@oneuptime/common 11.4.1 → 11.5.1

package/Server/Infrastructure/Postgres/SchemaMigrations/1783730000000-AddNetworkDeviceOwnersAndRules.ts

@@ -0,0 +1,192 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddNetworkDeviceOwnersAndRules1783730000000
+  implements MigrationInterface
+{
+  public name = "AddNetworkDeviceOwnersAndRules1783730000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    // --- NetworkDeviceOwnerTeam ---
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceOwnerTeam" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "teamId" uuid NOT NULL, "networkDeviceId" uuid NOT NULL, "isOwnerNotified" boolean NOT NULL DEFAULT false, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_device_owner_team_id" PRIMARY KEY ("_id"))`,
+    );
+    for (const column of [
+      "projectId",
+      "teamId",
+      "networkDeviceId",
+      "isOwnerNotified",
+    ]) {
+      await queryRunner.query(
+        `CREATE INDEX "IDX_network_device_owner_team_${column}" ON "NetworkDeviceOwnerTeam" ("${column}")`,
+      );
+    }
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerTeam" ADD CONSTRAINT "FK_nd_owner_team_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerTeam" ADD CONSTRAINT "FK_nd_owner_team_teamId" FOREIGN KEY ("teamId") REFERENCES "Team"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerTeam" ADD CONSTRAINT "FK_nd_owner_team_networkDeviceId" FOREIGN KEY ("networkDeviceId") REFERENCES "NetworkDevice"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerTeam" ADD CONSTRAINT "FK_nd_owner_team_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerTeam" ADD CONSTRAINT "FK_nd_owner_team_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    // --- NetworkDeviceOwnerUser ---
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceOwnerUser" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "networkDeviceId" uuid NOT NULL, "isOwnerNotified" boolean NOT NULL DEFAULT false, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_device_owner_user_id" PRIMARY KEY ("_id"))`,
+    );
+    for (const column of [
+      "projectId",
+      "userId",
+      "networkDeviceId",
+      "isOwnerNotified",
+    ]) {
+      await queryRunner.query(
+        `CREATE INDEX "IDX_network_device_owner_user_${column}" ON "NetworkDeviceOwnerUser" ("${column}")`,
+      );
+    }
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerUser" ADD CONSTRAINT "FK_nd_owner_user_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerUser" ADD CONSTRAINT "FK_nd_owner_user_userId" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerUser" ADD CONSTRAINT "FK_nd_owner_user_networkDeviceId" FOREIGN KEY ("networkDeviceId") REFERENCES "NetworkDevice"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerUser" ADD CONSTRAINT "FK_nd_owner_user_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerUser" ADD CONSTRAINT "FK_nd_owner_user_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    // --- NetworkDeviceOwnerRule ---
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceOwnerRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "isEnabled" boolean NOT NULL DEFAULT true, "notifyOwners" boolean NOT NULL DEFAULT true, "networkDeviceNamePattern" character varying(500), "networkDeviceDescriptionPattern" character varying(500), "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_device_owner_rule_id" PRIMARY KEY ("_id"))`,
+    );
+    for (const column of ["projectId", "name", "isEnabled"]) {
+      await queryRunner.query(
+        `CREATE INDEX "IDX_network_device_owner_rule_${column}" ON "NetworkDeviceOwnerRule" ("${column}")`,
+      );
+    }
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerRule" ADD CONSTRAINT "FK_nd_owner_rule_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerRule" ADD CONSTRAINT "FK_nd_owner_rule_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOwnerRule" ADD CONSTRAINT "FK_nd_owner_rule_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    // OwnerRule join tables
+    const ownerRuleJoins: Array<{
+      table: string;
+      column: string;
+      refTable: string;
+    }> = [
+      {
+        table: "NetworkDeviceOwnerRuleNetworkDeviceLabel",
+        column: "labelId",
+        refTable: "Label",
+      },
+      {
+        table: "NetworkDeviceOwnerRuleOwnerUser",
+        column: "userId",
+        refTable: "User",
+      },
+      {
+        table: "NetworkDeviceOwnerRuleOwnerTeam",
+        column: "teamId",
+        refTable: "Team",
+      },
+    ];
+
+    for (const join of ownerRuleJoins) {
+      await queryRunner.query(
+        `CREATE TABLE "${join.table}" ("networkDeviceOwnerRuleId" uuid NOT NULL, "${join.column}" uuid NOT NULL, CONSTRAINT "PK_${join.table}" PRIMARY KEY ("networkDeviceOwnerRuleId", "${join.column}"))`,
+      );
+      await queryRunner.query(
+        `CREATE INDEX "IDX_${join.table}_ruleId" ON "${join.table}" ("networkDeviceOwnerRuleId")`,
+      );
+      await queryRunner.query(
+        `CREATE INDEX "IDX_${join.table}_${join.column}" ON "${join.table}" ("${join.column}")`,
+      );
+      await queryRunner.query(
+        `ALTER TABLE "${join.table}" ADD CONSTRAINT "FK_${join.table}_ruleId" FOREIGN KEY ("networkDeviceOwnerRuleId") REFERENCES "NetworkDeviceOwnerRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+      );
+      await queryRunner.query(
+        `ALTER TABLE "${join.table}" ADD CONSTRAINT "FK_${join.table}_${join.column}" FOREIGN KEY ("${join.column}") REFERENCES "${join.refTable}"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+      );
+    }
+
+    // --- NetworkDeviceLabelRule ---
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceLabelRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "isEnabled" boolean NOT NULL DEFAULT true, "networkDeviceNamePattern" character varying(500), "networkDeviceDescriptionPattern" character varying(500), "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_device_label_rule_id" PRIMARY KEY ("_id"))`,
+    );
+    for (const column of ["projectId", "name", "isEnabled"]) {
+      await queryRunner.query(
+        `CREATE INDEX "IDX_network_device_label_rule_${column}" ON "NetworkDeviceLabelRule" ("${column}")`,
+      );
+    }
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLabelRule" ADD CONSTRAINT "FK_nd_label_rule_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLabelRule" ADD CONSTRAINT "FK_nd_label_rule_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLabelRule" ADD CONSTRAINT "FK_nd_label_rule_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    // LabelRule join tables
+    for (const table of [
+      "NetworkDeviceLabelRuleNetworkDeviceLabel",
+      "NetworkDeviceLabelRuleLabelToAdd",
+    ]) {
+      await queryRunner.query(
+        `CREATE TABLE "${table}" ("networkDeviceLabelRuleId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_${table}" PRIMARY KEY ("networkDeviceLabelRuleId", "labelId"))`,
+      );
+      await queryRunner.query(
+        `CREATE INDEX "IDX_${table}_ruleId" ON "${table}" ("networkDeviceLabelRuleId")`,
+      );
+      await queryRunner.query(
+        `CREATE INDEX "IDX_${table}_labelId" ON "${table}" ("labelId")`,
+      );
+      await queryRunner.query(
+        `ALTER TABLE "${table}" ADD CONSTRAINT "FK_${table}_ruleId" FOREIGN KEY ("networkDeviceLabelRuleId") REFERENCES "NetworkDeviceLabelRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+      );
+      await queryRunner.query(
+        `ALTER TABLE "${table}" ADD CONSTRAINT "FK_${table}_labelId" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+      );
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP TABLE IF EXISTS "NetworkDeviceLabelRuleLabelToAdd"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE IF EXISTS "NetworkDeviceLabelRuleNetworkDeviceLabel"`,
+    );
+    await queryRunner.query(`DROP TABLE IF EXISTS "NetworkDeviceLabelRule"`);
+    await queryRunner.query(
+      `DROP TABLE IF EXISTS "NetworkDeviceOwnerRuleOwnerTeam"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE IF EXISTS "NetworkDeviceOwnerRuleOwnerUser"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE IF EXISTS "NetworkDeviceOwnerRuleNetworkDeviceLabel"`,
+    );
+    await queryRunner.query(`DROP TABLE IF EXISTS "NetworkDeviceOwnerRule"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "NetworkDeviceOwnerUser"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "NetworkDeviceOwnerTeam"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783740000000-AddNetworkDeviceDiscoveryScan.ts

@@ -0,0 +1,37 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddNetworkDeviceDiscoveryScan1783740000000
+  implements MigrationInterface
+{
+  public name = "AddNetworkDeviceDiscoveryScan1783740000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceDiscoveryScan" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "probeId" uuid NOT NULL, "cidr" character varying(100) NOT NULL, "snmpVersion" character varying(100) DEFAULT '2c', "snmpCommunityString" character varying(100), "snmpPort" integer DEFAULT '161', "status" character varying(100) NOT NULL DEFAULT 'Pending', "statusMessage" character varying(500), "discoveredDevices" jsonb, "scannedHostCount" integer, "respondedHostCount" integer, "startedAt" TIMESTAMP WITH TIME ZONE, "completedAt" TIMESTAMP WITH TIME ZONE, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_device_discovery_scan_id" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_discovery_scan_projectId" ON "NetworkDeviceDiscoveryScan" ("projectId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_discovery_scan_probeId_status" ON "NetworkDeviceDiscoveryScan" ("probeId", "status")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD CONSTRAINT "FK_nd_discovery_scan_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD CONSTRAINT "FK_nd_discovery_scan_probeId" FOREIGN KEY ("probeId") REFERENCES "Probe"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD CONSTRAINT "FK_nd_discovery_scan_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD CONSTRAINT "FK_nd_discovery_scan_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP TABLE IF EXISTS "NetworkDeviceDiscoveryScan"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783750000000-AddLldpNeighborsToNetworkDevice.ts

@@ -0,0 +1,19 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddLldpNeighborsToNetworkDevice1783750000000
+  implements MigrationInterface
+{
+  public name = "AddLldpNeighborsToNetworkDevice1783750000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "lldpNeighbors" jsonb`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "lldpNeighbors"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783760576655-AddInvestigationTuningToProject.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddInvestigationTuningToProject1783760576655
+  implements MigrationInterface
+{
+  public name = "AddInvestigationTuningToProject1783760576655";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "alertInvestigationDedupeWindowMinutes" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "aiMaxConcurrentInvestigations" integer`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "aiMaxConcurrentInvestigations"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "alertInvestigationDedupeWindowMinutes"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783762505482-AddTelemetryEntityRelationshipMetrics.ts

@@ -0,0 +1,31 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddTelemetryEntityRelationshipMetrics1783762505482
+  implements MigrationInterface
+{
+  public name = "AddTelemetryEntityRelationshipMetrics1783762505482";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" ADD "callCount" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" ADD "errorCount" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" ADD "avgDurationMs" integer`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" DROP COLUMN "avgDurationMs"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" DROP COLUMN "errorCount"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" DROP COLUMN "callCount"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783780000000-AddIoTDeviceCredentialTable.ts

@@ -0,0 +1,79 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * IoT device registry + per-device MQTT credentials. Registered
+ * devices get individual authentication (credential id as MQTT
+ * username, secretKey as password), topic isolation, revocation, and
+ * silent-death offline detection (registered devices survive the
+ * stale-inventory cleanup and get absent-series injection in IoT
+ * Device monitors).
+ */
+export class AddIoTDeviceCredentialTable1783780000000
+  implements MigrationInterface
+{
+  public name = "AddIoTDeviceCredentialTable1783780000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "IoTDeviceCredential" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "iotFleetId" uuid NOT NULL, "externalId" character varying(100) NOT NULL, "name" character varying(100), "isEnabled" boolean NOT NULL DEFAULT true, "lastConnectedAt" TIMESTAMP WITH TIME ZONE, "createdByUserId" uuid, "deletedByUserId" uuid, "secretKey" uuid NOT NULL, CONSTRAINT "PK_iot_device_credential_id" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_iot_device_credential_projectId" ON "IoTDeviceCredential" ("projectId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_iot_device_credential_iotFleetId" ON "IoTDeviceCredential" ("iotFleetId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_iot_device_credential_externalId" ON "IoTDeviceCredential" ("externalId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_iot_device_credential_secretKey" ON "IoTDeviceCredential" ("secretKey")`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_iot_device_credential_fleet_externalId" ON "IoTDeviceCredential" ("projectId", "iotFleetId", "externalId")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" ADD CONSTRAINT "FK_iot_device_credential_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" ADD CONSTRAINT "FK_iot_device_credential_iotFleetId" FOREIGN KEY ("iotFleetId") REFERENCES "IoTFleet"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" ADD CONSTRAINT "FK_iot_device_credential_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" ADD CONSTRAINT "FK_iot_device_credential_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" DROP CONSTRAINT "FK_iot_device_credential_deletedByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" DROP CONSTRAINT "FK_iot_device_credential_createdByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" DROP CONSTRAINT "FK_iot_device_credential_iotFleetId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IoTDeviceCredential" DROP CONSTRAINT "FK_iot_device_credential_projectId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_iot_device_credential_fleet_externalId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_iot_device_credential_secretKey"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_iot_device_credential_externalId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_iot_device_credential_iotFleetId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_iot_device_credential_projectId"`,
+    );
+    await queryRunner.query(`DROP TABLE "IoTDeviceCredential"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1783790000000-AddSnmpV3AuthColumnsToNetworkDevice.ts

@@ -0,0 +1,49 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddSnmpV3AuthColumnsToNetworkDevice1783790000000
+  implements MigrationInterface
+{
+  public name = "AddSnmpV3AuthColumnsToNetworkDevice1783790000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "snmpV3SecurityLevel" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "snmpV3Username" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "snmpV3AuthProtocol" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "snmpV3AuthKey" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "snmpV3PrivProtocol" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "snmpV3PrivKey" text`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "snmpV3PrivKey"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "snmpV3PrivProtocol"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "snmpV3AuthKey"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "snmpV3AuthProtocol"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "snmpV3Username"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "snmpV3SecurityLevel"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -420,6 +420,19 @@ import { AddMigrationFailureTable1783523076215 } from "./1783523076215-AddMigrat
 import { AddEnableAutomaticIncidentInvestigationToProject1783598145111 } from "./1783598145111-AddEnableAutomaticIncidentInvestigationToProject";
 import { AddInvestigationSubjectToAIRun1783615884106 } from "./1783615884106-AddInvestigationSubjectToAIRun";
 import { AddEnableAutomaticAlertInvestigationToProject1783632447975 } from "./1783632447975-AddEnableAutomaticAlertInvestigationToProject";
+import { AddCacheTokenColumnsToLlmLog1783695782697 } from "./1783695782697-AddCacheTokenColumnsToLlmLog";
+import { AddAlertInvestigationGating1783701585317 } from "./1783701585317-AddAlertInvestigationGating";
+import { AddAiDailyAutonomousTokenLimitToProject1783702431535 } from "./1783702431535-AddAiDailyAutonomousTokenLimitToProject";
+import { AddNetworkDeviceTables1783720000000 } from "./1783720000000-AddNetworkDeviceTables";
+import { AddNetworkDeviceOwnersAndRules1783730000000 } from "./1783730000000-AddNetworkDeviceOwnersAndRules";
+import { AddNetworkDeviceDiscoveryScan1783740000000 } from "./1783740000000-AddNetworkDeviceDiscoveryScan";
+import { AddLldpNeighborsToNetworkDevice1783750000000 } from "./1783750000000-AddLldpNeighborsToNetworkDevice";
+import { AddAttemptCountToAIRun1783721121260 } from "./1783721121260-AddAttemptCountToAIRun";
+import { AddInvestigationTuningToProject1783760576655 } from "./1783760576655-AddInvestigationTuningToProject";
+import { AddTelemetryEntityRelationshipMetrics1783762505482 } from "./1783762505482-AddTelemetryEntityRelationshipMetrics";
+import { AddIoTDeviceCredentialTable1783780000000 } from "./1783780000000-AddIoTDeviceCredentialTable";
+import { AddSnmpV3AuthColumnsToNetworkDevice1783790000000 } from "./1783790000000-AddSnmpV3AuthColumnsToNetworkDevice";
+import { AddAdditionalParamsToLlmProvider1783650000000 } from "./1783650000000-AddAdditionalParamsToLlmProvider";
 
 export default [
   InitialMigration,
@@ -844,4 +857,17 @@ export default [
   AddEnableAutomaticIncidentInvestigationToProject1783598145111,
   AddInvestigationSubjectToAIRun1783615884106,
   AddEnableAutomaticAlertInvestigationToProject1783632447975,
+  AddCacheTokenColumnsToLlmLog1783695782697,
+  AddAlertInvestigationGating1783701585317,
+  AddAiDailyAutonomousTokenLimitToProject1783702431535,
+  AddNetworkDeviceTables1783720000000,
+  AddAttemptCountToAIRun1783721121260,
+  AddNetworkDeviceOwnersAndRules1783730000000,
+  AddNetworkDeviceDiscoveryScan1783740000000,
+  AddLldpNeighborsToNetworkDevice1783750000000,
+  AddInvestigationTuningToProject1783760576655,
+  AddTelemetryEntityRelationshipMetrics1783762505482,
+  AddIoTDeviceCredentialTable1783780000000,
+  AddSnmpV3AuthColumnsToNetworkDevice1783790000000,
+  AddAdditionalParamsToLlmProvider1783650000000
 ];

package/Server/Services/AIRunService.ts

@@ -1,4 +1,6 @@
 import PositiveNumber from "../../Types/PositiveNumber";
+import ObjectID from "../../Types/ObjectID";
+import AIRunStatus from "../../Types/AI/AIRunStatus";
 import CountBy from "../Types/Database/CountBy";
 import FindBy from "../Types/Database/FindBy";
 import { OnFind } from "../Types/Database/Hooks";
@@ -6,12 +8,68 @@ import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/AIRun";
 import { pinQueryToRequestingUser } from "../Utils/AI/AIChatPrivacyFilter";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { UpdateQueryBuilder, UpdateResult } from "typeorm";
+import { QueryDeepPartialEntity } from "typeorm/query-builder/QueryPartialEntity";
+
+/*
+ * The fields a status transition may set. Primitives only — the query-builder
+ * update below bypasses column transformers, so ObjectID fields must not be
+ * set through this path.
+ */
+export interface AIRunTransitionSet {
+  status: AIRunStatus;
+  attemptCount?: number | undefined;
+  startedAt?: Date | undefined;
+  lastHeartbeatAt?: Date | undefined;
+  completedAt?: Date | undefined;
+  errorMessage?: string | undefined;
+  llmCallCount?: number | undefined;
+  toolCallCount?: number | undefined;
+  totalTokens?: number | undefined;
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /*
+   * A genuinely atomic status transition: one conditional UPDATE whose WHERE
+   * carries the expected current status (and optionally the expected
+   * attemptCount). Returns the number of rows changed — 0 means another
+   * actor won the race.
+   *
+   * This exists because updateOneBy is SELECT-then-save: two concurrent
+   * callers can both observe the precondition and both write, so it cannot
+   * implement a claim. The durable investigation queue's exactly-once
+   * guarantee rests on this method.
+   */
+  @CaptureSpan()
+  public async attemptStatusTransition(data: {
+    aiRunId: ObjectID;
+    fromStatus: AIRunStatus;
+    expectedAttemptCount?: number | undefined;
+    set: AIRunTransitionSet;
+  }): Promise<number> {
+    const queryBuilder: UpdateQueryBuilder<Model> = this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set(data.set as QueryDeepPartialEntity<Model>)
+      .where('"_id" = :id', { id: data.aiRunId.toString() })
+      .andWhere('"status" = :fromStatus', { fromStatus: data.fromStatus })
+      .andWhere('"deletedAt" IS NULL');
+
+    if (data.expectedAttemptCount !== undefined) {
+      queryBuilder.andWhere('"attemptCount" = :expectedAttemptCount', {
+        expectedAttemptCount: data.expectedAttemptCount,
+      });
+    }
+
+    const result: UpdateResult = await queryBuilder.execute();
+
+    return result.affected || 0;
+  }
+
   protected override async onBeforeFind(
     findBy: FindBy<Model>,
   ): Promise<OnFind<Model>> {