ran += summary.ran;
+		totals.failed += summary.failed;
+		totals.refreshed += summary.refreshed;
+		totals.narrated += summary.narrated;
+		totals.skipped += summary.skipped ?? 0;
+	}
+	return totals;
+}
+
+/** Project ids to run analyses for; `default` when none can be listed. */
+async function listAnalysisProjects(
+	db: SqlDb,
+	logger: Logger,
+): Promise<string[]> {
+	try {
+		const ids = (await new ProjectsStore(db).listProjects())
+			.map((p) => p.id)
+			.filter((id) => typeof id === "string" && id.length > 0);
+		if (ids.length > 0) return ids;
+	} catch (error) {
+		logger.error("[analyses] failed to list projects; running default only", {
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+	return ["default"];
+}
+
+async function runDueAnalysesForProject(
+	projectId: string,
+	deps: {
+		ctx: {
+			env: CollectorEnv;
+			retentionHours: number;
+			tracer?: ChildSpanRunner;
+		};
+		db: SqlDb;
+		store: AnalysesStore;
+		logger: Logger;
+	},
+): Promise<{
+	ran: number;
+	failed: number;
+	refreshed: number;
+	narrated: number;
+	skipped?: number;
+}> {
+	const { ctx, db, store, logger } = deps;
 	const now = Date.now();
 	const expiresAt = now + ctx.retentionHours * 3600 * 1000;
 

package/src/lib/analyses-store-latest.test.ts

@@ -0,0 +1,61 @@
+import type { AnalysisResult } from "@obsunified/types";
+import { describe, expect, it } from "vitest";
+import { AnalysesStore } from "./analyses-store";
+import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
+
+const result = (
+	analysisId: string,
+	generatedAt: string,
+	status: AnalysisResult["status"],
+): AnalysisResult => ({
+	analysisId,
+	projectId: "alpha",
+	generatedAt,
+	paramsHash: null,
+	status,
+	primaryValue: 1,
+	baselineValue: 0,
+	deltaPct: null,
+	payload: {},
+	narrative: null,
+	narrativeSignature: null,
+	durationMs: 1,
+});
+
+describe("AnalysesStore.getLatestResultsBulk", () => {
+	it("returns the newest result per analysis from a single bounded query", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new AnalysesStore(db);
+		const expires = Date.now() + 3_600_000;
+		for (const [id, at, status] of [
+			["a", "2026-10-13T01:00:00.000Z", "ok"],
+			["a", "2026-10-13T03:00:00.000Z", "critical"],
+			["a", "2026-10-13T02:00:00.000Z", "warn"],
+			["b", "2026-10-13T02:30:00.000Z", "warn"],
+			["c", "2026-10-13T02:30:00.000Z", "ok"],
+		] as const) {
+			await store.insertResult(result(id, at, status), expires);
+		}
+		// Another project with the same ids must not bleed through.
+		await store.insertResult(
+			{ ...result("a", "2026-10-13T09:00:00.000Z", "ok"), projectId: "beta" },
+			expires,
+		);
+
+		const latest = await store.getLatestResultsBulk("alpha", ["a", "b", "zz"]);
+		expect([...latest.keys()].sort()).toEqual(["a", "b"]);
+		expect(latest.get("a")?.status).toBe("critical");
+		expect(latest.get("a")?.generatedAt).toBe("2026-10-13T03:00:00.000Z");
+		expect(latest.get("b")?.status).toBe("warn");
+
+		// The query itself must not return every retained row.
+		const rows = await db
+			.prepare(
+				`SELECT COUNT(*) AS n FROM analysis_results WHERE project_id = ? AND analysis_id = ?`,
+			)
+			.bind("alpha", "a")
+			.first<{ n: number }>();
+		expect(rows?.n).toBe(3);
+		db.close();
+	});
+});

package/src/lib/analyses-store.ts

@@ -293,20 +293,27 @@ export class AnalysesStore {
 			);
 		if (analysisIds.length === 0) return new Map();
 
-		// Pull a recent window of rows for the requested analyses then group by
-		// analysis_id, taking the row with the largest generated_at per group.
-		// One query, no per-analysis round-trips.
+		// One row per analysis: join against the per-analysis MAX(generated_at)
+		// so the database returns only the newest result for each id instead
+		// of every retained row (a 60 s refresh over a 72 h window is ~4k rows
+		// per analysis). Ties on generated_at are broken in JS below.
 		const placeholders = analysisIds.map(() => "?").join(", ");
 		const result = await this.db
 			.prepare(
-				`SELECT id, project_id, analysis_id, generated_at, params_hash,
-					status, primary_value, baseline_value, delta_pct, payload_json,
-					narrative, narrative_signature, duration_ms, expires_at
-				FROM analysis_results
-				WHERE project_id = ? AND analysis_id IN (${placeholders})
-				ORDER BY generated_at DESC`,
+				`SELECT r.id, r.project_id, r.analysis_id, r.generated_at, r.params_hash,
+					r.status, r.primary_value, r.baseline_value, r.delta_pct, r.payload_json,
+					r.narrative, r.narrative_signature, r.duration_ms, r.expires_at
+				FROM analysis_results r
+				JOIN (
+					SELECT analysis_id, MAX(generated_at) AS latest_at
+					FROM analysis_results
+					WHERE project_id = ? AND analysis_id IN (${placeholders})
+					GROUP BY analysis_id
+				) m ON m.analysis_id = r.analysis_id AND m.latest_at = r.generated_at
+				WHERE r.project_id = ?
+				ORDER BY r.generated_at DESC, r.id DESC`,
 			)
-			.bind(projectId, ...analysisIds)
+			.bind(projectId, ...analysisIds, projectId)
 			.all<ResultRow>();
 
 		const latest = new Map<string, AnalysisResult>();

package/src/lib/blob-store.ts

@@ -6,7 +6,7 @@
  *  - `R2BlobStore` — Cloudflare R2 binding (default on Workers).
  *  - `S3BlobStore` (sibling file) — AWS S3 / MinIO / any S3-compatible.
  *
- * Replay chunks live under `replays/<session_id>/<chunk_id>`; pprof
+ * Replay chunks live under `replays/<project_id>/<session_id>/<chunk_id>`; pprof
  * profiles live under `profiles/<service>/<trace_id>/<span_id>`. The
  * adapter never sees these paths — they're constructed by the callers
  * (`replay-receiver`, `profile-routes`).

package/src/lib/housekeeping.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+import { purgeSecondaryRows } from "./housekeeping";
+import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
+
+const HOUR = 3_600_000;
+const NOW = Date.UTC(2026, 9, 13, 12, 0, 0);
+const iso = (hoursAgo: number) => new Date(NOW - hoursAgo * HOUR).toISOString();
+
+describe("purgeSecondaryRows", () => {
+	it("removes only rows no API window or ingest path can still reach", async () => {
+		const db = createMigratedSqliteDb();
+		const raw = db.raw;
+		raw.exec(`
+			INSERT INTO projects (id, name, slug, created_at) VALUES ('alpha', 'A', 'a', '${iso(1000)}');
+			INSERT INTO alert_rules (id, project_id, name, signal, query_json, threshold, window_mins, comparison, channels_json, enabled, created_at, updated_at)
+			VALUES ('r1', 'alpha', 'r', 'spans', '{}', 1, 5, '>', '[]', 1, '${iso(1000)}', '${iso(1000)}');
+		`);
+		const ev = raw.prepare(
+			`INSERT INTO alert_evaluations (id, rule_id, project_id, evaluated_at, value, state, notified) VALUES (?, 'r1', 'alpha', ?, 1, 'ok', 0)`,
+		);
+		ev.run("old", iso(721));
+		ev.run("edge", iso(719));
+		const ask = raw.prepare(
+			`INSERT INTO ask_evidence_events (project_id, analysis_id, asked_at) VALUES ('alpha', 'x', ?)`,
+		);
+		ask.run(NOW - 31 * 24 * HOUR);
+		ask.run(NOW - 29 * 24 * HOUR);
+		const series = raw.prepare(
+			`INSERT INTO metric_series (id, project_id, name, type, identity, created_at) VALUES (?, 'alpha', 'm', 'gauge', ?, ?)`,
+		);
+		series.run("orphan-old", "i1", iso(100)); // no points, older than window
+		series.run("orphan-new", "i2", iso(1)); // no points but just created
+		series.run("live", "i3", iso(100)); // old but still has a point
+		raw
+			.prepare(
+				`INSERT INTO metric_point (id, series_id, project_id, ts_ns, received_at, expires_at) VALUES ('p1', 'live', 'alpha', '1', ?, ?)`,
+			)
+			.run(iso(1), iso(-1));
+		const ref = raw.prepare(
+			`INSERT INTO evidence_retrieval_refs (ref_id, project_id, kind, anchor_kind, anchor_id, source, expires_at) VALUES (?, 'alpha', 'logs', 'trace', 't', 'test', ?)`,
+		);
+		ref.run("expired", iso(1));
+		ref.run("fresh", iso(-1));
+		ref.run("no-expiry", null);
+		const exp = raw.prepare(
+			`INSERT INTO evidence_ref_expansions (id, ref_id, project_id, kind, operation, result_status) VALUES (?, ?, 'alpha', 'logs', 'expand', 'ok')`,
+		);
+		exp.run("e1", "expired");
+		exp.run("e2", "fresh");
+
+		const summary = await purgeSecondaryRows(db, {
+			retentionHours: 72,
+			now: () => NOW,
+		});
+		expect(summary).toEqual({
+			alert_evaluations: 1,
+			ask_evidence_events: 1,
+			metric_series: 1,
+			evidence_refs: 1,
+			evidence_ref_expansions: 1,
+		});
+		const ids = (sql: string) =>
+			(raw.prepare(sql).all() as Array<{ id: string }>).map((r) => r.id).sort();
+		expect(ids("SELECT id FROM alert_evaluations")).toEqual(["edge"]);
+		expect(ids("SELECT id FROM metric_series")).toEqual(["live", "orphan-new"]);
+		expect(ids("SELECT ref_id AS id FROM evidence_retrieval_refs")).toEqual([
+			"fresh",
+			"no-expiry",
+		]);
+		expect(ids("SELECT id FROM evidence_ref_expansions")).toEqual(["e2"]);
+		db.close();
+	});
+});

package/src/lib/housekeeping.ts

@@ -0,0 +1,93 @@
+/**
+ * Retention for the secondary tables the hourly sweep did not cover. Each
+ * rule is tied to an existing contract rather than a new policy:
+ *
+ *  - `alert_evaluations`: `/internal/alerts/evaluations` accepts at most a
+ *    720-hour window, so rows older than that are unreachable through the API.
+ *  - `ask_evidence_events`: feeds `getTopAskedAnalyses`, whose trailing window
+ *    is 7 days; rows older than 30 days cannot influence it.
+ *  - `metric_series`: identity rows whose points have all expired and that
+ *    were created before the retention window. They hold no data; the next
+ *    ingest of that identity recreates the row.
+ *  - `evidence_retrieval_refs`: rows carry their own `expires_at` (copied from
+ *    the signal they reference); expansions follow their ref.
+ */
+
+import type { SqlDb } from "./sql-db";
+
+export const ALERT_EVALUATIONS_MAX_AGE_HOURS = 720;
+export const ASK_EVIDENCE_EVENTS_MAX_AGE_HOURS = 30 * 24;
+
+export interface HousekeepingSummary {
+	alert_evaluations: number;
+	ask_evidence_events: number;
+	metric_series: number;
+	evidence_refs: number;
+	evidence_ref_expansions: number;
+}
+
+export interface HousekeepingOptions {
+	/** Window that bounds orphaned metric series; same value the main sweep uses. */
+	retentionHours: number;
+	/** Clock override for tests. */
+	now?: () => number;
+}
+
+const changes = (r: { meta?: { changes?: number } }) => r.meta?.changes ?? 0;
+
+export async function purgeSecondaryRows(
+	db: SqlDb,
+	options: HousekeepingOptions,
+): Promise<HousekeepingSummary> {
+	const nowMs = options.now?.() ?? Date.now();
+	const isoBefore = (hours: number) =>
+		new Date(nowMs - hours * 3_600_000).toISOString();
+
+	const alertEvaluations = await db
+		.prepare(`DELETE FROM alert_evaluations WHERE evaluated_at < ?`)
+		.bind(isoBefore(ALERT_EVALUATIONS_MAX_AGE_HOURS))
+		.run();
+
+	const askEvents = await db
+		.prepare(`DELETE FROM ask_evidence_events WHERE asked_at < ?`)
+		.bind(nowMs - ASK_EVIDENCE_EVENTS_MAX_AGE_HOURS * 3_600_000)
+		.run();
+
+	// Points and exemplars for the window are purged by MetricsStore first;
+	// a series created before the window with no remaining points is inert.
+	const series = await db
+		.prepare(
+			`DELETE FROM metric_series
+			 WHERE created_at < ?
+			   AND NOT EXISTS (
+			     SELECT 1 FROM metric_point p WHERE p.series_id = metric_series.id
+			   )`,
+		)
+		.bind(isoBefore(options.retentionHours))
+		.run();
+
+	const refs = await db
+		.prepare(
+			`DELETE FROM evidence_retrieval_refs
+			 WHERE expires_at IS NOT NULL AND expires_at < ?`,
+		)
+		.bind(isoBefore(0))
+		.run();
+	const expansions = await db
+		.prepare(
+			`DELETE FROM evidence_ref_expansions
+			 WHERE NOT EXISTS (
+			   SELECT 1 FROM evidence_retrieval_refs r
+			   WHERE r.ref_id = evidence_ref_expansions.ref_id
+			 )`,
+		)
+		.run();
+
+	return {
+		alert_evaluations: changes(alertEvaluations),
+		ask_evidence_events: changes(askEvents),
+		metric_series: changes(series),
+		evidence_refs: changes(refs),
+		evidence_ref_expansions: changes(expansions),
+	};
+}

package/src/lib/identity-index/action-lookups.ts

@@ -313,10 +313,10 @@ export async function manifestByAction(
 			.prepare(
 				`SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`,
 			)
-			.bind(...sessionIds)
+			.bind(projectId, ...sessionIds)
 			.first<{
 				session_id: string;
 				first_chunk_at: string;
@@ -546,10 +546,10 @@ export async function manifestByAgentRun(
 			.prepare(
 				`SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`,
 			)
-			.bind(...sessionIds)
+			.bind(projectId, ...sessionIds)
 			.first<{
 				session_id: string;
 				first_chunk_at: string;
@@ -767,10 +767,10 @@ export async function manifestByActor(
 			.prepare(
 				`SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`,
 			)
-			.bind(...sessionIds)
+			.bind(projectId, ...sessionIds)
 			.first<{
 				session_id: string;
 				first_chunk_at: string;