@obsunified/collector 2.0.1 → 2.1.1

package/src/migrations/project-scoped-keys.test.ts

@@ -0,0 +1,432 @@
+/**
+ * Migrations 045–048 move four row families from globally unique keys to
+ * project-scoped composite keys. These tests run the real D1 migration
+ * files through node:sqlite and then exercise the real write paths
+ * (/v1/identify, ActionStore, the AI span payload processor, span ingest)
+ * with two projects that emit identical ids.
+ */
+
+import type { StoredSpan } from "@obsunified/types";
+import type { MiddlewareHandler } from "hono";
+import { describe, expect, it } from "vitest";
+import {
+	type CollectorRuntime,
+	createTelemetryCollectorApp,
+	type SpanProcessorPlugin,
+} from "../framework/collector";
+import type { CollectorEnv, CollectorRouteContext } from "../framework/env";
+import { ActionStore } from "../lib/actions-store";
+import { getAISpansOverview } from "../lib/ai-store/spans";
+import { manifestByUser } from "../lib/identity-index/user-lookup";
+import { ingestTelemetrySpans } from "../lib/store/ingest";
+import { actionRecord } from "../lib/test-utils/action-graph-fixtures";
+import {
+	applySqliteMigrations,
+	createMigratedSqliteDb,
+	indexNames,
+	type NodeSqliteDb,
+	primaryKeyColumns,
+} from "../lib/test-utils/node-sqlite-db";
+import { aiSpanPayloadsProcessorPlugin } from "../plugins/ai-span-payloads-processor";
+import { identityReceiverPlugin } from "../plugins/identity-receiver";
+
+const NOW = "2026-10-13T05:00:00.000Z";
+const LATER = "2026-10-14T05:00:00.000Z";
+
+const EXPECTED_KEYS: Record<string, string[]> = {
+	user_profiles: ["project_id", "user_id"],
+	actions: ["project_id", "id"],
+	agent_runs: ["project_id", "id"],
+	tool_calls: ["project_id", "id"],
+	retrieval_events: ["project_id", "id"],
+	eval_results: ["project_id", "id"],
+	artifacts: ["project_id", "id"],
+	ai_span_payloads: ["project_id", "trace_id", "span_id"],
+	telemetry_spans: ["project_id", "trace_id", "span_id"],
+};
+
+const EXPECTED_INDEXES: Record<string, string[]> = {
+	user_profiles: ["idx_user_visitor", "idx_users_project_last"],
+	actions: [
+		"idx_actions_project_actor",
+		"idx_actions_project_agent_run",
+		"idx_actions_project_interaction",
+		"idx_actions_project_root",
+		"idx_actions_project_trace",
+		"idx_actions_started_at",
+	],
+	agent_runs: ["idx_agent_runs_project_agent"],
+	tool_calls: ["idx_tool_calls_action", "idx_tool_calls_name"],
+	retrieval_events: ["idx_retrieval_events_action"],
+	eval_results: ["idx_eval_results_action"],
+	artifacts: ["idx_artifacts_action"],
+	ai_span_payloads: [
+		"idx_ai_payloads_action",
+		"idx_ai_payloads_kind",
+		"idx_ai_payloads_project",
+		"idx_ai_payloads_received",
+		"idx_ai_payloads_session",
+		"idx_ai_payloads_user",
+	],
+	telemetry_spans: [
+		"idx_spans_interaction",
+		"idx_spans_project_received",
+		"idx_spans_project_service_received",
+		"idx_spans_received_at",
+		"idx_spans_root",
+		"idx_spans_sdk_name",
+		"idx_spans_service",
+		"idx_spans_session",
+		"idx_spans_status",
+		"idx_spans_trace_id",
+		"idx_spans_with_links",
+	],
+};
+
+const span = (over: Partial<StoredSpan>): StoredSpan => ({
+	projectId: "alpha",
+	traceId: "trace-shared",
+	spanId: "span-shared",
+	parentSpanId: null,
+	traceState: null,
+	serviceName: "agent",
+	scopeName: null,
+	scopeVersion: null,
+	spanName: "llm",
+	spanKind: 1,
+	statusCode: 1,
+	statusMessage: null,
+	startTime: NOW,
+	endTime: NOW,
+	durationMs: 5,
+	attributesJson: "{}",
+	droppedAttributesCount: 0,
+	resourceAttributesJson: "{}",
+	eventsJson: "[]",
+	droppedEventsCount: 0,
+	linksJson: "[]",
+	droppedLinksCount: 0,
+	receivedAt: new Date().toISOString(),
+	expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+	sessionId: null,
+	interactionId: null,
+	...over,
+});
+
+const aiSpan = (projectId: string, input: string): StoredSpan =>
+	span({
+		projectId,
+		attributesJson: JSON.stringify({
+			"openinference.span.kind": "LLM",
+			"ai.payload.input": input,
+			"ai.payload.output": `${input}-output`,
+		}),
+	});
+
+const runPayloadProcessor = async (db: NodeSqliteDb, spans: StoredSpan[]) => {
+	const processors: SpanProcessorPlugin[] = [];
+	aiSpanPayloadsProcessorPlugin.register(
+		{} as Parameters<typeof aiSpanPayloadsProcessorPlugin.register>[0],
+		{
+			addSpanProcessor(p: SpanProcessorPlugin) {
+				processors.push(p);
+			},
+		} as unknown as CollectorRuntime,
+	);
+	const process = processors[0]?.process;
+	if (!process) throw new Error("span processor was not registered");
+	return process(spans, {
+		env: { DB: db, OBS_PAYLOAD_CAPTURE_DEFAULT: "true" },
+		now: new Date(),
+		logger: { ...console, error: () => {} },
+	} as unknown as CollectorRouteContext);
+};
+
+const identifyApp = () => {
+	const setProject: MiddlewareHandler<{
+		Bindings: CollectorEnv;
+		Variables: { projectId: string };
+	}> = async (c, next) => {
+		const header = c.req.header("x-project-id");
+		if (header) c.set("projectId", header);
+		await next();
+	};
+	return createTelemetryCollectorApp({
+		plugins: [identityReceiverPlugin],
+		auth: { middleware: setProject },
+		dashboardAuth: { middleware: setProject, registerRoutes: () => {} },
+	});
+};
+
+const identify = (
+	app: ReturnType<typeof identifyApp>,
+	db: NodeSqliteDb,
+	projectId: string,
+	body: Record<string, unknown>,
+) =>
+	app.request(
+		"/v1/identify",
+		{
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-project-id": projectId,
+			},
+			body: JSON.stringify(body),
+		},
+		{ DB: db as unknown as D1Database } as CollectorEnv,
+	);
+
+describe("migrations 045–048 (project-scoped composite keys)", () => {
+	it("rebuild each table in place, keeping rows, defaults and indexes", async () => {
+		const db = createMigratedSqliteDb({ upTo: "044" });
+		const raw = db.raw;
+
+		// Legacy rows written under the old global keys (project_id defaults
+		// to 'default' on user_profiles / telemetry_spans).
+		raw.exec(`
+			INSERT INTO user_profiles (user_id, visitor_id, email, first_seen_at, last_seen_at)
+			VALUES ('ada@example.com', 'vis-1', 'ada@example.com', '${NOW}', '${NOW}');
+			INSERT INTO actions (id, project_id, root_action_id, actor_type, action_kind, started_at)
+			VALUES ('01ACTION', 'alpha', '01ACTION', 'agent', 'agent.run', '${NOW}');
+			INSERT INTO agent_runs (id, project_id, agent_id, agent_name, agent_version, autonomy_level)
+			VALUES ('01ACTION', 'alpha', 'bot', 'Bot', '1', 'read_only');
+			INSERT INTO tool_calls (id, action_id, project_id, tool_name, args_hash, result_hash, mutation_diff_json)
+			VALUES ('span-1', '01ACTION', 'alpha', 'sql_query', 'a', 'r', '{"diff":true}');
+			INSERT INTO retrieval_events (id, action_id, project_id, retriever_name, query_hash)
+			VALUES ('span-2', '01ACTION', 'alpha', 'vector', 'q');
+			INSERT INTO eval_results (id, action_id, project_id, evaluator_name, evaluator_version, score)
+			VALUES ('span-3', '01ACTION', 'alpha', 'groundedness', '1', 0.9);
+			INSERT INTO artifacts (id, action_id, project_id, artifact_name, artifact_type)
+			VALUES ('span-4', '01ACTION', 'alpha', 'invoice', 'file');
+			INSERT INTO ai_span_payloads (project_id, trace_id, span_id, span_kind, input_json, received_at, expires_at, input_hash, action_id)
+			VALUES ('alpha', 't1', 's1', 'LLM', '"prompt"', '${NOW}', '${LATER}', 'hash', '01ACTION');
+			INSERT INTO telemetry_spans (trace_id, span_id, span_name, start_time, end_time, duration_ms, received_at, expires_at, telemetry_sdk_name)
+			VALUES ('t1', 's1', 'llm', '${NOW}', '${NOW}', 5, '${NOW}', '${LATER}', 'beyla');
+		`);
+
+		const applied = applySqliteMigrations(raw, { from: "045", upTo: "048" });
+		expect(applied.map((f) => f.slice(0, 3))).toEqual([
+			"045",
+			"046",
+			"047",
+			"048",
+		]);
+
+		for (const [table, key] of Object.entries(EXPECTED_KEYS)) {
+			expect(primaryKeyColumns(raw, table), table).toEqual(key);
+			expect(indexNames(raw, table), table).toEqual(EXPECTED_INDEXES[table]);
+			expect(
+				raw.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get(),
+				table,
+			).toEqual({ n: 1 });
+			expect(
+				raw
+					.prepare(`SELECT name FROM sqlite_master WHERE name = ?`)
+					.get(`${table}_new`),
+				`${table}_new left behind`,
+			).toBeUndefined();
+		}
+
+		expect(
+			raw.prepare(`SELECT project_id, email FROM user_profiles`).get(),
+		).toEqual({ project_id: "default", email: "ada@example.com" });
+		expect(
+			raw
+				.prepare(
+					`SELECT project_id, status, mutation_diff_json, side_effect FROM tool_calls JOIN actions USING (project_id)`,
+				)
+				.get(),
+		).toEqual({
+			project_id: "alpha",
+			status: "ok",
+			mutation_diff_json: '{"diff":true}',
+			side_effect: 0,
+		});
+		expect(
+			raw
+				.prepare(
+					`SELECT project_id, telemetry_sdk_name, dropped_links_count FROM telemetry_spans`,
+				)
+				.get(),
+		).toEqual({
+			project_id: "default",
+			telemetry_sdk_name: "beyla",
+			dropped_links_count: 0,
+		});
+		expect(
+			raw.prepare(`SELECT input_hash, action_id FROM ai_span_payloads`).get(),
+		).toEqual({ input_hash: "hash", action_id: "01ACTION" });
+
+		// Re-applying the rebuild files is a no-op in effect.
+		applySqliteMigrations(raw, { from: "045" });
+		for (const [table, key] of Object.entries(EXPECTED_KEYS)) {
+			expect(primaryKeyColumns(raw, table), table).toEqual(key);
+			expect(
+				raw.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get(),
+				table,
+			).toEqual({ n: 1 });
+		}
+		db.close();
+	});
+});
+
+describe("tenant isolation on project-scoped keys", () => {
+	it("/v1/identify keeps one profile per project for the same userId", async () => {
+		const db = createMigratedSqliteDb();
+		const app = identifyApp();
+		const userId = "ada@example.com";
+
+		const alpha = await identify(app, db, "alpha", {
+			userId,
+			visitorId: "vis-alpha",
+			email: userId,
+			name: "Ada (alpha)",
+			properties: { plan: "alpha-plan" },
+		});
+		expect(alpha.status).toBe(200);
+		const beta = await identify(app, db, "beta", {
+			userId,
+			visitorId: "vis-beta",
+			name: "Ada (beta)",
+		});
+		expect(beta.status).toBe(200);
+
+		const rows = await db
+			.prepare(
+				`SELECT project_id, visitor_id, email, name, properties_json
+				 FROM user_profiles WHERE user_id = ? ORDER BY project_id`,
+			)
+			.bind(userId)
+			.all();
+		expect(rows.results).toEqual([
+			{
+				project_id: "alpha",
+				visitor_id: "vis-alpha",
+				email: userId,
+				name: "Ada (alpha)",
+				properties_json: JSON.stringify({ plan: "alpha-plan" }),
+			},
+			{
+				project_id: "beta",
+				visitor_id: "vis-beta",
+				email: null,
+				name: "Ada (beta)",
+				properties_json: null,
+			},
+		]);
+
+		// A repeat identify from beta updates beta only.
+		await identify(app, db, "beta", { userId, visitorId: "vis-beta-2" });
+		const visitors = await db
+			.prepare(
+				`SELECT project_id, visitor_id FROM user_profiles WHERE user_id = ? ORDER BY project_id`,
+			)
+			.bind(userId)
+			.all();
+		expect(visitors.results).toEqual([
+			{ project_id: "alpha", visitor_id: "vis-alpha" },
+			{ project_id: "beta", visitor_id: "vis-beta-2" },
+		]);
+
+		// The identity index resolves the visitor inside the caller's project.
+		const alphaCalls = db.raw.prepare(
+			`INSERT INTO usage_events (project_id, event_id, session_id, visitor_id, event_type, event_name, context_json, properties_json, occurred_at, received_at, expires_at)
+			 VALUES (?, ?, ?, ?, 'page_view', 'page_view', '{}', '{}', ?, ?, ?)`,
+		);
+		alphaCalls.run("alpha", "evt-a", "sess-a", "vis-alpha", NOW, NOW, LATER);
+		alphaCalls.run("beta", "evt-b", "sess-b", "vis-beta-2", NOW, NOW, LATER);
+		const alphaManifest = await manifestByUser(db, "alpha", userId);
+		const betaManifest = await manifestByUser(db, "beta", userId);
+		expect(alphaManifest.usageEvents.map((e) => e.sessionId)).toEqual([
+			"sess-a",
+		]);
+		expect(betaManifest.usageEvents.map((e) => e.sessionId)).toEqual([
+			"sess-b",
+		]);
+		db.close();
+	});
+
+	it("ActionStore keeps the same action id separate per project", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new ActionStore(db);
+		await store.upsertAction(
+			actionRecord({ id: "01SHARED", projectId: "alpha", name: "alpha run" }),
+		);
+		await store.upsertAction(
+			actionRecord({ id: "01SHARED", projectId: "beta", name: "beta run" }),
+		);
+		// A second write from beta must not reach alpha.
+		await store.upsertAction(
+			actionRecord({ id: "01SHARED", projectId: "beta", name: "beta run v2" }),
+		);
+
+		expect((await store.getAction("alpha", "01SHARED"))?.name).toBe(
+			"alpha run",
+		);
+		expect((await store.getAction("beta", "01SHARED"))?.name).toBe(
+			"beta run v2",
+		);
+		const count = await db
+			.prepare(`SELECT COUNT(*) AS n FROM actions WHERE id = ?`)
+			.bind("01SHARED")
+			.first<{ n: number }>();
+		expect(count?.n).toBe(2);
+		db.close();
+	});
+
+	it("AI span payloads with identical trace/span ids stay with their project", async () => {
+		const db = createMigratedSqliteDb();
+		await runPayloadProcessor(db, [aiSpan("alpha", "alpha prompt")]);
+		await runPayloadProcessor(db, [aiSpan("beta", "beta prompt")]);
+		await runPayloadProcessor(db, [aiSpan("beta", "beta prompt v2")]);
+
+		const rows = await db
+			.prepare(
+				`SELECT project_id, input_json FROM ai_span_payloads
+				 WHERE trace_id = ? AND span_id = ? ORDER BY project_id`,
+			)
+			.bind("trace-shared", "span-shared")
+			.all<{ project_id: string; input_json: string }>();
+		expect(rows.results).toEqual([
+			{ project_id: "alpha", input_json: "alpha prompt" },
+			{ project_id: "beta", input_json: "beta prompt v2" },
+		]);
+		db.close();
+	});
+
+	it("span ingest keeps colliding ids per project and the AI span join stays in-project", async () => {
+		const db = createMigratedSqliteDb();
+		const alphaSpan = span({ projectId: "alpha", spanName: "alpha-llm" });
+		const betaSpan = span({ projectId: "beta", spanName: "beta-llm" });
+		await ingestTelemetrySpans(db, [alphaSpan]);
+		// Previously INSERT OR IGNORE dropped this row: same (trace_id, span_id).
+		await ingestTelemetrySpans(db, [betaSpan]);
+
+		const names = await db
+			.prepare(
+				`SELECT project_id, span_name FROM telemetry_spans
+				 WHERE trace_id = ? AND span_id = ? ORDER BY project_id`,
+			)
+			.bind("trace-shared", "span-shared")
+			.all();
+		expect(names.results).toEqual([
+			{ project_id: "alpha", span_name: "alpha-llm" },
+			{ project_id: "beta", span_name: "beta-llm" },
+		]);
+
+		// Only alpha has a payload row; beta's span must not be joined to it.
+		await runPayloadProcessor(db, [aiSpan("alpha", "alpha prompt")]);
+		const alpha = await getAISpansOverview(db, {
+			projectId: "alpha",
+			hours: 24,
+		});
+		const beta = await getAISpansOverview(db, {
+			projectId: "beta",
+			hours: 24,
+		});
+		expect(alpha.spans.map((s) => s.spanName)).toEqual(["alpha-llm"]);
+		expect(beta.spans).toEqual([]);
+		db.close();
+	});
+});

package/src/migrations-postgres/009_projects_and_keys.sql

@@ -10,10 +10,10 @@ CREATE INDEX IF NOT EXISTS idx_projects_slug ON projects (slug);
 CREATE TABLE IF NOT EXISTS ingest_keys (
   id TEXT PRIMARY KEY,
   project_id TEXT NOT NULL,
-  -- D1 used TEXT for the bcrypt hash. Postgres stores it as BYTEA so
-  -- the column-comparison code in ingest-auth.ts (constant-time
-  -- compare via bytes) doesn't pay a UTF-8 decode cost on every check.
-  key_hash BYTEA NOT NULL UNIQUE,
+  -- SHA-256 hex digest of the plaintext key, exactly as D1 stores it.
+  -- ProjectsStore binds the hex string, so the column must be TEXT; an
+  -- earlier BYTEA version is converted by 041_ingest_key_hash_text.sql.
+  key_hash TEXT NOT NULL UNIQUE,
   key_prefix TEXT NOT NULL,
   name TEXT NOT NULL,
   created_at TEXT NOT NULL,

package/src/migrations-postgres/026_obs_dashboard_project_seed.sql

@@ -6,7 +6,7 @@ INSERT INTO ingest_keys (id, project_id, key_hash, key_prefix, name, created_at)
 VALUES (
   'obs-dashboard-bootstrap',
   'obs-dashboard',
-  decode('6aa18dc1261b312e98b236d5a7dae698d1a90ecbe33d8024744063a066a35b9b', 'hex'),
+  '6aa18dc1261b312e98b236d5a7dae698d1a90ecbe33d8024744063a066a35b9b',
   'obs_dashboard_65',
   'bootstrap',
   now()::text

package/src/migrations-postgres/035_metric_exemplars.sql

@@ -15,8 +15,11 @@ CREATE TABLE IF NOT EXISTS metric_exemplars (
   span_id TEXT,
   ts_ns TEXT NOT NULL,
   value DOUBLE PRECISION NOT NULL,
-  received_at TIMESTAMPTZ NOT NULL,
-  expires_at TIMESTAMPTZ NOT NULL
+  -- TEXT ISO timestamps like every other retention table; see
+  -- 043_metric_exemplars_text_timestamps.sql for databases that were
+  -- created with the earlier TIMESTAMPTZ version of this file.
+  received_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL
 );
 
 CREATE INDEX IF NOT EXISTS idx_metric_exemplars_project_trace

package/src/migrations-postgres/041_ingest_key_hash_text.sql

@@ -0,0 +1,32 @@
+-- Convert ingest_keys.key_hash from BYTEA to TEXT on databases migrated
+-- before 009 was corrected.
+--
+-- ProjectsStore binds the SHA-256 digest as a hex string. Against a BYTEA
+-- column Postgres parsed that string as escape-format bytes, so:
+--   * keys created by the collector (bootstrap INGEST_KEY, minted keys)
+--     were stored as the 64 ASCII bytes of the hex text;
+--   * the obs-dashboard seed in 026 used decode(..., 'hex') and stored the
+--     32 raw digest bytes, which never matched a lookup.
+-- Both shapes are mapped back to the 64-char lowercase hex digest here.
+-- Fresh installs already create the column as TEXT and this is a no-op.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'ingest_keys'
+      AND column_name = 'key_hash'
+      AND data_type = 'bytea'
+  ) THEN
+    ALTER TABLE ingest_keys
+      ALTER COLUMN key_hash TYPE TEXT
+      USING (
+        CASE
+          WHEN octet_length(key_hash) = 32 THEN encode(key_hash, 'hex')
+          ELSE convert_from(key_hash, 'UTF8')
+        END
+      );
+  END IF;
+END
+$$;

package/src/migrations-postgres/042_session_replay_project_composite_pk.sql

@@ -0,0 +1,16 @@
+-- Migration 042: session replay composite primary key (project_id, session_id)
+--
+-- Fixes cross-project session replay metadata collisions. Previously,
+-- session_replay_metadata used session_id alone as primary key while
+-- project_id was added in migration 010. Replay receiver upserts used
+-- ON CONFLICT(session_id), causing identical session IDs from different
+-- projects to overwrite or increment each other.
+--
+-- This forward migration drops the existing single-column primary key constraint
+-- and establishes PRIMARY KEY (project_id, session_id) while preserving all
+-- existing rows and indexes.
+
+UPDATE session_replay_metadata SET project_id = 'default' WHERE project_id IS NULL;
+ALTER TABLE session_replay_metadata ALTER COLUMN project_id SET NOT NULL;
+ALTER TABLE session_replay_metadata DROP CONSTRAINT IF EXISTS session_replay_metadata_pkey;
+ALTER TABLE session_replay_metadata ADD PRIMARY KEY (project_id, session_id);

package/src/migrations-postgres/043_metric_exemplars_text_timestamps.sql

@@ -0,0 +1,47 @@
+-- Convert metric_exemplars.received_at / expires_at from TIMESTAMPTZ to TEXT
+-- on databases migrated with the original Postgres 035.
+--
+-- Every other retention table stores timestamps as TEXT holding
+-- Date#toISOString() output, and postgresDialect renders now() as ISO text
+-- (to_char(..., 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')). Against TIMESTAMPTZ
+-- columns MetricsStore.purgeExpired failed with
+--   operator does not exist: timestamp with time zone < text
+-- so metric exemplars were never purged on Postgres.
+--
+-- Existing rows are preserved: each value is rendered in UTC in the exact
+-- shape the collector writes (millisecond precision, trailing "Z"), so the
+-- converted text compares correctly against freshly ingested rows and the
+-- dialect's now(). idx_metric_exemplars_expires is rebuilt by Postgres as
+-- part of the type change.
+--
+-- Fresh installs already create both columns as TEXT in 035 and this is a
+-- no-op. Re-running is also a no-op.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'metric_exemplars'
+      AND column_name = 'received_at'
+      AND data_type = 'timestamp with time zone'
+  ) THEN
+    ALTER TABLE metric_exemplars
+      ALTER COLUMN received_at TYPE TEXT
+      USING to_char(received_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"');
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'metric_exemplars'
+      AND column_name = 'expires_at'
+      AND data_type = 'timestamp with time zone'
+  ) THEN
+    ALTER TABLE metric_exemplars
+      ALTER COLUMN expires_at TYPE TEXT
+      USING to_char(expires_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"');
+  END IF;
+END
+$$;

package/src/migrations-postgres/044_actions_started_at_index.sql

@@ -0,0 +1,8 @@
+-- RFC 0010 — action graph retention.
+--
+-- Mirrors ../migrations/044_actions_started_at_index.sql. `started_at` is
+-- ISO-8601 TEXT on both backends, so the retention sweep compares it against
+-- a text cutoff rendered the same way `postgresDialect.sinceHours` does.
+
+CREATE INDEX IF NOT EXISTS idx_actions_started_at
+  ON actions (started_at);

package/src/migrations-postgres/045_user_profiles_project_composite_pk.sql

@@ -0,0 +1,33 @@
+-- Migration 045: user_profiles composite primary key (project_id, user_id)
+--
+-- Mirrors ../migrations/045_user_profiles_project_composite_pk.sql. The 006
+-- table used `user_id TEXT PRIMARY KEY`; 010 added project_id outside the
+-- key, so /v1/identify's ON CONFLICT(user_id) upsert let one project rewrite
+-- another project's profile. Swaps the key for (project_id, user_id) in
+-- place, keeping every row and index. The old key was unique, so the
+-- composite key cannot collide.
+--
+-- Idempotent: the block looks up the current primary key by definition and
+-- does nothing when it is already (project_id, user_id).
+
+UPDATE user_profiles SET project_id = 'default' WHERE project_id IS NULL;
+ALTER TABLE user_profiles ALTER COLUMN project_id SET NOT NULL;
+
+DO $$
+DECLARE
+  pk_name TEXT;
+  pk_def TEXT;
+BEGIN
+  SELECT c.conname, pg_get_constraintdef(c.oid)
+    INTO pk_name, pk_def
+    FROM pg_constraint c
+   WHERE c.conrelid = 'user_profiles'::regclass AND c.contype = 'p';
+
+  IF pk_def IS DISTINCT FROM 'PRIMARY KEY (project_id, user_id)' THEN
+    IF pk_name IS NOT NULL THEN
+      EXECUTE format('ALTER TABLE user_profiles DROP CONSTRAINT %I', pk_name);
+    END IF;
+    ALTER TABLE user_profiles ADD PRIMARY KEY (project_id, user_id);
+  END IF;
+END
+$$;

package/src/migrations-postgres/046_action_graph_project_composite_pk.sql

@@ -0,0 +1,39 @@
+-- Migration 046: action graph tables keyed by (project_id, id)
+--
+-- Mirrors ../migrations/046_action_graph_project_composite_pk.sql. The 031
+-- spine and leaf tables used `id TEXT PRIMARY KEY`; action ids are
+-- client-supplied and leaf ids are raw OTel span ids, so two projects can
+-- emit the same id and the ON CONFLICT(id) upserts let one tenant overwrite
+-- another's row. Swaps each key for (project_id, id) in place, keeping every
+-- row and index (031, 038, 044). The old keys were unique, so the composite
+-- keys cannot collide.
+--
+-- Idempotent: each table is skipped when its primary key is already
+-- (project_id, id).
+
+DO $$
+DECLARE
+  t TEXT;
+  pk_name TEXT;
+  pk_def TEXT;
+BEGIN
+  FOREACH t IN ARRAY ARRAY[
+    'actions', 'agent_runs', 'tool_calls', 'retrieval_events',
+    'eval_results', 'artifacts'
+  ] LOOP
+    pk_name := NULL;
+    pk_def := NULL;
+    SELECT c.conname, pg_get_constraintdef(c.oid)
+      INTO pk_name, pk_def
+      FROM pg_constraint c
+     WHERE c.conrelid = t::regclass AND c.contype = 'p';
+
+    IF pk_def IS DISTINCT FROM 'PRIMARY KEY (project_id, id)' THEN
+      IF pk_name IS NOT NULL THEN
+        EXECUTE format('ALTER TABLE %I DROP CONSTRAINT %I', t, pk_name);
+      END IF;
+      EXECUTE format('ALTER TABLE %I ADD PRIMARY KEY (project_id, id)', t);
+    END IF;
+  END LOOP;
+END
+$$;

package/src/migrations-postgres/047_ai_span_payloads_project_composite_pk.sql

@@ -0,0 +1,30 @@
+-- Migration 047: ai_span_payloads composite primary key
+-- (project_id, trace_id, span_id)
+--
+-- Mirrors ../migrations/047_ai_span_payloads_project_composite_pk.sql. 019
+-- keyed the payload side table by (trace_id, span_id) only; the processor's
+-- ON CONFLICT(trace_id, span_id) upsert let a second project replace the
+-- first project's prompt/completion payloads. Swaps the key for
+-- (project_id, trace_id, span_id) in place, keeping every row and index.
+-- The old key was unique, so the composite key cannot collide.
+--
+-- Idempotent: does nothing when the key is already composite.
+
+DO $$
+DECLARE
+  pk_name TEXT;
+  pk_def TEXT;
+BEGIN
+  SELECT c.conname, pg_get_constraintdef(c.oid)
+    INTO pk_name, pk_def
+    FROM pg_constraint c
+   WHERE c.conrelid = 'ai_span_payloads'::regclass AND c.contype = 'p';
+
+  IF pk_def IS DISTINCT FROM 'PRIMARY KEY (project_id, trace_id, span_id)' THEN
+    IF pk_name IS NOT NULL THEN
+      EXECUTE format('ALTER TABLE ai_span_payloads DROP CONSTRAINT %I', pk_name);
+    END IF;
+    ALTER TABLE ai_span_payloads ADD PRIMARY KEY (project_id, trace_id, span_id);
+  END IF;
+END
+$$;