@obsunified/collector 2.0.1 → 2.1.1

package/dist/index.js

@@ -1,13 +1,15 @@
 import {
   D1Adapter,
   ProjectsStore,
+  SQLITE_ISO_FORMAT,
   createIngestAuth,
   dialectFor,
   postgresDialect,
+  postgresIsoText,
   randomHex,
   sha256Hex,
   sqlDbFor
-} from "./chunk-UGWDOGGH.js";
+} from "./chunk-KMEZKGSO.js";
 import {
   LlmCallError,
   aiEvaluationEvidenceReferences,
@@ -21,6 +23,224 @@ import {
 // src/framework/collector.ts
 import { getConfiguredRetentionHours } from "@obsunified/types/constants";
 import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+
+// src/lib/action-retention.ts
+var DEFAULT_MAX_ACTIONS_PER_BATCH = 500;
+var DEFAULT_MAX_TREES_PER_BATCH = 25;
+var DEFAULT_MAX_BATCHES = 10;
+var OVERSIZED_REPORT_LIMIT = 20;
+var treeEligibleSql = (project, root, cutoff) => `
+	NOT EXISTS (
+	  SELECT 1 FROM actions t
+	  WHERE t.project_id = ${project} AND t.root_action_id = ${root}
+	    AND (t.started_at >= ${cutoff} OR t.ended_at IS NULL)
+	)
+	AND NOT EXISTS (
+	  SELECT 1 FROM actions t
+	  JOIN agent_runs r ON r.project_id = t.project_id AND r.id = t.agent_run_id
+	  WHERE t.project_id = ${project} AND t.root_action_id = ${root}
+	    AND r.status = 'running'
+	)
+	AND NOT EXISTS (
+	  SELECT 1 FROM actions t
+	  JOIN eval_cases c
+	    ON c.project_id = t.project_id
+	   AND (c.source_action_id = t.id OR c.source_agent_run_id = t.agent_run_id)
+	  WHERE t.project_id = ${project} AND t.root_action_id = ${root}
+	)
+	AND NOT EXISTS (
+	  SELECT 1 FROM actions t
+	  JOIN tool_calls tc ON tc.project_id = t.project_id AND tc.action_id = t.id
+	  JOIN eval_cases c ON c.project_id = tc.project_id AND c.source_tool_call_id = tc.id
+	  WHERE t.project_id = ${project} AND t.root_action_id = ${root}
+	)`;
+var TREE_ELIGIBLE_SQL = treeEligibleSql("?", "?", "?");
+var treeEligibleBinds = (projectId, rootActionId, cutoff) => [
+  projectId,
+  rootActionId,
+  cutoff,
+  projectId,
+  rootActionId,
+  projectId,
+  rootActionId,
+  projectId,
+  rootActionId
+];
+var candidateTreesSql = (sizeOp) => `
+	SELECT a.project_id, a.root_action_id, COUNT(*) AS action_count,
+	       MIN(a.started_at) AS oldest_started_at
+	FROM actions a
+	WHERE a.started_at < ?
+	GROUP BY a.project_id, a.root_action_id
+	HAVING COUNT(*) ${sizeOp} ?
+	   AND ${treeEligibleSql("a.project_id", "a.root_action_id", "?")}
+	ORDER BY oldest_started_at ASC
+	LIMIT ?
+`;
+var SELECT_DELETABLE_TREES_SQL = candidateTreesSql("<=");
+var SELECT_OVERSIZED_TREES_SQL = candidateTreesSql(">");
+var LEAF_TABLES = [
+  "tool_calls",
+  "retrieval_events",
+  "eval_results",
+  "artifacts"
+];
+var emptySummary = () => ({
+  actions: 0,
+  agent_runs: 0,
+  tool_calls: 0,
+  retrieval_events: 0,
+  eval_results: 0,
+  artifacts: 0,
+  trees: 0,
+  batches: 0,
+  truncated: false,
+  oversized_trees: 0,
+  oversized: []
+});
+var actionRetentionCutoff = (retentionHours, nowMs = Date.now()) => new Date(nowMs - retentionHours * 60 * 60 * 1e3).toISOString();
+var selectTrees = async (db, sql, cutoff, sizeCap, limit) => {
+  const { results } = await db.prepare(sql).bind(cutoff, sizeCap, cutoff, limit).all();
+  return results.map((row) => ({
+    projectId: row.project_id,
+    rootActionId: row.root_action_id,
+    actions: Number(row.action_count)
+  }));
+};
+var packBatch = (candidates, maxActions) => {
+  const batch = [];
+  let used = 0;
+  for (const tree of candidates) {
+    if (batch.length > 0 && used + tree.actions > maxActions) break;
+    batch.push(tree);
+    used += tree.actions;
+  }
+  return batch;
+};
+async function purgeExpiredActionGraph(db, options) {
+  const maxActions = Math.max(
+    1,
+    options.maxActionsPerBatch ?? DEFAULT_MAX_ACTIONS_PER_BATCH
+  );
+  const maxTrees = Math.max(
+    1,
+    options.maxTreesPerBatch ?? DEFAULT_MAX_TREES_PER_BATCH
+  );
+  const maxBatches = Math.max(1, options.maxBatches ?? DEFAULT_MAX_BATCHES);
+  const nowMs = (options.now ?? Date.now)();
+  const cutoff = actionRetentionCutoff(options.retentionHours, nowMs);
+  const summary = emptySummary();
+  let exhausted = false;
+  for (let batch = 0; batch < maxBatches && !exhausted; batch += 1) {
+    const candidates = await selectTrees(
+      db,
+      SELECT_DELETABLE_TREES_SQL,
+      cutoff,
+      maxActions,
+      maxTrees
+    );
+    if (candidates.length === 0) {
+      exhausted = true;
+      break;
+    }
+    const trees = packBatch(candidates, maxActions);
+    summary.batches += 1;
+    const deleted = await deleteTrees(db, trees, cutoff);
+    for (const table of LEAF_TABLES) summary[table] += deleted[table];
+    summary.agent_runs += deleted.agent_runs;
+    summary.actions += deleted.actions;
+    summary.trees += deleted.trees;
+    exhausted = candidates.length < maxTrees && trees.length === candidates.length;
+  }
+  if (!exhausted) {
+    const remaining = await selectTrees(
+      db,
+      SELECT_DELETABLE_TREES_SQL,
+      cutoff,
+      maxActions,
+      1
+    );
+    summary.truncated = remaining.length > 0;
+  }
+  const oversized = await selectTrees(
+    db,
+    SELECT_OVERSIZED_TREES_SQL,
+    cutoff,
+    maxActions,
+    OVERSIZED_REPORT_LIMIT
+  );
+  summary.oversized_trees = oversized.length;
+  summary.oversized = oversized.map((tree) => ({
+    project_id: tree.projectId,
+    root_action_id: tree.rootActionId,
+    actions: tree.actions
+  }));
+  return summary;
+}
+async function deleteTrees(db, trees, cutoff) {
+  const statements = [];
+  const owners = [];
+  trees.forEach(({ projectId, rootActionId }, treeIndex) => {
+    const guard = treeEligibleBinds(projectId, rootActionId, cutoff);
+    const push = (table, stmt) => {
+      statements.push(stmt);
+      owners.push({ table, tree: treeIndex });
+    };
+    for (const table of LEAF_TABLES) {
+      push(
+        table,
+        db.prepare(
+          `DELETE FROM ${table}
+						 WHERE project_id = ?
+						   AND action_id IN (
+						     SELECT id FROM actions WHERE project_id = ? AND root_action_id = ?
+						   )
+						   AND ${TREE_ELIGIBLE_SQL}`
+        ).bind(projectId, projectId, rootActionId, ...guard)
+      );
+    }
+    push(
+      "agent_runs",
+      db.prepare(
+        `DELETE FROM agent_runs
+					 WHERE project_id = ?
+					   AND id IN (
+					     SELECT id FROM actions WHERE project_id = ? AND root_action_id = ?
+					   )
+					   AND ${TREE_ELIGIBLE_SQL}`
+      ).bind(projectId, projectId, rootActionId, ...guard)
+    );
+    push(
+      "actions",
+      db.prepare(
+        `DELETE FROM actions
+					 WHERE project_id = ? AND root_action_id = ?
+					   AND ${TREE_ELIGIBLE_SQL}`
+      ).bind(projectId, rootActionId, ...guard)
+    );
+  });
+  const results = await db.batch(statements);
+  const counts = {
+    tool_calls: 0,
+    retrieval_events: 0,
+    eval_results: 0,
+    artifacts: 0,
+    agent_runs: 0,
+    actions: 0,
+    trees: 0
+  };
+  const spineDeleted = /* @__PURE__ */ new Set();
+  results.forEach((result, index) => {
+    const owner = owners[index];
+    if (!owner) return;
+    const changes2 = result?.meta?.changes ?? 0;
+    counts[owner.table] += changes2;
+    if (owner.table === "actions" && changes2 > 0) spineDeleted.add(owner.tree);
+  });
+  counts.trees = spineDeleted.size;
+  return counts;
+}
 
 // src/lib/ai-store/types.ts
 var clampInt = (value, min, max, fallback) => {
@@ -102,7 +322,7 @@ async function getAICallsOverview(db, options) {
         SUM(total_cost_usd) as totalCostUsd,
         SUM(prompt_tokens) as totalPromptTokens,
         SUM(completion_tokens) as totalCompletionTokens,
-        SUM(is_error) as errorCalls
+        SUM(CASE WHEN is_error THEN 1 ELSE 0 END) as errorCalls
       FROM ai_calls WHERE project_id = ? AND received_at >= ${dialect.sinceHours("?")}
       ${options.service ? "AND service_name = ?" : ""}
     `;
@@ -124,7 +344,7 @@ async function getAICallsOverview(db, options) {
     completionTokens: row.completion_tokens,
     totalCostUsd: row.total_cost_usd,
     latencyMs: row.latency_ms,
-    isError: row.is_error === 1,
+    isError: row.is_error === 1 || row.is_error === true,
     errorMessage: row.error_message,
     occurredAt: row.occurred_at,
     receivedAt: row.received_at,
@@ -371,7 +591,7 @@ async function listAISessions(db, options) {
         COUNT(DISTINCT s.trace_id) AS trace_count
       FROM ai_span_payloads p
       INNER JOIN telemetry_spans s
-        ON s.trace_id = p.trace_id AND s.span_id = p.span_id
+        ON s.project_id = p.project_id AND s.trace_id = p.trace_id AND s.span_id = p.span_id
       WHERE p.project_id = ?
         AND p.session_id IS NOT NULL
         AND p.received_at >= ${dialect.sinceHours("?")}
@@ -434,7 +654,7 @@ async function getAISessionDetail(db, projectId, sessionId) {
         p.user_id             AS user_id
       FROM ai_span_payloads p
       INNER JOIN telemetry_spans s
-        ON s.trace_id = p.trace_id AND s.span_id = p.span_id
+        ON s.project_id = p.project_id AND s.trace_id = p.trace_id AND s.span_id = p.span_id
       WHERE p.project_id = ? AND p.session_id = ?
       ORDER BY s.start_time ASC
       LIMIT 1000
@@ -478,7 +698,7 @@ async function loadSessionPreviews(db, dialect, projectId, hours, sessionIds) {
       SELECT p.session_id, p.input_json, s.start_time
       FROM ai_span_payloads p
       INNER JOIN telemetry_spans s
-        ON s.trace_id = p.trace_id AND s.span_id = p.span_id
+        ON s.project_id = p.project_id AND s.trace_id = p.trace_id AND s.span_id = p.span_id
       WHERE p.project_id = ?
         AND p.session_id IS NOT NULL
         AND p.session_id IN (${sessionIds.map(() => "?").join(", ")})
@@ -572,7 +792,7 @@ async function getAISpansOverview(db, options) {
         p.output_json         AS output_json
       FROM ai_span_payloads p
       INNER JOIN telemetry_spans s
-        ON s.trace_id = p.trace_id AND s.span_id = p.span_id
+        ON s.project_id = p.project_id AND s.trace_id = p.trace_id AND s.span_id = p.span_id
       WHERE p.project_id = ?
         AND p.received_at >= ${dialect.sinceHours("?")}
     `;
@@ -844,13 +1064,19 @@ var AnalysesStore = class {
     if (analysisIds.length === 0) return /* @__PURE__ */ new Map();
     const placeholders2 = analysisIds.map(() => "?").join(", ");
     const result = await this.db.prepare(
-      `SELECT id, project_id, analysis_id, generated_at, params_hash,
-					status, primary_value, baseline_value, delta_pct, payload_json,
-					narrative, narrative_signature, duration_ms, expires_at
-				FROM analysis_results
-				WHERE project_id = ? AND analysis_id IN (${placeholders2})
-				ORDER BY generated_at DESC`
-    ).bind(projectId, ...analysisIds).all();
+      `SELECT r.id, r.project_id, r.analysis_id, r.generated_at, r.params_hash,
+					r.status, r.primary_value, r.baseline_value, r.delta_pct, r.payload_json,
+					r.narrative, r.narrative_signature, r.duration_ms, r.expires_at
+				FROM analysis_results r
+				JOIN (
+					SELECT analysis_id, MAX(generated_at) AS latest_at
+					FROM analysis_results
+					WHERE project_id = ? AND analysis_id IN (${placeholders2})
+					GROUP BY analysis_id
+				) m ON m.analysis_id = r.analysis_id AND m.latest_at = r.generated_at
+				WHERE r.project_id = ?
+				ORDER BY r.generated_at DESC, r.id DESC`
+    ).bind(projectId, ...analysisIds, projectId).all();
     const latest2 = /* @__PURE__ */ new Map();
     for (const row of result.results ?? []) {
       if (!latest2.has(row.analysis_id)) {
@@ -979,7 +1205,7 @@ var fetchShape = async (projectId, db) => {
 			 FROM telemetry_spans
 			 WHERE project_id = ?
 			   AND service_name IS NOT NULL
-			   AND received_at >= datetime('now', '-1 hour')`
+			   AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')`
   ).bind(projectId).all();
   const services = servicesRes.results.map((row) => row.service_name).filter(
     (name) => typeof name === "string" && name.length > 0
@@ -993,7 +1219,7 @@ var fetchShape = async (projectId, db) => {
 			  AND parent.trace_id   = child.trace_id
 			  AND parent.span_id    = child.parent_span_id
 			 WHERE child.project_id = ?
-			   AND child.received_at >= datetime('now', '-1 hour')
+			   AND child.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			   AND parent.service_name IS NOT NULL
 			   AND child.service_name  IS NOT NULL
 			   AND parent.service_name <> child.service_name`
@@ -1003,7 +1229,7 @@ var fetchShape = async (projectId, db) => {
     `SELECT DISTINCT json_extract(attributes_json, '$."messaging.destination"') AS topic
 			 FROM telemetry_spans
 			 WHERE project_id = ?
-			   AND received_at >= datetime('now', '-1 hour')
+			   AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			   AND json_extract(attributes_json, '$."messaging.destination"') IS NOT NULL`
   ).bind(projectId).all();
   const messagingTopics = topicsRes.results.map((row) => row.topic).filter(
@@ -1013,7 +1239,7 @@ var fetchShape = async (projectId, db) => {
     `SELECT 1
 			 FROM telemetry_spans
 			 WHERE project_id = ?
-			   AND received_at >= datetime('now', '-1 hour')
+			   AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			   AND (
 			     json_extract(attributes_json, '$."openinference.span.kind"') = 'LLM'
 			     OR json_extract(attributes_json, '$."gen_ai.system"') IS NOT NULL
@@ -1071,7 +1297,7 @@ var makeServiceErrorRate = (projectId, service) => ({
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
@@ -1080,8 +1306,8 @@ var makeServiceErrorRate = (projectId, service) => ({
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		spark AS (
 			SELECT
@@ -1091,7 +1317,7 @@ var makeServiceErrorRate = (projectId, service) => ({
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 			GROUP BY minute
 			ORDER BY minute ASC
 		)
@@ -1153,7 +1379,7 @@ var makeServiceLatencyP95 = (projectId, service) => ({
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		base AS (
 			SELECT duration_ms,
@@ -1162,8 +1388,8 @@ var makeServiceLatencyP95 = (projectId, service) => ({
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-25 hours')
-				AND received_at <  datetime('now', '-24 hours')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-25 hours')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-24 hours')
 		),
 		cur_p95 AS (
 			SELECT duration_ms FROM cur
@@ -1228,7 +1454,7 @@ var makeDependencyHealth = (projectId, source, target) => ({
 			WHERE child.project_id   = '${sqlEscape(projectId)}'
 				AND parent.service_name = '${sqlEscape(source)}'
 				AND child.service_name  = '${sqlEscape(target)}'
-				AND child.received_at >= datetime('now', '-5 minutes')
+				AND child.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		edge_base AS (
 			SELECT child.status_code AS sc
@@ -1240,8 +1466,8 @@ var makeDependencyHealth = (projectId, source, target) => ({
 			WHERE child.project_id   = '${sqlEscape(projectId)}'
 				AND parent.service_name = '${sqlEscape(source)}'
 				AND child.service_name  = '${sqlEscape(target)}'
-				AND child.received_at >= datetime('now', '-1 hour')
-				AND child.received_at <  datetime('now', '-5 minutes')
+				AND child.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND child.received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		now_agg AS (
 			SELECT COUNT(*) AS total,
@@ -1302,7 +1528,7 @@ var makeMessagingLag = (projectId, topic) => ({
 			WHERE project_id = '${sqlEscape(projectId)}'
 				AND span_kind = 4
 				AND json_extract(attributes_json, '$."messaging.destination"') = '${sqlEscape(topic)}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		consumers AS (
 			SELECT trace_id,
@@ -1312,7 +1538,7 @@ var makeMessagingLag = (projectId, topic) => ({
 			WHERE project_id = '${sqlEscape(projectId)}'
 				AND span_kind = 5
 				AND json_extract(attributes_json, '$."messaging.destination"') = '${sqlEscape(topic)}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		gaps AS (
 			SELECT
@@ -1377,15 +1603,15 @@ var makeAiCostBurn = (projectId) => ({
 			       COUNT(*) AS n
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		prev AS (
 			SELECT COALESCE(SUM(total_cost_usd), 0) AS cost,
 			       COUNT(*) AS n
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-2 hours')
-				AND received_at <  datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-2 hours')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		delta AS (
 			SELECT CASE
@@ -1422,25 +1648,26 @@ var makeAiErrorRate = (projectId) => ({
   // AI error rate is per-call; 5 min cadence balances signal vs cost on
   // installs with hundreds of LLM spans.
   refreshSeconds: 300,
-  // is_error = 1 fraction in the last 5 minutes vs trailing 1h baseline.
+  // is_error fraction in the last 5 minutes vs trailing 1h baseline. Tested
+  // as a bare boolean so it works for INTEGER 0/1 (D1) and BOOLEAN (Postgres).
   // Same thresholds as overall_error_rate.
   sql: `
 		WITH now_window AS (
 			SELECT
 				COUNT(*) AS total,
-				SUM(CASE WHEN is_error = 1 THEN 1 ELSE 0 END) AS errors
+				SUM(CASE WHEN is_error THEN 1 ELSE 0 END) AS errors
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
 				COUNT(*) AS total,
-				SUM(CASE WHEN is_error = 1 THEN 1 ELSE 0 END) AS errors
+				SUM(CASE WHEN is_error THEN 1 ELSE 0 END) AS errors
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		)
 		SELECT
 			CASE
@@ -1505,7 +1732,7 @@ var errorTopOffenders = {
 				COUNT(*) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND status_code = 2
 			GROUP BY service_name
 			ORDER BY errors DESC
@@ -1516,8 +1743,8 @@ var errorTopOffenders = {
 				COUNT(*) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND status_code = 2
 			GROUP BY service_name
 			ORDER BY errors DESC
@@ -1579,7 +1806,7 @@ var latencyOutlierAttribution = {
 				COUNT(*)    OVER ()                            AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		p95_cut AS (
 			-- Conservatively call "tail" the slowest 5% of the window.
@@ -1647,12 +1874,12 @@ var logAnomalySummary = {
 				(SELECT l2.message FROM logs l2
 					WHERE l2.project_id = '{{PROJECT_ID}}'
 						AND COALESCE(l2.logger_name, '<unknown>') = COALESCE(l1.logger_name, '<unknown>')
-						AND l2.received_at >= datetime('now', '-5 minutes')
+						AND l2.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 						AND l2.severity_number >= 17
 					ORDER BY l2.received_at DESC LIMIT 1) AS sample_message
 			FROM logs l1
 			WHERE l1.project_id = '{{PROJECT_ID}}'
-				AND l1.received_at >= datetime('now', '-5 minutes')
+				AND l1.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND l1.severity_number >= 17
 			GROUP BY l1.logger_name
 		),
@@ -1660,8 +1887,8 @@ var logAnomalySummary = {
 			SELECT DISTINCT COALESCE(logger_name, '<unknown>') AS logger
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND severity_number >= 17
 		),
 		newcomers AS (
@@ -1738,7 +1965,7 @@ var overallErrorRate = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
@@ -1746,8 +1973,8 @@ var overallErrorRate = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		spark AS (
 			-- per-minute error rate over the last 30 minutes for sparkline rendering
@@ -1757,7 +1984,7 @@ var overallErrorRate = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 			GROUP BY minute
 			ORDER BY minute ASC
 		)
@@ -1814,7 +2041,7 @@ var topErrorServices = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 			GROUP BY service
 		),
 		top5 AS (
@@ -1866,7 +2093,7 @@ var latencyP95Overall = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		base AS (
 			SELECT duration_ms,
@@ -1874,8 +2101,8 @@ var latencyP95Overall = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-25 hours')
-				AND received_at <  datetime('now', '-24 hours')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-25 hours')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-24 hours')
 		),
 		cur_p95 AS (
 			SELECT duration_ms FROM cur
@@ -1897,7 +2124,7 @@ var latencyP95Overall = {
 				COUNT(*) AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			GROUP BY bucket
 			ORDER BY bucket ASC
 		),
@@ -1949,7 +2176,7 @@ var throughputSlope = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 		),
 		prev AS (
 			SELECT duration_ms,
@@ -1957,8 +2184,8 @@ var throughputSlope = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-60 minutes')
-				AND received_at <  datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-60 minutes')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 		),
 		cur_n   AS (SELECT COALESCE((SELECT n FROM cur LIMIT 1), 0) AS n),
 		prev_n  AS (SELECT COALESCE((SELECT n FROM prev LIMIT 1), 0) AS n),
@@ -2020,7 +2247,7 @@ var activeSessions = {
 			SELECT COUNT(DISTINCT session_id) AS n
 			FROM usage_events
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		hourly AS (
 			SELECT
@@ -2028,7 +2255,7 @@ var activeSessions = {
 				COUNT(DISTINCT session_id) AS sessions
 			FROM usage_events
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-24 hours')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-24 hours')
 			GROUP BY hour
 			ORDER BY hour ASC
 		)
@@ -2066,7 +2293,7 @@ var logErrorRate = {
 				SUM(CASE WHEN severity_number >= 17 THEN 1 ELSE 0 END) AS errors
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
@@ -2074,8 +2301,8 @@ var logErrorRate = {
 				SUM(CASE WHEN severity_number >= 17 THEN 1 ELSE 0 END) AS errors
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		spark AS (
 			SELECT
@@ -2084,7 +2311,7 @@ var logErrorRate = {
 				SUM(CASE WHEN severity_number >= 17 THEN 1 ELSE 0 END) AS errors
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 			GROUP BY minute
 			ORDER BY minute ASC
 		)
@@ -2144,19 +2371,19 @@ var serviceCpuUtilization = {
 			WHERE s.project_id = '{{PROJECT_ID}}'
 				AND s.name = 'process.cpu.utilization'
 				AND s.service_name IS NOT NULL
-				AND p.received_at >= datetime('now', '-30 minutes')
+				AND p.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 		),
 		now_window AS (
 			SELECT service_name, AVG(value) AS avg_util
 			FROM cpu_points
-			WHERE received_at >= datetime('now', '-5 minutes')
+			WHERE received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 			GROUP BY service_name
 		),
 		base_window AS (
 			SELECT service_name, AVG(value) AS avg_util
 			FROM cpu_points
-			WHERE received_at >= datetime('now', '-30 minutes')
-				AND received_at <  datetime('now', '-5 minutes')
+			WHERE received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 			GROUP BY service_name
 		),
 			top_now AS (
@@ -2497,7 +2724,35 @@ async function runAllDueAnalyses(ctx, _runtime) {
   const logger = ctx.logger ?? consoleLogger;
   const db = sqlDbFor(ctx.env);
   const store = new AnalysesStore(db);
-  const projectId = "default";
+  const totals = { ran: 0, failed: 0, refreshed: 0, narrated: 0, skipped: 0 };
+  for (const projectId of await listAnalysisProjects(db, logger)) {
+    const summary = await runDueAnalysesForProject(projectId, {
+      ctx,
+      db,
+      store,
+      logger
+    });
+    totals.ran += summary.ran;
+    totals.failed += summary.failed;
+    totals.refreshed += summary.refreshed;
+    totals.narrated += summary.narrated;
+    totals.skipped += summary.skipped ?? 0;
+  }
+  return totals;
+}
+async function listAnalysisProjects(db, logger) {
+  try {
+    const ids = (await new ProjectsStore(db).listProjects()).map((p) => p.id).filter((id) => typeof id === "string" && id.length > 0);
+    if (ids.length > 0) return ids;
+  } catch (error) {
+    logger.error("[analyses] failed to list projects; running default only", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  return ["default"];
+}
+async function runDueAnalysesForProject(projectId, deps) {
+  const { ctx, db, store, logger } = deps;
   const now = Date.now();
   const expiresAt = now + ctx.retentionHours * 3600 * 1e3;
   let registered = [];
@@ -2618,6 +2873,42 @@ async function runAllDueAnalyses(ctx, _runtime) {
   return { ran, failed, refreshed, narrated, skipped };
 }
 
+// src/lib/housekeeping.ts
+var ALERT_EVALUATIONS_MAX_AGE_HOURS = 720;
+var ASK_EVIDENCE_EVENTS_MAX_AGE_HOURS = 30 * 24;
+var changes = (r) => r.meta?.changes ?? 0;
+async function purgeSecondaryRows(db, options) {
+  const nowMs = options.now?.() ?? Date.now();
+  const isoBefore = (hours) => new Date(nowMs - hours * 36e5).toISOString();
+  const alertEvaluations = await db.prepare(`DELETE FROM alert_evaluations WHERE evaluated_at < ?`).bind(isoBefore(ALERT_EVALUATIONS_MAX_AGE_HOURS)).run();
+  const askEvents = await db.prepare(`DELETE FROM ask_evidence_events WHERE asked_at < ?`).bind(nowMs - ASK_EVIDENCE_EVENTS_MAX_AGE_HOURS * 36e5).run();
+  const series = await db.prepare(
+    `DELETE FROM metric_series
+			 WHERE created_at < ?
+			   AND NOT EXISTS (
+			     SELECT 1 FROM metric_point p WHERE p.series_id = metric_series.id
+			   )`
+  ).bind(isoBefore(options.retentionHours)).run();
+  const refs = await db.prepare(
+    `DELETE FROM evidence_retrieval_refs
+			 WHERE expires_at IS NOT NULL AND expires_at < ?`
+  ).bind(isoBefore(0)).run();
+  const expansions = await db.prepare(
+    `DELETE FROM evidence_ref_expansions
+			 WHERE NOT EXISTS (
+			   SELECT 1 FROM evidence_retrieval_refs r
+			   WHERE r.ref_id = evidence_ref_expansions.ref_id
+			 )`
+  ).run();
+  return {
+    alert_evaluations: changes(alertEvaluations),
+    ask_evidence_events: changes(askEvents),
+    metric_series: changes(series),
+    evidence_refs: changes(refs),
+    evidence_ref_expansions: changes(expansions)
+  };
+}
+
 // src/lib/logs-store.ts
 var LOG_SEVERITIES = /* @__PURE__ */ new Set([
   "DEBUG",
@@ -2913,18 +3204,20 @@ var MetricsStore = class {
       }
     }
     const insertStmt = this.db.prepare(`
-			INSERT INTO metric_series (
+			INSERT OR IGNORE INTO metric_series (
 				id, project_id, name, description, unit, type,
 				is_monotonic, temporality, scope_name, scope_version, service_name,
 				resource_attrs_json, attributes_json, identity, created_at
 			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 		`);
     const toInsert = [];
+    const attemptedIds = /* @__PURE__ */ new Set();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
     for (const [identity, p] of byIdentity.entries()) {
       if (existing.has(identity)) continue;
       const id = crypto.randomUUID();
       existing.set(identity, { id, identity });
+      attemptedIds.add(identity);
       toInsert.push(
         insertStmt.bind(
           id,
@@ -2945,7 +3238,20 @@ var MetricsStore = class {
         )
       );
     }
-    if (toInsert.length) await this.db.batch(toInsert);
+    if (toInsert.length === 0) return existing;
+    await this.db.batch(toInsert);
+    const attempted = identities.filter(
+      (identity) => attemptedIds.has(identity)
+    );
+    for (let i = 0; i < attempted.length; i += 50) {
+      const chunk = attempted.slice(i, i + 50);
+      const placeholders2 = chunk.map(() => "?").join(",");
+      const rows = await this.db.prepare(
+        `SELECT id, identity FROM metric_series
+					 WHERE project_id = ? AND identity IN (${placeholders2})`
+      ).bind(projectId, ...chunk).all();
+      for (const row of rows.results) existing.set(row.identity, row);
+    }
     return existing;
   }
 };
@@ -4645,6 +4951,15 @@ var UsageStore = class {
   }
 };
 
+// src/framework/limits.ts
+var DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024;
+var DEFAULT_MAX_AUTH_BODY_BYTES = 16 * 1024;
+var DEFAULT_MAX_DECOMPRESSED_BYTES = 32 * 1024 * 1024;
+var parseByteLimit = (raw, fallback) => {
+  const parsed = Number.parseInt(raw ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+};
+
 // src/framework/collector.ts
 var defaultSqlDbFactory = (env) => new D1Adapter(env.DB);
 var CollectorRuntime = class {
@@ -4734,6 +5049,7 @@ var CollectorRuntime = class {
     return nextEvents;
   }
 };
+var isDashboardLoginPath = (path) => path === "/dashboard/login" || path.startsWith("/dashboard/login/");
 var createTelemetryCollectorApp = (pluginsOrConfig) => {
   const config = Array.isArray(pluginsOrConfig) ? { plugins: pluginsOrConfig } : pluginsOrConfig;
   const app = new Hono();
@@ -4773,19 +5089,43 @@ var createTelemetryCollectorApp = (pluginsOrConfig) => {
       c.res.headers.set("Access-Control-Allow-Origin", allowedOrigin);
     }
   });
+  const bodyCap = (c, next) => {
+    const maxSize = config.maxBodyBytes ?? parseByteLimit(c.env?.MAX_BODY_BYTES, DEFAULT_MAX_BODY_BYTES);
+    return bodyLimit({
+      maxSize,
+      onError: (ctx) => ctx.json({ error: `Payload too large (max ${maxSize} bytes)` }, 413)
+    })(c, next);
+  };
+  app.use("/v1/*", bodyCap);
+  app.use("/internal/*", bodyCap);
+  const authMaxSize = config.maxAuthBodyBytes ?? DEFAULT_MAX_AUTH_BODY_BYTES;
+  app.use(
+    "/auth/*",
+    bodyLimit({
+      maxSize: authMaxSize,
+      onError: (ctx) => ctx.json(
+        { error: `Payload too large (max ${authMaxSize} bytes)` },
+        413
+      )
+    })
+  );
   if (config.auth?.middleware) {
     app.use("/v1/*", config.auth.middleware);
   } else if (config.auth?.ingest) {
     app.use("/v1/*", config.auth.ingest);
   }
   if (config.dashboardAuth) {
+    const { middleware } = config.dashboardAuth;
     config.dashboardAuth.registerRoutes(app);
-    app.use("/dashboard/*", config.dashboardAuth.middleware);
-    app.use("/internal/*", config.dashboardAuth.middleware);
-  } else if (config.auth?.middleware) {
-    app.use("/internal/*", config.auth.middleware);
-  } else if (config.auth?.query) {
-    app.use("/internal/*", config.auth.query);
+    const guard = async (c, next) => isDashboardLoginPath(c.req.path) ? next() : middleware(c, next);
+    app.use("/dashboard/*", guard);
+    app.use("/internal/*", middleware);
+  } else {
+    app.use("/internal/*", async (c) => c.json({ error: "Unauthorized" }, 401));
+    app.use(
+      "/dashboard/*",
+      async (c) => c.json({ error: "Unauthorized" }, 401)
+    );
   }
   for (const plugin of config.plugins) {
     runtime.registerPlugin(plugin);
@@ -4799,101 +5139,199 @@ var createTelemetryCollectorApp = (pluginsOrConfig) => {
   });
   return app;
 };
+var PROFILE_PURGE_PAGE_SIZE = 500;
+var PROFILE_PURGE_MAX_PAGES = 10;
 var createRetentionCleanupHandler = (options) => {
   const logger = options?.logger ?? consoleLogger;
-  return {
-    async scheduled(_event, env, _ctx) {
-      const db = sqlDbFor(env);
-      const telemetryStore = new TelemetryStore(db);
-      const usageStore = new UsageStore(db);
-      const logsStore = new LogsStore(db);
-      const aiStore = new AIStore(db);
-      const metricsStore = new MetricsStore(db);
-      const analysesStore = new AnalysesStore(db);
-      const [
-        telemetryPurged,
-        usagePurged,
-        logsPurged,
-        aiPurged,
-        metricsPurged,
-        analysesPurged
-      ] = await Promise.all([
-        telemetryStore.purgeExpired(),
-        usageStore.purgeExpired(),
-        logsStore.purgeExpired(),
-        aiStore.purgeExpired(),
-        metricsStore.purgeExpired(),
-        analysesStore.purgeExpired()
-      ]);
-      let profilesPurged = 0;
-      try {
-        const dialect = dialectFor(db);
-        const expiredProfiles = await db.prepare(
-          `SELECT id, blob_url FROM profile_blobs WHERE expires_at < ${dialect.now()} LIMIT 500`
+  const run = async (env) => {
+    const db = sqlDbFor(env);
+    const telemetryStore = new TelemetryStore(db);
+    const usageStore = new UsageStore(db);
+    const logsStore = new LogsStore(db);
+    const aiStore = new AIStore(db);
+    const metricsStore = new MetricsStore(db);
+    const analysesStore = new AnalysesStore(db);
+    const [
+      telemetryPurged,
+      usagePurged,
+      logsPurged,
+      aiPurged,
+      metricsPurged,
+      analysesPurged
+    ] = await Promise.all([
+      telemetryStore.purgeExpired(),
+      usageStore.purgeExpired(),
+      logsStore.purgeExpired(),
+      aiStore.purgeExpired(),
+      metricsStore.purgeExpired(),
+      analysesStore.purgeExpired()
+    ]);
+    let profilesPurged = 0;
+    try {
+      const dialect = dialectFor(db);
+      if (!env.PROFILES_BUCKET) {
+        logger.warn(
+          "[retention-cleanup] PROFILES_BUCKET is not bound; expired profile rows are removed without deleting their blobs"
+        );
+      }
+      for (let page = 0; page < PROFILE_PURGE_MAX_PAGES; page += 1) {
+        const expired = await db.prepare(
+          `SELECT id, blob_url FROM profile_blobs WHERE expires_at < ${dialect.now()} LIMIT ${PROFILE_PURGE_PAGE_SIZE}`
         ).all();
-        if (expiredProfiles.results.length > 0 && env.PROFILES_BUCKET) {
-          await Promise.allSettled(
-            expiredProfiles.results.map(
-              (p) => env.PROFILES_BUCKET?.delete(p.blob_url)
-            )
+        if (expired.results.length === 0) break;
+        const removable = [];
+        if (env.PROFILES_BUCKET) {
+          const bucket = env.PROFILES_BUCKET;
+          const settled = await Promise.allSettled(
+            expired.results.map((p) => bucket.delete(p.blob_url))
           );
+          settled.forEach((outcome, i) => {
+            const row = expired.results[i];
+            if (!row) return;
+            if (outcome.status === "fulfilled") removable.push(row.id);
+            else
+              logger.warn(
+                "[retention-cleanup] profile blob delete failed; row kept for retry",
+                {
+                  profile_id: row.id,
+                  error: outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason)
+                }
+              );
+          });
+        } else {
+          removable.push(...expired.results.map((p) => p.id));
         }
-        const deleted = await db.prepare(
-          `DELETE FROM profile_blobs WHERE expires_at < ${dialect.now()}`
-        ).run();
-        profilesPurged = deleted.meta.changes;
-      } catch (err) {
-        logger.error("[retention-cleanup] profile purge failed", {
-          error: err instanceof Error ? err.message : String(err)
-        });
+        for (let i = 0; i < removable.length; i += 90) {
+          const chunk = removable.slice(i, i + 90);
+          const deleted = await db.prepare(
+            `DELETE FROM profile_blobs WHERE id IN (${chunk.map(() => "?").join(", ")})`
+          ).bind(...chunk).run();
+          profilesPurged += deleted.meta.changes;
+        }
+        if (expired.results.length < PROFILE_PURGE_PAGE_SIZE || removable.length < expired.results.length)
+          break;
       }
-      logger.info("[retention-cleanup] purged expired rows", {
-        spans: telemetryPurged,
-        usage: usagePurged,
-        logs: logsPurged,
-        ai_calls: aiPurged,
-        metric_points: metricsPurged,
-        analysis_results: analysesPurged,
-        profile_blobs: profilesPurged
+    } catch (err) {
+      logger.error("[retention-cleanup] profile purge failed", {
+        error: err instanceof Error ? err.message : String(err)
       });
-      try {
-        const propagation = await aggregatePropagation(db, /* @__PURE__ */ new Date(), logger);
-        logger.info("[propagation-metric] hourly aggregation complete", {
-          projects: propagation.projects,
-          points_written: propagation.pointsWritten
-        });
-      } catch (err) {
-        logger.error("[propagation-metric] aggregation failed", {
-          error: err instanceof Error ? err.message : String(err)
-        });
+    }
+    let housekeeping = {
+      alert_evaluations: 0,
+      ask_evidence_events: 0,
+      metric_series: 0,
+      evidence_refs: 0,
+      evidence_ref_expansions: 0
+    };
+    try {
+      housekeeping = await purgeSecondaryRows(db, {
+        retentionHours: getConfiguredRetentionHours(env.RETENTION_HOURS)
+      });
+    } catch (err) {
+      logger.error("[retention-cleanup] housekeeping purge failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    let actionGraph;
+    try {
+      actionGraph = await purgeExpiredActionGraph(db, {
+        retentionHours: getConfiguredRetentionHours(env.RETENTION_HOURS)
+      });
+      if (actionGraph.truncated) {
+        logger.warn(
+          "[retention-cleanup] action graph purge hit its batch cap; remaining expired trees wait for the next run",
+          { batches: actionGraph.batches, trees: actionGraph.trees }
+        );
+      }
+      if (actionGraph.oversized_trees > 0) {
+        logger.warn(
+          "[retention-cleanup] expired action trees retained because they exceed the per-batch action cap",
+          {
+            oversized_trees: actionGraph.oversized_trees,
+            trees: actionGraph.oversized
+          }
+        );
       }
+    } catch (err) {
+      logger.error("[retention-cleanup] action graph purge failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    const summary = {
+      spans: telemetryPurged,
+      usage: usagePurged,
+      logs: logsPurged,
+      ai_calls: aiPurged,
+      metric_points: metricsPurged,
+      analysis_results: analysesPurged,
+      profile_blobs: profilesPurged,
+      housekeeping,
+      actions: actionGraph?.actions ?? 0,
+      action_leaves: actionGraph ? actionGraph.agent_runs + actionGraph.tool_calls + actionGraph.retrieval_events + actionGraph.eval_results + actionGraph.artifacts : 0
+    };
+    logger.info("[retention-cleanup] purged expired rows", {
+      ...summary,
+      ...actionGraph ? {
+        action_agent_runs: actionGraph.agent_runs,
+        action_tool_calls: actionGraph.tool_calls,
+        action_retrieval_events: actionGraph.retrieval_events,
+        action_eval_results: actionGraph.eval_results,
+        action_artifacts: actionGraph.artifacts,
+        action_trees: actionGraph.trees,
+        action_batches: actionGraph.batches,
+        action_oversized_trees: actionGraph.oversized_trees
+      } : {}
+    });
+    try {
+      const propagation = await aggregatePropagation(db, /* @__PURE__ */ new Date(), logger);
+      logger.info("[propagation-metric] hourly aggregation complete", {
+        projects: propagation.projects,
+        points_written: propagation.pointsWritten
+      });
+    } catch (err) {
+      logger.error("[propagation-metric] aggregation failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    return summary;
+  };
+  return {
+    run,
+    scheduled: async (_event, env, _ctx) => {
+      await run(env);
     }
   };
 };
 var createAnalysesRunHandler = (options) => {
   const logger = options?.logger ?? consoleLogger;
   const tracer = options?.tracer;
+  const run = async (env) => {
+    try {
+      const retentionHours = getConfiguredRetentionHours(env.RETENTION_HOURS);
+      const summary = await runAllDueAnalyses({
+        env,
+        retentionHours,
+        logger,
+        tracer
+      });
+      logger.info("[analyses] scheduled run summary", {
+        refreshed: summary.refreshed,
+        ran: summary.ran,
+        failed: summary.failed,
+        narrated: summary.narrated
+      });
+      return summary;
+    } catch (error) {
+      logger.error("[analyses] scheduled run failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return void 0;
+    }
+  };
   return {
-    async scheduled(_event, env, _ctx) {
-      try {
-        const retentionHours = getConfiguredRetentionHours(env.RETENTION_HOURS);
-        const summary = await runAllDueAnalyses({
-          env,
-          retentionHours,
-          logger,
-          tracer
-        });
-        logger.info("[analyses] scheduled run summary", {
-          refreshed: summary.refreshed,
-          ran: summary.ran,
-          failed: summary.failed,
-          narrated: summary.narrated
-        });
-      } catch (error) {
-        logger.error("[analyses] scheduled run failed", {
-          error: error instanceof Error ? error.message : String(error)
-        });
-      }
+    run,
+    scheduled: async (_event, env, _ctx) => {
+      await run(env);
     }
   };
 };
@@ -5666,8 +6104,7 @@ var actionGraphProcessorPlugin = {
 							span_id, session_id, interaction_id, user_id, agent_run_id, step_id,
 							tool_call_id, prompt_version, model_name, provider, total_cost_usd, attrs_json
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
-							project_id = excluded.project_id,
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							root_action_id = excluded.root_action_id,
 							caused_by_action_id = excluded.caused_by_action_id,
 							actor_type = excluded.actor_type,
@@ -5730,8 +6167,7 @@ var actionGraphProcessorPlugin = {
 							id, project_id, agent_id, agent_name, agent_version, goal, outcome,
 							autonomy_level, status, error_message, total_cost_usd, total_duration_ms, metadata_json
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
-							project_id = excluded.project_id,
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							agent_id = excluded.agent_id,
 							agent_name = excluded.agent_name,
 							agent_version = excluded.agent_version,
@@ -5772,9 +6208,8 @@ var actionGraphProcessorPlugin = {
 							mcp_audit_json, mutation_before_json, mutation_after_json,
 							mutation_diff_json, mutation_artifact_id
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							tool_name = excluded.tool_name,
 							args_hash = excluded.args_hash,
 							result_hash = excluded.result_hash,
@@ -5818,9 +6253,8 @@ var actionGraphProcessorPlugin = {
 							id, action_id, project_id, retriever_name, query_hash, documents_json,
 							total_results, max_relevance_score, duration_ms
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							retriever_name = excluded.retriever_name,
 							query_hash = excluded.query_hash,
 							documents_json = excluded.documents_json,
@@ -5850,9 +6284,8 @@ var actionGraphProcessorPlugin = {
 							id, action_id, project_id, evaluator_name, evaluator_version,
 							score, passed, reasoning, rubric_json
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							evaluator_name = excluded.evaluator_name,
 							evaluator_version = excluded.evaluator_version,
 							score = excluded.score,
@@ -5882,9 +6315,8 @@ var actionGraphProcessorPlugin = {
 							id, action_id, project_id, artifact_name, artifact_type,
 							storage_ref, size_bytes, sha256_hash, content_preview
 						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-						ON CONFLICT (id) DO UPDATE SET
+						ON CONFLICT (project_id, id) DO UPDATE SET
 							action_id = excluded.action_id,
-							project_id = excluded.project_id,
 							artifact_name = excluded.artifact_name,
 							artifact_type = excluded.artifact_type,
 							storage_ref = excluded.storage_ref,
@@ -6809,8 +7241,8 @@ async function manifestBySession(db, projectId, sessionId) {
     db.prepare(
       `SELECT first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id = ?`
-    ).bind(sessionId).first()
+					WHERE project_id = ? AND session_id = ?`
+    ).bind(projectId, sessionId).first()
   ]);
   return {
     spans: spans.results.map(mapSpan),
@@ -7090,9 +7522,9 @@ async function manifestByAction(db, projectId, actionId) {
     replayRes = await db.prepare(
       `SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`
-    ).bind(...sessionIds).first();
+    ).bind(projectId, ...sessionIds).first();
   }
   const sumAiCost = aiCallsRes.results.reduce(
     (sum, a) => sum + (a.total_cost_usd ?? 0),
@@ -7231,9 +7663,9 @@ async function manifestByAgentRun(db, projectId, agentRunId) {
     replayRes = await db.prepare(
       `SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`
-    ).bind(...sessionIds).first();
+    ).bind(projectId, ...sessionIds).first();
   }
   const sumAiCost = aiCallsRes.results.reduce(
     (sum, a) => sum + (a.total_cost_usd ?? 0),
@@ -7375,9 +7807,9 @@ async function manifestByActor(db, projectId, actorType, actorId) {
     replayRes = await db.prepare(
       `SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${sessionPlaceholders})
+					WHERE project_id = ? AND session_id IN (${sessionPlaceholders})
 					ORDER BY last_chunk_at DESC LIMIT 1`
-    ).bind(...sessionIds).first();
+    ).bind(projectId, ...sessionIds).first();
   }
   return {
     spans: spansRes.results.map(mapSpan),
@@ -7405,7 +7837,9 @@ async function manifestByActor(db, projectId, actorType, actorId) {
 async function manifestByUser(db, projectId, userId, opts = {}) {
   const limit = Math.min(opts.limit ?? 100, FETCH_LIMIT);
   const sessionLimit = Math.max(1, Math.min(opts.sessions ?? 5, 20));
-  const profile = await db.prepare(`SELECT visitor_id FROM user_profiles WHERE user_id = ? LIMIT 1`).bind(userId).first();
+  const profile = await db.prepare(
+    `SELECT visitor_id FROM user_profiles WHERE project_id = ? AND user_id = ? LIMIT 1`
+  ).bind(projectId, userId).first();
   if (!profile) {
     return {
       spans: [],
@@ -7469,9 +7903,9 @@ async function manifestByUser(db, projectId, userId, opts = {}) {
     db.prepare(
       `SELECT session_id, first_chunk_at, last_chunk_at, chunk_count, events_count
 					FROM session_replay_metadata
-					WHERE session_id IN (${placeholders2})
+					WHERE project_id = ? AND session_id IN (${placeholders2})
 					ORDER BY last_chunk_at DESC LIMIT 1`
-    ).bind(...sessionIds).first()
+    ).bind(projectId, ...sessionIds).first()
   ]);
   return {
     spans: spans.results.map(mapSpan),
@@ -7779,17 +8213,29 @@ import {
   TOOL_RESPONSE_CONTRACT_SCHEMA_VERSION
 } from "@obsunified/types";
 import { getConfiguredRetentionHours as getConfiguredRetentionHours3 } from "@obsunified/types/constants";
+
+// src/plugins/_json.ts
+async function readJsonObject(c) {
+  let parsed;
+  try {
+    parsed = await c.req.json();
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  return parsed;
+}
+
+// src/plugins/ai-receiver.ts
 var aiReceiverPlugin = {
   name: "ai-receiver",
   register(app, _runtime) {
     app.post("/v1/ai", async (c) => {
       const projectId = getProjectId(c);
-      let payload;
-      try {
-        payload = await c.req.json();
-      } catch {
-        return c.json({ error: "Invalid JSON body" }, 400);
-      }
+      const payload = await readJsonObject(c);
+      if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
       if (!payload.calls || !Array.isArray(payload.calls)) {
         return c.json({ error: "Missing calls array" }, 400);
       }
@@ -7866,12 +8312,8 @@ var aiReceiverPlugin = {
     });
     app.post("/v1/ai/evaluations", async (c) => {
       const projectId = getProjectId(c);
-      let payload;
-      try {
-        payload = await c.req.json();
-      } catch {
-        return c.json({ error: "Invalid JSON body" }, 400);
-      }
+      const payload = await readJsonObject(c);
+      if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
       if (!payload.evaluations || !Array.isArray(payload.evaluations)) {
         return c.json({ error: "Missing evaluations array" }, 400);
       }
@@ -8062,8 +8504,7 @@ var aiSpanPayloadsProcessorPlugin = {
 								input_json, output_json, input_hash, output_hash, session_id, user_id,
 								received_at, expires_at, interaction_id, action_id
 							) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-							ON CONFLICT(trace_id, span_id) DO UPDATE SET
-								project_id = excluded.project_id,
+							ON CONFLICT(project_id, trace_id, span_id) DO UPDATE SET
 								span_kind = excluded.span_kind,
 								input_json = excluded.input_json,
 								output_json = excluded.output_json,
@@ -8110,6 +8551,100 @@ var aiSpanPayloadsProcessorPlugin = {
 
 // src/lib/alerts-store.ts
 import { EVIDENCE_REFERENCE_CONTRACT as EVIDENCE_REFERENCE_CONTRACT4 } from "@obsunified/types";
+
+// src/lib/webhook-url.ts
+var WebhookUrlError = class extends Error {
+};
+var parseIpv4 = (host) => {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return null;
+  const octets = m.slice(1).map((o) => Number.parseInt(o, 10));
+  return octets.every((o) => o <= 255) ? octets : null;
+};
+var isPrivateIpv4 = (o) => o[0] === 0 || // "this" network / unspecified
+o[0] === 10 || o[0] === 127 || o[0] === 100 && o[1] >= 64 && o[1] <= 127 || // CGNAT
+o[0] === 169 && o[1] === 254 || // link-local incl. cloud metadata
+o[0] === 172 && o[1] >= 16 && o[1] <= 31 || o[0] === 192 && o[1] === 168 || o[0] >= 224;
+var isPrivateIpv6 = (host) => {
+  const literal = host.replace(/^\[|\]$/g, "").toLowerCase();
+  if (literal === "::" || literal === "::1") return true;
+  const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(literal);
+  if (dotted) {
+    const v4 = parseIpv4(dotted[1]);
+    return v4 ? isPrivateIpv4(v4) : true;
+  }
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(literal);
+  if (hex) {
+    const hi = Number.parseInt(hex[1], 16);
+    const lo = Number.parseInt(hex[2], 16);
+    return isPrivateIpv4([hi >> 8, hi & 255, lo >> 8, lo & 255]);
+  }
+  const first = Number.parseInt(literal.split(":")[0] || "0", 16);
+  if (Number.isNaN(first)) return true;
+  if ((first & 65024) === 64512) return true;
+  if ((first & 65472) === 65152) return true;
+  if ((first & 65280) === 65280) return true;
+  return false;
+};
+var isPrivateWebhookHost = (hostname) => {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (!host) return true;
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host.endsWith(".local") || host.endsWith(".internal")) return true;
+  if (host.startsWith("[")) return isPrivateIpv6(host);
+  const v4 = parseIpv4(host);
+  if (v4) return isPrivateIpv4(v4);
+  return !host.includes(".");
+};
+var assertSafeWebhookUrl = (raw, options = {}) => {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new WebhookUrlError("channel.url must be an absolute http(s) URL");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new WebhookUrlError("channel.url must be http(s)://");
+  }
+  if (url.username || url.password) {
+    throw new WebhookUrlError(
+      "channel.url must not embed credentials; use channel.headers"
+    );
+  }
+  if (!options.allowPrivateNetworks && isPrivateWebhookHost(url.hostname)) {
+    throw new WebhookUrlError(
+      `channel.url host "${url.hostname}" is not a public address (set ALERT_WEBHOOK_ALLOW_PRIVATE=true to allow internal receivers)`
+    );
+  }
+  return url;
+};
+var resolveWebhookHost = async (hostname, lookup) => {
+  if (parseIpv4(hostname) || hostname.startsWith("[")) return "public";
+  let addresses;
+  try {
+    addresses = await lookup(hostname);
+  } catch {
+    return "unresolvable";
+  }
+  if (addresses.length === 0) return "unresolvable";
+  const isPrivate = addresses.some((address) => {
+    const v4 = parseIpv4(address);
+    if (v4) return isPrivateIpv4(v4);
+    return isPrivateIpv6(`[${address}]`);
+  });
+  return isPrivate ? "private" : "public";
+};
+var redactWebhookUrl = (raw) => {
+  try {
+    const url = new URL(raw);
+    const hasPath = url.pathname !== "/" || url.search !== "";
+    return `${url.protocol}//${url.host}${hasPath ? "/\u2026" : ""}`;
+  } catch {
+    return "<invalid url>";
+  }
+};
+
+// src/lib/alerts-store.ts
 var parseJsonField = (value) => {
   if (typeof value === "string") return JSON.parse(value);
   return value;
@@ -8156,8 +8691,9 @@ function compareValue(value, threshold, comparison) {
   }
 }
 var AlertsStore = class {
-  constructor(db) {
+  constructor(db, options = {}) {
     this.db = db;
+    this.options = options;
   }
   validateInput(input) {
     if (!input.name?.trim()) throw new Error("name is required");
@@ -8174,8 +8710,16 @@ var AlertsStore = class {
     for (const ch of input.channels) {
       if (ch.type !== "webhook")
         throw new Error(`unknown channel type: ${ch.type}`);
-      if (!ch.url || !/^https?:\/\//.test(ch.url))
+      if (!ch.url || typeof ch.url !== "string")
         throw new Error("channel.url must be http(s)://");
+      try {
+        assertSafeWebhookUrl(ch.url, {
+          allowPrivateNetworks: this.options.allowPrivateWebhookTargets
+        });
+      } catch (err) {
+        if (err instanceof WebhookUrlError) throw new Error(err.message);
+        throw err;
+      }
     }
   }
   async listRules(projectId) {
@@ -8260,9 +8804,15 @@ var AlertsStore = class {
     return this.getRule(id, projectId);
   }
   async deleteRule(id, projectId) {
+    const owned = await this.db.prepare(
+      `SELECT 1 AS ok FROM alert_rules WHERE id = ? AND project_id = ?`
+    ).bind(id, projectId).first();
+    if (!owned) return false;
+    await this.db.prepare(`DELETE FROM alert_state WHERE rule_id = ? AND project_id = ?`).bind(id, projectId).run();
+    await this.db.prepare(
+      `DELETE FROM alert_evaluations WHERE rule_id = ? AND project_id = ?`
+    ).bind(id, projectId).run();
     const result = await this.db.prepare(`DELETE FROM alert_rules WHERE id = ? AND project_id = ?`).bind(id, projectId).run();
-    await this.db.prepare(`DELETE FROM alert_state WHERE rule_id = ?`).bind(id).run();
-    await this.db.prepare(`DELETE FROM alert_evaluations WHERE rule_id = ?`).bind(id).run();
     return (result.meta?.changes ?? 0) > 0;
   }
   async listEnabledRules() {
@@ -8270,16 +8820,58 @@ var AlertsStore = class {
     return (rs.results ?? []).map((r) => rowToRule(r));
   }
   // ── State ──
-  async getState(ruleId) {
-    const row = await this.db.prepare(`SELECT * FROM alert_state WHERE rule_id = ?`).bind(ruleId).first();
+  async getState(ruleId, projectId) {
+    const row = await this.db.prepare(`SELECT * FROM alert_state WHERE rule_id = ? AND project_id = ?`).bind(ruleId, projectId).first();
     return row ?? null;
   }
+  /**
+   * Record a state transition with its notification still outstanding
+   * (`notified = 0`); `markNotified` flips it once a channel accepts the
+   * alert. On a database that has not applied migration 049 the column is
+   * missing: the transition is still written (legacy statement) so alerting
+   * keeps working through a rolling deploy, and the evaluator treats a row
+   * without the column as delivered.
+   */
   async transitionState(ruleId, projectId, newState, now) {
-    await this.db.prepare(
-      `INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change)
+    try {
+      await this.db.prepare(
+        `INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change, notified)
+         VALUES (?, ?, ?, ?, 0)
+         ON CONFLICT(rule_id) DO UPDATE SET
+           current_state = excluded.current_state,
+           last_state_change = excluded.last_state_change,
+           notified = 0`
+      ).bind(ruleId, projectId, newState, now).run();
+    } catch (err) {
+      if (!isMissingNotifiedColumn(err)) throw err;
+      await this.db.prepare(
+        `INSERT INTO alert_state (rule_id, project_id, current_state, last_state_change)
          VALUES (?, ?, ?, ?)
-         ON CONFLICT(rule_id) DO UPDATE SET current_state = excluded.current_state, last_state_change = excluded.last_state_change`
-    ).bind(ruleId, projectId, newState, now).run();
+         ON CONFLICT(rule_id) DO UPDATE SET
+           current_state = excluded.current_state,
+           last_state_change = excluded.last_state_change`
+      ).bind(ruleId, projectId, newState, now).run();
+    }
+  }
+  /**
+   * Mark the transition `(state, lastStateChange)` as delivered. Scoped to
+   * the exact transition the caller notified for: if the rule changed state
+   * again while the webhook was in flight, the newer transition keeps its
+   * own outstanding flag. Returns false when nothing matched (stale or
+   * already marked). On a pre-049 schema there is nothing to mark.
+   */
+  async markNotified(ruleId, projectId, state, lastStateChange) {
+    try {
+      const result = await this.db.prepare(
+        `UPDATE alert_state SET notified = 1
+				 WHERE rule_id = ? AND project_id = ? AND current_state = ?
+				   AND last_state_change = ? AND notified = 0`
+      ).bind(ruleId, projectId, state, lastStateChange).run();
+      return (result.meta?.changes ?? 0) > 0;
+    } catch (err) {
+      if (isMissingNotifiedColumn(err)) return false;
+      throw err;
+    }
   }
   async recordEvaluation(ruleId, projectId, value, state, notified) {
     await this.db.prepare(
@@ -8413,16 +9005,48 @@ var AlertsStore = class {
       sql += ` AND model_name = ?`;
       binds.push(q.model);
     }
-    if (q.isError === true) sql += ` AND is_error = 1`;
+    if (q.isError === true) sql += ` AND is_error`;
     const row = await this.db.prepare(sql).bind(...binds).first();
     return row?.c ?? 0;
   }
 };
+var isMissingNotifiedColumn = (err) => {
+  const message = err instanceof Error ? err.message : String(err);
+  return /notified/i.test(message) && /no such column|has no column|does not exist/i.test(message);
+};
 
 // src/plugins/alerts-evaluator.ts
 var DEFAULT_RULE_CONCURRENCY = 5;
 var DEFAULT_RULE_TIMEOUT_MS = 1e4;
-async function fireWebhook(channel, payload, logger, tracer) {
+async function fireWebhook(channel, payload, logger, tracer, delivery = {}) {
+  const target = redactWebhookUrl(channel.url);
+  try {
+    const url = assertSafeWebhookUrl(channel.url, {
+      allowPrivateNetworks: delivery.allowPrivateWebhookTargets
+    });
+    if (!delivery.allowPrivateWebhookTargets && delivery.hostLookup) {
+      const resolution = await resolveWebhookHost(
+        url.hostname,
+        delivery.hostLookup
+      );
+      if (resolution === "private") {
+        throw new Error(
+          `channel.url host "${url.hostname}" resolves to a private address`
+        );
+      }
+      if (resolution === "unresolvable") {
+        throw new Error(
+          `channel.url host "${url.hostname}" could not be resolved; refusing to deliver blind`
+        );
+      }
+    }
+  } catch (err) {
+    logger.error("[alerts-evaluator] webhook target refused", {
+      url: target,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return false;
+  }
   const exec = async (span) => {
     try {
       const response = await fetch(channel.url, {
@@ -8432,13 +9056,24 @@ async function fireWebhook(channel, payload, logger, tracer) {
           ...channel.headers ?? {}
         },
         body: JSON.stringify(payload),
+        // Never follow redirects: a 3xx could re-aim the POST (and its
+        // headers) at an arbitrary host. A redirecting hook is a
+        // misconfiguration and counts as a failed delivery.
+        redirect: "manual",
         signal: AbortSignal.timeout(5e3)
       });
       if (span) span.setAttribute("http.response.status_code", response.status);
+      if (response.status >= 300 && response.status < 400) {
+        logger.error("[alerts-evaluator] webhook responded with a redirect", {
+          url: target,
+          status: response.status
+        });
+        return false;
+      }
       return response.ok;
     } catch (err) {
       logger.error("[alerts-evaluator] webhook delivery failed", {
-        url: channel.url,
+        url: target,
         error: err instanceof Error ? err.message : String(err)
       });
       return false;
@@ -8447,14 +9082,14 @@ async function fireWebhook(channel, payload, logger, tracer) {
   if (!tracer) return exec(null);
   return tracer("webhook.alert", async (span) => exec(span), {
     "http.method": "POST",
-    "http.url": channel.url,
+    "http.url": target,
     "alert.state": payload.state
   });
 }
-async function fireChannels(channels, payload, logger, tracer) {
+async function fireChannels(channels, payload, logger, tracer, delivery = {}) {
   if (channels.length === 0) return true;
   const results = await Promise.all(
-    channels.filter((ch) => ch.type === "webhook").map((ch) => fireWebhook(ch, payload, logger, tracer))
+    channels.filter((ch) => ch.type === "webhook").map((ch) => fireWebhook(ch, payload, logger, tracer, delivery))
   );
   return results.every(Boolean);
 }
@@ -8485,7 +9120,8 @@ async function mapWithConcurrency(items, concurrency, mapper) {
   );
   return results;
 }
-async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs) {
+async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs, delivery) {
+  const none = { fired: 0, resolved: 0, redelivered: 0 };
   try {
     const value = await withTimeout(
       store.evaluateRule(rule),
@@ -8493,7 +9129,7 @@ async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs) {
       `rule evaluation timed out after ${ruleTimeoutMs}ms`
     );
     const shouldFire = compareValue(value, rule.threshold, rule.comparison);
-    const priorState = await store.getState(rule.id);
+    const priorState = await store.getState(rule.id, rule.projectId);
     const previous = priorState?.current_state ?? "ok";
     const next = shouldFire ? "firing" : "ok";
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -8504,51 +9140,58 @@ async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs) {
         status: n.status
       } : void 0
     ).catch(() => void 0) : void 0;
-    if (previous === "ok" && next === "firing") {
-      const ok = await fireChannels(
-        rule.channels,
-        {
-          rule: { id: rule.id, name: rule.name, signal: rule.signal },
-          value,
-          threshold: rule.threshold,
-          comparison: rule.comparison,
-          state: "firing",
-          evaluatedAt: now,
-          projectId: rule.projectId,
-          analysis: analysisAttachment
-        },
-        logger,
-        tracer
-      );
-      await store.transitionState(rule.id, rule.projectId, "firing", now);
-      await store.recordEvaluation(
-        rule.id,
-        rule.projectId,
+    const deliver = (state) => fireChannels(
+      rule.channels,
+      {
+        rule: { id: rule.id, name: rule.name, signal: rule.signal },
         value,
-        "firing",
-        ok
-      );
-      return { fired: 1, resolved: 0 };
+        threshold: rule.threshold,
+        comparison: rule.comparison,
+        state,
+        evaluatedAt: now,
+        projectId: rule.projectId,
+        analysis: analysisAttachment
+      },
+      logger,
+      tracer,
+      delivery
+    );
+    if (previous !== next) {
+      await store.transitionState(rule.id, rule.projectId, next, now);
+      const ok = await deliver(next);
+      if (ok) {
+        await store.markNotified(rule.id, rule.projectId, next, now);
+      }
+      await store.recordEvaluation(rule.id, rule.projectId, value, next, ok);
+      if (!ok) {
+        logger.warn(
+          "[alerts-evaluator] state recorded but delivery failed; will retry",
+          { rule_id: rule.id, project_id: rule.projectId, state: next }
+        );
+      }
+      return next === "firing" ? { fired: 1, resolved: 0, redelivered: 0 } : { fired: 0, resolved: 1, redelivered: 0 };
     }
-    if (previous === "firing" && next === "ok") {
-      const ok = await fireChannels(
-        rule.channels,
-        {
-          rule: { id: rule.id, name: rule.name, signal: rule.signal },
-          value,
-          threshold: rule.threshold,
-          comparison: rule.comparison,
-          state: "ok",
-          evaluatedAt: now,
-          projectId: rule.projectId,
-          analysis: analysisAttachment
-        },
-        logger,
-        tracer
-      );
-      await store.transitionState(rule.id, rule.projectId, "ok", now);
-      await store.recordEvaluation(rule.id, rule.projectId, value, "ok", ok);
-      return { fired: 0, resolved: 1 };
+    const owed = priorState !== null && priorState.notified === 0;
+    if (owed) {
+      const ok = await deliver(previous);
+      if (ok) {
+        await store.markNotified(
+          rule.id,
+          rule.projectId,
+          previous,
+          priorState.last_state_change
+        );
+      }
+      await store.recordEvaluation(rule.id, rule.projectId, value, next, ok);
+      if (!ok) {
+        logger.warn("[alerts-evaluator] delivery retry failed; will retry", {
+          rule_id: rule.id,
+          project_id: rule.projectId,
+          state: previous
+        });
+        return none;
+      }
+      return { fired: 0, resolved: 0, redelivered: 1 };
     }
     await store.recordEvaluation(rule.id, rule.projectId, value, next, false);
   } catch (err) {
@@ -8558,10 +9201,14 @@ async function evaluateOneRule(store, rule, logger, tracer, ruleTimeoutMs) {
       error: err instanceof Error ? err.message : String(err)
     });
   }
-  return { fired: 0, resolved: 0 };
+  return none;
 }
 async function evaluateRuleBatch(store, rules, options) {
   const logger = options?.logger ?? consoleLogger;
+  const delivery = {
+    allowPrivateWebhookTargets: options?.allowPrivateWebhookTargets,
+    hostLookup: options?.hostLookup
+  };
   const concurrency = Math.max(
     1,
     Math.floor(options?.concurrency ?? DEFAULT_RULE_CONCURRENCY)
@@ -8573,24 +9220,35 @@ async function evaluateRuleBatch(store, rules, options) {
   const results = await mapWithConcurrency(
     rules,
     concurrency,
-    (rule) => evaluateOneRule(store, rule, logger, options?.tracer, ruleTimeoutMs)
+    (rule) => evaluateOneRule(
+      store,
+      rule,
+      logger,
+      options?.tracer,
+      ruleTimeoutMs,
+      delivery
+    )
   );
   return {
     evaluated: rules.length,
     fired: results.reduce((sum, result) => sum + result.fired, 0),
-    resolved: results.reduce((sum, result) => sum + result.resolved, 0)
+    resolved: results.reduce((sum, result) => sum + result.resolved, 0),
+    redelivered: results.reduce((sum, result) => sum + result.redelivered, 0)
   };
 }
 async function evaluateAllRules(env, options) {
   const logger = options?.logger ?? consoleLogger;
   const tracer = options?.tracer;
-  const store = new AlertsStore(sqlDbFor(env));
+  const allowPrivateWebhookTargets = env.ALERT_WEBHOOK_ALLOW_PRIVATE === "true";
+  const store = new AlertsStore(sqlDbFor(env), { allowPrivateWebhookTargets });
   const rules = await store.listEnabledRules();
   return evaluateRuleBatch(store, rules, {
     logger,
     tracer,
     concurrency: options?.concurrency,
-    ruleTimeoutMs: options?.ruleTimeoutMs
+    ruleTimeoutMs: options?.ruleTimeoutMs,
+    allowPrivateWebhookTargets,
+    hostLookup: options?.hostLookup
   });
 }
 function createAlertEvaluatorHandler() {
@@ -8603,12 +9261,15 @@ function createAlertEvaluatorHandler() {
 
 // src/plugins/alerts-routes.ts
 import { EVIDENCE_REFERENCE_CONTRACT as EVIDENCE_REFERENCE_CONTRACT5 } from "@obsunified/types";
+var storeOptions = (env) => ({
+  allowPrivateWebhookTargets: env.ALERT_WEBHOOK_ALLOW_PRIVATE === "true"
+});
 var alertsRoutesPlugin = {
   name: "alerts-routes",
   register(app) {
     app.get("/internal/alerts/rules", async (c) => {
       const projectId = getProjectId(c);
-      const store = new AlertsStore(sqlDbFor(c.env));
+      const store = new AlertsStore(sqlDbFor(c.env), storeOptions(c.env));
       const rules = await store.listRules(projectId);
       return c.json({ rules });
     });
@@ -8620,7 +9281,7 @@ var alertsRoutesPlugin = {
       } catch {
         return c.json({ error: "Invalid JSON body" }, 400);
       }
-      const store = new AlertsStore(sqlDbFor(c.env));
+      const store = new AlertsStore(sqlDbFor(c.env), storeOptions(c.env));
       try {
         const rule = await store.createRule(projectId, input);
         return c.json({ rule }, 201);
@@ -8638,7 +9299,7 @@ var alertsRoutesPlugin = {
       } catch {
         return c.json({ error: "Invalid JSON body" }, 400);
       }
-      const store = new AlertsStore(sqlDbFor(c.env));
+      const store = new AlertsStore(sqlDbFor(c.env), storeOptions(c.env));
       try {
         const rule = await store.updateRule(id, projectId, patch);
         if (!rule) return c.json({ error: "Rule not found" }, 404);
@@ -8651,7 +9312,7 @@ var alertsRoutesPlugin = {
     app.delete("/internal/alerts/rules/:id", async (c) => {
       const projectId = getProjectId(c);
       const id = c.req.param("id");
-      const store = new AlertsStore(sqlDbFor(c.env));
+      const store = new AlertsStore(sqlDbFor(c.env), storeOptions(c.env));
       const deleted = await store.deleteRule(id, projectId);
       if (!deleted) return c.json({ error: "Rule not found" }, 404);
       return c.json({ success: true });
@@ -8664,7 +9325,7 @@ var alertsRoutesPlugin = {
         1,
         Math.min(720, Number.parseInt(c.req.query("hours") || "24", 10) || 24)
       );
-      const store = new AlertsStore(sqlDbFor(c.env));
+      const store = new AlertsStore(sqlDbFor(c.env), storeOptions(c.env));
       const response = await store.listEvaluations({
         ruleId,
         projectId,
@@ -8675,7 +9336,7 @@ var alertsRoutesPlugin = {
     app.post("/internal/alerts/rules/:id/test", async (c) => {
       const projectId = getProjectId(c);
       const id = c.req.param("id");
-      const store = new AlertsStore(sqlDbFor(c.env));
+      const store = new AlertsStore(sqlDbFor(c.env), storeOptions(c.env));
       const rule = await store.getRule(id, projectId);
       if (!rule) return c.json({ error: "Rule not found" }, 404);
       const value = await store.evaluateRule(rule);
@@ -9082,12 +9743,10 @@ var askRoutesPlugin = {
   name: "ask-routes",
   register(app, runtime) {
     app.post("/internal/ask", async (c) => {
-      let body = {};
-      try {
-        body = await c.req.json();
-      } catch {
+      const body = await readJsonObject(c);
+      if (!body) {
         return c.json(
-          { error: "Bad Request", message: "body must be JSON" },
+          { error: "Bad Request", message: "body must be a JSON object" },
           400
         );
       }
@@ -9777,12 +10436,22 @@ var connectedRoutesPlugin = {
           const otherSpans = traceManifest.spans.filter(
             (s) => s.spanId !== span.spanId
           );
+          const interactionManifest = span.interactionId ? await index.byInteraction(projectId, span.interactionId) : null;
+          const parentSessionId = interactionManifest?.usageEvents.find(
+            (e) => Boolean(e.sessionId)
+          )?.sessionId;
           manifest.up = [
             {
               label: "Trace",
               links: [linkToTrace(span.traceId, "Parent trace")]
             }
           ];
+          if (parentSessionId) {
+            manifest.up.push({
+              label: "User session",
+              links: [linkToSession(parentSessionId)]
+            });
+          }
           manifest.across = [
             linksFromSpans(otherSpans, `Other spans in this trace`),
             linksFromLogs(traceManifest.logs, "Logs in this trace"),
@@ -9816,11 +10485,7 @@ var connectedRoutesPlugin = {
               "Metric exemplars in this trace"
             )
           ];
-          if (span.interactionId) {
-            const interactionManifest = await index.byInteraction(
-              projectId,
-              span.interactionId
-            );
+          if (interactionManifest) {
             manifest.related = [
               linksFromUsage(
                 interactionManifest.usageEvents,
@@ -10435,7 +11100,12 @@ var dashboardRoutesPlugin = {
         url.pathname = "/dashboard/";
         return assets.fetch(new Request(url.toString(), c.req.raw));
       }
-      return c.redirect("/dashboard/");
+      return c.json(
+        {
+          error: "Dashboard assets are not configured on this collector. Serve @obsunified/dashboard separately or bind [assets] in wrangler.toml."
+        },
+        404
+      );
     });
     app.get("/", (c) => {
       return c.redirect("/dashboard/");
@@ -11182,12 +11852,8 @@ var evalCasesRoutesPlugin = {
   name: "eval-cases-routes",
   register(app) {
     app.post("/internal/eval-cases", async (c) => {
-      let body;
-      try {
-        body = await c.req.json();
-      } catch {
-        return c.json(badRequest("body must be JSON"), 400);
-      }
+      const body = await readJsonObject(c);
+      if (!body) return c.json(badRequest("body must be a JSON object"), 400);
       const sourceType = body.sourceEntityType ?? body.source?.type;
       if (!isEvalCaseSourceType(sourceType)) {
         return c.json(
@@ -11280,12 +11946,8 @@ var evalCasesRoutesPlugin = {
       return c.json({ evalCase });
     });
     app.post("/internal/eval-runs", async (c) => {
-      let body;
-      try {
-        body = await c.req.json();
-      } catch {
-        return c.json(badRequest("body must be JSON"), 400);
-      }
+      const body = await readJsonObject(c);
+      if (!body) return c.json(badRequest("body must be a JSON object"), 400);
       const id = asOptionalString(body.id ?? body.runId)?.trim();
       if ((body.id ?? body.runId) !== void 0 && !id) {
         return c.json(badRequest("id must be a non-empty string"), 400);
@@ -11399,11 +12061,9 @@ var evalCasesRoutesPlugin = {
       const evalCaseId = c.req.param("id");
       if (!evalCaseId) return c.json(badRequest("id is required"), 400);
       let body;
-      try {
-        body = await c.req.json();
-      } catch {
-        return c.json(badRequest("body must be JSON"), 400);
-      }
+      const parsed = await readJsonObject(c);
+      if (!parsed) return c.json(badRequest("body must be a JSON object"), 400);
+      body = parsed;
       if (body.passed === void 0 || typeof body.passed !== "boolean") {
         return c.json(badRequest("passed must be a boolean"), 400);
       }
@@ -13664,12 +14324,8 @@ var identityReceiverPlugin = {
   register(app) {
     app.post("/v1/identify", async (c) => {
       const projectId = getProjectId(c);
-      let payload;
-      try {
-        payload = await c.req.json();
-      } catch {
-        return c.json({ error: "Invalid JSON body" }, 400);
-      }
+      const payload = await readJsonObject(c);
+      if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
       if (!payload.userId || typeof payload.userId !== "string") {
         return c.json({ error: "userId is required" }, 400);
       }
@@ -13696,7 +14352,7 @@ var identityReceiverPlugin = {
       await db.prepare(
         `INSERT INTO user_profiles (project_id, user_id, visitor_id, email, name, properties_json, first_seen_at, last_seen_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT(user_id) DO UPDATE SET
+         ON CONFLICT(project_id, user_id) DO UPDATE SET
            visitor_id = excluded.visitor_id,
            email = COALESCE(excluded.email, user_profiles.email),
            name = COALESCE(excluded.name, user_profiles.name),
@@ -13948,13 +14604,22 @@ var OtlpDecodeError = class extends Error {
     this.status = status;
   }
 };
-var readOtlpBody = async (c) => {
+var readOtlpBody = async (c, limits = {}) => {
   const contentType = (c.req.header("content-type") ?? "").toLowerCase();
   const wireFormat = detectWireFormat(contentType);
+  const env = c.env ?? {};
+  const maxBodyBytes = limits.maxBodyBytes ?? parseByteLimit(env.MAX_BODY_BYTES, DEFAULT_MAX_BODY_BYTES);
+  const maxDecompressedBytes = limits.maxDecompressedBytes ?? DEFAULT_MAX_DECOMPRESSED_BYTES;
   let body = await c.req.arrayBuffer();
+  if (body.byteLength > maxBodyBytes) {
+    throw new OtlpDecodeError(
+      `Payload too large (max ${maxBodyBytes} bytes)`,
+      413
+    );
+  }
   const encoding = (c.req.header("content-encoding") ?? "").toLowerCase();
   if (encoding === "gzip") {
-    body = await gunzip(body);
+    body = await gunzip(body, maxDecompressedBytes);
   } else if (encoding && encoding !== "identity") {
     throw new OtlpDecodeError(`Unsupported content-encoding: ${encoding}`, 415);
   }
@@ -13968,12 +14633,40 @@ var detectWireFormat = (contentType) => {
     415
   );
 };
-var gunzip = async (input) => {
+var gunzip = async (input, maxBytes) => {
   const stream = new Response(input).body?.pipeThrough(
     new DecompressionStream("gzip")
   );
   if (!stream) throw new OtlpDecodeError("Empty gzip body", 400);
-  return new Response(stream).arrayBuffer();
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => {
+        });
+        throw new OtlpDecodeError(
+          `Decompressed payload too large (max ${maxBytes} bytes)`,
+          413
+        );
+      }
+      chunks.push(value);
+    }
+  } catch (err) {
+    if (err instanceof OtlpDecodeError) throw err;
+    throw new OtlpDecodeError("Malformed gzip body", 400);
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out.buffer;
 };
 var decodeJsonBody = (bytes) => {
   const text = new TextDecoder().decode(bytes);
@@ -14827,17 +15520,20 @@ var onboardingRoutesPlugin = {
   register(app) {
     app.get("/internal/onboarding/counts", async (c) => {
       const db = sqlDbFor(c.env);
+      const projectId = getProjectId(c);
+      const count = (table, extra = "") => safeCount(
+        db,
+        `SELECT COUNT(*) AS n FROM ${table} WHERE project_id = ?${extra}`,
+        projectId
+      );
       const counts = await Promise.all([
-        safeCount(db, "SELECT COUNT(*) AS n FROM telemetry_spans"),
-        safeCount(db, "SELECT COUNT(*) AS n FROM logs"),
-        safeCount(db, "SELECT COUNT(*) AS n FROM usage_events"),
-        safeCount(db, "SELECT COUNT(*) AS n FROM user_profiles"),
-        safeCount(db, "SELECT COUNT(*) AS n FROM ai_calls"),
-        safeCount(db, "SELECT COUNT(*) AS n FROM session_replay_metadata"),
-        safeCount(
-          db,
-          "SELECT COUNT(*) AS n FROM telemetry_spans WHERE interaction_id IS NOT NULL"
-        )
+        count("telemetry_spans"),
+        count("logs"),
+        count("usage_events"),
+        count("user_profiles"),
+        count("ai_calls"),
+        count("session_replay_metadata"),
+        count("telemetry_spans", " AND interaction_id IS NOT NULL")
       ]);
       return c.json({
         spans: counts[0],
@@ -14851,9 +15547,9 @@ var onboardingRoutesPlugin = {
     });
   }
 };
-async function safeCount(db, sql) {
+async function safeCount(db, sql, ...binds) {
   try {
-    const row = await db.prepare(sql).first();
+    const row = await db.prepare(sql).bind(...binds).first();
     return Number(row?.n ?? 0);
   } catch {
     return 0;
@@ -15616,9 +16312,10 @@ var projectsRoutesPlugin = {
       }
     });
     app.delete("/internal/projects/:id/keys/:keyId", async (c) => {
+      const projectId = c.req.param("id");
       const keyId = c.req.param("keyId");
       const store = new ProjectsStore(sqlDbFor(c.env));
-      const revoked = await store.revokeKey(keyId);
+      const revoked = await store.revokeKey(keyId, projectId);
       if (!revoked)
         return c.json({ error: "Key not found or already revoked" }, 404);
       return c.json({ success: true });
@@ -15925,13 +16622,9 @@ var replayReceiverPlugin = {
   register(app, runtime) {
     app.post("/v1/replays", async (c) => {
       const projectId = getProjectId(c);
-      let payload;
-      try {
-        payload = await c.req.json();
-      } catch {
-        return c.json({ error: "Invalid JSON body" }, 400);
-      }
-      if (!isSafeId(payload.sessionId) || payload.visitorId !== void 0 && !isSafeId(payload.visitorId) || !Number.isInteger(payload.sequenceNumber) || payload.sequenceNumber < 0 || !Array.isArray(payload.events)) {
+      const payload = await readJsonObject(c);
+      if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
+      if (!isSafeId(payload.sessionId) || !isSafeId(payload.visitorId) || !Number.isInteger(payload.sequenceNumber) || payload.sequenceNumber < 0 || !Array.isArray(payload.events)) {
         return c.json({ error: "Invalid replay payload" }, 400);
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -15951,7 +16644,7 @@ var replayReceiverPlugin = {
       await sqlDbFor(c.env).prepare(
         `INSERT INTO session_replay_metadata (project_id, session_id, visitor_id, first_chunk_at, last_chunk_at, chunk_count, events_count, storage_bytes)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT(session_id) DO UPDATE SET
+         ON CONFLICT(project_id, session_id) DO UPDATE SET
            last_chunk_at = excluded.last_chunk_at,
            chunk_count = session_replay_metadata.chunk_count + 1,
            events_count = session_replay_metadata.events_count + excluded.events_count,
@@ -16385,12 +17078,8 @@ var usageReceiverPlugin = {
   register(app, runtime) {
     app.post("/v1/usage", async (c) => {
       const projectId = getProjectId(c);
-      let payload;
-      try {
-        payload = await c.req.json();
-      } catch {
-        return c.json({ error: "Invalid JSON body" }, 400);
-      }
+      const payload = await readJsonObject(c);
+      if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
       const rawEvents = payload.events || [];
       if (rawEvents.length > 200) {
         return c.json(
@@ -16521,6 +17210,71 @@ var utmEnrichmentPlugin = {
   }
 };
 
+// src/auth/login-rate-limit.ts
+var LoginRateLimiter = class {
+  buckets = /* @__PURE__ */ new Map();
+  maxFailures;
+  windowMs;
+  maxClients;
+  now;
+  constructor(options = {}) {
+    this.maxFailures = Math.max(1, options.maxFailures ?? 10);
+    this.windowMs = Math.max(1e3, options.windowMs ?? 15 * 6e4);
+    this.maxClients = Math.max(1, options.maxClients ?? 1e4);
+    this.now = options.now ?? Date.now;
+  }
+  check(key) {
+    const bucket = this.live(key);
+    if (!bucket || bucket.failures < this.maxFailures) {
+      return { allowed: true, retryAfterSeconds: 0 };
+    }
+    const remaining = bucket.windowStartedAt + this.windowMs - this.now();
+    return {
+      allowed: false,
+      retryAfterSeconds: Math.max(1, Math.ceil(remaining / 1e3))
+    };
+  }
+  recordFailure(key) {
+    const bucket = this.live(key);
+    if (bucket) {
+      bucket.failures += 1;
+      return;
+    }
+    if (this.buckets.size >= this.maxClients) {
+      const oldest = this.buckets.keys().next().value;
+      if (oldest !== void 0) this.buckets.delete(oldest);
+    }
+    this.buckets.set(key, { failures: 1, windowStartedAt: this.now() });
+  }
+  reset(key) {
+    this.buckets.delete(key);
+  }
+  /** Bucket for `key` if its window is still open; expired buckets are dropped. */
+  live(key) {
+    const bucket = this.buckets.get(key);
+    if (!bucket) return void 0;
+    if (bucket.windowStartedAt + this.windowMs <= this.now()) {
+      this.buckets.delete(key);
+      return void 0;
+    }
+    return bucket;
+  }
+};
+var isCloudflareWorkersRuntime = () => typeof navigator !== "undefined" && typeof navigator.userAgent === "string" && navigator.userAgent.startsWith("Cloudflare-Workers");
+var loginClientKey = (headers, options = {}) => {
+  const cf = headers.get("cf-connecting-ip")?.trim();
+  if (options.trustProxyHeaders) {
+    if (cf) return cf;
+    const forwarded = headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+    if (forwarded) return forwarded;
+  }
+  const peer = options.clientAddress?.trim();
+  if (peer) return peer;
+  if (cf && isCloudflareWorkersRuntime()) return cf;
+  return null;
+};
+var UNKEYED_LOGIN_CLIENT_WARNING = "[dashboard-auth] login rate limiting is inactive: no trustworthy client address. On Node, pass `loginRateLimit.clientAddress` (e.g. the TCP peer from @hono/node-server's getConnInfo); behind a trusted reverse proxy set `loginRateLimit.trustProxyHeaders`. Cloudflare Workers key on CF-Connecting-IP automatically.";
+
 // src/auth/dashboard-auth.ts
 var SESSION_COOKIE = "obs_session";
 var SESSION_MAX_AGE = 7 * 24 * 60 * 60;
@@ -16588,37 +17342,75 @@ function getCookie(cookieHeader, name) {
 }
 function createDashboardAuth(config) {
   const middleware = async (c, next) => {
-    if (!config.password) {
+    const configuredPassword = config?.password ?? c.env.DASHBOARD_PASSWORD;
+    const configuredToken = config?.token ?? c.env.DASHBOARD_TOKEN ?? c.env.OBS_DASHBOARD_TOKEN;
+    if (!configuredPassword && !configuredToken) {
       return c.json(
         {
-          error: "DASHBOARD_PASSWORD is not configured. Set the DASHBOARD_PASSWORD environment variable."
+          error: "Neither DASHBOARD_PASSWORD nor DASHBOARD_TOKEN is configured. Set at least one environment variable."
         },
         500
       );
     }
-    const cookieHeader = c.req.header("Cookie");
-    const sessionValue = getCookie(cookieHeader, SESSION_COOKIE);
-    if (!sessionValue) {
+    let authenticated = false;
+    const authHeader = c.req.header("Authorization");
+    if (authHeader) {
+      const match = authHeader.match(/^Bearer\s+(.+)$/i);
+      if (!match) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+      const bearerToken = match[1].trim();
+      if (!bearerToken) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+      const ingestKey = c.env.INGEST_KEY;
+      if (ingestKey && await timingSafeEqualStr(bearerToken, ingestKey)) {
+        return c.json(
+          {
+            error: "Unauthorized: ingest keys cannot be used for dashboard/internal access"
+          },
+          401
+        );
+      }
+      if (!configuredToken) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+      const valid = await timingSafeEqualStr(bearerToken, configuredToken);
+      if (!valid) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+      authenticated = true;
+    } else {
+      const cookieHeader = c.req.header("Cookie");
+      const sessionValue = getCookie(cookieHeader, SESSION_COOKIE);
+      if (sessionValue) {
+        if (!configuredPassword) {
+          return c.json({ error: "Unauthorized" }, 401);
+        }
+        const dotIndex = sessionValue.lastIndexOf(".");
+        if (dotIndex === -1) {
+          return c.json({ error: "Invalid session" }, 401);
+        }
+        const payload = sessionValue.substring(0, dotIndex);
+        const sig = sessionValue.substring(dotIndex + 1);
+        const valid = await verify(payload, sig, configuredPassword);
+        if (!valid) {
+          return c.json({ error: "Invalid session" }, 401);
+        }
+        const token = parseSessionToken(payload);
+        if (!token || token.exp < Math.floor(Date.now() / 1e3)) {
+          return c.json({ error: "Session expired" }, 401);
+        }
+        authenticated = true;
+      }
+    }
+    if (!authenticated) {
       const accept = c.req.header("Accept") || "";
       if (accept.includes("text/html")) {
         return c.redirect("/dashboard/login");
       }
       return c.json({ error: "Unauthorized" }, 401);
     }
-    const dotIndex = sessionValue.lastIndexOf(".");
-    if (dotIndex === -1) {
-      return c.json({ error: "Invalid session" }, 401);
-    }
-    const payload = sessionValue.substring(0, dotIndex);
-    const sig = sessionValue.substring(dotIndex + 1);
-    const valid = await verify(payload, sig, config.password);
-    if (!valid) {
-      return c.json({ error: "Invalid session" }, 401);
-    }
-    const token = parseSessionToken(payload);
-    if (!token || token.exp < Math.floor(Date.now() / 1e3)) {
-      return c.json({ error: "Session expired" }, 401);
-    }
     const path = c.req.path;
     const needsProject = path.startsWith("/internal/") && !path.startsWith("/internal/projects");
     if (needsProject) {
@@ -16637,17 +17429,42 @@ function createDashboardAuth(config) {
     await next();
   };
   const registerRoutes = (app) => {
+    const limiter = config?.loginRateLimit === false ? null : new LoginRateLimiter(config?.loginRateLimit ?? {});
+    let warnedUnkeyedClient = false;
     app.post("/auth/login", async (c) => {
-      if (!config.password) {
+      const configuredPassword = config?.password ?? c.env.DASHBOARD_PASSWORD;
+      if (!configuredPassword) {
         return c.json({ error: "Dashboard password not configured" }, 500);
       }
-      const body = await c.req.json().catch(() => ({ password: void 0 }));
-      if (!body.password || !await timingSafeEqualStr(body.password, config.password)) {
+      const limitConfig = config?.loginRateLimit || void 0;
+      const clientKey = limiter ? loginClientKey(c.req.raw.headers, {
+        clientAddress: limitConfig?.clientAddress?.(c),
+        trustProxyHeaders: limitConfig?.trustProxyHeaders
+      }) : null;
+      if (limiter && clientKey === null && !warnedUnkeyedClient) {
+        warnedUnkeyedClient = true;
+        (limitConfig?.warn ?? console.warn)(UNKEYED_LOGIN_CLIENT_WARNING);
+      }
+      const verdict = clientKey === null ? null : limiter?.check(clientKey);
+      if (verdict && !verdict.allowed) {
+        c.header("Retry-After", String(verdict.retryAfterSeconds));
+        return c.json({ error: "Too many failed login attempts" }, 429);
+      }
+      let body = null;
+      try {
+        body = await c.req.json();
+      } catch (err) {
+        if (err instanceof Error && err.name === "BodyLimitError") throw err;
+        body = null;
+      }
+      if (!body?.password || typeof body.password !== "string" || !await timingSafeEqualStr(body.password, configuredPassword)) {
+        if (clientKey !== null) limiter?.recordFailure(clientKey);
         return c.json({ error: "Invalid password" }, 401);
       }
+      if (clientKey !== null) limiter?.reset(clientKey);
       const expiresAt = Math.floor(Date.now() / 1e3) + SESSION_MAX_AGE;
       const payload = createSessionToken(expiresAt);
-      const sig = await sign(payload, config.password);
+      const sig = await sign(payload, configuredPassword);
       const cookieValue = `${payload}.${sig}`;
       const isSecure = c.req.url.startsWith("https:");
       c.header(
@@ -16657,9 +17474,27 @@ function createDashboardAuth(config) {
       return c.json({ success: true });
     });
     app.get("/auth/check", async (c) => {
+      const configuredPassword = config?.password ?? c.env.DASHBOARD_PASSWORD;
+      const configuredToken = config?.token ?? c.env.DASHBOARD_TOKEN ?? c.env.OBS_DASHBOARD_TOKEN;
+      const authHeader = c.req.header("Authorization");
+      if (authHeader) {
+        const match = authHeader.match(/^Bearer\s+(.+)$/i);
+        if (match && configuredToken) {
+          const bearerToken = match[1].trim();
+          const ingestKey = c.env.INGEST_KEY;
+          if (ingestKey && await timingSafeEqualStr(bearerToken, ingestKey)) {
+            return c.json({ authenticated: false });
+          }
+          const valid2 = await timingSafeEqualStr(bearerToken, configuredToken);
+          if (valid2) {
+            return c.json({ authenticated: true });
+          }
+        }
+        return c.json({ authenticated: false });
+      }
       const cookieHeader = c.req.header("Cookie");
       const sessionValue = getCookie(cookieHeader, SESSION_COOKIE);
-      if (!sessionValue) {
+      if (!sessionValue || !configuredPassword) {
         return c.json({ authenticated: false });
       }
       const dotIndex = sessionValue.lastIndexOf(".");
@@ -16668,7 +17503,7 @@ function createDashboardAuth(config) {
       }
       const payload = sessionValue.substring(0, dotIndex);
       const sig = sessionValue.substring(dotIndex + 1);
-      const valid = await verify(payload, sig, config.password);
+      const valid = await verify(payload, sig, configuredPassword);
       if (!valid) {
         return c.json({ authenticated: false });
       }
@@ -16812,8 +17647,7 @@ var ActionStore = class {
 					tool_call_id, prompt_version, model_name, provider, total_cost_usd,
 					attrs_json
 				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-				ON CONFLICT(id) DO UPDATE SET
-					project_id = excluded.project_id,
+				ON CONFLICT(project_id, id) DO UPDATE SET
 					root_action_id = excluded.root_action_id,
 					caused_by_action_id = excluded.caused_by_action_id,
 					actor_type = excluded.actor_type,
@@ -16872,8 +17706,7 @@ var ActionStore = class {
 					autonomy_level, status, error_message, total_cost_usd,
 					total_duration_ms, metadata_json
 				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-				ON CONFLICT(id) DO UPDATE SET
-					project_id = excluded.project_id,
+				ON CONFLICT(project_id, id) DO UPDATE SET
 					agent_id = excluded.agent_id,
 					agent_name = excluded.agent_name,
 					agent_version = excluded.agent_version,
@@ -16909,9 +17742,8 @@ var ActionStore = class {
 					mcp_audit_json, mutation_before_json, mutation_after_json,
 					mutation_diff_json, mutation_artifact_id
 				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-				ON CONFLICT(id) DO UPDATE SET
+				ON CONFLICT(project_id, id) DO UPDATE SET
 					action_id = excluded.action_id,
-					project_id = excluded.project_id,
 					tool_name = excluded.tool_name,
 					args_hash = excluded.args_hash,
 					result_hash = excluded.result_hash,
@@ -16950,9 +17782,8 @@ var ActionStore = class {
 					id, action_id, project_id, retriever_name, query_hash, documents_json,
 					total_results, max_relevance_score, duration_ms
 				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-				ON CONFLICT(id) DO UPDATE SET
+				ON CONFLICT(project_id, id) DO UPDATE SET
 					action_id = excluded.action_id,
-					project_id = excluded.project_id,
 					retriever_name = excluded.retriever_name,
 					query_hash = excluded.query_hash,
 					documents_json = excluded.documents_json,
@@ -16977,9 +17808,8 @@ var ActionStore = class {
 					id, action_id, project_id, evaluator_name, evaluator_version, score,
 					passed, reasoning, rubric_json
 				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-				ON CONFLICT(id) DO UPDATE SET
+				ON CONFLICT(project_id, id) DO UPDATE SET
 					action_id = excluded.action_id,
-					project_id = excluded.project_id,
 					evaluator_name = excluded.evaluator_name,
 					evaluator_version = excluded.evaluator_version,
 					score = excluded.score,
@@ -17004,9 +17834,8 @@ var ActionStore = class {
 					id, action_id, project_id, artifact_name, artifact_type, storage_ref,
 					size_bytes, sha256_hash, content_preview
 				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-				ON CONFLICT(id) DO UPDATE SET
+				ON CONFLICT(project_id, id) DO UPDATE SET
 					action_id = excluded.action_id,
-					project_id = excluded.project_id,
 					artifact_name = excluded.artifact_name,
 					artifact_type = excluded.artifact_type,
 					storage_ref = excluded.storage_ref,
@@ -17452,9 +18281,11 @@ var PostgresAdapter = class {
   dialect = postgresDialect;
   statementTimeoutMs;
   prepare(sql) {
+    const translated = prepareSqlForPostgres(sql);
     return new PostgresStatement(
       this.pool,
-      translateD1Sql(rewriteQuestionMarks(sql))
+      translated,
+      mixedCaseAliases(translated)
     );
   }
   async batch(statements) {
@@ -17485,23 +18316,49 @@ var PostgresAdapter = class {
     }
   }
 };
-var PostgresStatement = class {
-  constructor(pool, sql) {
+var PostgresStatement = class _PostgresStatement {
+  constructor(pool, sql, aliases = /* @__PURE__ */ new Map(), bound = []) {
     this.pool = pool;
     this.sql = sql;
+    this.aliases = aliases;
+    this.bound = bound;
   }
-  bound = [];
+  /**
+   * Returns a NEW statement, matching D1 semantics. Stores prepare once and
+   * bind per row (`calls.map((c) => stmt.bind(...))`), so mutating in place
+   * would make every statement in a batch carry the last row's values.
+   */
   bind(...args) {
-    this.bound = args;
-    return this;
+    return new _PostgresStatement(this.pool, this.sql, this.aliases, args);
   }
   async first() {
     const result = await this.exec();
-    return result.rows[0] ?? null;
+    const row = result.rows[0];
+    return row === void 0 ? null : this.restoreAliases(row);
   }
   async all() {
     const result = await this.exec();
-    return { results: result.rows };
+    return {
+      results: result.rows.map(
+        (row) => this.restoreAliases(row)
+      )
+    };
+  }
+  /**
+   * Postgres folds unquoted identifiers to lower case, so `COUNT(*) AS
+   * totalCalls` comes back as `totalcalls`. D1 preserves the alias. Put the
+   * mixed-case spelling back so stores can read `row.totalCalls` on both.
+   */
+  restoreAliases(row) {
+    if (this.aliases.size === 0 || !row || typeof row !== "object") return row;
+    const out = row;
+    for (const [lower, original] of this.aliases) {
+      if (lower in out && !(original in out)) {
+        out[original] = out[lower];
+        delete out[lower];
+      }
+    }
+    return row;
   }
   async run() {
     const result = await this.exec();
@@ -17510,19 +18367,100 @@ var PostgresStatement = class {
   // Internal — used by batch() to run inside an already-checked-out
   // client (so the BEGIN/COMMIT span the whole batch).
   async runOnClient(client) {
-    const r = await client.query(this.sql, this.bound);
+    const r = await client.query(this.sql, [...this.bound]);
     return { meta: { changes: r.rowCount ?? 0 } };
   }
   async exec() {
     const client = await this.pool.connect();
     try {
-      const r = await client.query(this.sql, this.bound);
+      const r = await client.query(this.sql, [...this.bound]);
       return { rows: r.rows, rowCount: r.rowCount };
     } finally {
       client.release();
     }
   }
 };
+var POSTGRES_TYPE_OIDS = {
+  BOOL: 16,
+  INT8: 20,
+  JSON: 114,
+  NUMERIC: 1700,
+  JSONB: 3802
+};
+var parsePostgresNumber = (value, typeName) => {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) {
+    throw new RangeError(
+      `PostgresAdapter: cannot convert ${typeName} value ${JSON.stringify(value)} to a JS number`
+    );
+  }
+  if (/^-?\d+$/.test(value) && !Number.isSafeInteger(parsed)) {
+    throw new RangeError(
+      `PostgresAdapter: ${typeName} value ${value} exceeds Number.MAX_SAFE_INTEGER (${Number.MAX_SAFE_INTEGER}); cast it to TEXT in SQL if the exact value is needed`
+    );
+  }
+  return parsed;
+};
+var configurePostgresTypeParsers = (types) => {
+  types.setTypeParser(
+    POSTGRES_TYPE_OIDS.BOOL,
+    (value) => value === "t" || value === "true" ? 1 : 0
+  );
+  types.setTypeParser(
+    POSTGRES_TYPE_OIDS.INT8,
+    (value) => parsePostgresNumber(value, "BIGINT")
+  );
+  types.setTypeParser(
+    POSTGRES_TYPE_OIDS.NUMERIC,
+    (value) => parsePostgresNumber(value, "NUMERIC")
+  );
+  types.setTypeParser(POSTGRES_TYPE_OIDS.JSON, (value) => value);
+  types.setTypeParser(POSTGRES_TYPE_OIDS.JSONB, (value) => value);
+};
+var prepareSqlForPostgres = (sql) => translateD1Sql(rewriteQuestionMarks(stripSqlComments(sql)));
+var stripSqlComments = (sql) => {
+  let out = "";
+  let inString = false;
+  for (let i = 0; i < sql.length; i++) {
+    const ch = sql[i];
+    if (ch === "'") {
+      inString = !inString;
+      out += ch;
+      continue;
+    }
+    if (inString) {
+      out += ch;
+      continue;
+    }
+    if (ch === "-" && sql[i + 1] === "-") {
+      const eol = sql.indexOf("\n", i);
+      if (eol === -1) return out;
+      i = eol - 1;
+      continue;
+    }
+    if (ch === "/" && sql[i + 1] === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      if (end === -1) return out;
+      i = end + 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+};
+var mixedCaseAliases = (sql) => {
+  const aliases = /* @__PURE__ */ new Map();
+  const pattern = /\bAS\s+([A-Za-z_][A-Za-z0-9_]*)/gi;
+  stripSqlComments(sql).split("'").filter((_segment, index) => index % 2 === 0).forEach((segment) => {
+    for (const match of segment.matchAll(pattern)) {
+      const alias = match[1];
+      if (alias !== alias.toLowerCase() && alias !== alias.toUpperCase()) {
+        aliases.set(alias.toLowerCase(), alias);
+      }
+    }
+  });
+  return aliases;
+};
 var rewriteQuestionMarks = (sql) => {
   let out = "";
   let inString = false;
@@ -17543,45 +18481,167 @@ var rewriteQuestionMarks = (sql) => {
   }
   return out;
 };
+var UTC_NOW = "(CURRENT_TIMESTAMP AT TIME ZONE 'UTC')";
+var INTERVAL_UNITS = /^(hour|hours|minute|minutes|day|days|second|seconds)$/i;
+var sqliteModifierToInterval = (modifier) => {
+  const literal = /^'-(\d+)\s+([a-z]+)'$/i.exec(modifier);
+  if (literal && INTERVAL_UNITS.test(literal[2])) {
+    return `INTERVAL '${literal[1]} ${literal[2].toLowerCase()}'`;
+  }
+  const concat = /^'-'\s*\|\|\s*(.+?)\s*\|\|\s*'\s*([a-z]+)'$/i.exec(modifier);
+  if (concat && INTERVAL_UNITS.test(concat[2])) {
+    return `(${concat[1].trim()}::text || ' ${concat[2].toLowerCase()}')::interval`;
+  }
+  return null;
+};
+var asUtcTimestamp = (expr) => `(${expr})::timestamptz AT TIME ZONE 'UTC'`;
+var STRFTIME_FORMATS = {
+  "%Y-%m-%dT%H:%M:00Z": (expr) => `to_char(date_trunc('minute', ${asUtcTimestamp(expr)}), 'YYYY-MM-DD"T"HH24:MI:00"Z"')`,
+  "%Y-%m-%dT%H:00:00Z": (expr) => `to_char(date_trunc('hour', ${asUtcTimestamp(expr)}), 'YYYY-MM-DD"T"HH24:00:00"Z"')`,
+  "%s": (expr) => `EXTRACT(EPOCH FROM (${expr})::timestamptz)`
+};
+var unquote = (literal) => {
+  const m = /^'((?:[^']|'')*)'$/.exec(literal.trim());
+  return m ? m[1].replace(/''/g, "'") : null;
+};
+var jsonPathToPostgres = (expr, pathLiteral) => {
+  const path = unquote(pathLiteral);
+  if (!path?.startsWith("$.")) return null;
+  const rest = path.slice(2);
+  const quoted = /^"([^"]+)"$/.exec(rest);
+  const escapeKey = (key) => key.replace(/\\u002E/g, ".").replace(/'/g, "''");
+  if (quoted) return `((${expr})::jsonb ->> '${escapeKey(quoted[1])}')`;
+  if (!/^[A-Za-z0-9_.\\]+$/.test(rest)) return null;
+  const segments = rest.split(".").map(escapeKey);
+  if (segments.length === 1) return `((${expr})::jsonb ->> '${segments[0]}')`;
+  return `((${expr})::jsonb #>> '{${segments.join(",")}}')`;
+};
+var FUNCTION_REWRITES = {
+  datetime: (args) => {
+    if (args.length === 1 && /^'now'$/i.test(args[0])) {
+      return postgresIsoText(UTC_NOW);
+    }
+    if (args.length === 2 && /^'now'$/i.test(args[0])) {
+      const interval = sqliteModifierToInterval(args[1]);
+      return interval ? postgresIsoText(`${UTC_NOW} - ${interval}`) : null;
+    }
+    if (args.length === 2 && /^'unixepoch'$/i.test(args[1])) {
+      return `to_timestamp(${args[0]})`;
+    }
+    return null;
+  },
+  strftime: (args) => {
+    const format = args.length >= 2 ? unquote(args[0]) : null;
+    if (format === SQLITE_ISO_FORMAT && /^'now'$/i.test(args[1])) {
+      if (args.length === 2) return postgresIsoText(UTC_NOW);
+      if (args.length === 3) {
+        const interval = sqliteModifierToInterval(args[2]);
+        return interval ? postgresIsoText(`${UTC_NOW} - ${interval}`) : null;
+      }
+      return null;
+    }
+    if (args.length !== 2) return null;
+    const render = format ? STRFTIME_FORMATS[format] : void 0;
+    return render ? render(args[1]) : null;
+  },
+  julianday: (args) => args.length === 1 ? `(EXTRACT(EPOCH FROM (${args[0]})::timestamptz) / 86400.0 + 2440587.5)` : null,
+  json_extract: (args) => args.length === 2 ? jsonPathToPostgres(args[0], args[1]) : null,
+  json_object: (args) => `json_build_object(${args.join(", ")})`,
+  json_array: (args) => `json_build_array(${args.join(", ")})`,
+  json_group_array: (args) => `json_agg(${args.join(", ")})`,
+  // SQLite's scalar MAX/MIN take several arguments; Postgres spells those
+  // GREATEST/LEAST. Single-argument MAX/MIN stay aggregates.
+  max: (args) => args.length > 1 ? `GREATEST(${args.join(", ")})` : null,
+  min: (args) => args.length > 1 ? `LEAST(${args.join(", ")})` : null,
+  // Postgres only defines ROUND(numeric, int); SQLite rounds REAL directly.
+  round: (args) => args.length === 2 ? `ROUND((${args[0]})::numeric, ${args[1]})` : null
+};
+var FUNCTION_NAME_PATTERN = new RegExp(
+  `\\b(${Object.keys(FUNCTION_REWRITES).join("|")})\\s*\\(`,
+  "i"
+);
+var isIdentifierChar = (ch) => ch !== void 0 && /[A-Za-z0-9_.]/.test(ch);
+var findClosingParen = (sql, open) => {
+  let depth = 0;
+  let inString = false;
+  for (let i = open; i < sql.length; i++) {
+    const ch = sql[i];
+    if (ch === "'") {
+      inString = !inString;
+      continue;
+    }
+    if (inString) continue;
+    if (ch === "(") depth += 1;
+    else if (ch === ")") {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+};
+var splitTopLevelArgs = (inner) => {
+  const args = [];
+  let depth = 0;
+  let inString = false;
+  let current = "";
+  for (const ch of inner) {
+    if (ch === "'") inString = !inString;
+    if (!inString) {
+      if (ch === "(") depth += 1;
+      else if (ch === ")") depth -= 1;
+      else if (ch === "," && depth === 0) {
+        args.push(current.trim());
+        current = "";
+        continue;
+      }
+    }
+    current += ch;
+  }
+  if (current.trim() !== "" || args.length > 0) args.push(current.trim());
+  return args;
+};
+var insideStringLiteral = (sql, index) => {
+  let inString = false;
+  for (let i = 0; i < index; i++) {
+    if (sql[i] === "'") inString = !inString;
+  }
+  return inString;
+};
+var translateFunctionCalls = (sql) => {
+  let out = "";
+  let rest = sql;
+  for (; ; ) {
+    const match = FUNCTION_NAME_PATTERN.exec(rest);
+    if (!match) return out + rest;
+    const start = match.index;
+    const open = start + match[0].length - 1;
+    if (insideStringLiteral(rest, start)) {
+      const closeQuote = rest.indexOf("'", start);
+      const cut = closeQuote === -1 ? rest.length : closeQuote + 1;
+      out += rest.slice(0, cut);
+      rest = rest.slice(cut);
+      continue;
+    }
+    const precededByIdentifier = isIdentifierChar(rest[start - 1]);
+    const close = findClosingParen(rest, open);
+    if (precededByIdentifier || close === -1) {
+      out += rest.slice(0, open + 1);
+      rest = rest.slice(open + 1);
+      continue;
+    }
+    const name = match[1].toLowerCase();
+    const inner = translateFunctionCalls(rest.slice(open + 1, close));
+    const replacement = FUNCTION_REWRITES[name](splitTopLevelArgs(inner));
+    out += rest.slice(0, start);
+    out += replacement ?? `${match[1]}(${inner})`;
+    rest = rest.slice(close + 1);
+  }
+};
 var translateD1Sql = (sql) => {
   let out = sql;
   const hadInsertOrIgnore = /\bINSERT\s+OR\s+IGNORE\s+INTO\b/i.test(out);
   out = out.replace(/\bINSERT\s+OR\s+IGNORE\s+INTO\b/gi, "INSERT INTO");
-  out = out.replace(
-    /datetime\('now',\s*'-'\s*\|\|\s*(\$\d+)\s*\|\|\s*'\s*hours'\)/gi,
-    "(CURRENT_TIMESTAMP - ($1::text || ' hours')::interval)"
-  );
-  out = out.replace(
-    /datetime\('now',\s*'-'\s*\|\|\s*(\$\d+)\s*\|\|\s*'\s*minutes'\)/gi,
-    "(CURRENT_TIMESTAMP - ($1::text || ' minutes')::interval)"
-  );
-  out = out.replace(
-    /datetime\('now',\s*'-(\d+)\s+(hour|hours|minute|minutes|day|days)'\)/gi,
-    "CURRENT_TIMESTAMP - INTERVAL '$1 $2'"
-  );
-  out = out.replace(/datetime\('now'\)/gi, "CURRENT_TIMESTAMP");
-  out = out.replace(
-    /json_extract\(([^,()]+),\s*'\$\.(?:"([^"]+)"|([A-Za-z0-9_\\.\\\\]+))'\)/gi,
-    (_match, expr, quotedKey, bareKey) => {
-      const key = (quotedKey ?? bareKey ?? "").replace(
-        /\\\\u002E|\\u002E/g,
-        "."
-      );
-      return `(${expr.trim()}::jsonb ->> '${key.replace(/'/g, "''")}')`;
-    }
-  );
-  out = out.replace(
-    /strftime\('%Y-%m-%dT%H:%M:00Z',\s*([^)]+)\)/gi,
-    `to_char(date_trunc('minute', $1::timestamp), 'YYYY-MM-DD"T"HH24:MI:00"Z"')`
-  );
-  out = out.replace(
-    /strftime\('%Y-%m-%dT%H:00:00Z',\s*([^)]+)\)/gi,
-    `to_char(date_trunc('hour', $1::timestamp), 'YYYY-MM-DD"T"HH24:00:00"Z"')`
-  );
-  out = out.replace(
-    /strftime\('%s',\s*([^)]+)\)/gi,
-    "EXTRACT(EPOCH FROM $1::timestamp)"
-  );
+  out = translateFunctionCalls(out);
   if (hadInsertOrIgnore && /\bON\s+CONFLICT\b/i.test(out) === false) {
     out = out.replace(/(;?\s*)$/, " ON CONFLICT DO NOTHING$1");
   }
@@ -17653,6 +18713,7 @@ export {
   R2BlobStore,
   S3BlobStore,
   TailHub,
+  actionRetentionCutoff,
   actionRoutesPlugin,
   aiReceiverPlugin,
   aiSpanPayloadsProcessorPlugin,
@@ -17662,6 +18723,7 @@ export {
   askRoutesPlugin,
   botFilterPlugin,
   compareValue,
+  configurePostgresTypeParsers,
   connectedRoutesPlugin,
   consoleLogger,
   createAlertEvaluatorHandler,
@@ -17690,6 +18752,7 @@ export {
   platformRoutesPlugin,
   profileRoutesPlugin,
   projectsRoutesPlugin,
+  purgeExpiredActionGraph,
   queryRoutesPlugin,
   redactionProcessorPlugin,
   replayQueryRoutesPlugin,