@oneuptime/common 10.7.2 → 10.8.1

package/Server/Services/ServiceService.ts

@@ -119,32 +119,119 @@ export class Service extends DatabaseService<Model> {
    * per batch instead of a DB write.
    */
   @CaptureSpan()
-  public async updateLastSeen(serviceId: ObjectID): Promise<void> {
+  public async updateLastSeen(
+    serviceId: ObjectID,
+    extra?: {
+      serviceVersion?: string | undefined;
+      deploymentEnvironment?: string | undefined;
+      serviceNamespace?: string | undefined;
+      runtimeName?: string | undefined;
+      runtimeVersion?: string | undefined;
+      cloudProvider?: string | undefined;
+      cloudPlatform?: string | undefined;
+      cloudRegion?: string | undefined;
+      cloudAccountId?: string | undefined;
+    },
+  ): Promise<void> {
+    /*
+     * Throttle keyed on a fingerprint of the metadata so the steady-state
+     * firehose (the same serviceId re-resolved every batch) costs one
+     * in-memory cache lookup, but a changed attribute (e.g. a new
+     * service.version after a deploy) busts the cache and writes
+     * immediately. With no extras the fingerprint is constant, preserving
+     * the original "refresh lastSeenAt at most once per window" behaviour.
+     */
     const cacheKey: string = serviceId.toString();
+    const fingerprint: string = this.fingerprintLastSeenExtras(extra);
     const cached: string | null = await GlobalCache.getString(
       LAST_SEEN_CACHE_NAMESPACE,
       cacheKey,
     );
 
-    if (cached) {
+    if (cached === fingerprint) {
       return;
     }
 
-    await GlobalCache.setString(LAST_SEEN_CACHE_NAMESPACE, cacheKey, "1", {
-      expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS,
-    });
+    await GlobalCache.setString(
+      LAST_SEEN_CACHE_NAMESPACE,
+      cacheKey,
+      fingerprint,
+      {
+        expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS,
+      },
+    );
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data: any = {
+      lastSeenAt: OneUptimeDate.getCurrentDate(),
+    };
+
+    if (extra?.serviceVersion) {
+      data.serviceVersion = extra.serviceVersion;
+    }
+    if (extra?.deploymentEnvironment) {
+      data.deploymentEnvironment = extra.deploymentEnvironment;
+    }
+    if (extra?.serviceNamespace) {
+      data.serviceNamespace = extra.serviceNamespace;
+    }
+    if (extra?.runtimeName) {
+      data.runtimeName = extra.runtimeName;
+    }
+    if (extra?.runtimeVersion) {
+      data.runtimeVersion = extra.runtimeVersion;
+    }
+    if (extra?.cloudProvider) {
+      data.cloudProvider = extra.cloudProvider;
+    }
+    if (extra?.cloudPlatform) {
+      data.cloudPlatform = extra.cloudPlatform;
+    }
+    if (extra?.cloudRegion) {
+      data.cloudRegion = extra.cloudRegion;
+    }
+    if (extra?.cloudAccountId) {
+      data.cloudAccountId = extra.cloudAccountId;
+    }
 
     await this.updateOneById({
       id: serviceId,
-      data: {
-        lastSeenAt: OneUptimeDate.getCurrentDate(),
-      },
+      data: data,
       props: {
         isRoot: true,
       },
     });
   }
 
+  private fingerprintLastSeenExtras(extra?: {
+    serviceVersion?: string | undefined;
+    deploymentEnvironment?: string | undefined;
+    serviceNamespace?: string | undefined;
+    runtimeName?: string | undefined;
+    runtimeVersion?: string | undefined;
+    cloudProvider?: string | undefined;
+    cloudPlatform?: string | undefined;
+    cloudRegion?: string | undefined;
+    cloudAccountId?: string | undefined;
+  }): string {
+    const normalized: Record<string, string | null> = {
+      serviceVersion: extra?.serviceVersion ?? null,
+      deploymentEnvironment: extra?.deploymentEnvironment ?? null,
+      serviceNamespace: extra?.serviceNamespace ?? null,
+      runtimeName: extra?.runtimeName ?? null,
+      runtimeVersion: extra?.runtimeVersion ?? null,
+      cloudProvider: extra?.cloudProvider ?? null,
+      cloudPlatform: extra?.cloudPlatform ?? null,
+      cloudRegion: extra?.cloudRegion ?? null,
+      cloudAccountId: extra?.cloudAccountId ?? null,
+    };
+
+    return crypto
+      .createHash("sha1")
+      .update(JSON.stringify(normalized))
+      .digest("hex");
+  }
+
   /**
    * Additively attach labels to a telemetry service. Existing labels
    * are never removed — manual labels set via the UI survive ingest.

package/Server/Services/TraceAggregationService.ts

@@ -81,6 +81,9 @@ export class TraceAggregationService {
       ["hostId", ServiceType.Host],
       ["dockerHostId", ServiceType.DockerHost],
       ["kubernetesClusterId", ServiceType.KubernetesCluster],
+      ["serverlessFunctionId", ServiceType.ServerlessFunction],
+      ["cloudResourceId", ServiceType.CloudResource],
+      ["rumApplicationId", ServiceType.RealUserMonitor],
     ]);
   private static readonly ATTRIBUTE_KEY_PATTERN: RegExp = /^[a-zA-Z0-9._:/-]+$/;
   private static readonly MAX_FACET_KEY_LENGTH: number = 256;
@@ -342,6 +345,121 @@ export class TraceAggregationService {
     return result;
   }
 
+  /*
+   * Accurate per-service and per-status counts over the FULL time window,
+   * computed with a real GROUP BY instead of the recent-N sample in
+   * getFacetValuesFromSample(). The sample saturates with whichever service
+   * is chattiest right now, so high-volume services that aren't in the most
+   * recent N root spans read 0 — the "top 1000" symptom. This GROUP BY is
+   * exact regardless of skew.
+   *
+   * It is cheap because it rides the proj_hist_by_minute aggregate projection
+   * (projectId, minute, serviceId, statusCode, isRootSpan -> count): a 1-month
+   * window reads a few thousand pre-aggregated minute rows in single-digit ms
+   * instead of scanning tens of millions of raw spans. Two things are required
+   * for ClickHouse to actually pick that projection, both load-bearing:
+   *   1. The time predicate must be on toStartOfMinute(startTime) — the
+   *      projection's key expression — NOT raw startTime. A raw startTime
+   *      filter references a column the aggregate projection does not store, so
+   *      ClickHouse rejects the projection and full-scans. (Window edges land
+   *      on minute boundaries, consistent with the minute-bucketed histogram.)
+   *   2. Every other predicate must be on a projection column. isRootSpan,
+   *      serviceId and statusCode all are, so the default sidebar load and
+   *      drill-down-by-service stay on the projection. A non-projection filter
+   *      (kind / name / traceId / attributes) transparently falls back to a
+   *      base-table scan — still correct, still bounded by max_execution_time.
+   *
+   * serviceId is intentionally NOT disambiguated by serviceType here. Resource
+   * IDs are globally unique, so a single serviceId -> count map correctly
+   * serves the service / host / docker host / k8s cluster facets once merged
+   * against each Postgres source-of-truth list (a host id never collides with
+   * a service id, so an unrelated entry is simply never looked up). Omitting
+   * the serviceType predicate keeps the query projection-eligible.
+   */
+  @CaptureSpan()
+  public static async getResourceFacetCounts(
+    request: MultiFacetRequest,
+  ): Promise<{
+    serviceCounts: Map<string, number>;
+    statusCounts: Map<string, number>;
+  }> {
+    const statement: Statement = new Statement();
+    statement.append(
+      `SELECT serviceId, statusCode, count() AS cnt FROM ${TraceAggregationService.TABLE_NAME}`,
+    );
+    statement.append(
+      SQL` WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: request.projectId,
+      }} AND toStartOfMinute(startTime) >= toStartOfMinute(${{
+        type: TableColumnType.Date,
+        value: request.startTime,
+      }}) AND toStartOfMinute(startTime) <= toStartOfMinute(${{
+        type: TableColumnType.Date,
+        value: request.endTime,
+      }})`,
+    );
+
+    TraceAggregationService.appendCommonFilters(statement, request);
+
+    statement.append(" GROUP BY serviceId, statusCode");
+
+    /*
+     * Cap runtime below nginx's 60s proxy_read_timeout and explicitly allow
+     * projection use so proj_hist_by_minute is read when eligible (see the
+     * toStartOfMinute note above).
+     */
+    statement.append(
+      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break', optimize_use_projections = 1",
+    );
+
+    const serviceCounts: Map<string, number> = new Map<string, number>();
+    const statusCounts: Map<string, number> = new Map<string, number>();
+
+    const dbResult: Results = await SpanService.executeQuery(statement);
+
+    let rows: Array<JSONObject> = [];
+    try {
+      const response: DbJSONResponse = await dbResult.json<{
+        data?: Array<JSONObject>;
+      }>();
+      rows = response.data || [];
+    } catch {
+      /*
+       * 'break' mode can return truncated JSON on timeout. Degrade to empty
+       * counts — the Postgres resolver still lists every resource (count 0),
+       * which is no worse than the prior transient-failure behavior.
+       */
+      logger.warn(
+        "Resource facet count query returned unparseable response, returning empty counts",
+      );
+      return { serviceCounts, statusCounts };
+    }
+
+    for (const row of rows) {
+      const cnt: number = Number(row["cnt"] || 0);
+
+      const rawServiceId: unknown = row["serviceId"];
+      if (rawServiceId !== undefined && rawServiceId !== null) {
+        const serviceId: string = String(rawServiceId);
+        if (serviceId.length > 0) {
+          serviceCounts.set(
+            serviceId,
+            (serviceCounts.get(serviceId) || 0) + cnt,
+          );
+        }
+      }
+
+      const rawStatusCode: unknown = row["statusCode"];
+      if (rawStatusCode !== undefined && rawStatusCode !== null) {
+        const statusCode: string = String(rawStatusCode);
+        statusCounts.set(statusCode, (statusCounts.get(statusCode) || 0) + cnt);
+      }
+    }
+
+    return { serviceCounts, statusCounts };
+  }
+
   private static mapStatusCodeToSeries(code: number): string {
     if (code === 1) {
       return "ok";
@@ -363,6 +481,15 @@ export class TraceAggregationService {
      * even for multi-week ranges. The outer query then re-buckets the tiny
      * minute-level result to the requested bucket size.
      *
+     * The time window is filtered on toStartOfMinute(startTime) — the
+     * projection's key expression — NOT raw startTime. A raw startTime
+     * predicate references a column the aggregate projection does not store,
+     * so ClickHouse rejects proj_hist_by_minute and full-scans the base table
+     * (verified: 32M rows / ~220ms vs 1.5K rows / ~6ms with this form). The
+     * window edges round to the minute, which is consistent with the
+     * minute-bucketed output and only shifts the first/last bucket by the
+     * partial boundary minute when the range is not minute-aligned.
+     *
      * If any non-projection filter (kind, name, traceId, nameSearchText,
      * attributes) is active, ClickHouse transparently falls back to
      * scanning the main table for the inner query — same cost as before.
@@ -385,14 +512,14 @@ export class TraceAggregationService {
           type: TableColumnType.ObjectID,
           value: request.projectId,
         }}
-          AND startTime >= ${{
+          AND toStartOfMinute(startTime) >= toStartOfMinute(${{
             type: TableColumnType.Date,
             value: request.startTime,
-          }}
-          AND startTime <= ${{
+          }})
+          AND toStartOfMinute(startTime) <= toStartOfMinute(${{
             type: TableColumnType.Date,
             value: request.endTime,
-          }}
+          }})
     `;
 
     TraceAggregationService.appendCommonFilters(statement, request);

package/Server/Types/Database/Permissions/OwnerTableRegistry.ts

@@ -20,6 +20,12 @@ import DockerHostOwnerTeamService from "../../../Services/DockerHostOwnerTeamSer
 import DockerHostOwnerUserService from "../../../Services/DockerHostOwnerUserService";
 import KubernetesClusterOwnerTeamService from "../../../Services/KubernetesClusterOwnerTeamService";
 import KubernetesClusterOwnerUserService from "../../../Services/KubernetesClusterOwnerUserService";
+import ServerlessFunctionOwnerTeamService from "../../../Services/ServerlessFunctionOwnerTeamService";
+import ServerlessFunctionOwnerUserService from "../../../Services/ServerlessFunctionOwnerUserService";
+import CloudResourceOwnerTeamService from "../../../Services/CloudResourceOwnerTeamService";
+import CloudResourceOwnerUserService from "../../../Services/CloudResourceOwnerUserService";
+import RumApplicationOwnerTeamService from "../../../Services/RumApplicationOwnerTeamService";
+import RumApplicationOwnerUserService from "../../../Services/RumApplicationOwnerUserService";
 import StatusPageOwnerTeamService from "../../../Services/StatusPageOwnerTeamService";
 import StatusPageOwnerUserService from "../../../Services/StatusPageOwnerUserService";
 import WorkflowOwnerTeamService from "../../../Services/WorkflowOwnerTeamService";
@@ -35,6 +41,9 @@ import MonitorService from "../../../Services/MonitorService";
 import HostService from "../../../Services/HostService";
 import DockerHostService from "../../../Services/DockerHostService";
 import KubernetesClusterService from "../../../Services/KubernetesClusterService";
+import ServerlessFunctionService from "../../../Services/ServerlessFunctionService";
+import CloudResourceService from "../../../Services/CloudResourceService";
+import RumApplicationService from "../../../Services/RumApplicationService";
 
 /*
  * Maps an operational model name (e.g. "Monitor") to the two services that
@@ -180,6 +189,36 @@ const ownerTableRegistry: Map<string, OwnerTablePair> = new Map<
       modelService: KubernetesClusterService,
     },
   ],
+  [
+    "ServerlessFunction",
+    {
+      ownerUserService: ServerlessFunctionOwnerUserService,
+      ownerTeamService: ServerlessFunctionOwnerTeamService,
+      fkColumn: "serverlessFunctionId",
+      canOwnTelemetry: true,
+      modelService: ServerlessFunctionService,
+    },
+  ],
+  [
+    "CloudResource",
+    {
+      ownerUserService: CloudResourceOwnerUserService,
+      ownerTeamService: CloudResourceOwnerTeamService,
+      fkColumn: "cloudResourceId",
+      canOwnTelemetry: true,
+      modelService: CloudResourceService,
+    },
+  ],
+  [
+    "RumApplication",
+    {
+      ownerUserService: RumApplicationOwnerUserService,
+      ownerTeamService: RumApplicationOwnerTeamService,
+      fkColumn: "rumApplicationId",
+      canOwnTelemetry: true,
+      modelService: RumApplicationService,
+    },
+  ],
   [
     "Workflow",
     {

package/Server/Types/Workflow/ComponentCode.ts

@@ -38,6 +38,15 @@ export interface RunOptions {
 export interface RunReturnType {
   returnValues: JSONObject;
   executePort?: Port | undefined;
+  /**
+   * When set to a positive number of milliseconds, the workflow runner will
+   * suspend execution AFTER this component (the components connected to
+   * `executePort` are scheduled but not run inline). The run is persisted and
+   * a delayed job re-enqueues it once the duration elapses, at which point it
+   * resumes from where it left off. Used by the Sleep component to implement a
+   * durable delay that does not block a worker.
+   */
+  suspendForMs?: number | undefined;
 }
 
 export default class ComponentCode {

package/Server/Types/Workflow/Components/Index.ts

@@ -28,6 +28,7 @@ import ManualTrigger from "./Manual";
 import MicrosoftTeamsSendMessageToChannel from "./MicrosoftTeams/SendMessageToChannel";
 import Schedule from "./Schedule";
 import SlackSendMessageToChannel from "./Slack/SendMessageToChannel";
+import Sleep from "./Sleep";
 import TelegramSendMessageToChat from "./Telegram/SendMessageToChat";
 import WebhookTrigger from "./Webhook";
 import ExecuteWorkflow from "./Workflow";
@@ -59,6 +60,7 @@ const Components: Dictionary<ComponentCode> = {
   [ComponentID.SendEmail]: new Email(),
   [ComponentID.IfElse]: new IfElse(),
   [ComponentID.WorkflowRun]: new ExecuteWorkflow(),
+  [ComponentID.Sleep]: new Sleep(),
 };
 
 for (const baseModelService of Services) {

package/Server/Types/Workflow/Components/Sleep.ts

@@ -0,0 +1,105 @@
+import ComponentCode, { RunOptions, RunReturnType } from "../ComponentCode";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../../Types/JSON";
+import ComponentMetadata, { Port } from "../../../../Types/Workflow/Component";
+import ComponentID from "../../../../Types/Workflow/ComponentID";
+import SleepComponents from "../../../../Types/Workflow/Components/Sleep";
+import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+
+/**
+ * Maximum duration a single Sleep component may suspend for. Bounds how far in
+ * the future a delayed resume job can be parked.
+ */
+export const MAX_SLEEP_IN_MS: number = 30 * 24 * 60 * 60 * 1000; // 30 days
+
+export default class Sleep extends ComponentCode {
+  public constructor() {
+    super();
+
+    const SleepComponent: ComponentMetadata | undefined = SleepComponents.find(
+      (i: ComponentMetadata) => {
+        return i.id === ComponentID.Sleep;
+      },
+    );
+
+    if (!SleepComponent) {
+      throw new BadDataException("Component not found.");
+    }
+
+    this.setMetadata(SleepComponent);
+  }
+
+  /**
+   * Coerce a workflow argument (which may arrive as a string from the form, a
+   * number, or null) into a non-negative integer. Invalid / negative values
+   * are treated as 0.
+   */
+  private toNonNegativeNumber(value: unknown): number {
+    const parsed: number =
+      typeof value === "number" ? value : parseFloat(value as string);
+
+    if (isNaN(parsed) || !isFinite(parsed) || parsed < 0) {
+      return 0;
+    }
+
+    return parsed;
+  }
+
+  @CaptureSpan()
+  public override async run(
+    args: JSONObject,
+    options: RunOptions,
+  ): Promise<RunReturnType> {
+    const outPort: Port | undefined = this.getMetadata().outPorts.find(
+      (p: Port) => {
+        return p.id === "out";
+      },
+    );
+
+    if (!outPort) {
+      throw options.onError(new BadDataException("Out port not found"));
+    }
+
+    const days: number = this.toNonNegativeNumber(args["days"]);
+    const hours: number = this.toNonNegativeNumber(args["hours"]);
+    const minutes: number = this.toNonNegativeNumber(args["minutes"]);
+    const seconds: number = this.toNonNegativeNumber(args["seconds"]);
+
+    let sleepForMs: number =
+      days * 24 * 60 * 60 * 1000 +
+      hours * 60 * 60 * 1000 +
+      minutes * 60 * 1000 +
+      seconds * 1000;
+
+    sleepForMs = Math.round(sleepForMs);
+
+    if (sleepForMs > MAX_SLEEP_IN_MS) {
+      options.log(
+        `Requested sleep of ${sleepForMs}ms exceeds the maximum of ${MAX_SLEEP_IN_MS}ms. Clamping to the maximum.`,
+      );
+      sleepForMs = MAX_SLEEP_IN_MS;
+    }
+
+    if (sleepForMs <= 0) {
+      // Nothing to sleep for — behave as a pass-through.
+      options.log(
+        "Sleep duration is zero. Continuing to the next step immediately.",
+      );
+
+      return Promise.resolve({
+        returnValues: {},
+        executePort: outPort,
+      });
+    }
+
+    options.log(
+      `Workflow will sleep for ${sleepForMs}ms and then continue to the next step.`,
+    );
+
+    return Promise.resolve({
+      returnValues: {},
+      executePort: outPort,
+      suspendForMs: sleepForMs,
+    });
+  }
+}

package/Server/Types/Workflow/Workflow.ts

@@ -6,6 +6,12 @@ export interface RunProps {
   workflowId: ObjectID;
   workflowLogId: ObjectID | null;
   timeout: number;
+  /**
+   * True when this run is resuming a previously-suspended workflow (e.g. after
+   * a Sleep step). The runner rehydrates execution state from the WorkflowLog's
+   * `resumeData` instead of starting from the trigger.
+   */
+  isResume?: boolean;
   /**
    * Chain of ancestor workflow IDs that led to this run, oldest first.
    * Empty / undefined for top-level runs. Used by the Execute Workflow

package/Server/Utils/Telemetry/ResourceFacetResolver.ts

@@ -6,10 +6,16 @@ import ServiceModel from "../../../Models/DatabaseModels/Service";
 import HostModel from "../../../Models/DatabaseModels/Host";
 import DockerHostModel from "../../../Models/DatabaseModels/DockerHost";
 import KubernetesClusterModel from "../../../Models/DatabaseModels/KubernetesCluster";
+import ServerlessFunctionModel from "../../../Models/DatabaseModels/ServerlessFunction";
+import CloudResourceModel from "../../../Models/DatabaseModels/CloudResource";
+import RumApplicationModel from "../../../Models/DatabaseModels/RumApplication";
 import ServiceService from "../../Services/ServiceService";
 import HostService from "../../Services/HostService";
 import DockerHostService from "../../Services/DockerHostService";
 import KubernetesClusterService from "../../Services/KubernetesClusterService";
+import ServerlessFunctionService from "../../Services/ServerlessFunctionService";
+import CloudResourceService from "../../Services/CloudResourceService";
+import RumApplicationService from "../../Services/RumApplicationService";
 import CaptureSpan from "./CaptureSpan";
 
 /*
@@ -25,6 +31,9 @@ export const RESOURCE_FACET_KEYS: ReadonlySet<string> = new Set([
   "hostId",
   "dockerHostId",
   "kubernetesClusterId",
+  "serverlessFunctionId",
+  "cloudResourceId",
+  "rumApplicationId",
 ]);
 
 export interface ResourceFacetSpec {
@@ -111,6 +120,27 @@ export default class ResourceFacetResolver {
           searchText,
           limit,
         );
+      case "serverlessFunctionId":
+        return ResourceFacetResolver.queryServerlessFunctions(
+          projectId,
+          spec.counts,
+          searchText,
+          limit,
+        );
+      case "cloudResourceId":
+        return ResourceFacetResolver.queryCloudResources(
+          projectId,
+          spec.counts,
+          searchText,
+          limit,
+        );
+      case "rumApplicationId":
+        return ResourceFacetResolver.queryRumApplications(
+          projectId,
+          spec.counts,
+          searchText,
+          limit,
+        );
       default:
         return [];
     }
@@ -265,6 +295,126 @@ export default class ResourceFacetResolver {
     );
   }
 
+  private static async queryServerlessFunctions(
+    projectId: ObjectID,
+    counts: Map<string, number>,
+    searchText: string | undefined,
+    limit: number,
+  ): Promise<Array<ResolvedFacetValue>> {
+    const query: Record<string, unknown> = { projectId };
+    if (searchText) {
+      query["name"] = new MultiSearch({
+        fields: ["name", "functionIdentifier"],
+        value: searchText,
+      });
+    }
+
+    const functions: Array<ServerlessFunctionModel> =
+      await ServerlessFunctionService.findBy({
+        query: query as any,
+        select: {
+          _id: true,
+          name: true,
+          functionIdentifier: true,
+        },
+        limit: new PositiveNumber(limit),
+        skip: new PositiveNumber(0),
+        props: { isRoot: true },
+      });
+
+    return ResourceFacetResolver.mergeCounts(
+      functions.map(
+        (f: ServerlessFunctionModel): { id: string; displayName: string } => {
+          return {
+            id: f._id ? f._id.toString() : "",
+            displayName: f.name || f.functionIdentifier || "Unknown",
+          };
+        },
+      ),
+      counts,
+    );
+  }
+
+  private static async queryCloudResources(
+    projectId: ObjectID,
+    counts: Map<string, number>,
+    searchText: string | undefined,
+    limit: number,
+  ): Promise<Array<ResolvedFacetValue>> {
+    const query: Record<string, unknown> = { projectId };
+    if (searchText) {
+      query["name"] = new MultiSearch({
+        fields: ["name", "resourceIdentifier"],
+        value: searchText,
+      });
+    }
+
+    const resources: Array<CloudResourceModel> =
+      await CloudResourceService.findBy({
+        query: query as any,
+        select: {
+          _id: true,
+          name: true,
+          resourceIdentifier: true,
+        },
+        limit: new PositiveNumber(limit),
+        skip: new PositiveNumber(0),
+        props: { isRoot: true },
+      });
+
+    return ResourceFacetResolver.mergeCounts(
+      resources.map(
+        (r: CloudResourceModel): { id: string; displayName: string } => {
+          return {
+            id: r._id ? r._id.toString() : "",
+            displayName: r.name || r.resourceIdentifier || "Unknown",
+          };
+        },
+      ),
+      counts,
+    );
+  }
+
+  private static async queryRumApplications(
+    projectId: ObjectID,
+    counts: Map<string, number>,
+    searchText: string | undefined,
+    limit: number,
+  ): Promise<Array<ResolvedFacetValue>> {
+    const query: Record<string, unknown> = { projectId };
+    if (searchText) {
+      query["name"] = new MultiSearch({
+        fields: ["name", "appIdentifier"],
+        value: searchText,
+      });
+    }
+
+    const apps: Array<RumApplicationModel> =
+      await RumApplicationService.findBy({
+        query: query as any,
+        select: {
+          _id: true,
+          name: true,
+          appIdentifier: true,
+        },
+        limit: new PositiveNumber(limit),
+        skip: new PositiveNumber(0),
+        props: { isRoot: true },
+      });
+
+    return ResourceFacetResolver.mergeCounts(
+      apps.map(
+        (a: RumApplicationModel): { id: string; displayName: string } => {
+          return {
+            id: a._id ? a._id.toString() : "",
+            displayName: a.name || a.appIdentifier || "Unknown",
+          };
+        },
+      ),
+      counts,
+    );
+  }
+
   /*
    * Combine Postgres-sourced entities with counts from the ClickHouse sample.
    * Entities without a count default to 0 (they exist in the project but