@oneuptime/common 11.5.4 → 11.5.6

package/build/dist/Server/Utils/AI/SRE/Insights/InsightScanner.js

@@ -0,0 +1,269 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import OneUptimeDate from "../../../../../Types/Date";
+import LIMIT_MAX from "../../../../../Types/Database/LimitMax";
+import Project from "../../../../../Models/DatabaseModels/Project";
+import AIInsightStatus from "../../../../../Types/AI/AIInsightStatus";
+import ProjectService from "../../../../Services/ProjectService";
+import AIInsightService from "../../../../Services/AIInsightService";
+import InsightDetectors from "./Detectors/Index";
+import InsightStore from "./InsightStore";
+import InsightFixRouting from "./FixRouting";
+import InsightTriage from "./Triage";
+import logger from "../../../Logger";
+import CaptureSpan from "../../../Telemetry/CaptureSpan";
+/*
+ * AI Insights — the scan orchestration (the "watch loop").
+ *
+ * THE RULE: no LLM here. Detectors are deterministic statistical sensors;
+ * the LLM only engages per-finding AFTERWARDS through InsightTriage
+ * (budgeted, read-only), and the fix decision inside InsightFixRouting is
+ * deterministic and reuses the existing budgeted CodeFix creation paths.
+ *
+ * Everything is opt-in and quiet: only projects with the default-false
+ * enableAiInsights flag are scanned, insights never page and never
+ * open incidents, and every layer (project, detector, insight) fails in
+ * isolation — one broken tenant or sensor must not stop the sweep.
+ */
+export default class InsightScanner {
+    /*
+     * One scan tick across all opted-in projects. The flag query IS the gate:
+     * enableAiInsights defaults to false, so nothing runs for a project
+     * that never opted in. Runs as root with explicit projectId scoping
+     * (monitor-worker precedent), not per-user ACL. Never throws — the cron
+     * caller gets a clean resolve either way.
+     */
+    static async scanAllProjects() {
+        var _a;
+        let projects = [];
+        try {
+            projects = await ProjectService.findBy({
+                query: { enableAiInsights: true },
+                select: {
+                    _id: true,
+                    enableInsightFixTasks: true,
+                    enableAi: true,
+                },
+                limit: LIMIT_MAX,
+                skip: 0,
+                props: { isRoot: true },
+            });
+        }
+        catch (error) {
+            logger.error(`AI Insights: failed to list opted-in projects for the scan tick: ${error}`);
+            return;
+        }
+        for (const project of projects) {
+            try {
+                await this.scanProjectForInsights(project);
+            }
+            catch (error) {
+                logger.error(`AI Insights: scan failed for project ${(_a = project.id) === null || _a === void 0 ? void 0 : _a.toString()}: ${error}`);
+            }
+        }
+    }
+    /*
+     * One project's scan: self-heal any insight an earlier tick left unrouted,
+     * run every registered detector (isolated — one failing sensor must not
+     * blind the others), dedupe/upsert the candidates through InsightStore,
+     * then route each NEWLY created insight to FixOpened or ActionRequired and
+     * enqueue its triage.
+     */
+    static async scanProjectForInsights(project) {
+        var _a;
+        const projectId = project.id || undefined;
+        if (!projectId) {
+            return;
+        }
+        /*
+         * The self-heal sweep runs FIRST — before the detectors — so it can only
+         * ever see rows from EARLIER ticks: this tick's own new rows do not
+         * exist yet and therefore cannot be routed twice.
+         */
+        await this.rerouteStrandedInsights({
+            projectId: projectId,
+            project: project,
+        });
+        // The tick's single clock — detectors compute all windows from it.
+        const now = OneUptimeDate.getCurrentDate();
+        const context = {
+            projectId: projectId,
+            now: now,
+        };
+        const candidates = [];
+        const detectors = InsightDetectors.getAllDetectors();
+        for (const detector of detectors) {
+            try {
+                const detected = await detector.detect(context);
+                candidates.push(...detected);
+            }
+            catch (error) {
+                logger.error(`AI Insights: ${detector.insightType} detector failed for project ${projectId.toString()} — continuing with the remaining detectors: ${error}`);
+            }
+        }
+        if (candidates.length === 0) {
+            return;
+        }
+        const upsertResult = await InsightStore.upsertCandidates({
+            projectId: projectId,
+            candidates: candidates,
+            now: now,
+        });
+        /*
+         * Only NEWLY created insights are routed — refreshed rows were routed
+         * on the tick that created them and their status is owned by humans and
+         * the fix flow from then on.
+         */
+        for (const insight of upsertResult.created) {
+            try {
+                await this.routeNewInsight({ insight: insight, project: project });
+            }
+            catch (error) {
+                logger.error(`AI Insights: routing failed for insight ${(_a = insight.id) === null || _a === void 0 ? void 0 : _a.toString()} (project ${projectId.toString()}) — continuing with the remaining insights: ${error}`);
+            }
+        }
+    }
+    /*
+     * Self-heal for insights stranded in the defensive Detected state.
+     *
+     * InsightStore CREATES rows as Detected and the routing status write is a
+     * SEPARATE, later write. If the pod dies in between (eviction, OOM,
+     * deploy) — or that write simply fails — the row is stranded: later ticks
+     * take the REFRESH path, which by contract never touches status and never
+     * re-routes, so the insight would stay Detected FOREVER: never triaged,
+     * never fix-routed, and its fingerprint permanently pinned (the dedupe
+     * lookup would keep refreshing the dead row instead of letting a fresh,
+     * routable insight be created for that finding).
+     *
+     * RE-ROUTING IS SAFE BY CONSTRUCTION — it cannot double-create work:
+     *   - fix creation dedupes inside the creation paths (per (exception,
+     *     recipe) for FixException, per trace for FixPerformance), so a row
+     *     that DID get its fix run created before the pod died gets a rejected
+     *     create here, which InsightFixRouting swallows into "no fix opened";
+     *   - triage dedupes to one non-terminal run per insight, so a re-routed
+     *     insight with a live triage run enqueues nothing;
+     *   - both status writes are idempotent overwrites of the same row.
+     * NEVER throws: a sweep failure must not cost the project its scan.
+     */
+    static async rerouteStrandedInsights(data) {
+        var _a;
+        const { projectId, project } = data;
+        let stranded = [];
+        try {
+            stranded = await AIInsightService.findBy({
+                query: {
+                    projectId: projectId,
+                    status: AIInsightStatus.Detected,
+                },
+                // Exactly the fields routeNewInsight's collaborators read.
+                select: {
+                    _id: true,
+                    projectId: true,
+                    insightType: true,
+                    serviceName: true,
+                    traceId: true,
+                    telemetryExceptionId: true,
+                    evidence: true,
+                },
+                limit: LIMIT_MAX,
+                skip: 0,
+                props: { isRoot: true },
+            });
+        }
+        catch (error) {
+            logger.error(`AI Insights: failed to sweep unrouted (Detected) insights for project ${projectId.toString()} — continuing with the scan: ${error}`);
+            return;
+        }
+        for (const insight of stranded) {
+            try {
+                await this.routeNewInsight({ insight: insight, project: project });
+            }
+            catch (error) {
+                logger.error(`AI Insights: re-routing failed for stranded insight ${(_a = insight.id) === null || _a === void 0 ? void 0 : _a.toString()} (project ${projectId.toString()}) — continuing with the remaining stranded insights: ${error}`);
+            }
+        }
+    }
+    /*
+     * Route one insight — newly created this tick, or swept up as stranded
+     * from an earlier one — out of the defensive Detected state:
+     *   1. deterministic fix routing (gated on enableAi + enableInsightFixTasks
+     *      inside InsightFixRouting) → FixOpened + fixAiRunId, else
+     *      ActionRequired;
+     *   2. triage enqueue for EVERY new insight — triage enriches fix and
+     *      non-fix insights alike → triageAiRunId when a run was enqueued.
+     * Both collaborators are never-throws by contract, but they are wrapped
+     * anyway: a contract breach must degrade (no fix / no triage), not leave
+     * the insight stuck in Detected or fail the scan.
+     */
+    static async routeNewInsight(data) {
+        var _a, _b;
+        const { insight, project } = data;
+        let fixAiRunId = undefined;
+        try {
+            const fixResult = await InsightFixRouting.routeInsightFix({
+                insight: insight,
+                project: project,
+            });
+            fixAiRunId = fixResult.fixAiRunId;
+        }
+        catch (error) {
+            logger.error(`AI Insights: fix routing threw for insight ${(_a = insight.id) === null || _a === void 0 ? void 0 : _a.toString()} (treating as no fix opened): ${error}`);
+        }
+        if (fixAiRunId) {
+            await AIInsightService.updateOneById({
+                id: insight.id,
+                data: {
+                    status: AIInsightStatus.FixOpened,
+                    fixAiRunId: fixAiRunId,
+                },
+                props: { isRoot: true },
+            });
+        }
+        else {
+            await AIInsightService.updateOneById({
+                id: insight.id,
+                data: {
+                    status: AIInsightStatus.ActionRequired,
+                },
+                props: { isRoot: true },
+            });
+        }
+        let triageAiRunId = undefined;
+        try {
+            const triageResult = await InsightTriage.enqueueInsightTriage({ insight: insight });
+            triageAiRunId = triageResult.triageAiRunId;
+        }
+        catch (error) {
+            logger.error(`AI Insights: triage enqueue threw for insight ${(_b = insight.id) === null || _b === void 0 ? void 0 : _b.toString()} (continuing without triage): ${error}`);
+        }
+        if (triageAiRunId) {
+            await AIInsightService.updateOneById({
+                id: insight.id,
+                data: {
+                    triageAiRunId: triageAiRunId,
+                },
+                props: { isRoot: true },
+            });
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], InsightScanner, "scanAllProjects", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Project]),
+    __metadata("design:returntype", Promise)
+], InsightScanner, "scanProjectForInsights", null);
+//# sourceMappingURL=InsightScanner.js.map

package/build/dist/Server/Utils/AI/SRE/Insights/InsightScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InsightScanner.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/AI/SRE/Insights/InsightScanner.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,SAAS,MAAM,wCAAwC,CAAC;AAC/D,OAAO,OAAO,MAAM,8CAA8C,CAAC;AAEnE,OAAO,eAAe,MAAM,yCAAyC,CAAC;AACtE,OAAO,cAAc,MAAM,qCAAqC,CAAC;AACjE,OAAO,gBAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,gBAAgB,MAAM,mBAAmB,CAAC;AACjD,OAAO,YAAwC,MAAM,gBAAgB,CAAC;AACtE,OAAO,iBAA8C,MAAM,cAAc,CAAC;AAC1E,OAAO,aAAsC,MAAM,UAAU,CAAC;AAE9D,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC;;;;;;OAMG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,eAAe;;QACjC,IAAI,QAAQ,GAAmB,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;gBACrC,KAAK,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;gBACjC,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,qBAAqB,EAAE,IAAI;oBAC3B,QAAQ,EAAE,IAAI;iBACf;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,oEAAoE,KAAK,EAAE,CAC5E,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,wCAAwC,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,KAAK,KAAK,EAAE,CAC3E,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,OAAgB;;QACzD,MAAM,SAAS,GAAyB,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;QAEhE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED;;;;WAIG;QACH,MAAM,IAAI,CAAC,uBAAuB,CAAC;YACjC,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QAEH,mEAAmE;QACnE,MAAM,GAAG,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QAEjD,MAAM,OAAO,GAAuB;YAClC,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,GAAG;SACT,CAAC;QAEF,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,MAAM,SAAS,GACb,gBAAgB,CAAC,eAAe,EAAE,CAAC;QAErC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,GACZ,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,gBAAgB,QAAQ,CAAC,WAAW,gCAAgC,SAAS,CAAC,QAAQ,EAAE,+CAA+C,KAAK,EAAE,CAC/I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAChB,MAAM,YAAY,CAAC,gBAAgB,CAAC;YAClC,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,UAAU;YACtB,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QAEL;;;;WAIG;QACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,2CAA2C,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,aAAa,SAAS,CAAC,QAAQ,EAAE,+CAA+C,KAAK,EAAE,CACzJ,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAG5C;;QACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAEpC,IAAI,QAAQ,GAAqB,EAAE,CAAC;QAEpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC;gBACvC,KAAK,EAAE;oBACL,SAAS,EAAE,SAAS;oBACpB,MAAM,EAAE,eAAe,CAAC,QAAQ;iBACjC;gBACD,2DAA2D;gBAC3D,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,IAAI;oBACjB,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,IAAI;oBACb,oBAAoB,EAAE,IAAI;oBAC1B,QAAQ,EAAE,IAAI;iBACf;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,yEAAyE,SAAS,CAAC,QAAQ,EAAE,gCAAgC,KAAK,EAAE,CACrI,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,uDAAuD,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,aAAa,SAAS,CAAC,QAAQ,EAAE,wDAAwD,KAAK,EAAE,CAC9K,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAGpC;;QACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAElC,IAAI,UAAU,GAAyB,SAAS,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,SAAS,GACb,MAAM,iBAAiB,CAAC,eAAe,CAAC;gBACtC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACL,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,8CAA8C,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,iCAAiC,KAAK,EAAE,CAC7G,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,gBAAgB,CAAC,aAAa,CAAC;gBACnC,EAAE,EAAE,OAAO,CAAC,EAAG;gBACf,IAAI,EAAE;oBACJ,MAAM,EAAE,eAAe,CAAC,SAAS;oBACjC,UAAU,EAAE,UAAU;iBACvB;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC,aAAa,CAAC;gBACnC,EAAE,EAAE,OAAO,CAAC,EAAG;gBACf,IAAI,EAAE;oBACJ,MAAM,EAAE,eAAe,CAAC,cAAc;iBACvC;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,GAAyB,SAAS,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,YAAY,GAChB,MAAM,aAAa,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACjE,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,iDAAiD,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,iCAAiC,KAAK,EAAE,CAChH,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,gBAAgB,CAAC,aAAa,CAAC;gBACnC,EAAE,EAAE,OAAO,CAAC,EAAG;gBACf,IAAI,EAAE;oBACJ,aAAa,EAAE,aAAa;iBAC7B;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA3PqB;IADnB,WAAW,EAAE;;;;2CAgCb;AAUmB;IADnB,WAAW,EAAE;;qCACsC,OAAO;;kDAkE1D"}

package/build/dist/Server/Utils/AI/SRE/Insights/InsightStore.js

@@ -0,0 +1,231 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import OneUptimeDate from "../../../../../Types/Date";
+import ColumnLength from "../../../../../Types/Database/ColumnLength";
+import SortOrder from "../../../../../Types/BaseDatabase/SortOrder";
+import AIInsight from "../../../../../Models/DatabaseModels/AIInsight";
+import AIInsightStatus, { AIInsightStatusHelper, } from "../../../../../Types/AI/AIInsightStatus";
+import AIInsightService from "../../../../Services/AIInsightService";
+import logger from "../../../Logger";
+import CaptureSpan from "../../../Telemetry/CaptureSpan";
+/*
+ * AI Insights — the dedupe/upsert store between detectors and the
+ * AIInsight table. Detectors re-emit the same finding on every scan
+ * tick while the underlying signal persists; the store's job is to keep the
+ * inbox quiet: one row per live finding (refreshed in place), a cooldown on
+ * findings a human already dismissed, and a hard cap on how many NEW rows a
+ * single scan may create.
+ */
+/*
+ * G4/G11 volume guardrail: a single scan tick may create at most this many
+ * NEW insights per project. A telemetry storm (deploy gone wrong, detector
+ * mis-tuning) would otherwise flood the inbox — and every new insight fans
+ * out into budgeted triage/fix work. Recurring findings still refresh their
+ * existing rows beyond the cap; drops are logged, never silent.
+ */
+export const MAX_NEW_INSIGHTS_PER_PROJECT_PER_SCAN = 10;
+/*
+ * G11 noise posture: a human dismissal is the strongest precision signal we
+ * have, so a finding with the same fingerprint stays suppressed for this
+ * many days after the dismissal instead of reappearing on the next tick.
+ * After the cooldown (or after a Resolved insight's signal returns) a fresh
+ * insight is warranted — a resolved issue that reappears is a regression.
+ */
+export const DISMISSED_COOLDOWN_DAYS = 7;
+/*
+ * Column-safety clamps: DatabaseService validates string columns against the
+ * model's declared lengths and THROWS on overflow, and detectors embed raw
+ * telemetry strings (a span name can be an entire SQL statement, exception
+ * types and service names are unbounded). Clamping here — the single choke
+ * point where candidates become rows — protects every current and future
+ * detector. The fingerprint clamp is applied to the dedupe LOOKUP as well as
+ * the insert, so a clamped fingerprint keeps refreshing the same row instead
+ * of failing (or duplicating) on every tick. Values mirror the
+ * AIInsight column definitions (LongText/ShortText).
+ */
+export const INSIGHT_FINGERPRINT_MAX_LENGTH = ColumnLength.LongText;
+export const INSIGHT_TITLE_MAX_LENGTH = ColumnLength.LongText;
+export const INSIGHT_SERVICE_NAME_MAX_LENGTH = ColumnLength.LongText;
+export const INSIGHT_METRIC_NAME_MAX_LENGTH = ColumnLength.LongText;
+export const INSIGHT_TRACE_ID_MAX_LENGTH = ColumnLength.ShortText;
+export default class InsightStore {
+    /*
+     * Upsert one scan tick's candidates for one project. For each candidate,
+     * the most recent insight with the same (projectId, fingerprint) decides
+     * the outcome:
+     *   - none                          → CREATE (subject to the per-scan cap)
+     *   - non-terminal                  → REFRESH (never touches status)
+     *   - Dismissed within the cooldown → suppress
+     *   - Dismissed past the cooldown,
+     *     or Resolved                   → CREATE (regression / recurrence)
+     * All access is root-props: the scanner is a system actor with explicit
+     * projectId scoping, not a per-user ACL consumer.
+     */
+    static async upsertCandidates(data) {
+        const result = {
+            created: [],
+            refreshed: 0,
+            suppressed: 0,
+            droppedByCap: 0,
+        };
+        // No silent caps: dropped fingerprints are logged after the loop.
+        const droppedFingerprints = [];
+        for (const candidate of data.candidates) {
+            /*
+             * Per-candidate isolation: one failing candidate (transient DB error,
+             * unexpected data) must not abort the batch — insights created earlier
+             * in this tick are returned for routing either way, and the remaining
+             * candidates still get their chance. Without this, a mid-batch failure
+             * would strand already-created rows in Detected forever (refreshes
+             * never touch status, so they would never be routed).
+             */
+            try {
+                /*
+                 * The clamped fingerprint is the row's identity everywhere — lookup
+                 * and insert — so dedupe survives the clamp (see the constants).
+                 */
+                const fingerprint = this.clampToColumn(candidate.fingerprint, INSIGHT_FINGERPRINT_MAX_LENGTH);
+                /*
+                 * Most recent row wins: (projectId, fingerprint) is deliberately NOT
+                 * unique — terminal rows accumulate as history — so sort by createdAt
+                 * to judge against the latest lifecycle state of this finding.
+                 */
+                const existing = await AIInsightService.findOneBy({
+                    query: {
+                        projectId: data.projectId,
+                        fingerprint: fingerprint,
+                    },
+                    select: {
+                        _id: true,
+                        status: true,
+                        occurrenceCount: true,
+                        humanVerdictAt: true,
+                    },
+                    sort: { createdAt: SortOrder.Descending },
+                    props: { isRoot: true },
+                });
+                if (existing &&
+                    existing.status &&
+                    !AIInsightStatusHelper.isTerminalStatus(existing.status)) {
+                    /*
+                     * REFRESH: the finding is still live and already has a row. The
+                     * evidence/severity are replaced with this tick's numbers (the
+                     * newest picture of the signal), but status is NEVER touched here —
+                     * routing (ActionRequired/FixOpened) happened when the row was
+                     * created and humans/fix flows own it from there.
+                     */
+                    await AIInsightService.updateOneById({
+                        id: existing.id,
+                        data: {
+                            lastSeenAt: data.now,
+                            occurrenceCount: (existing.occurrenceCount || 1) + 1,
+                            severity: candidate.severity,
+                            detailMarkdown: candidate.detailMarkdown,
+                            evidence: candidate.evidence,
+                        },
+                        props: { isRoot: true },
+                    });
+                    result.refreshed++;
+                    continue;
+                }
+                if (existing && existing.status === AIInsightStatus.Dismissed) {
+                    /*
+                     * Cooldown is measured from the human's dismissal, inclusive at the
+                     * boundary (exactly DISMISSED_COOLDOWN_DAYS old still suppresses).
+                     * A Dismissed row without a verdict timestamp cannot prove the
+                     * cooldown elapsed, so it suppresses too — when in doubt, stay
+                     * quiet (G11 noise posture).
+                     */
+                    const cooldownMs = OneUptimeDate.getMillisecondsInDays(DISMISSED_COOLDOWN_DAYS);
+                    const withinCooldown = existing.humanVerdictAt
+                        ? data.now.getTime() -
+                            OneUptimeDate.fromString(existing.humanVerdictAt).getTime() <=
+                            cooldownMs
+                        : true;
+                    if (withinCooldown) {
+                        logger.debug(`AI Insights: suppressing candidate ${fingerprint} for project ${data.projectId.toString()} — dismissed by a human within the last ${DISMISSED_COOLDOWN_DAYS} days.`);
+                        result.suppressed++;
+                        continue;
+                    }
+                }
+                /*
+                 * CREATE: no live row for this fingerprint (never seen, Resolved, or
+                 * Dismissed long enough ago). Subject to the per-scan cap.
+                 */
+                if (result.created.length >= MAX_NEW_INSIGHTS_PER_PROJECT_PER_SCAN) {
+                    droppedFingerprints.push(fingerprint);
+                    result.droppedByCap++;
+                    continue;
+                }
+                const insight = new AIInsight();
+                insight.projectId = data.projectId;
+                insight.insightType = candidate.insightType;
+                // Defensive initial state — the scanner routes it in the same tick.
+                insight.status = AIInsightStatus.Detected;
+                insight.severity = candidate.severity;
+                insight.fingerprint = fingerprint;
+                insight.title = this.clampToColumn(candidate.title, INSIGHT_TITLE_MAX_LENGTH);
+                insight.detailMarkdown = candidate.detailMarkdown;
+                insight.evidence = candidate.evidence;
+                insight.firstSeenAt = data.now;
+                insight.lastSeenAt = data.now;
+                insight.occurrenceCount = 1;
+                if (candidate.serviceName) {
+                    insight.serviceName = this.clampToColumn(candidate.serviceName, INSIGHT_SERVICE_NAME_MAX_LENGTH);
+                }
+                if (candidate.telemetryServiceId) {
+                    insight.telemetryServiceId = candidate.telemetryServiceId;
+                }
+                if (candidate.telemetryExceptionId) {
+                    insight.telemetryExceptionId = candidate.telemetryExceptionId;
+                }
+                if (candidate.traceId) {
+                    insight.traceId = this.clampToColumn(candidate.traceId, INSIGHT_TRACE_ID_MAX_LENGTH);
+                }
+                if (candidate.metricName) {
+                    insight.metricName = this.clampToColumn(candidate.metricName, INSIGHT_METRIC_NAME_MAX_LENGTH);
+                }
+                const created = await AIInsightService.create({
+                    data: insight,
+                    props: { isRoot: true },
+                });
+                result.created.push(created);
+            }
+            catch (error) {
+                logger.error(`AI Insights: upsert failed for candidate ${candidate.fingerprint} (project ${data.projectId.toString()}) — continuing with the remaining candidates: ${error}`);
+            }
+        }
+        if (result.droppedByCap > 0) {
+            logger.debug(`AI Insights: candidate fingerprints dropped by the per-scan cap for project ${data.projectId.toString()}: ${droppedFingerprints.join(", ")}`);
+            logger.info(`AI Insights: per-scan new-insight cap (${MAX_NEW_INSIGHTS_PER_PROJECT_PER_SCAN}) reached for project ${data.projectId.toString()} — dropped ${result.droppedByCap} candidate(s) this tick. Recurring findings will re-surface on later ticks if their signal persists.`);
+        }
+        return result;
+    }
+    /*
+     * Hard code-unit slice to the column's declared length — the same measure
+     * DatabaseService validates against, so a clamped value can never trip the
+     * length check. No cosmetic ellipsis: detectors own presentation; this is
+     * purely a data-safety guard, and it must be deterministic so a clamped
+     * fingerprint stays stable across ticks.
+     */
+    static clampToColumn(value, maxLength) {
+        if (value.length <= maxLength) {
+            return value;
+        }
+        return value.slice(0, maxLength);
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InsightStore, "upsertCandidates", null);
+//# sourceMappingURL=InsightStore.js.map

package/build/dist/Server/Utils/AI/SRE/Insights/InsightStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InsightStore.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/AI/SRE/Insights/InsightStore.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,YAAY,MAAM,4CAA4C,CAAC;AACtE,OAAO,SAAS,MAAM,6CAA6C,CAAC;AACpE,OAAO,SAAS,MAAM,gDAAgD,CAAC;AACvE,OAAO,eAAe,EAAE,EACtB,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,gBAAgB,MAAM,uCAAuC,CAAC;AAErE,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAW,EAAE,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAW,CAAC,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,YAAY,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAW,YAAY,CAAC,QAAQ,CAAC;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAW,YAAY,CAAC,QAAQ,CAAC;AAC7E,MAAM,CAAC,MAAM,8BAA8B,GAAW,YAAY,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAW,YAAY,CAAC,SAAS,CAAC;AAa1E,MAAM,CAAC,OAAO,OAAO,YAAY;IAC/B;;;;;;;;;;;OAWG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAIpC;QACC,MAAM,MAAM,GAA2B;YACrC,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;SAChB,CAAC;QAEF,kEAAkE;QAClE,MAAM,mBAAmB,GAAkB,EAAE,CAAC;QAE9C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC;;;;;;;eAOG;YACH,IAAI,CAAC;gBACH;;;mBAGG;gBACH,MAAM,WAAW,GAAW,IAAI,CAAC,aAAa,CAC5C,SAAS,CAAC,WAAW,EACrB,8BAA8B,CAC/B,CAAC;gBAEF;;;;mBAIG;gBACH,MAAM,QAAQ,GAAqB,MAAM,gBAAgB,CAAC,SAAS,CAAC;oBAClE,KAAK,EAAE;wBACL,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,WAAW,EAAE,WAAW;qBACzB;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,MAAM,EAAE,IAAI;wBACZ,eAAe,EAAE,IAAI;wBACrB,cAAc,EAAE,IAAI;qBACrB;oBACD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE;oBACzC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,IACE,QAAQ;oBACR,QAAQ,CAAC,MAAM;oBACf,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EACxD,CAAC;oBACD;;;;;;uBAMG;oBACH,MAAM,gBAAgB,CAAC,aAAa,CAAC;wBACnC,EAAE,EAAE,QAAQ,CAAC,EAAG;wBAChB,IAAI,EAAE;4BACJ,UAAU,EAAE,IAAI,CAAC,GAAG;4BACpB,eAAe,EAAE,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;4BACpD,QAAQ,EAAE,SAAS,CAAC,QAAQ;4BAC5B,cAAc,EAAE,SAAS,CAAC,cAAc;4BACxC,QAAQ,EAAE,SAAS,CAAC,QAAQ;yBAC7B;wBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;qBACxB,CAAC,CAAC;oBAEH,MAAM,CAAC,SAAS,EAAE,CAAC;oBACnB,SAAS;gBACX,CAAC;gBAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,CAAC,SAAS,EAAE,CAAC;oBAC9D;;;;;;uBAMG;oBACH,MAAM,UAAU,GAAW,aAAa,CAAC,qBAAqB,CAC5D,uBAAuB,CACxB,CAAC;oBAEF,MAAM,cAAc,GAAY,QAAQ,CAAC,cAAc;wBACrD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE;4BAChB,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;4BAC7D,UAAU;wBACZ,CAAC,CAAC,IAAI,CAAC;oBAET,IAAI,cAAc,EAAE,CAAC;wBACnB,MAAM,CAAC,KAAK,CACV,sCAAsC,WAAW,gBAAgB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,2CAA2C,uBAAuB,QAAQ,CACrK,CAAC;wBAEF,MAAM,CAAC,UAAU,EAAE,CAAC;wBACpB,SAAS;oBACX,CAAC;gBACH,CAAC;gBAED;;;mBAGG;gBACH,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,qCAAqC,EAAE,CAAC;oBACnE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACtC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACtB,SAAS;gBACX,CAAC;gBAED,MAAM,OAAO,GAAc,IAAI,SAAS,EAAE,CAAC;gBAC3C,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBACnC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;gBAC5C,oEAAoE;gBACpE,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC;gBAC1C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;gBACtC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;gBAClC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,CAChC,SAAS,CAAC,KAAK,EACf,wBAAwB,CACzB,CAAC;gBACF,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC;gBAClD,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;gBACtC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;gBAC/B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC;gBAC9B,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC;gBAE5B,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;oBAC1B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,aAAa,CACtC,SAAS,CAAC,WAAW,EACrB,+BAA+B,CAChC,CAAC;gBACJ,CAAC;gBACD,IAAI,SAAS,CAAC,kBAAkB,EAAE,CAAC;oBACjC,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,CAAC;gBAC5D,CAAC;gBACD,IAAI,SAAS,CAAC,oBAAoB,EAAE,CAAC;oBACnC,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,CAAC;gBAChE,CAAC;gBACD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAClC,SAAS,CAAC,OAAO,EACjB,2BAA2B,CAC5B,CAAC;gBACJ,CAAC;gBACD,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;oBACzB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa,CACrC,SAAS,CAAC,UAAU,EACpB,8BAA8B,CAC/B,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAc,MAAM,gBAAgB,CAAC,MAAM,CAAC;oBACvD,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,4CAA4C,SAAS,CAAC,WAAW,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,iDAAiD,KAAK,EAAE,CAChK,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,CACV,+EAA+E,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9I,CAAC;YACF,MAAM,CAAC,IAAI,CACT,0CAA0C,qCAAqC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,cAAc,MAAM,CAAC,YAAY,sGAAsG,CACzQ,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,aAAa,CAAC,KAAa,EAAE,SAAiB;QAC3D,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC;CACF;AAxMqB;IADnB,WAAW,EAAE;;;;0CA0Lb"}