@oneuptime/common 11.4.0 → 11.5.0

package/Models/DatabaseModels/TelemetryEntityRelationship.ts

@@ -205,6 +205,60 @@ export default class TelemetryEntityRelationship extends DatabaseBaseModel {
   @Column({ type: ColumnType.Date, nullable: true })
   public lastSeenAt?: Date = undefined;
 
+  /*
+   * Traffic metrics for `depends-on` edges, refreshed each run of the
+   * ComputeServiceDependencies cron from the most recent span window
+   * (~15 min). Null on co-occurrence-inferred edges, which carry no
+   * call semantics.
+   */
+  @ColumnAccessControl({
+    create: CREATE_PERMS,
+    read: READ_PERMS,
+    update: UPDATE_PERMS,
+  })
+  @TableColumn({
+    type: TableColumnType.Number,
+    required: false,
+    title: "Call Count",
+    description:
+      "Calls observed over this edge in the most recent computation window (depends-on edges only).",
+    example: "1240",
+  })
+  @Column({ type: ColumnType.Number, nullable: true })
+  public callCount?: number = undefined;
+
+  @ColumnAccessControl({
+    create: CREATE_PERMS,
+    read: READ_PERMS,
+    update: UPDATE_PERMS,
+  })
+  @TableColumn({
+    type: TableColumnType.Number,
+    required: false,
+    title: "Error Count",
+    description:
+      "Errored calls observed over this edge in the most recent computation window (depends-on edges only).",
+    example: "12",
+  })
+  @Column({ type: ColumnType.Number, nullable: true })
+  public errorCount?: number = undefined;
+
+  @ColumnAccessControl({
+    create: CREATE_PERMS,
+    read: READ_PERMS,
+    update: UPDATE_PERMS,
+  })
+  @TableColumn({
+    type: TableColumnType.Number,
+    required: false,
+    title: "Average Duration (ms)",
+    description:
+      "Average call duration in milliseconds over this edge in the most recent computation window (depends-on edges only).",
+    example: "38",
+  })
+  @Column({ type: ColumnType.Number, nullable: true })
+  public avgDurationMs?: number = undefined;
+
   @ColumnAccessControl({ create: CREATE_PERMS, read: READ_PERMS, update: [] })
   @TableColumn({
     manyToOneRelationColumn: "createdByUserId",

package/Server/API/AIAgentTaskAPI.ts

@@ -16,7 +16,6 @@ import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import AIAgentTaskStatus from "../../Types/AI/AIAgentTaskStatus";
-import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import PositiveNumber from "../../Types/PositiveNumber";
 
 export default class AIAgentTaskAPI extends BaseAPI<
@@ -27,8 +26,10 @@ export default class AIAgentTaskAPI extends BaseAPI<
     super(AIAgentTask, AIAgentTaskService);
 
     /*
-     * Get the next pending (scheduled) task for processing
-     * Validates aiAgentId and aiAgentKey before returning task
+     * Claim the next pending (scheduled) task for processing.
+     * Validates aiAgentId and aiAgentKey before claiming. The task is
+     * atomically transitioned Scheduled -> InProgress before it is
+     * returned, so concurrent workers can never receive the same task.
      */
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/get-pending-task`,
@@ -39,7 +40,7 @@ export default class AIAgentTaskAPI extends BaseAPI<
           /* Validate AI Agent credentials */
           const aiAgent: AIAgent | null = await this.validateAIAgent(data);
 
-          if (!aiAgent) {
+          if (!aiAgent || !aiAgent.id) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -47,25 +48,10 @@ export default class AIAgentTaskAPI extends BaseAPI<
             );
           }
 
-          /* Fetch one scheduled task, sorted by createdAt (oldest first) */
-          const task: AIAgentTask | null = await AIAgentTaskService.findOneBy({
-            query: {
-              status: AIAgentTaskStatus.Scheduled,
-            },
-            sort: {
-              createdAt: SortOrder.Ascending,
-            },
-            select: {
-              _id: true,
-              projectId: true,
-              taskType: true,
-              metadata: true,
-              createdAt: true,
-            },
-            props: {
-              isRoot: true,
-            },
-          });
+          const task: AIAgentTask | null =
+            await AIAgentTaskService.claimNextScheduledTask({
+              aiAgentId: aiAgent.id,
+            });
 
           if (!task) {
             return Response.sendJsonObjectResponse(req, res, {
@@ -82,7 +68,7 @@ export default class AIAgentTaskAPI extends BaseAPI<
               metadata: task.metadata as JSONObject | undefined,
               createdAt: task.createdAt,
             },
-            message: "Task fetched successfully",
+            message: "Task claimed successfully",
           });
         } catch (err) {
           next(err);

package/Server/API/AIInvestigationAPI.ts

@@ -12,13 +12,16 @@ import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import Query from "../../Types/BaseDatabase/Query";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIRun from "../../Models/DatabaseModels/AIRun";
 import AIRunEvent from "../../Models/DatabaseModels/AIRunEvent";
 import Incident from "../../Models/DatabaseModels/Incident";
+import Alert from "../../Models/DatabaseModels/Alert";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import IncidentService from "../Services/IncidentService";
+import AlertService from "../Services/AlertService";
 import AIRunService from "../Services/AIRunService";
 import AIRunEventService from "../Services/AIRunEventService";
 
@@ -28,14 +31,96 @@ const MAX_EVENTS: number = 500;
 
 /*
  * Returns the latest Sentinel investigation (the AIRun + its ordered
- * AIRunEvents) for an incident, so the dashboard can render a live "watch it
- * think" panel.
+ * AIRunEvents) for an incident or alert, so the dashboard can render a live
+ * "watch it think" panel.
  *
  * Investigation runs are system-authored (userId = null) and are therefore
  * hidden by the per-user privacy pin on the generic AIRun / AIRunEvent CRUD. So
- * we gate access explicitly here: first confirm the caller can read the incident
- * under THEIR permissions, then read the run + events as root.
+ * we gate access explicitly here: first confirm the caller can read the
+ * incident/alert under THEIR permissions, then read the run + events as root.
  */
+
+async function getLoggedInProps(
+  req: ExpressRequest,
+): Promise<DatabaseCommonInteractionProps> {
+  const props: DatabaseCommonInteractionProps =
+    await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+  if (!props.userId) {
+    throw new NotAuthorizedException("A logged-in user session is required.");
+  }
+
+  return props;
+}
+
+/*
+ * Read the latest investigation run + its events as root (bypasses the
+ * per-user pin) and send them. Callers must have already access-checked the
+ * subject under the USER's permissions.
+ */
+async function sendLatestInvestigation(
+  req: ExpressRequest,
+  res: ExpressResponse,
+  runQuery: Query<AIRun>,
+): Promise<void> {
+  const runs: Array<AIRun> = await AIRunService.findBy({
+    query: runQuery,
+    select: {
+      _id: true,
+      status: true,
+      startedAt: true,
+      completedAt: true,
+      errorMessage: true,
+      llmCallCount: true,
+      toolCallCount: true,
+      totalTokens: true,
+      createdAt: true,
+    },
+    sort: { createdAt: SortOrder.Descending },
+    limit: 1,
+    skip: 0,
+    props: { isRoot: true },
+  });
+
+  const run: AIRun | undefined = runs[0];
+
+  if (!run) {
+    Response.sendJsonObjectResponse(req, res, {
+      run: null,
+      events: [],
+    });
+    return;
+  }
+
+  const events: Array<AIRunEvent> = await AIRunEventService.findBy({
+    query: { aiRunId: run.id! },
+    select: {
+      _id: true,
+      sequence: true,
+      eventType: true,
+      toolName: true,
+      resultSummary: true,
+      createdAt: true,
+    },
+    sort: { sequence: SortOrder.Ascending },
+    limit: MAX_EVENTS,
+    skip: 0,
+    props: { isRoot: true },
+  });
+
+  const runJson: JSONObject | undefined = BaseModel.toJSONArray(
+    [run],
+    AIRun,
+  )[0];
+
+  const eventsJson: JSONArray = BaseModel.toJSONArray(events, AIRunEvent);
+
+  Response.sendJsonObjectResponse(req, res, {
+    run: runJson || null,
+    events: eventsJson,
+  });
+}
+
 router.post(
   "/ai-investigation/incident",
   UserMiddleware.getUserMiddleware,
@@ -45,14 +130,7 @@ router.post(
     next: NextFunction,
   ): Promise<void> => {
     try {
-      const props: DatabaseCommonInteractionProps =
-        await CommonAPI.getDatabaseCommonInteractionProps(req);
-
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "A logged-in user session is required.",
-        );
-      }
+      const props: DatabaseCommonInteractionProps = await getLoggedInProps(req);
 
       const incidentIdString: string | undefined = req.body["incidentId"] as
         | string
@@ -77,65 +155,55 @@ router.post(
         );
       }
 
-      // Read the latest investigation run as root (bypasses the per-user pin).
-      const runs: Array<AIRun> = await AIRunService.findBy({
-        query: {
-          triggeredByIncidentId: incidentId,
-          runType: AIRunType.Investigation,
-        },
-        select: {
-          _id: true,
-          status: true,
-          startedAt: true,
-          completedAt: true,
-          errorMessage: true,
-          llmCallCount: true,
-          toolCallCount: true,
-          totalTokens: true,
-          createdAt: true,
-        },
-        sort: { createdAt: SortOrder.Descending },
-        limit: 1,
-        skip: 0,
-        props: { isRoot: true },
+      await sendLatestInvestigation(req, res, {
+        triggeredByIncidentId: incidentId,
+        runType: AIRunType.Investigation,
       });
+      return;
+    } catch (err) {
+      next(err);
+      return;
+    }
+  },
+);
+
+router.post(
+  "/ai-investigation/alert",
+  UserMiddleware.getUserMiddleware,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const props: DatabaseCommonInteractionProps = await getLoggedInProps(req);
 
-      const run: AIRun | undefined = runs[0];
+      const alertIdString: string | undefined = req.body["alertId"] as
+        | string
+        | undefined;
 
-      if (!run) {
-        Response.sendJsonObjectResponse(req, res, {
-          run: null,
-          events: [],
-        });
-        return;
+      if (!alertIdString) {
+        throw new BadDataException("alertId is required.");
       }
 
-      const events: Array<AIRunEvent> = await AIRunEventService.findBy({
-        query: { aiRunId: run.id! },
-        select: {
-          _id: true,
-          sequence: true,
-          eventType: true,
-          toolName: true,
-          resultSummary: true,
-          createdAt: true,
-        },
-        sort: { sequence: SortOrder.Ascending },
-        limit: MAX_EVENTS,
-        skip: 0,
-        props: { isRoot: true },
-      });
+      const alertId: ObjectID = new ObjectID(alertIdString);
 
-      const runJson: JSONObject | undefined = BaseModel.toJSONArray(
-        [run],
-        AIRun,
-      )[0];
+      // Access check under the USER's permissions (null when not allowed).
+      const alert: Alert | null = await AlertService.findOneById({
+        id: alertId,
+        select: { _id: true },
+        props,
+      });
 
-      const eventsJson: JSONArray = BaseModel.toJSONArray(events, AIRunEvent);
+      if (!alert) {
+        throw new BadDataException(
+          "Alert not found (or you do not have access to it).",
+        );
+      }
 
-      Response.sendJsonObjectResponse(req, res, {
-        run: runJson || null,
-        events: eventsJson,
+      await sendLatestInvestigation(req, res, {
+        triggeredByAlertId: alertId,
+        runType: AIRunType.Investigation,
       });
       return;
     } catch (err) {

package/Server/API/AlertAPI.ts

@@ -123,6 +123,11 @@ export default class AlertAPI extends BaseAPI<Alert, AlertServiceType> {
       messages: aiContext.messages,
       maxTokens: 4096,
       temperature: 0.2,
+      /*
+       * G8: the prompt embeds incident/alert/maintenance context whose read
+       * ACLs are narrower than LlmLog's — do not store previews.
+       */
+      storeContentPreviews: false,
     };
 
     if (props.userId) {

package/Server/API/IncidentAPI.ts

@@ -231,6 +231,11 @@ export default class IncidentAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 8192,
       temperature: 0.2,
+      /*
+       * G8: the prompt embeds incident/alert/maintenance context whose read
+       * ACLs are narrower than LlmLog's — do not store previews.
+       */
+      storeContentPreviews: false,
     };
 
     if (props.userId) {
@@ -348,6 +353,11 @@ export default class IncidentAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 4096,
       temperature: 0.2,
+      /*
+       * G8: the prompt embeds incident/alert/maintenance context whose read
+       * ACLs are narrower than LlmLog's — do not store previews.
+       */
+      storeContentPreviews: false,
     };
 
     if (props.userId) {

package/Server/API/IncidentEpisodeAPI.ts

@@ -134,6 +134,11 @@ export default class IncidentEpisodeAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 8192,
       temperature: 0.2,
+      /*
+       * G8: the prompt embeds incident/alert/maintenance context whose read
+       * ACLs are narrower than LlmLog's — do not store previews.
+       */
+      storeContentPreviews: false,
     };
 
     if (props.userId) {

package/Server/API/LlmProviderAPI.ts

@@ -152,6 +152,7 @@ export default class LlmProviderAPI extends BaseAPI<
                 apiKey: true,
                 baseUrl: true,
                 modelName: true,
+                additionalParams: true,
               },
               props: {
                 isRoot: true,
@@ -191,6 +192,9 @@ export default class LlmProviderAPI extends BaseAPI<
               temperature: 0,
               maxTokens: 16,
               llmProviderConfig: llmProviderConfig,
+              ...(provider.additionalParams
+                ? { additionalParams: provider.additionalParams }
+                : {}),
             });
           } catch (err) {
             logger.error(err);

package/Server/API/ScheduledMaintenanceAPI.ts

@@ -148,6 +148,11 @@ export default class ScheduledMaintenanceAPI extends BaseAPI<
       messages: aiContext.messages,
       maxTokens: 4096,
       temperature: 0.2,
+      /*
+       * G8: the prompt embeds incident/alert/maintenance context whose read
+       * ACLs are narrower than LlmLog's — do not store previews.
+       */
+      storeContentPreviews: false,
     };
 
     if (props.userId) {

package/Server/API/TelemetryAPI.ts

@@ -404,9 +404,10 @@ router.post(
         ? (body["spanIds"] as Array<string>)
         : undefined;
 
-      const attributes: Record<string, string> | undefined = body["attributes"]
-        ? (body["attributes"] as Record<string, string>)
-        : undefined;
+      const attributes: Record<string, string | Array<string>> | undefined =
+        body["attributes"]
+          ? (body["attributes"] as Record<string, string | Array<string>>)
+          : undefined;
 
       const request: HistogramRequest = {
         projectId: databaseProps.tenantId,

package/Server/Infrastructure/Postgres/SchemaMigrations/1783650000000-AddAdditionalParamsToLlmProvider.ts

@@ -0,0 +1,19 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAdditionalParamsToLlmProvider1783650000000
+  implements MigrationInterface
+{
+  public name = "AddAdditionalParamsToLlmProvider1783650000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "LlmProvider" ADD "additionalParams" jsonb`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "LlmProvider" DROP COLUMN "additionalParams"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783695782697-AddCacheTokenColumnsToLlmLog.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddCacheTokenColumnsToLlmLog1783695782697
+  implements MigrationInterface
+{
+  public name = "AddCacheTokenColumnsToLlmLog1783695782697";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "LlmLog" ADD "cachedInputTokens" integer NOT NULL DEFAULT '0'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "LlmLog" ADD "cacheCreationTokens" integer NOT NULL DEFAULT '0'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "LlmLog" DROP COLUMN "cacheCreationTokens"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "LlmLog" DROP COLUMN "cachedInputTokens"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783701585317-AddAlertInvestigationGating.ts

@@ -0,0 +1,31 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAlertInvestigationGating1783701585317
+  implements MigrationInterface
+{
+  public name = "AddAlertInvestigationGating1783701585317";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertInvestigationMinimumSeverityId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD CONSTRAINT "FK_Project_alertInvestigationMinimumSeverityId" FOREIGN KEY ("alertInvestigationMinimumSeverityId") REFERENCES "AlertSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(`ALTER TABLE "AIRun" ADD "monitorId" uuid`);
+    await queryRunner.query(
+      `CREATE INDEX "IDX_AIRun_monitorId" ON "AIRun" ("monitorId")`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP INDEX "IDX_AIRun_monitorId"`);
+    await queryRunner.query(`ALTER TABLE "AIRun" DROP COLUMN "monitorId"`);
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP CONSTRAINT "FK_Project_alertInvestigationMinimumSeverityId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertInvestigationMinimumSeverityId"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783702431535-AddAiDailyAutonomousTokenLimitToProject.ts

@@ -0,0 +1,19 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAiDailyAutonomousTokenLimitToProject1783702431535
+  implements MigrationInterface
+{
+  public name = "AddAiDailyAutonomousTokenLimitToProject1783702431535";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "aiDailyAutonomousTokenLimit" integer`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "aiDailyAutonomousTokenLimit"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783720000000-AddNetworkDeviceTables.ts

@@ -0,0 +1,105 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddNetworkDeviceTables1783720000000 implements MigrationInterface {
+  public name = "AddNetworkDeviceTables1783720000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDevice" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "slug" character varying(100) NOT NULL, "description" character varying(500), "hostname" character varying(100) NOT NULL, "probeId" uuid, "snmpVersion" character varying(100) DEFAULT '2c', "snmpCommunityString" character varying(100), "snmpPort" integer DEFAULT '161', "snmpV3Auth" jsonb, "sysDescr" character varying(500), "sysName" character varying(100), "lastSeenAt" TIMESTAMP WITH TIME ZONE, "interfacesTotal" integer DEFAULT '0', "interfacesUp" integer DEFAULT '0', "interfacesDown" integer DEFAULT '0', "createdByUserId" uuid, "isArchived" boolean NOT NULL DEFAULT false, "archivedAt" TIMESTAMP WITH TIME ZONE, "archivedByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_device_id" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_projectId" ON "NetworkDevice" ("projectId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_projectId_isArchived" ON "NetworkDevice" ("projectId", "isArchived")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_hostname" ON "NetworkDevice" ("hostname")`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_network_device_slug" ON "NetworkDevice" ("slug")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_network_device_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_network_device_probeId" FOREIGN KEY ("probeId") REFERENCES "Probe"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_network_device_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_network_device_archivedByUserId" FOREIGN KEY ("archivedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_network_device_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    // Label join table
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceLabel" ("networkDeviceId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_network_device_label" PRIMARY KEY ("networkDeviceId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_label_networkDeviceId" ON "NetworkDeviceLabel" ("networkDeviceId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_label_labelId" ON "NetworkDeviceLabel" ("labelId")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLabel" ADD CONSTRAINT "FK_network_device_label_networkDeviceId" FOREIGN KEY ("networkDeviceId") REFERENCES "NetworkDevice"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLabel" ADD CONSTRAINT "FK_network_device_label_labelId" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+
+    // Interfaces
+    await queryRunner.query(
+      `CREATE TABLE "NetworkInterface" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "networkDeviceId" uuid NOT NULL, "interfaceIndex" integer NOT NULL, "name" character varying(100) NOT NULL, "alias" character varying(100), "isMonitored" boolean NOT NULL DEFAULT true, "isOperationallyUp" boolean, "isAdministrativelyUp" boolean, "speedInMbps" decimal, "inRateMbps" decimal, "outRateMbps" decimal, "utilizationPercent" decimal, "errorsPerSecond" decimal, "lastSeenAt" TIMESTAMP WITH TIME ZONE, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_interface_id" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_interface_projectId" ON "NetworkInterface" ("projectId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_interface_networkDeviceId" ON "NetworkInterface" ("networkDeviceId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_interface_projectId_networkDeviceId" ON "NetworkInterface" ("projectId", "networkDeviceId")`,
+    );
+    /*
+     * The upsert path looks interfaces up by (device, ifIndex); enforce
+     * uniqueness at the DB level for soft-delete-aware rows.
+     */
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_network_interface_device_ifindex" ON "NetworkInterface" ("networkDeviceId", "interfaceIndex") WHERE "deletedAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkInterface" ADD CONSTRAINT "FK_network_interface_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkInterface" ADD CONSTRAINT "FK_network_interface_networkDeviceId" FOREIGN KEY ("networkDeviceId") REFERENCES "NetworkDevice"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkInterface" ADD CONSTRAINT "FK_network_interface_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkInterface" ADD CONSTRAINT "FK_network_interface_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    /*
+     * SNMP monitor type retirement: the monitor type was replaced by
+     * Network Device monitors backed by NetworkDevice resources. The few
+     * existing SNMP monitors are soft-deleted (customers were notified);
+     * their rows remain recoverable but stop being scheduled or listed.
+     */
+    await queryRunner.query(
+      `UPDATE "Monitor" SET "deletedAt" = now() WHERE "monitorType" = 'SNMP' AND "deletedAt" IS NULL`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TABLE IF EXISTS "NetworkInterface"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "NetworkDeviceLabel"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "NetworkDevice"`);
+    // Soft-deleted SNMP monitors are not restored on rollback.
+  }
+}