@oneuptime/common 11.7.3 → 12.0.0

package/build/dist/Types/Recommendation/RecommendationType.js

@@ -0,0 +1,21 @@
+/*
+ * The kinds of recommendation OneUptime can surface.
+ *
+ * Recommendations are suggestions OneUptime derives from telemetry it already
+ * has — "you have a Kubernetes cluster reporting HPA metrics but nothing
+ * watching whether an HPA is pinned at max replicas". Today the only kind is
+ * `Monitor` (create this monitor), but the surrounding machinery — the
+ * dismissal table, the side-menu count, the page shell — is deliberately keyed
+ * on this enum rather than on monitors, so a second kind (dashboards, cost
+ * savings, retention policies) needs no schema change and no new page.
+ *
+ * The values ARE persisted, in `RecommendationDismissal.recommendationType`.
+ * Renaming a member orphans every dismissal recorded under the old value, so
+ * treat these strings as a migration surface.
+ */
+var RecommendationType;
+(function (RecommendationType) {
+    RecommendationType["Monitor"] = "Monitor";
+})(RecommendationType || (RecommendationType = {}));
+export default RecommendationType;
+//# sourceMappingURL=RecommendationType.js.map

package/build/dist/Types/Recommendation/RecommendationType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendationType.js","sourceRoot":"","sources":["../../../../Types/Recommendation/RecommendationType.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,IAAK,kBAEJ;AAFD,WAAK,kBAAkB;IACrB,yCAAmB,CAAA;AACrB,CAAC,EAFI,kBAAkB,KAAlB,kBAAkB,QAEtB;AAED,eAAe,kBAAkB,CAAC"}

package/build/dist/Types/Rum/SessionReplay.js

@@ -0,0 +1,155 @@
+/*
+ * Wire contract between the browser (and later mobile) recorder and the
+ * session-replay ingest endpoint.
+ *
+ * Both sides of this file are load-bearing: the recorder is bundled and
+ * served to third-party origins, so a customer's browser may be running
+ * an older recorder than the server it posts to for as long as the
+ * pinned-artifact cache lives. Every field here is therefore additive-only,
+ * and SESSION_REPLAY_WIRE_VERSION is bumped for anything else.
+ */
+/* Bumped only on a breaking change to the envelope or the frame layout. */
+export const SESSION_REPLAY_WIRE_VERSION = 1;
+/*
+ * Bumped when the *payload* (the rrweb event array) changes shape in a
+ * way playback must branch on. Stored per chunk so a player can refuse
+ * gracefully instead of rendering a plausible-but-wrong DOM.
+ */
+export const SESSION_REPLAY_SCHEMA_VERSION = 1;
+/*
+ * Cap on a single POST body, post-compression. Enforced by the ingest
+ * middleware's running byte counter and mirrored by nginx's
+ * client_max_body_size on the /session-replay location. This is per
+ * REQUEST, not per frame — a catch-up post carrying several frames is
+ * bounded by this same number.
+ */
+export const MAX_SESSION_REPLAY_CHUNK_BYTES = 2 * 1024 * 1024;
+/* Frames a single catch-up request may concatenate. */
+export const MAX_SESSION_REPLAY_CHUNKS_PER_REQUEST = 8;
+/*
+ * Hard stop per session. At the 15s flush cadence this is ~2 hours of
+ * continuous recording, comfortably past the 4-hour session cap once
+ * idle gaps are accounted for. Prevents one pathological tab from
+ * writing unbounded rows under a single sort-key prefix.
+ */
+export const MAX_SESSION_REPLAY_CHUNKS_PER_SESSION = 480;
+/* Chunks a single playback request may ask for, and their total size. */
+export const MAX_SESSION_REPLAY_CHUNKS_PER_READ = 8;
+export const MAX_SESSION_REPLAY_READ_BYTES = 8 * 1024 * 1024;
+/*
+ * Default for the instance-wide per-project daily byte budget. The live
+ * value is the SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY env var; this
+ * default is shared between the ingest gate (App Telemetry Config) and the
+ * Dashboard-facing ingest-status endpoint so the number the gate enforces
+ * and the number the customer is shown cannot drift.
+ */
+export const DEFAULT_SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY = 1024 * 1024 * 1024;
+/*
+ * Recorder flush triggers. A chunk closes on whichever comes first.
+ * SESSION_REPLAY_CHECKOUT_INTERVAL_MS is also the worst-case seek
+ * granularity, since seeking rewinds to the nearest full snapshot.
+ */
+export const SESSION_REPLAY_FLUSH_INTERVAL_MS = 15 * 1000;
+export const SESSION_REPLAY_FLUSH_BYTES = 256 * 1024;
+export const SESSION_REPLAY_CHECKOUT_INTERVAL_MS = 60 * 1000;
+/*
+ * Rolling pre-roll buffer held in memory before a trigger fires, and the
+ * hard byte ceiling on it. The ceiling matters more than the duration:
+ * a heavily dynamic page can blow through 2MB in well under 60s, and a
+ * recorder that OOMs the host page is worse than no recorder.
+ */
+export const SESSION_REPLAY_ROLLING_BUFFER_MS = 60 * 1000;
+export const SESSION_REPLAY_ROLLING_BUFFER_BYTES = 2 * 1024 * 1024;
+/* Session identity lifetimes. */
+export const SESSION_REPLAY_IDLE_ROLLOVER_MS = 30 * 60 * 1000;
+export const SESSION_REPLAY_MAX_SESSION_MS = 4 * 60 * 60 * 1000;
+/*
+ * fetch(keepalive) quota is 64KB combined per origin across all in-flight
+ * keepalive requests, so the terminal flush gets one request under this
+ * cap rather than several that would silently fail against the quota.
+ */
+export const SESSION_REPLAY_KEEPALIVE_MAX_BYTES = 56 * 1024;
+/*
+ * Consecutive transport failures before the recorder permanently
+ * self-disables and releases its buffer. A recorder that retries forever
+ * against a misconfigured origin is a battery and bandwidth bug on the
+ * customer's site.
+ */
+export const SESSION_REPLAY_MAX_FLUSH_FAILURES = 3;
+/* Content type carried on every chunk POST. */
+export const SESSION_REPLAY_CONTENT_TYPE = "application/vnd.oneuptime.session-replay.v1";
+/* Header carrying the RUM application identifier, needed pre-decode. */
+export const SESSION_REPLAY_APP_IDENTIFIER_HEADER = "x-oneuptime-app-identifier";
+/*
+ * Header carrying the host page's end-user reference on the CONFIG fetch,
+ * URI-component-encoded so a non-ASCII reference cannot make fetch() throw
+ * and take the whole recorder down with it. Only sent when the page
+ * provided a userRef, and only used server-side to answer one question:
+ * "is there a pending record-next-session target for this user?". A header
+ * rather than a query parameter so it can never land in access logs.
+ */
+export const SESSION_REPLAY_USER_REF_HEADER = "x-oneuptime-user-ref";
+/*
+ * How long a "record the next session for this user" target waits for
+ * that user to show up before expiring, and the cap on the reference
+ * length accepted from either side (dashboard or config fetch).
+ */
+export const SESSION_REPLAY_TARGET_TTL_SECONDS = 24 * 60 * 60;
+export const SESSION_REPLAY_MAX_USER_REF_LENGTH = 512;
+/*
+ * Retention values a session may be clamped to. Under expiry-based
+ * partitioning each distinct value creates its own partition per ingest
+ * day, so this is deliberately a short closed set rather than a free
+ * integer.
+ */
+export const SESSION_REPLAY_ALLOWED_RETENTION_DAYS = [
+    1, 7, 14, 30, 90,
+];
+/*
+ * 7 days, not the 15 the other telemetry pillars default to. Replay is
+ * the highest-sensitivity and highest-byte pillar, and a short retention
+ * is itself a privacy control.
+ */
+export const DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS = 7;
+/*
+ * Machine-readable disclosures of what the recorder could not capture.
+ * Surfaced on the player so a viewer sees "this region was not recorded"
+ * rather than a silent blank rectangle — in a tool that presents evidence,
+ * an unexplained gap is worse than an acknowledged one.
+ */
+export var SessionReplayFidelityNotice;
+(function (SessionReplayFidelityNotice) {
+    SessionReplayFidelityNotice["CanvasNotRecorded"] = "canvas-not-recorded";
+    SessionReplayFidelityNotice["CrossOriginIframe"] = "cross-origin-iframe";
+    SessionReplayFidelityNotice["ClosedShadowRoot"] = "closed-shadow-root";
+    SessionReplayFidelityNotice["StylesheetInaccessible"] = "stylesheet-inaccessible";
+    SessionReplayFidelityNotice["AdoptedStylesheet"] = "adopted-stylesheet";
+    SessionReplayFidelityNotice["FontsOmitted"] = "fonts-omitted";
+    SessionReplayFidelityNotice["MediaNotReplayable"] = "media-not-replayable";
+    SessionReplayFidelityNotice["SnapshotTooLarge"] = "snapshot-too-large";
+    SessionReplayFidelityNotice["BufferOverflow"] = "buffer-overflow";
+    SessionReplayFidelityNotice["BfcacheRestore"] = "bfcache-restore";
+    /*
+     * One or more configured ignoreErrorPatterns could not be applied
+     * (invalid regex, or over the count/length caps), so error triggering
+     * may be noisier than the application's settings intend.
+     */
+    SessionReplayFidelityNotice["IgnorePatternsDiscarded"] = "ignore-patterns-discarded";
+})(SessionReplayFidelityNotice || (SessionReplayFidelityNotice = {}));
+/* Why a session stopped accumulating chunks. */
+export var SessionReplaySealedReason;
+(function (SessionReplaySealedReason) {
+    SessionReplaySealedReason["FinalChunk"] = "final-chunk";
+    SessionReplaySealedReason["IdleTimeout"] = "idle-timeout";
+    SessionReplaySealedReason["DurationCap"] = "duration-cap";
+    SessionReplaySealedReason["Budget"] = "budget";
+    SessionReplaySealedReason["Truncated"] = "truncated";
+    /*
+     * Sealed by the never-finalized sweep for a session whose chunks never
+     * landed or expired before finalization could run: the header survives
+     * as an honest "a recording existed but was lost" record instead of
+     * sitting provisional (and re-swept) forever.
+     */
+    SessionReplaySealedReason["RecordingLost"] = "recording-lost";
+})(SessionReplaySealedReason || (SessionReplaySealedReason = {}));
+//# sourceMappingURL=SessionReplay.js.map

package/build/dist/Types/Rum/SessionReplay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplay.js","sourceRoot":"","sources":["../../../../Types/Rum/SessionReplay.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GAAW,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAW,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtE,uDAAuD;AACvD,MAAM,CAAC,MAAM,qCAAqC,GAAW,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAW,GAAG,CAAC;AAEjE,yEAAyE;AACzE,MAAM,CAAC,MAAM,kCAAkC,GAAW,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,6BAA6B,GAAW,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAC/D,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAW,EAAE,GAAG,IAAI,CAAC;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAW,GAAG,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,mCAAmC,GAAW,EAAE,GAAG,IAAI,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAW,EAAE,GAAG,IAAI,CAAC;AAClE,MAAM,CAAC,MAAM,mCAAmC,GAAW,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3E,iCAAiC;AACjC,MAAM,CAAC,MAAM,+BAA+B,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAW,EAAE,GAAG,IAAI,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAW,CAAC,CAAC;AAE3D,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GACtC,6CAA6C,CAAC;AAEhD,wEAAwE;AACxE,MAAM,CAAC,MAAM,oCAAoC,GAC/C,4BAA4B,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,sBAAsB,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtE,MAAM,CAAC,MAAM,kCAAkC,GAAW,GAAG,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAkB;IAClE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAW,CAAC,CAAC;AAkBlE;;;;;GAKG;AACH,MAAM,CAAN,IAAY,2BAiBX;AAjBD,WAAY,2BAA2B;IACrC,wEAAyC,CAAA;IACzC,wEAAyC,CAAA;IACzC,sEAAuC,CAAA;IACvC,iFAAkD,CAAA;IAClD,uEAAwC,CAAA;IACxC,6DAA8B,CAAA;IAC9B,0EAA2C,CAAA;IAC3C,sEAAuC,CAAA;IACvC,iEAAkC,CAAA;IAClC,iEAAkC,CAAA;IAClC;;;;OAIG;IACH,oFAAqD,CAAA;AACvD,CAAC,EAjBW,2BAA2B,KAA3B,2BAA2B,QAiBtC;AAED,gDAAgD;AAChD,MAAM,CAAN,IAAY,yBAaX;AAbD,WAAY,yBAAyB;IACnC,uDAA0B,CAAA;IAC1B,yDAA4B,CAAA;IAC5B,yDAA4B,CAAA;IAC5B,8CAAiB,CAAA;IACjB,oDAAuB,CAAA;IACvB;;;;;OAKG;IACH,6DAAgC,CAAA;AAClC,CAAC,EAbW,yBAAyB,KAAzB,yBAAyB,QAapC"}

package/build/dist/Types/Rum/SessionReplayCaptureTrigger.js

@@ -0,0 +1,26 @@
+/*
+ * What causes a session to be uploaded — the single decision that drives
+ * the cost, storage and privacy-exposure profile of the whole feature.
+ *
+ * OnErrorOrFrustration is the observability-native default: the recorder
+ * holds a rolling buffer and only uploads when something actually went
+ * wrong, so a recording exists for very nearly every failed session
+ * while costing roughly 15x less than recording everyone.
+ */
+var SessionReplayCaptureTrigger;
+(function (SessionReplayCaptureTrigger) {
+    /*
+     * Default. Upload only on error / unhandled rejection / 5xx response /
+     * frustration signal, plus whatever the sample percentage picks up.
+     */
+    SessionReplayCaptureTrigger["OnErrorOrFrustration"] = "OnErrorOrFrustration";
+    /*
+     * Upload every sampled session from its first event, whether or not
+     * anything goes wrong. What users migrating from a marketing-analytics
+     * tool expect to find. Materially more expensive and materially more
+     * end-user data at rest.
+     */
+    SessionReplayCaptureTrigger["Always"] = "Always";
+})(SessionReplayCaptureTrigger || (SessionReplayCaptureTrigger = {}));
+export default SessionReplayCaptureTrigger;
+//# sourceMappingURL=SessionReplayCaptureTrigger.js.map

package/build/dist/Types/Rum/SessionReplayCaptureTrigger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayCaptureTrigger.js","sourceRoot":"","sources":["../../../../Types/Rum/SessionReplayCaptureTrigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,IAAK,2BAcJ;AAdD,WAAK,2BAA2B;IAC9B;;;OAGG;IACH,4EAA6C,CAAA;IAE7C;;;;;OAKG;IACH,gDAAiB,CAAA;AACnB,CAAC,EAdI,2BAA2B,KAA3B,2BAA2B,QAc/B;AAED,eAAe,2BAA2B,CAAC"}

package/build/dist/Types/Rum/SessionReplayConsentMode.js

@@ -0,0 +1,27 @@
+/*
+ * Whether the recorder needs an explicit consent grant from the host
+ * page before it may upload anything.
+ *
+ * In RequireExplicit the recorder still *records* into its in-memory
+ * ring buffer (so the pre-roll leading up to an error is not lost while
+ * a cookie banner is on screen) but uploads nothing until the host page
+ * calls grantConsent(). revokeConsent() drops the buffer outright.
+ */
+var SessionReplayConsentMode;
+(function (SessionReplayConsentMode) {
+    /*
+     * Default. Nothing is uploaded until the host page grants consent.
+     * Chunks carry their consentState and the ingest worker drops any
+     * chunk marked Unknown when the application requires explicit consent,
+     * so a recorder that skips the handshake fails closed server-side too.
+     */
+    SessionReplayConsentMode["RequireExplicit"] = "RequireExplicit";
+    /*
+     * The customer asserts they have a lawful basis that does not require
+     * a per-session grant (for example an internal admin tool covered by
+     * an employment agreement). Uploads begin immediately.
+     */
+    SessionReplayConsentMode["NotRequired"] = "NotRequired";
+})(SessionReplayConsentMode || (SessionReplayConsentMode = {}));
+export default SessionReplayConsentMode;
+//# sourceMappingURL=SessionReplayConsentMode.js.map

package/build/dist/Types/Rum/SessionReplayConsentMode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayConsentMode.js","sourceRoot":"","sources":["../../../../Types/Rum/SessionReplayConsentMode.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,IAAK,wBAeJ;AAfD,WAAK,wBAAwB;IAC3B;;;;;OAKG;IACH,+DAAmC,CAAA;IAEnC;;;;OAIG;IACH,uDAA2B,CAAA;AAC7B,CAAC,EAfI,wBAAwB,KAAxB,wBAAwB,QAe5B;AAED,eAAe,wBAAwB,CAAC"}

package/build/dist/Types/Rum/SessionReplayMaskingMode.js

@@ -0,0 +1,79 @@
+/*
+ * How aggressively the browser recorder masks page content before an
+ * event ever leaves the end user's device.
+ *
+ * Masking is applied at capture, in the browser, BEFORE compression and
+ * BEFORE the chunk is posted. The server never sees unmasked content, so
+ * a leak cannot be repaired retroactively — tightening the mode does not
+ * scrub recordings that were already taken under a looser one.
+ *
+ * The three modes are ordered here from most useful to most private,
+ * which is also the order they appear in the settings dropdown.
+ */
+var SessionReplayMaskingMode;
+(function (SessionReplayMaskingMode) {
+    /*
+     * Default. Only fields that are sensitive by their own markup are
+     * masked: password inputs, and inputs whose autocomplete token marks
+     * them as a card number, CVC, expiry or one-time code. Everything else
+     * — static page text and ordinary input values alike — is recorded
+     * verbatim, which is what makes a recording readable enough to debug
+     * from.
+     *
+     * "Sensitive" is decided per node and is STICKY: once a field has ever
+     * looked sensitive it stays masked for the life of the page, so a
+     * "show password" toggle cannot unmask it. Anything the markup does not
+     * declare (an account number rendered into a plain text input, an
+     * order id in a heading) is NOT covered — use the mask and block
+     * selectors on the application's policy for those.
+     */
+    SessionReplayMaskingMode["MaskSensitiveInputsOnly"] = "MaskSensitiveInputsOnly";
+    /*
+     * Every input value is masked, whether or not the field looks
+     * sensitive; static page text is still recorded verbatim. Choose this
+     * when users type data into your app that the markup does not declare
+     * as sensitive.
+     */
+    SessionReplayMaskingMode["MaskInputsOnly"] = "MaskInputsOnly";
+    /*
+     * The strictest mode. Every text node and every input value is replaced
+     * with a placeholder at capture time. Playback shows layout,
+     * interaction and shape — a wireframe — but no readable copy.
+     */
+    SessionReplayMaskingMode["MaskAllText"] = "MaskAllText";
+})(SessionReplayMaskingMode || (SessionReplayMaskingMode = {}));
+/*
+ * Narrow an untrusted value onto the enum.
+ *
+ * Used by the recorder on a config response, by the gate cache on a stored
+ * column, and by the ingest envelope parser on recorder-supplied metadata.
+ * All three fail CLOSED: anything unrecognised - a value from a newer
+ * server than this build, a tampered response, a corrupted row - becomes
+ * MaskAllText rather than the configured default, because the strictest
+ * mode is the only one that is never wrong to apply.
+ *
+ * Must stay dependency-free: this module is bundled into the browser
+ * recorder.
+ */
+export function parseSessionReplayMaskingMode(value) {
+    switch (value) {
+        case SessionReplayMaskingMode.MaskSensitiveInputsOnly:
+            return SessionReplayMaskingMode.MaskSensitiveInputsOnly;
+        case SessionReplayMaskingMode.MaskInputsOnly:
+            return SessionReplayMaskingMode.MaskInputsOnly;
+        default:
+            return SessionReplayMaskingMode.MaskAllText;
+    }
+}
+/*
+ * Does this mode record readable page content? True for everything except
+ * the wireframe mode. Drives the "this recording may contain readable
+ * content" notice on the player, which must fire for BOTH relaxed modes -
+ * keying that notice on a single enum member is how a new mode silently
+ * stops warning anyone.
+ */
+export function doesMaskingModeRecordReadableContent(mode) {
+    return mode !== SessionReplayMaskingMode.MaskAllText;
+}
+export default SessionReplayMaskingMode;
+//# sourceMappingURL=SessionReplayMaskingMode.js.map

package/build/dist/Types/Rum/SessionReplayMaskingMode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayMaskingMode.js","sourceRoot":"","sources":["../../../../Types/Rum/SessionReplayMaskingMode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,IAAK,wBAgCJ;AAhCD,WAAK,wBAAwB;IAC3B;;;;;;;;;;;;;;OAcG;IACH,+EAAmD,CAAA;IAEnD;;;;;OAKG;IACH,6DAAiC,CAAA;IAEjC;;;;OAIG;IACH,uDAA2B,CAAA;AAC7B,CAAC,EAhCI,wBAAwB,KAAxB,wBAAwB,QAgC5B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,wBAAwB,CAAC,uBAAuB;YACnD,OAAO,wBAAwB,CAAC,uBAAuB,CAAC;QAC1D,KAAK,wBAAwB,CAAC,cAAc;YAC1C,OAAO,wBAAwB,CAAC,cAAc,CAAC;QACjD;YACE,OAAO,wBAAwB,CAAC,WAAW,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oCAAoC,CAClD,IAA8B;IAE9B,OAAO,IAAI,KAAK,wBAAwB,CAAC,WAAW,CAAC;AACvD,CAAC;AAED,eAAe,wBAAwB,CAAC"}

package/build/dist/Types/Rum/SessionReplayTriggerReason.js

@@ -0,0 +1,28 @@
+/*
+ * Why a session was uploaded at all.
+ *
+ * The recorder keeps a rolling in-memory buffer and, in the default
+ * capture mode, uploads nothing until one of these fires. Storing the
+ * reason lets the read side explain *why* a recording exists, and lets
+ * analytics un-bias counts against the sample percentage in force at
+ * capture time.
+ */
+var SessionReplayTriggerReason;
+(function (SessionReplayTriggerReason) {
+    /* An uncaught error or unhandled promise rejection was observed. */
+    SessionReplayTriggerReason["Error"] = "error";
+    /* A rage click, dead click, error click or refresh-rage was observed. */
+    SessionReplayTriggerReason["Frustration"] = "frustration";
+    /* Picked up by the deterministic sample percentage, nothing went wrong. */
+    SessionReplayTriggerReason["Sampled"] = "sampled";
+    /* The host page called OneUptimeReplay.captureSession() explicitly. */
+    SessionReplayTriggerReason["Manual"] = "manual";
+    /*
+     * A performance budget was blown: LCP, a main-thread long task, or an
+     * instrumented request over the application's configured budget. Slow
+     * sessions get recordings the same way broken ones do.
+     */
+    SessionReplayTriggerReason["Performance"] = "performance";
+})(SessionReplayTriggerReason || (SessionReplayTriggerReason = {}));
+export default SessionReplayTriggerReason;
+//# sourceMappingURL=SessionReplayTriggerReason.js.map

package/build/dist/Types/Rum/SessionReplayTriggerReason.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayTriggerReason.js","sourceRoot":"","sources":["../../../../Types/Rum/SessionReplayTriggerReason.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,IAAK,0BAmBJ;AAnBD,WAAK,0BAA0B;IAC7B,oEAAoE;IACpE,6CAAe,CAAA;IAEf,yEAAyE;IACzE,yDAA2B,CAAA;IAE3B,2EAA2E;IAC3E,iDAAmB,CAAA;IAEnB,uEAAuE;IACvE,+CAAiB,CAAA;IAEjB;;;;OAIG;IACH,yDAA2B,CAAA;AAC7B,CAAC,EAnBI,0BAA0B,KAA1B,0BAA0B,QAmB9B;AAED,eAAe,0BAA0B,CAAC"}

package/build/dist/Types/Runbook/RunbookCredentialType.js

@@ -0,0 +1,7 @@
+var RunbookCredentialType;
+(function (RunbookCredentialType) {
+    RunbookCredentialType["SSH"] = "SSH";
+    RunbookCredentialType["Kubernetes"] = "Kubernetes";
+})(RunbookCredentialType || (RunbookCredentialType = {}));
+export default RunbookCredentialType;
+//# sourceMappingURL=RunbookCredentialType.js.map

package/build/dist/Types/Runbook/RunbookCredentialType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunbookCredentialType.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookCredentialType.ts"],"names":[],"mappings":"AAAA,IAAK,qBAGJ;AAHD,WAAK,qBAAqB;IACxB,oCAAW,CAAA;IACX,kDAAyB,CAAA;AAC3B,CAAC,EAHI,qBAAqB,KAArB,qBAAqB,QAGzB;AAED,eAAe,qBAAqB,CAAC"}

package/build/dist/Types/Runbook/RunbookExecutionDeadline.js

@@ -0,0 +1,93 @@
+/*
+ * When a runbook execution stops being anybody's responsibility.
+ *
+ * An execution runs inside a single queue job on one Worker. If that Worker
+ * dies mid-step and the job is never redelivered — Redis lost it, the stall
+ * budget ran out, the handler threw somewhere unrecoverable — the row stays
+ * Running with nobody advancing it. Nothing else in the system would ever
+ * change it, so the reconciler needs a defensible answer to "has this been
+ * abandoned?".
+ *
+ * The answer is derived from the step that is currently Running: it cannot
+ * legitimately outlive the claim + execution window its author configured, so
+ * anything past that window plus a grace margin is abandoned. Deriving it per
+ * execution (rather than picking one global timeout) matters now that a step
+ * may be configured for anything from one second to one hour — a single
+ * threshold would either kill live hour-long restores or leave a one-second
+ * step hanging for an hour.
+ */
+import RunbookStepExecutionStatus from "./RunbookStepExecutionStatus";
+import RunbookStepType from "./RunbookStepType";
+import { MAX_STEP_EXECUTION_TIMEOUT_IN_MS, resolveAgentClaimTimeoutInMs, resolveStepExecutionTimeoutInMs, } from "./RunbookStepTimeout";
+/*
+ * Margin on top of a step's own window before the execution is declared
+ * abandoned. The Worker running the step gives up at claim + execution + 5s
+ * and then writes the failure itself, so this only has to outlast that write —
+ * five minutes leaves room for a slow database or a Worker that is briefly
+ * paused, and keeps the reconciler from racing a run that is still healthy.
+ */
+export const STUCK_EXECUTION_GRACE_IN_MS = 5 * 60 * 1000;
+/*
+ * Allowance for a step type whose runtime the author cannot bound — today
+ * that is the AI step, which runs as long as the model provider takes. The
+ * longest configurable step window is the least surprising ceiling to borrow.
+ */
+export const UNBOUNDED_STEP_ALLOWANCE_IN_MS = MAX_STEP_EXECUTION_TIMEOUT_IN_MS;
+/*
+ * The longest a single step can legitimately occupy its Worker. Agent steps
+ * spend the claim window waiting for an agent to pick the job up and the
+ * execution window actually running, so they get both.
+ */
+export function getStepMaxRuntimeInMs(step) {
+    switch (step.type) {
+        case RunbookStepType.Bash:
+        case RunbookStepType.JavaScript: {
+            const config = step.config;
+            return (resolveAgentClaimTimeoutInMs(config.claimTimeoutInMs) +
+                resolveStepExecutionTimeoutInMs(config.timeoutInMs));
+        }
+        case RunbookStepType.HttpRequest: {
+            const config = step.config;
+            return resolveStepExecutionTimeoutInMs(config.timeoutInMs);
+        }
+        /*
+         * Manual steps park the execution as WaitingForManualStep rather than
+         * Running, so one found Running is a torn write, not a wait. It gets no
+         * allowance — the grace margin alone decides.
+         */
+        case RunbookStepType.Manual:
+            return 0;
+        default:
+            return UNBOUNDED_STEP_ALLOWANCE_IN_MS;
+    }
+}
+/*
+ * Deadline for an execution currently in the Running state.
+ *
+ * Anchored on the running step's own startedAt where possible. Two fallbacks
+ * use the execution's updatedAt instead:
+ *
+ *  - A step is Running but carries no usable startedAt. The state machine
+ *    stamps startedAt and persists in the same write, so updatedAt is the same
+ *    instant; the step still gets its full allowance.
+ *  - No step is Running at all. The Worker died between steps, so nothing is
+ *    executing and no allowance is owed — only the grace margin.
+ */
+export function getRunningExecutionDeadline(data) {
+    const runningStep = data.stepExecutions.find((stepExecution) => {
+        return stepExecution.status === RunbookStepExecutionStatus.Running;
+    });
+    if (!runningStep) {
+        return new Date(data.executionUpdatedAt.getTime() + STUCK_EXECUTION_GRACE_IN_MS);
+    }
+    const startedAtMs = runningStep.startedAt
+        ? new Date(runningStep.startedAt).getTime()
+        : NaN;
+    const anchorMs = isFinite(startedAtMs)
+        ? startedAtMs
+        : data.executionUpdatedAt.getTime();
+    return new Date(anchorMs +
+        getStepMaxRuntimeInMs(runningStep.step) +
+        STUCK_EXECUTION_GRACE_IN_MS);
+}
+//# sourceMappingURL=RunbookExecutionDeadline.js.map

package/build/dist/Types/Runbook/RunbookExecutionDeadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RunbookExecutionDeadline.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookExecutionDeadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,OAAO,0BAA0B,MAAM,8BAA8B,CAAC;AACtE,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,gCAAgC,CAAC;AAEnC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,eAAe,CAAC,IAAI,CAAC;QAC1B,KAAK,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAChC,MAAM,MAAM,GAA0C,IAAI,CAAC,MAEnC,CAAC;YACzB,OAAO,CACL,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBACrD,+BAA+B,CAAC,MAAM,CAAC,WAAW,CAAC,CACpD,CAAC;QACJ,CAAC;QAED,KAAK,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;YACjC,MAAM,MAAM,GACV,IAAI,CAAC,MAA+B,CAAC;YACvC,OAAO,+BAA+B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;QAED;;;;WAIG;QACH,KAAK,eAAe,CAAC,MAAM;YACzB,OAAO,CAAC,CAAC;QAEX;YACE,OAAO,8BAA8B,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAG3C;IACC,MAAM,WAAW,GACf,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,aAAwC,EAAE,EAAE;QACpE,OAAO,aAAa,CAAC,MAAM,KAAK,0BAA0B,CAAC,OAAO,CAAC;IACrE,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,IAAI,CACb,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,GAAG,2BAA2B,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAW,WAAW,CAAC,SAAS;QAC/C,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QAC3C,CAAC,CAAC,GAAG,CAAC;IAER,MAAM,QAAQ,GAAW,QAAQ,CAAC,WAAW,CAAC;QAC5C,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;IAEtC,OAAO,IAAI,IAAI,CACb,QAAQ;QACN,qBAAqB,CAAC,WAAW,CAAC,IAAI,CAAC;QACvC,2BAA2B,CAC9B,CAAC;AACJ,CAAC"}

package/build/dist/Types/Runbook/RunbookStep.js

@@ -1,2 +1,21 @@
-export {};
+/*
+ * The workload actions that cover almost every "turn it off and on again"
+ * remediation. Deliberately a closed set of verbs rather than free-form
+ * manifests: a runbook that can PATCH arbitrary Kubernetes objects is a
+ * cluster-admin shell, and the whole reason this exists is to make the common
+ * remediations safe rather than to add another way to run anything.
+ */
+export var KubernetesAction;
+(function (KubernetesAction) {
+    // Rolling restart: stamps the pod template so the controller recreates pods.
+    KubernetesAction["RestartWorkload"] = "RestartWorkload";
+    // Set replica count — scale out under load, or to zero and back.
+    KubernetesAction["ScaleWorkload"] = "ScaleWorkload";
+})(KubernetesAction || (KubernetesAction = {}));
+export var KubernetesWorkloadKind;
+(function (KubernetesWorkloadKind) {
+    KubernetesWorkloadKind["Deployment"] = "Deployment";
+    KubernetesWorkloadKind["StatefulSet"] = "StatefulSet";
+    KubernetesWorkloadKind["DaemonSet"] = "DaemonSet";
+})(KubernetesWorkloadKind || (KubernetesWorkloadKind = {}));
 //# sourceMappingURL=RunbookStep.js.map

package/build/dist/Types/Runbook/RunbookStep.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunbookStep.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookStep.ts"],"names":[],"mappings":""}
+{"version":3,"file":"RunbookStep.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookStep.ts"],"names":[],"mappings":"AAkGA;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,6EAA6E;IAC7E,uDAAmC,CAAA;IACnC,iEAAiE;IACjE,mDAA+B,CAAA;AACjC,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,mDAAyB,CAAA;IACzB,qDAA2B,CAAA;IAC3B,iDAAuB,CAAA;AACzB,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC"}

package/build/dist/Types/Runbook/RunbookStepTimeout.js

@@ -0,0 +1,142 @@
+/*
+ * Timeouts are configured per step and stored on the step config in
+ * milliseconds. Both the dashboard (which edits them) and the Worker (which
+ * enforces them) resolve values through this module so a step never runs with
+ * a bound the author could not see, and never with one that would pin a
+ * Worker slot open indefinitely.
+ */
+// How long the step itself may run before it is killed.
+export const DEFAULT_STEP_EXECUTION_TIMEOUT_IN_MS = 30 * 1000;
+export const MIN_STEP_EXECUTION_TIMEOUT_IN_MS = 1000;
+export const MAX_STEP_EXECUTION_TIMEOUT_IN_MS = 60 * 60 * 1000;
+/*
+ * How long the Worker waits for the selected agent to claim the job. Only
+ * meaningful for Bash and JavaScript steps, which never run on the Worker.
+ */
+export const DEFAULT_AGENT_CLAIM_TIMEOUT_IN_MS = 2 * 60 * 1000;
+export const MIN_AGENT_CLAIM_TIMEOUT_IN_MS = 1000;
+export const MAX_AGENT_CLAIM_TIMEOUT_IN_MS = 60 * 60 * 1000;
+export const STEP_EXECUTION_TIMEOUT_BOUNDS = {
+    defaultInMs: DEFAULT_STEP_EXECUTION_TIMEOUT_IN_MS,
+    minInMs: MIN_STEP_EXECUTION_TIMEOUT_IN_MS,
+    maxInMs: MAX_STEP_EXECUTION_TIMEOUT_IN_MS,
+};
+export const AGENT_CLAIM_TIMEOUT_BOUNDS = {
+    defaultInMs: DEFAULT_AGENT_CLAIM_TIMEOUT_IN_MS,
+    minInMs: MIN_AGENT_CLAIM_TIMEOUT_IN_MS,
+    maxInMs: MAX_AGENT_CLAIM_TIMEOUT_IN_MS,
+};
+/*
+ * Resolve a configured timeout to the value execution should actually use.
+ *
+ * Anything unusable — unset, blank, non-numeric, zero or negative — falls back
+ * to the default rather than failing the step, because a runbook that runs
+ * with the documented default is more useful during an incident than one that
+ * refuses to run at all. Usable values are rounded to whole milliseconds and
+ * clamped into range.
+ */
+export function resolveTimeoutInMs(value, bounds) {
+    if (value === null || value === undefined || value === "") {
+        return bounds.defaultInMs;
+    }
+    const parsed = typeof value === "number" ? value : Number(value);
+    if (!isFinite(parsed) || parsed <= 0) {
+        return bounds.defaultInMs;
+    }
+    return Math.min(Math.max(Math.round(parsed), bounds.minInMs), bounds.maxInMs);
+}
+export function resolveStepExecutionTimeoutInMs(value) {
+    return resolveTimeoutInMs(value, STEP_EXECUTION_TIMEOUT_BOUNDS);
+}
+export function resolveAgentClaimTimeoutInMs(value) {
+    return resolveTimeoutInMs(value, AGENT_CLAIM_TIMEOUT_BOUNDS);
+}
+/*
+ * Milliseconds are the storage unit; seconds are what people think in. The
+ * two helpers below bridge the step editor's seconds input and the stored
+ * value. An empty input means "unset" — the step then uses the default — so
+ * it round-trips to undefined rather than to zero.
+ */
+export function timeoutInMsToSecondsInputValue(value) {
+    if (value === null || value === undefined || !isFinite(Number(value))) {
+        return "";
+    }
+    const seconds = Number(value) / 1000;
+    if (seconds <= 0) {
+        return "";
+    }
+    // Sub-second values would render as "0" and read as "no timeout"; keep the decimal.
+    return String(Math.round(seconds * 1000) / 1000);
+}
+export function secondsInputValueToTimeoutInMs(value) {
+    const trimmed = (value || "").trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    const seconds = Number(trimmed);
+    if (!isFinite(seconds) || seconds <= 0) {
+        return undefined;
+    }
+    const inMs = Math.round(seconds * 1000);
+    /*
+     * Sub-half-millisecond input rounds to zero. Zero is not a timeout, so it
+     * reports as unset like any other unusable value — storing a literal 0 would
+     * put a number in the step config that means nothing.
+     */
+    if (inMs <= 0) {
+        return undefined;
+    }
+    return inMs;
+}
+/*
+ * Shown when the field holds something that is not a number at all. Lives here
+ * rather than in the editor so the message the browser's own parse failure
+ * produces is the same one this validator produces.
+ */
+export const NON_NUMERIC_TIMEOUT_MESSAGE = "Enter a number of seconds.";
+/*
+ * Validation message for the step editor. Returns null when the input is
+ * acceptable — including when it is blank, which simply means "use the
+ * default". Out-of-range values are still saved and then clamped at run time;
+ * the message is what tells the author that will happen.
+ */
+export function getTimeoutValidationError(value, bounds) {
+    const trimmed = (value || "").trim();
+    if (!trimmed) {
+        return null;
+    }
+    const seconds = Number(trimmed);
+    if (!isFinite(seconds)) {
+        return NON_NUMERIC_TIMEOUT_MESSAGE;
+    }
+    const inMs = Math.round(seconds * 1000);
+    /*
+     * Zero, negatives, and anything that rounds down to zero milliseconds are
+     * not timeouts. They fall back to the default rather than being clamped up,
+     * so they get the same message.
+     */
+    if (seconds <= 0 || inMs <= 0) {
+        return "Timeout must be greater than 0 seconds.";
+    }
+    if (inMs < bounds.minInMs) {
+        return `Minimum is ${bounds.minInMs / 1000} second${bounds.minInMs === 1000 ? "" : "s"}.`;
+    }
+    if (inMs > bounds.maxInMs) {
+        return `Maximum is ${bounds.maxInMs / 1000} seconds (${bounds.maxInMs / 60000} minutes).`;
+    }
+    return null;
+}
+/*
+ * True when the input is a usable number that sits outside the bounds — the
+ * only case where run time will clamp it. Unusable input (blank, zero, junk)
+ * falls back to the default instead, which is the opposite end of the range,
+ * so the editor must not promise clamping there.
+ */
+export function willTimeoutBeClamped(value, bounds) {
+    const inMs = secondsInputValueToTimeoutInMs(value);
+    if (inMs === undefined) {
+        return false;
+    }
+    return inMs < bounds.minInMs || inMs > bounds.maxInMs;
+}
+//# sourceMappingURL=RunbookStepTimeout.js.map