@obsunified/collector 2.0.1 → 2.1.1

package/src/lib/sql-db-sqlite-time-windows.test.ts

@@ -0,0 +1,194 @@
+/**
+ * Real-SQLite regression for the D1 time-window bug: every timestamp column
+ * stores `Date#toISOString()` text (`2026-10-13T05:04:53.123Z`), but the
+ * dialect and the shared analysis SQL used `datetime('now', …)`, which
+ * renders `2026-10-13 05:04:53`. In a text comparison the space sorts before
+ * `T`, so "last 5 minutes" matched the whole current UTC day and
+ * `expires_at < now` purges ran a day late. The expressions now render ISO
+ * text via `strftime('%Y-%m-%dT%H:%M:%fZ', …)`; these tests execute them.
+ */
+
+import { readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import type { StoredSpan } from "@obsunified/types";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { deriveAnalysesForProject } from "../analyses/derive";
+import { INVESTIGATION_ANALYSES } from "../analyses/investigations";
+import { TIER0_ANALYSES } from "../analyses/tier0";
+import { purgeExpiredAIData } from "./ai-store/retention";
+import { runSqlAnalysis } from "./analyses-runner";
+import { SQLITE_ISO_FORMAT, sqliteDialect, sqliteIsoNow } from "./sql-db";
+import { ingestTelemetrySpans } from "./store/ingest";
+import {
+	createMigratedSqliteDb,
+	type NodeSqliteDb,
+} from "./test-utils/node-sqlite-db";
+
+const ISO_TEXT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const PROJECT = "alpha";
+
+const minutesAgo = (minutes: number): string =>
+	new Date(Date.now() - minutes * 60_000).toISOString();
+
+const span = (over: Partial<StoredSpan>): StoredSpan => ({
+	projectId: PROJECT,
+	traceId: "trace-1",
+	spanId: "span-1",
+	parentSpanId: null,
+	traceState: null,
+	serviceName: "checkout",
+	scopeName: null,
+	scopeVersion: null,
+	spanName: "GET /",
+	spanKind: 2,
+	statusCode: 1,
+	statusMessage: null,
+	startTime: minutesAgo(1),
+	endTime: minutesAgo(1),
+	durationMs: 12,
+	attributesJson: "{}",
+	droppedAttributesCount: 0,
+	resourceAttributesJson: "{}",
+	eventsJson: "[]",
+	droppedEventsCount: 0,
+	linksJson: "[]",
+	droppedLinksCount: 0,
+	receivedAt: minutesAgo(1),
+	expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+	sessionId: null,
+	interactionId: null,
+	...over,
+});
+
+describe("sqliteDialect time windows against ISO text columns", () => {
+	let db: NodeSqliteDb;
+
+	beforeAll(async () => {
+		db = createMigratedSqliteDb();
+		await ingestTelemetrySpans(db, [
+			// inside the 5-minute window, and an error
+			span({
+				spanId: "recent-error",
+				statusCode: 2,
+				receivedAt: minutesAgo(2),
+			}),
+			// inside the 1-hour baseline only
+			span({ spanId: "base-1", receivedAt: minutesAgo(30) }),
+			span({ spanId: "base-2", receivedAt: minutesAgo(30) }),
+			span({ spanId: "base-3", receivedAt: minutesAgo(30) }),
+			// outside both windows, but still "today" in UTC for most of the day
+			span({ spanId: "old", receivedAt: minutesAgo(120) }),
+		]);
+	});
+
+	afterAll(() => db.close());
+
+	it("renders now() and relative windows in the shape Date#toISOString writes", async () => {
+		const row = await db
+			.prepare(
+				`SELECT ${sqliteDialect.now()} AS now_iso,
+				        ${sqliteDialect.sinceMinutes("?")} AS minutes_iso,
+				        ${sqliteDialect.sinceHours("?")} AS hours_iso`,
+			)
+			.bind(5, 1)
+			.first<{ now_iso: string; minutes_iso: string; hours_iso: string }>();
+		expect(row?.now_iso).toMatch(ISO_TEXT);
+		expect(row?.minutes_iso).toMatch(ISO_TEXT);
+		expect(row?.hours_iso).toMatch(ISO_TEXT);
+		const now = Date.parse(row?.now_iso ?? "");
+		expect(Math.abs(now - Date.now())).toBeLessThan(5_000);
+		expect(now - Date.parse(row?.minutes_iso ?? "")).toBe(5 * 60_000);
+		expect(now - Date.parse(row?.hours_iso ?? "")).toBe(60 * 60_000);
+		expect(sqliteIsoNow()).toBe(`strftime('${SQLITE_ISO_FORMAT}', 'now')`);
+	});
+
+	it("sinceMinutes / sinceHours select only rows inside the window", async () => {
+		const count = async (where: string, ...binds: unknown[]) => {
+			const row = await db
+				.prepare(
+					`SELECT COUNT(*) AS n FROM telemetry_spans WHERE project_id = ? AND ${where}`,
+				)
+				.bind(PROJECT, ...binds)
+				.first<{ n: number }>();
+			return row?.n ?? -1;
+		};
+		expect(
+			await count(`received_at >= ${sqliteDialect.sinceMinutes("?")}`, 5),
+		).toBe(1);
+		expect(
+			await count(`received_at >= ${sqliteDialect.sinceHours("?")}`, 1),
+		).toBe(4);
+		expect(
+			await count(
+				`received_at >= ${sqliteDialect.sinceHours("?")} AND received_at < ${sqliteDialect.sinceMinutes("?")}`,
+				1,
+				5,
+			),
+		).toBe(3);
+	});
+
+	it("purges rows whose ISO expires_at has passed and keeps the rest", async () => {
+		const insert = db.prepare(
+			`INSERT INTO ai_span_payloads (project_id, trace_id, span_id, span_kind, received_at, expires_at)
+			 VALUES (?, ?, ?, 'LLM', ?, ?)`,
+		);
+		await db.batch([
+			insert.bind(PROJECT, "t", "expired", minutesAgo(120), minutesAgo(1)),
+			insert.bind(
+				PROJECT,
+				"t",
+				"live",
+				minutesAgo(1),
+				new Date(Date.now() + 60_000).toISOString(),
+			),
+		]);
+		await purgeExpiredAIData(db);
+		const rows = await db
+			.prepare(`SELECT span_id FROM ai_span_payloads ORDER BY span_id`)
+			.all<{ span_id: string }>();
+		expect(rows.results.map((r) => r.span_id)).toEqual(["live"]);
+	});
+
+	it("overall_error_rate sees only the last 5 minutes as the primary window", async () => {
+		const def = TIER0_ANALYSES.find((d) => d.id === "overall_error_rate");
+		if (!def) throw new Error("overall_error_rate analysis missing");
+		const result = await runSqlAnalysis(def, {
+			db,
+			projectId: PROJECT,
+			retentionHours: 24,
+		});
+		// 1 span in the last 5 minutes and it is an error.
+		expect(result.primaryValue).toBe(1);
+		// 3 ok spans in [-1h, -5m); the 2-hour-old span is outside both.
+		expect(result.baselineValue).toBe(0);
+		expect(result.status).toBe("critical");
+	});
+
+	it("every built-in and derived analysis executes on SQLite", async () => {
+		const derived = await deriveAnalysesForProject(PROJECT, db);
+		const defs = [...TIER0_ANALYSES, ...INVESTIGATION_ANALYSES, ...derived];
+		expect(defs.length).toBeGreaterThan(TIER0_ANALYSES.length);
+		for (const def of defs) {
+			if (!def.sql) continue;
+			const result = await runSqlAnalysis(def, {
+				db,
+				projectId: PROJECT,
+				retentionHours: 24,
+			});
+			expect(result.analysisId, def.id).toBe(def.id);
+		}
+	});
+
+	it("ships no datetime('now') windows in the analysis sources", () => {
+		const here = path.dirname(fileURLToPath(import.meta.url));
+		const analysesDir = path.resolve(here, "../analyses");
+		const offenders: string[] = [];
+		for (const file of readdirSync(analysesDir)) {
+			if (!file.endsWith(".ts") || file.endsWith(".test.ts")) continue;
+			const source = readFileSync(path.join(analysesDir, file), "utf8");
+			if (/datetime\(\s*'now'/.test(source)) offenders.push(file);
+		}
+		expect(offenders).toEqual([]);
+	});
+});

package/src/lib/sql-db.ts

@@ -96,21 +96,55 @@ export class D1Adapter implements SqlDb {
 export const sqlDbFor = (env: { DB: D1Database | SqlDb }): SqlDb =>
 	isSqlDb(env.DB) ? env.DB : new D1Adapter(env.DB);
 
+/**
+ * SQLite `strftime` format that reproduces `Date#toISOString()` output
+ * (`YYYY-MM-DDTHH:MM:SS.mmmZ`). Every stored timestamp column holds that
+ * shape, so time windows must be rendered the same way: `datetime('now')`
+ * yields `YYYY-MM-DD HH:MM:SS` and in a text comparison the space sorts
+ * before the `T`, which made "last 5 minutes" match the whole current UTC
+ * day on D1 and made `expires_at < now` purges run a day late.
+ */
+export const SQLITE_ISO_FORMAT = "%Y-%m-%dT%H:%M:%fZ";
+
+/** Render SQLite `now` (optionally shifted by a modifier expression) as ISO text. */
+export const sqliteIsoNow = (modifier?: string): string =>
+	modifier
+		? `strftime('${SQLITE_ISO_FORMAT}', 'now', ${modifier})`
+		: `strftime('${SQLITE_ISO_FORMAT}', 'now')`;
+
 export const sqliteDialect: SqlDialect = {
 	name: "sqlite",
-	now: () => "datetime('now')",
-	sinceHours: (param) => `datetime('now', '-' || ${param} || ' hours')`,
-	sinceMinutes: (param) => `datetime('now', '-' || ${param} || ' minutes')`,
+	now: () => sqliteIsoNow(),
+	sinceHours: (param) => sqliteIsoNow(`'-' || ${param} || ' hours'`),
+	sinceMinutes: (param) => sqliteIsoNow(`'-' || ${param} || ' minutes'`),
 	jsonText: (expr, path) => `json_extract(${expr}, '${path}')`,
 };
 
+/**
+ * The collector stores every timestamp column (`received_at`, `expires_at`,
+ * `occurred_at`, …) as TEXT holding `Date#toISOString()` output on both
+ * D1 and Postgres. Postgres will not compare TEXT against a
+ * `timestamptz`, so time-window expressions have to be rendered as ISO
+ * text in the same `YYYY-MM-DDTHH:MM:SS.mmmZ` shape the collector writes.
+ */
+const POSTGRES_ISO_TEXT_FORMAT = `'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'`;
+const POSTGRES_UTC_NOW = "(CURRENT_TIMESTAMP AT TIME ZONE 'UTC')";
+
+/** Render a Postgres `timestamp` expression as collector-style ISO text. */
+export const postgresIsoText = (expr: string): string =>
+	`to_char(${expr}, ${POSTGRES_ISO_TEXT_FORMAT})`;
+
 export const postgresDialect: SqlDialect = {
 	name: "postgres",
-	now: () => "CURRENT_TIMESTAMP",
+	now: () => postgresIsoText(POSTGRES_UTC_NOW),
 	sinceHours: (param) =>
-		`(CURRENT_TIMESTAMP - (${param}::text || ' hours')::interval)`,
+		postgresIsoText(
+			`${POSTGRES_UTC_NOW} - (${param}::text || ' hours')::interval`,
+		),
 	sinceMinutes: (param) =>
-		`(CURRENT_TIMESTAMP - (${param}::text || ' minutes')::interval)`,
+		postgresIsoText(
+			`${POSTGRES_UTC_NOW} - (${param}::text || ' minutes')::interval`,
+		),
 	jsonText: (expr, path) => {
 		const key = path
 			.replace(/^\$\./, "")

package/src/lib/test-utils/action-graph-fixtures.ts

@@ -0,0 +1,307 @@
+/**
+ * Builders for RFC 0010 action-graph rows used by the retention tests on
+ * both SQLite (`action-retention.test.ts`) and live Postgres
+ * (`sql-db-postgres.integration.test.ts`). Everything is written through
+ * `ActionStore`, i.e. the same SQL the ingest path uses.
+ */
+
+import {
+	type ActionRecord,
+	ActionStore,
+	type AgentRunRecord,
+	type ArtifactRecord,
+	type EvalResultRecord,
+	type RetrievalEventRecord,
+	type ToolCallRecord,
+} from "../actions-store";
+import type { SqlDb } from "../sql-db";
+
+/** Fixed clock for deterministic cutoffs: 2026-10-12T12:00:00Z. */
+export const FIXTURE_NOW_MS = Date.UTC(2026, 9, 12, 12, 0, 0);
+export const FIXTURE_RETENTION_HOURS = 72;
+
+/** ISO timestamp `hours` before `FIXTURE_NOW_MS`. */
+export const hoursAgo = (hours: number): string =>
+	new Date(FIXTURE_NOW_MS - hours * 3_600_000).toISOString();
+
+export const EXPIRED_START = hoursAgo(100);
+export const FRESH_START = hoursAgo(1);
+
+export const actionRecord = (
+	over: Partial<ActionRecord> = {},
+): ActionRecord => {
+	const id = over.id ?? "act-1";
+	return {
+		id,
+		projectId: "alpha",
+		rootActionId: id,
+		causedByActionId: null,
+		actorType: "agent",
+		actorId: "agent-1",
+		actionKind: "agent.run",
+		name: "run",
+		status: "ok",
+		startedAt: EXPIRED_START,
+		endedAt: EXPIRED_START,
+		durationMs: 10,
+		traceId: null,
+		spanId: null,
+		sessionId: null,
+		interactionId: null,
+		userId: null,
+		agentRunId: null,
+		stepId: null,
+		toolCallId: null,
+		promptVersion: null,
+		modelName: null,
+		provider: null,
+		totalCostUsd: null,
+		causalConfidence: "explicit",
+		attrsJson: null,
+		...over,
+	};
+};
+
+export const agentRunRecord = (
+	over: Partial<AgentRunRecord> = {},
+): AgentRunRecord => ({
+	id: "act-1",
+	projectId: "alpha",
+	agentId: "agent-1",
+	agentName: "Agent",
+	agentVersion: "1",
+	goal: null,
+	outcome: null,
+	autonomyLevel: "autonomous_write",
+	status: "success",
+	errorMessage: null,
+	totalCostUsd: 0,
+	totalDurationMs: 10,
+	metadataJson: null,
+	...over,
+});
+
+export const toolCallRecord = (
+	over: Partial<ToolCallRecord> = {},
+): ToolCallRecord => ({
+	id: "tc-1",
+	actionId: "act-1",
+	projectId: "alpha",
+	toolName: "sql_query",
+	argsHash: "a",
+	resultHash: "r",
+	errorType: null,
+	sideEffect: 0,
+	approvalState: null,
+	argsRedacted: null,
+	resultRedacted: null,
+	mcpAuditJson: null,
+	mutationBeforeJson: null,
+	mutationAfterJson: null,
+	mutationDiffJson: null,
+	mutationArtifactId: null,
+	...over,
+});
+
+export const retrievalEventRecord = (
+	over: Partial<RetrievalEventRecord> = {},
+): RetrievalEventRecord => ({
+	id: "re-1",
+	actionId: "act-1",
+	projectId: "alpha",
+	retrieverName: "vector-db",
+	queryHash: "q",
+	documentsJson: null,
+	totalResults: 0,
+	maxRelevanceScore: null,
+	durationMs: null,
+	...over,
+});
+
+export const evalResultRecord = (
+	over: Partial<EvalResultRecord> = {},
+): EvalResultRecord => ({
+	id: "er-1",
+	actionId: "act-1",
+	projectId: "alpha",
+	evaluatorName: "groundedness",
+	evaluatorVersion: "1",
+	score: 1,
+	passed: 1,
+	reasoning: null,
+	rubricJson: null,
+	...over,
+});
+
+export const artifactRecord = (
+	over: Partial<ArtifactRecord> = {},
+): ArtifactRecord => ({
+	id: "af-1",
+	actionId: "act-1",
+	projectId: "alpha",
+	artifactName: "invoice-pdf",
+	artifactType: "file",
+	storageRef: "s3://bucket/invoice.pdf",
+	sizeBytes: 1,
+	sha256Hash: null,
+	contentPreview: null,
+	...over,
+});
+
+export interface SeedTreeOptions {
+	projectId?: string;
+	/** Root action id; also the `agent_runs.id`. */
+	rootId: string;
+	rootStartedAt?: string;
+	childStartedAt?: string;
+	/** `null` leaves the child in progress. */
+	childEndedAt?: string | null;
+	agentRunStatus?: string;
+	/** Attach one row of every leaf table to the child action. */
+	withLeaves?: boolean;
+}
+
+/**
+ * Seed a two-action tree (root `agent.run` + child `tool.call`) with an
+ * `agent_runs` row for the root and, optionally, one row in each leaf table
+ * hanging off the child. Returns the ids so tests can assert on them.
+ */
+export async function seedTree(db: SqlDb, options: SeedTreeOptions) {
+	const store = new ActionStore(db);
+	const projectId = options.projectId ?? "alpha";
+	const rootId = options.rootId;
+	const childId = `${rootId}-child`;
+	const rootStartedAt = options.rootStartedAt ?? EXPIRED_START;
+	const childStartedAt = options.childStartedAt ?? rootStartedAt;
+	const childEndedAt =
+		options.childEndedAt === undefined ? childStartedAt : options.childEndedAt;
+
+	await store.upsertAction(
+		actionRecord({
+			id: rootId,
+			projectId,
+			rootActionId: rootId,
+			agentRunId: rootId,
+			startedAt: rootStartedAt,
+			endedAt: rootStartedAt,
+		}),
+	);
+	await store.upsertAgentRun(
+		agentRunRecord({
+			id: rootId,
+			projectId,
+			status: options.agentRunStatus ?? "success",
+		}),
+	);
+	await store.upsertAction(
+		actionRecord({
+			id: childId,
+			projectId,
+			rootActionId: rootId,
+			causedByActionId: rootId,
+			agentRunId: rootId,
+			actionKind: "tool.call",
+			startedAt: childStartedAt,
+			endedAt: childEndedAt,
+			toolCallId: `${childId}-tc`,
+		}),
+	);
+
+	const leaves = {
+		toolCallId: `${childId}-tc`,
+		retrievalEventId: `${childId}-re`,
+		evalResultId: `${childId}-er`,
+		artifactId: `${childId}-af`,
+	};
+	if (options.withLeaves ?? true) {
+		await store.upsertArtifact(
+			artifactRecord({ id: leaves.artifactId, actionId: childId, projectId }),
+		);
+		await store.upsertToolCall(
+			toolCallRecord({
+				id: leaves.toolCallId,
+				actionId: childId,
+				projectId,
+				mutationArtifactId: leaves.artifactId,
+			}),
+		);
+		await store.upsertRetrievalEvent(
+			retrievalEventRecord({
+				id: leaves.retrievalEventId,
+				actionId: childId,
+				projectId,
+			}),
+		);
+		await store.upsertEvalResult(
+			evalResultRecord({
+				id: leaves.evalResultId,
+				actionId: childId,
+				projectId,
+			}),
+		);
+	}
+
+	return { projectId, rootId, childId, ...leaves };
+}
+
+/** Minimal `eval_cases` row pointing at production entities. */
+export async function seedEvalCase(
+	db: SqlDb,
+	over: {
+		id: string;
+		projectId?: string;
+		sourceActionId?: string | null;
+		sourceAgentRunId?: string | null;
+		sourceToolCallId?: string | null;
+	},
+): Promise<void> {
+	const now = new Date(FIXTURE_NOW_MS).toISOString();
+	await db
+		.prepare(
+			`INSERT INTO eval_cases (
+				id, project_id, source_entity_type, source_entity_id,
+				source_agent_run_id, source_action_id, source_tool_call_id,
+				name, metadata_json, created_at, updated_at
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		)
+		.bind(
+			over.id,
+			over.projectId ?? "alpha",
+			over.sourceActionId
+				? "action"
+				: over.sourceToolCallId
+					? "tool_call"
+					: "agent_run",
+			over.sourceActionId ??
+				over.sourceToolCallId ??
+				over.sourceAgentRunId ??
+				"unknown",
+			over.sourceAgentRunId ?? null,
+			over.sourceActionId ?? null,
+			over.sourceToolCallId ?? null,
+			`case ${over.id}`,
+			"{}",
+			now,
+			now,
+		)
+		.run();
+}
+
+/** Row counts across the whole action graph for a project. */
+export async function countActionGraph(db: SqlDb, projectId: string) {
+	const count = async (table: string) => {
+		const row = await db
+			.prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE project_id = ?`)
+			.bind(projectId)
+			.first<{ n: number | string | bigint }>();
+		return Number(row?.n ?? 0);
+	};
+	return {
+		actions: await count("actions"),
+		agent_runs: await count("agent_runs"),
+		tool_calls: await count("tool_calls"),
+		retrieval_events: await count("retrieval_events"),
+		eval_results: await count("eval_results"),
+		artifacts: await count("artifacts"),
+	};
+}