@oneuptime/common 11.5.12 → 11.6.0

package/Server/API/EnterpriseLicenseAPI.ts

@@ -5,6 +5,7 @@ import { JSONObject } from "../../Types/JSON";
 import PartialEntity from "../../Types/Database/PartialEntity";
 import EnterpriseLicenseInstanceSummary from "../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
 import EnterpriseLicenseUsageUtil from "../../Utils/EnterpriseLicense/EnterpriseLicenseUsage";
+import VersionUtil from "../../Utils/VersionUtil";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
@@ -29,6 +30,8 @@ export interface LicenseInstanceUpsert {
   licenseId: ObjectID;
   instanceId: string;
   host: string | undefined;
+  // OneUptime version the instance is running. Absent on instances too old to report it.
+  oneuptimeVersion?: string | null | undefined;
   // Usage fields are only set on report-user-count, not on validate.
   userCount?: number | undefined;
   userEmailHashes?: Array<string> | undefined;
@@ -84,6 +87,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
                 userLimit: true,
                 currentUserCount: true,
                 userCountUpdatedAt: true,
+                isEvaluationLicense: true,
               },
               props: {
                 isRoot: true,
@@ -117,12 +121,16 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
             req.body["instanceId"],
           );
           const instanceHost: string = this.parseShortText(req.body["host"]);
+          const instanceVersion: string | null | undefined = this.parseVersion(
+            req.body["version"],
+          );
 
           if (instanceId) {
             await this.upsertLicenseInstance({
               licenseId: license.id!,
               instanceId: instanceId,
               host: instanceHost || undefined,
+              oneuptimeVersion: instanceVersion,
             });
           }
 
@@ -154,6 +162,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
             userCountUpdatedAt: license.userCountUpdatedAt
               ? license.userCountUpdatedAt.toISOString()
               : null,
+            isEvaluationLicense: Boolean(license.isEvaluationLicense),
             instances: this.getInstanceSummaries(instances),
             token,
           });
@@ -196,6 +205,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
               select: {
                 _id: true,
                 userLimit: true,
+                isEvaluationLicense: true,
               },
               props: {
                 isRoot: true,
@@ -212,6 +222,9 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
             req.body["instanceId"],
           );
           const instanceHost: string = this.parseShortText(req.body["host"]);
+          const instanceVersion: string | null | undefined = this.parseVersion(
+            req.body["version"],
+          );
           const userEmailHashes: Array<string> =
             EnterpriseLicenseUsageUtil.sanitizeUserEmailHashes(
               req.body["userEmailHashes"],
@@ -230,6 +243,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
               licenseId: license.id!,
               instanceId: instanceId,
               host: instanceHost || undefined,
+              oneuptimeVersion: instanceVersion,
               userCount: userCount,
               userEmailHashes: userEmailHashes,
               masterAdminEmails: masterAdminEmails,
@@ -273,6 +287,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
             userCountUpdatedAt: reportedAt.toISOString(),
             userLimit:
               typeof license.userLimit === "number" ? license.userLimit : null,
+            isEvaluationLicense: Boolean(license.isEvaluationLicense),
             instances: this.getInstanceSummaries(instances),
           });
         } catch (err) {
@@ -290,6 +305,31 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
     return value.trim().substring(0, 100);
   }
 
+  /*
+   * report-user-count is unauthenticated, so the reported version is only
+   * stored when it is a version we could actually compare against a release —
+   * garbage never reaches the admin dashboard or the customer's modal.
+   *
+   * Three outcomes, and the callers depend on the distinction:
+   *   undefined — the instance sent no version at all (it predates this
+   *               field). Leave whatever is stored alone.
+   *   null      — it sent something, but not a version. Clear the stored
+   *               value, so an instance rolled back to a build with no
+   *               APP_VERSION stops advertising the version it used to run.
+   *   string    — a valid, canonical version to store.
+   */
+  private parseVersion(value: unknown): string | null | undefined {
+    if (value === undefined || value === null) {
+      return undefined;
+    }
+
+    /*
+     * Canonicalized rather than passed through, so the stored string is never
+     * something the UIs would render with a doubled "v".
+     */
+    return VersionUtil.canonicalize(value);
+  }
+
   private async findLicenseInstances(
     licenseId: ObjectID,
   ): Promise<Array<EnterpriseLicenseInstance>> {
@@ -304,6 +344,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
         userCount: true,
         userEmailHashes: true,
         lastReportedAt: true,
+        oneuptimeVersion: true,
       },
       sort: {
         createdAt: SortOrder.Ascending,
@@ -331,6 +372,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
           lastReportedAt: instance.lastReportedAt
             ? instance.lastReportedAt.toISOString()
             : null,
+          version: instance.oneuptimeVersion || null,
         };
       },
     );
@@ -370,6 +412,11 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
       newInstance.host = data.host;
     }
 
+    // Null means "reported something that is not a version" — nothing to store.
+    if (data.oneuptimeVersion) {
+      newInstance.oneuptimeVersion = data.oneuptimeVersion;
+    }
+
     if (data.userCount !== undefined) {
       newInstance.userCount = data.userCount;
     }
@@ -434,6 +481,16 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
       updateData.host = data.host;
     }
 
+    /*
+     * Null clears the column: an instance rebuilt onto a build with no
+     * APP_VERSION must stop advertising the version it used to run, because
+     * lastReportedAt is refreshed on the same request and would otherwise
+     * read as "confirmed running v11.5.13 as of today".
+     */
+    if (data.oneuptimeVersion !== undefined) {
+      updateData.oneuptimeVersion = data.oneuptimeVersion;
+    }
+
     if (data.userCount !== undefined) {
       updateData.userCount = data.userCount;
     }

package/Server/API/GlobalConfigAPI.ts

@@ -17,8 +17,14 @@ import API from "../../Utils/API";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../Types/API/HTTPResponse";
 import PartialEntity from "../../Types/Database/PartialEntity";
-import { EnterpriseLicenseValidationUrl, Host } from "../EnvironmentConfig";
+import {
+  AppVersion,
+  DisableUpdateCheck,
+  EnterpriseLicenseValidationUrl,
+  Host,
+} from "../EnvironmentConfig";
 import EnterpriseLicenseInstanceSummary from "../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
+import VersionUtil from "../../Utils/VersionUtil";
 import UserMiddleware from "../Middleware/UserAuthorization";
 
 export default class GlobalConfigAPI extends BaseAPI<
@@ -67,11 +73,15 @@ export default class GlobalConfigAPI extends BaseAPI<
                 enterpriseLicenseExpiresAt: true,
                 enterpriseLicenseKey: true,
                 enterpriseLicenseToken: true,
+                enterpriseLicenseIsEvaluation: true,
                 enterpriseLicenseUserLimit: true,
                 enterpriseLicenseCurrentUserCount: true,
                 enterpriseLicenseUserCountUpdatedAt: true,
                 enterpriseLicenseInstances: true,
                 instanceId: true,
+                latestReleaseVersion: true,
+                latestReleasePublishedAt: true,
+                latestReleaseCheckedAt: true,
               },
               props: {
                 isRoot: true,
@@ -106,6 +116,12 @@ export default class GlobalConfigAPI extends BaseAPI<
               ? config?.enterpriseLicenseToken || null
               : null,
             licenseValid: licenseValid,
+            /*
+             * Whether this is an evaluation/testing license. Benign like the
+             * company name and expiry, so it is not gated behind sign-in — the
+             * edition modal shows the evaluation notice to anyone who opens it.
+             */
+            isEvaluationLicense: Boolean(config?.enterpriseLicenseIsEvaluation),
             userLimit:
               typeof config?.enterpriseLicenseUserLimit === "number"
                 ? config.enterpriseLicenseUserLimit
@@ -126,6 +142,38 @@ export default class GlobalConfigAPI extends BaseAPI<
               isAuthenticatedUser && config?.instanceId
                 ? config.instanceId.toString()
                 : null,
+            /*
+             * Which build this installation runs, and whether a newer one has
+             * been released, are gated the same way as the instance topology:
+             * telling an anonymous visitor on the login page that this server
+             * is behind on patches advertises an unpatched target.
+             */
+            currentVersion: isAuthenticatedUser ? AppVersion : null,
+            latestVersion: isAuthenticatedUser
+              ? config?.latestReleaseVersion || null
+              : null,
+            latestVersionPublishedAt:
+              isAuthenticatedUser && config?.latestReleasePublishedAt
+                ? config.latestReleasePublishedAt.toISOString()
+                : null,
+            latestVersionCheckedAt:
+              isAuthenticatedUser && config?.latestReleaseCheckedAt
+                ? config.latestReleaseCheckedAt.toISOString()
+                : null,
+            isUpdateAvailable: isAuthenticatedUser
+              ? VersionUtil.isUpdateAvailable({
+                  currentVersion: AppVersion,
+                  latestVersion: config?.latestReleaseVersion,
+                })
+              : false,
+            /*
+             * Lets the modal say "update checks are off" instead of "has not
+             * checked yet", which would be a promise the installation is never
+             * going to keep.
+             */
+            isUpdateCheckDisabled: isAuthenticatedUser
+              ? DisableUpdateCheck
+              : false,
           };
 
           return Response.sendJsonObjectResponse(req, res, responseBody);
@@ -179,6 +227,12 @@ export default class GlobalConfigAPI extends BaseAPI<
               licenseKey,
               instanceId: instanceId.toString(),
               host: Host,
+              /*
+               * Sent here as well as from the daily report job so the version
+               * lands on the license server the moment the key is validated,
+               * rather than up to 24 hours later.
+               */
+              version: AppVersion,
             },
           });
 
@@ -239,6 +293,9 @@ export default class GlobalConfigAPI extends BaseAPI<
             }
           }
 
+          const isEvaluationLicense: boolean =
+            payload["isEvaluationLicense"] === true;
+
           const instances: Array<EnterpriseLicenseInstanceSummary> =
             Array.isArray(payload["instances"])
               ? (payload[
@@ -251,6 +308,7 @@ export default class GlobalConfigAPI extends BaseAPI<
             enterpriseLicenseKey: licenseKeyRaw || null,
             enterpriseLicenseExpiresAt: licenseExpiry || null,
             enterpriseLicenseToken: licenseToken || null,
+            enterpriseLicenseIsEvaluation: isEvaluationLicense,
             enterpriseLicenseUserLimit: userLimit,
             enterpriseLicenseCurrentUserCount: currentUserCount,
             enterpriseLicenseUserCountUpdatedAt: userCountUpdatedAt,
@@ -287,6 +345,8 @@ export default class GlobalConfigAPI extends BaseAPI<
               newConfig.enterpriseLicenseToken = licenseToken;
             }
 
+            newConfig.enterpriseLicenseIsEvaluation = isEvaluationLicense;
+
             if (licenseExpiry) {
               newConfig.enterpriseLicenseExpiresAt = licenseExpiry;
             }
@@ -321,6 +381,7 @@ export default class GlobalConfigAPI extends BaseAPI<
             expiresAt: licenseExpiry ? licenseExpiry.toISOString() : null,
             licenseKey: licenseKeyRaw || null,
             token: licenseToken || null,
+            isEvaluationLicense: isEvaluationLicense,
             userLimit: userLimit,
             currentUserCount: currentUserCount,
             userCountUpdatedAt: userCountUpdatedAt

package/Server/EnvironmentConfig.ts

@@ -665,6 +665,14 @@ export const IpWhitelist: string = process.env["IP_WHITELIST"] || "";
 export const DisableTelemetry: boolean =
   process.env["DISABLE_TELEMETRY"] === "true";
 
+/*
+ * Opt out of the daily "is a newer OneUptime released?" check against the
+ * GitHub API. Deliberately separate from DISABLE_TELEMETRY, which turns off
+ * the OpenTelemetry SDK and says nothing about outbound calls.
+ */
+export const DisableUpdateCheck: boolean =
+  process.env["DISABLE_UPDATE_CHECK"] === "true";
+
 export const EnableProfiling: boolean =
   process.env["ENABLE_PROFILING"] === "true";
 
@@ -782,6 +790,20 @@ export const EnterpriseLicenseUserCountReportUrl: URL = URL.fromString(
   "https://oneuptime.com/api/enterprise-license/report-user-count",
 );
 
+/*
+ * GitHub's "latest release" endpoint. It already excludes drafts and
+ * prereleases, so whatever it returns is a version an administrator can
+ * safely be told to upgrade to.
+ *
+ * Overridable so an installation with no route to github.com can point the
+ * check at an internal mirror instead of turning it off entirely. The mirror
+ * must answer with GitHub's release shape (tag_name, html_url, published_at).
+ */
+export const LatestReleaseCheckUrl: URL = URL.fromString(
+  process.env["LATEST_RELEASE_CHECK_URL"] ||
+    "https://api.github.com/repos/OneUptime/oneuptime/releases/latest",
+);
+
 // Inbound Email Configuration for Incoming Email Monitor
 export enum InboundEmailProviderType {
   SendGrid = "SendGrid",

package/Server/Infrastructure/Postgres/SchemaMigrations/1784640000000-AddExceptionTriageAndPrivacyColumns.ts

@@ -0,0 +1,56 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * AI exception triage + privacy columns:
+ *
+ * - TelemetryException.unhandled: sticky rollup of OTel exception.escaped
+ *   (maintained by the ingest upsert with OR semantics).
+ * - TelemetryException.aiClassification: triage verdict (code-fault,
+ *   user-error, expected-denial, infrastructure, unknown).
+ * - TelemetryException.aiFixDeclinedAt: stamped when a human closes an
+ *   AI fix PR without merging; suppresses further automatic fix attempts.
+ * - AIInsight.classification: the same triage verdict on the insight row.
+ * - Project.autoArchiveNonActionableExceptions: opt-in auto-archive of
+ *   expected-denial exception groups.
+ */
+export class AddExceptionTriageAndPrivacyColumns1784640000000
+  implements MigrationInterface
+{
+  public name: string = "AddExceptionTriageAndPrivacyColumns1784640000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" ADD "unhandled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" ADD "aiClassification" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" ADD "aiFixDeclinedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AIInsight" ADD "classification" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "autoArchiveNonActionableExceptions" boolean NOT NULL DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "autoArchiveNonActionableExceptions"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AIInsight" DROP COLUMN "classification"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" DROP COLUMN "aiFixDeclinedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" DROP COLUMN "aiClassification"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" DROP COLUMN "unhandled"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1784659816363-AddInstanceVersionAndLatestReleaseColumns.ts

@@ -0,0 +1,38 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddInstanceVersionAndLatestReleaseColumns1784659816363
+  implements MigrationInterface
+{
+  public name: string =
+    "AddInstanceVersionAndLatestReleaseColumns1784659816363";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicenseInstance" ADD "oneuptimeVersion" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" ADD "latestReleaseVersion" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" ADD "latestReleasePublishedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" ADD "latestReleaseCheckedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" DROP COLUMN "latestReleaseCheckedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" DROP COLUMN "latestReleasePublishedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" DROP COLUMN "latestReleaseVersion"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicenseInstance" DROP COLUMN "oneuptimeVersion"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1784705487674-AddEnterpriseLicenseEvaluationColumns.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddEnterpriseLicenseEvaluationColumns1784705487674
+  implements MigrationInterface
+{
+  public name: string = "AddEnterpriseLicenseEvaluationColumns1784705487674";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" ADD "isEvaluationLicense" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" ADD "enterpriseLicenseIsEvaluation" boolean DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" DROP COLUMN "enterpriseLicenseIsEvaluation"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" DROP COLUMN "isEvaluationLicense"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -461,6 +461,9 @@ import { AddNetworkDeviceInventoryAndDiscoverySchedule1784211212164 } from "./17
 import { AddEnterpriseLicenseNotificationColumns1784218257664 } from "./1784218257664-AddEnterpriseLicenseNotificationColumns";
 import { AddAttributionColumnsToUserAndProject1784293516000 } from "./1784293516000-AddAttributionColumnsToUserAndProject";
 import { AddMarketingConversionTable1784298000000 } from "./1784298000000-AddMarketingConversionTable";
+import { AddExceptionTriageAndPrivacyColumns1784640000000 } from "./1784640000000-AddExceptionTriageAndPrivacyColumns";
+import { AddInstanceVersionAndLatestReleaseColumns1784659816363 } from "./1784659816363-AddInstanceVersionAndLatestReleaseColumns";
+import { AddEnterpriseLicenseEvaluationColumns1784705487674 } from "./1784705487674-AddEnterpriseLicenseEvaluationColumns";
 
 export default [
   InitialMigration,
@@ -926,4 +929,7 @@ export default [
   AddEnterpriseLicenseNotificationColumns1784218257664,
   AddAttributionColumnsToUserAndProject1784293516000,
   AddMarketingConversionTable1784298000000,
+  AddExceptionTriageAndPrivacyColumns1784640000000,
+  AddInstanceVersionAndLatestReleaseColumns1784659816363,
+  AddEnterpriseLicenseEvaluationColumns1784705487674,
 ];

package/Server/Services/AIRunService.ts

@@ -187,6 +187,14 @@ export class Service extends DatabaseService<Model> {
           run.triggeredByIncidentId || run.triggeredByAlertId
             ? null
             : "Queued code-fix run has no incident or alert subject.";
+      } else if (
+        run.codeFixTaskType === CodeFixTaskType.ImproveLogging ||
+        run.codeFixTaskType === CodeFixTaskType.ImproveTracing
+      ) {
+        // Service-scoped instrumentation recipes carry the service instead.
+        missingContextMessage = run.taskContext?.telemetryServiceId
+          ? null
+          : "Queued code-fix run has no telemetry service in its task context.";
       } else {
         missingContextMessage = run.taskContext?.traceId
           ? null

package/Server/Services/AnalyticsDatabaseService.ts

@@ -47,7 +47,7 @@ import {
   ResponseJSON,
   ResultSet,
 } from "@clickhouse/client";
-import { AsyncLocalStorage } from "node:async_hooks";
+import { nextInsertDedupToken } from "../Utils/AnalyticsDatabase/InsertDedupContext";
 import AnalyticsBaseModel from "../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
 import { WorkflowRoute } from "../../ServiceRoute";
 import Protocol from "../../Types/API/Protocol";
@@ -140,40 +140,42 @@ export const MigrationExecuteOptions: ClickhouseExecuteOptions = {
   },
 };
 
-/**
- * Ambient context that makes ClickHouse inserts idempotent across queue
- * retries. The telemetry queue worker wraps each job in
- * `runWithInsertDedup(jobId, ...)`; every insertJsonRows call inside the
- * job then stamps `insert_deduplication_token =
- * "<tokenBase>:<table>:<chunkIndex>"` plus async_insert_deduplicate=1 /
- * wait_for_async_insert=1, so a stalled-job retry that re-processes the
- * same payload re-issues byte-identical tokens and ClickHouse drops the
- * duplicate blocks (on replicated tables; on plain MergeTree the token is
- * ignored unless non_replicated_deduplication_window is set — no harm
- * either way). The chunk counter is per table because one job inserts
- * into several tables (e.g. Span + ExceptionInstance) in a deterministic
- * order.
+/*
+ * The insert-dedup ambient context lives in
+ * Utils/AnalyticsDatabase/InsertDedupContext so that both this service and
+ * TelemetryFanInWriter can consume deterministic tokens without an import
+ * cycle. Re-exported here for existing callers.
  *
- * HTTP-path inserts run outside the context and keep the fire-and-forget
- * async insert (wait_for_async_insert=0) — dedup waiting is only
- * affordable off the request thread.
+ * HTTP-path inserts run outside the context and are always fire-and-forget
+ * (wait_for_async_insert=0) — flush waiting, when opted into via
+ * TELEMETRY_WAIT_FOR_ASYNC_INSERT, is only affordable off the request
+ * thread and therefore only applies to tokened (queue-job) inserts.
  */
-export interface InsertDedupContextStore {
-  tokenBase: string;
-  chunkIndexByTable: Map<string, number>;
-}
+export {
+  runWithInsertDedup,
+  nextInsertDedupToken,
+  type InsertDedupContextStore,
+} from "../Utils/AnalyticsDatabase/InsertDedupContext";
 
-const insertDedupContext: AsyncLocalStorage<InsertDedupContextStore> =
-  new AsyncLocalStorage<InsertDedupContextStore>();
-
-export function runWithInsertDedup<T>(
-  tokenBase: string,
-  fn: () => Promise<T>,
-): Promise<T> {
-  return insertDedupContext.run(
-    { tokenBase, chunkIndexByTable: new Map<string, number>() },
-    fn,
-  );
+/*
+ * Ack mode for telemetry ClickHouse inserts.
+ *
+ * Default (false): wait_for_async_insert=0 — fire-and-forget. ClickHouse
+ * acks as soon as the batch is accepted into its async-insert buffer and
+ * owns flushing from there; inserts release their query slot almost
+ * immediately. The trade: flush-time errors surface only in server logs
+ * (system.asynchronous_inserts / part log), and a ClickHouse crash between
+ * buffer-accept and flush loses that buffer even though callers were acked.
+ *
+ * Set TELEMETRY_WAIT_FOR_ASYNC_INSERT=true to make every tokened insert
+ * wait for the durable flush before acking (ack-after-flush end to end
+ * through the fan-in writer and writer tier) — at the cost of each waiting
+ * insert holding a ClickHouse query slot until its buffer flushes.
+ */
+export function shouldWaitForAsyncInsert(): boolean {
+  const raw: string | undefined =
+    process.env["TELEMETRY_WAIT_FOR_ASYNC_INSERT"];
+  return raw === "true" || raw === "1";
 }
 
 export default class AnalyticsDatabaseService<
@@ -259,30 +261,31 @@ export default class AnalyticsDatabaseService<
     let dedupToken: string | undefined = options?.dedupToken;
 
     if (!dedupToken) {
-      const dedupStore: InsertDedupContextStore | undefined =
-        insertDedupContext.getStore();
-      if (dedupStore) {
-        const chunkIndex: number =
-          dedupStore.chunkIndexByTable.get(tableName) ?? 0;
-        dedupStore.chunkIndexByTable.set(tableName, chunkIndex + 1);
-        dedupToken = `${dedupStore.tokenBase}:${tableName}:${chunkIndex}`;
-      }
+      dedupToken = nextInsertDedupToken(tableName);
     }
 
+    const waitForAsyncInsert: 0 | 1 = shouldWaitForAsyncInsert() ? 1 : 0;
+
     let clickhouseSettings: ClickHouseSettings = {
       async_insert: 1,
-      wait_for_async_insert: 0,
+      wait_for_async_insert: waitForAsyncInsert,
     };
 
     if (dedupToken) {
       /*
-       * wait_for_async_insert=1 so the worker only acks the job after
-       * the block actually landed (or was deduplicated) — otherwise a
-       * crash between buffer-write and flush loses data with no retry.
+       * Dedup settings ride along in both ack modes. For async inserts
+       * ClickHouse dedups by content hash of the insert body when
+       * async_insert_deduplicate=1 (the explicit token is not yet honored
+       * for async inserts — ClickHouse #52018), so byte-identical queue
+       * retries are still dropped. The ack mode is a separate, deliberate
+       * trade (see shouldWaitForAsyncInsert): by default ClickHouse owns
+       * flushing and an ack means "accepted into the async-insert buffer";
+       * with TELEMETRY_WAIT_FOR_ASYNC_INSERT=true the ack waits for the
+       * durable flush instead.
        */
       clickhouseSettings = {
         async_insert: 1,
-        wait_for_async_insert: 1,
+        wait_for_async_insert: waitForAsyncInsert,
         async_insert_deduplicate: 1,
         insert_deduplication_token: dedupToken,
       };