@oneuptime/common 11.7.4 → 12.0.1

package/Server/Services/{RunbookAgentOwnerTeamService.ts → AutoRemediationRuleService.ts}

@@ -1,5 +1,5 @@
 import DatabaseService from "./DatabaseService";
-import Model from "../../Models/DatabaseModels/RunbookAgentOwnerTeam";
+import Model from "../../Models/DatabaseModels/AutoRemediationRule";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {

package/Server/Services/AutoRemediationSuggestionService.ts

@@ -0,0 +1,183 @@
+import AutoRemediationSuggestionStatus from "../../Types/AutoRemediation/AutoRemediationSuggestionStatus";
+import AutoRemediationVerificationStatus from "../../Types/AutoRemediation/AutoRemediationVerificationStatus";
+import { JSONObject } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import CountBy from "../Types/Database/CountBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import FindBy from "../Types/Database/FindBy";
+import { OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/AutoRemediationSuggestion";
+import { applyOptionalAlertRelatedRecordPrivacyFilter } from "../Utils/Alert/AlertPrivacyFilter";
+import { applyOptionalIncidentRelatedRecordPrivacyFilter } from "../Utils/Incident/IncidentPrivacyFilter";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { UpdateQueryBuilder, UpdateResult } from "typeorm";
+import { QueryDeepPartialEntity } from "typeorm/query-builder/QueryPartialEntity";
+
+/*
+ * The fields a status transition may set. Primitives only — the query-builder
+ * update below bypasses column transformers, so ObjectID-backed columns must
+ * be passed as their pre-transformed string form (ObjectID.toString()).
+ */
+export interface SuggestionTransitionSet {
+  status: AutoRemediationSuggestionStatus;
+  runbookId?: string | undefined;
+  runbookNameSnapshot?: string | undefined;
+  rationaleMarkdown?: string | undefined;
+  runbookExecutionId?: string | undefined;
+  approvedByUserId?: string | undefined;
+  approvedAt?: Date | undefined;
+  dismissedByUserId?: string | undefined;
+  dismissedAt?: Date | undefined;
+  verificationStatus?: AutoRemediationVerificationStatus | undefined;
+  verificationDeadlineAt?: Date | undefined;
+  /*
+   * The frozen AI-composed command plan (AiRemediationCommandPlan as plain
+   * JSON) for CommandPlan suggestions. jsonb column — no transformer, so
+   * the query-builder update stores it as-is.
+   */
+  commandPlan?: JSONObject | undefined;
+}
+
+// What the outcome verifier may set when a verification concludes.
+export interface VerificationTransitionSet {
+  verificationStatus: AutoRemediationVerificationStatus;
+  verificationCompletedAt?: Date | undefined;
+  verificationNote?: string | undefined;
+}
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * Suggestions are incident/alert child records whose rationale can quote
+   * the AI's analysis of the subject — reads must respect the subject's
+   * privacy exactly like feed items and internal notes do. Both link
+   * columns are nullable (a row links an incident OR an alert), so the
+   * null-tolerant filter variants apply: a NULL link passes its own clause
+   * and the sibling column's filter does the gating.
+   */
+  @CaptureSpan()
+  protected override async onBeforeFind(
+    findBy: FindBy<Model>,
+  ): Promise<OnFind<Model>> {
+    findBy.query = applyOptionalIncidentRelatedRecordPrivacyFilter(
+      findBy.query,
+      findBy.props,
+    );
+    findBy.query = applyOptionalAlertRelatedRecordPrivacyFilter(
+      findBy.query,
+      findBy.props,
+    );
+    return { findBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  public override async countBy(
+    countBy: CountBy<Model>,
+  ): Promise<PositiveNumber> {
+    countBy.query = applyOptionalIncidentRelatedRecordPrivacyFilter(
+      countBy.query,
+      countBy.props,
+    );
+    countBy.query = applyOptionalAlertRelatedRecordPrivacyFilter(
+      countBy.query,
+      countBy.props,
+    );
+    return super.countBy(countBy);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    updateBy.query = applyOptionalIncidentRelatedRecordPrivacyFilter(
+      updateBy.query,
+      updateBy.props,
+    );
+    updateBy.query = applyOptionalAlertRelatedRecordPrivacyFilter(
+      updateBy.query,
+      updateBy.props,
+    );
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    deleteBy.query = applyOptionalIncidentRelatedRecordPrivacyFilter(
+      deleteBy.query,
+      deleteBy.props,
+    );
+    deleteBy.query = applyOptionalAlertRelatedRecordPrivacyFilter(
+      deleteBy.query,
+      deleteBy.props,
+    );
+    return { deleteBy, carryForward: null };
+  }
+
+  /*
+   * A genuinely atomic status transition: one conditional UPDATE whose WHERE
+   * carries the expected current status. Returns the number of rows changed —
+   * 0 means another actor won the race. This is what makes double-approving
+   * (and therefore double-starting a runbook) impossible; updateOneBy is
+   * SELECT-then-save and cannot implement a claim.
+   */
+  @CaptureSpan()
+  public async attemptStatusTransition(data: {
+    suggestionId: ObjectID;
+    fromStatus: AutoRemediationSuggestionStatus;
+    set: SuggestionTransitionSet;
+  }): Promise<number> {
+    /*
+     * The double cast stops TS from structurally exploring JSONObject
+     * (commandPlan) against the entity type — a recursive type that trips
+     * TS2589. The set is intentionally a raw column map.
+     */
+    const queryBuilder: UpdateQueryBuilder<Model> = this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set(data.set as unknown as QueryDeepPartialEntity<Model>)
+      .where('"_id" = :id', { id: data.suggestionId.toString() })
+      .andWhere('"status" = :fromStatus', { fromStatus: data.fromStatus })
+      .andWhere('"deletedAt" IS NULL');
+
+    const result: UpdateResult = await queryBuilder.execute();
+
+    return result.affected || 0;
+  }
+
+  /*
+   * The verification twin of attemptStatusTransition: one conditional
+   * UPDATE guarded on the expected current verificationStatus, so
+   * concurrent verifier sweeps (multiple Workers replicas) settle each
+   * verification exactly once.
+   */
+  @CaptureSpan()
+  public async attemptVerificationTransition(data: {
+    suggestionId: ObjectID;
+    fromVerificationStatus: AutoRemediationVerificationStatus;
+    set: VerificationTransitionSet;
+  }): Promise<number> {
+    const queryBuilder: UpdateQueryBuilder<Model> = this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set(data.set as QueryDeepPartialEntity<Model>)
+      .where('"_id" = :id', { id: data.suggestionId.toString() })
+      .andWhere('"verificationStatus" = :fromVerificationStatus', {
+        fromVerificationStatus: data.fromVerificationStatus,
+      })
+      .andWhere('"deletedAt" IS NULL');
+
+    const result: UpdateResult = await queryBuilder.execute();
+
+    return result.affected || 0;
+  }
+}
+
+export default new Service();

package/Server/Services/BillingService.ts

@@ -261,12 +261,23 @@ export class BillingService extends BaseService {
     meteredSubscriptionId: string;
     trialEndsAt: Date | null;
   }> {
+    /*
+     * Only plans with a Stripe price can become subscription items. A plan
+     * without one yet would make getPriceId throw and abort project
+     * creation, so we skip them here - their usage still stages
+     * into TelemetryUsageBilling and is pushed once the price ids exist.
+     */
+    const priceableMeteredPlans: Array<ServerMeteredPlan> =
+      data.serverMeteredPlans.filter((plan: ServerMeteredPlan) => {
+        return plan.hasPriceId();
+      });
+
     const meteredPlanSubscriptionParams: Stripe.SubscriptionCreateParams = {
       customer: data.customerId,
 
       proration_behavior: "always_invoice",
 
-      items: data.serverMeteredPlans.map((item: ServerMeteredPlan) => {
+      items: priceableMeteredPlans.map((item: ServerMeteredPlan) => {
         return {
           price: item.getPriceId(),
         };
@@ -456,6 +467,16 @@ export class BillingService extends BaseService {
       throw new BadDataException(Errors.BillingService.BILLING_NOT_ENABLED);
     }
 
+    /*
+     * A plan without a Stripe price yet cannot be pushed
+     * to a subscription - getPriceId would throw. Usage has already been staged
+     * into TelemetryUsageBilling by the caller, so skipping here loses nothing;
+     * the push happens once the price ids are created.
+     */
+    if (!serverMeteredPlan.hasPriceId()) {
+      return;
+    }
+
     // get subscription.
     const subscription: Stripe.Subscription = await this.getSubscription(
       subscriptionId.toString(),
@@ -1496,11 +1517,39 @@ export class BillingService extends BaseService {
       return "price_1TGwTDANuQdJ93r7s0jKRxaT";
     }
 
+    if (productType === ProductType.SessionReplay) {
+      if (this.isTestEnvironment()) {
+        return "price_1U0icaANuQdJ93r7yE4a6icc";
+      }
+
+      return "price_1U0iWJANuQdJ93r7iVAXwhdP";
+    }
+
     throw new BadDataException(
       "Plan with productType " + productType + " not found",
     );
   }
 
+  /*
+   * Whether a Stripe metered price exists for this product type yet.
+   *
+   * getMeteredPlanPriceId throws for product types whose Stripe prices have
+   * not been created and for unknown types. Every product type is priced
+   * today, so this only guards the next one added ahead of its Stripe price.
+   * Callers that build Stripe subscription items must skip those plans instead of
+   * letting the throw abort the whole operation - a metered plan without a
+   * price still stages usage into TelemetryUsageBilling, only the push to
+   * Stripe waits on the price ids. This is the single, side-effect-free way to
+   * ask, so we keep getMeteredPlanPriceId as the single source of truth.
+   */
+  public hasMeteredPlanPriceId(productType: ProductType): boolean {
+    try {
+      return Boolean(this.getMeteredPlanPriceId(productType));
+    } catch {
+      return false;
+    }
+  }
+
   @CaptureSpan()
   public verifyWebhookSignature(
     payload: string | Buffer,

package/Server/Services/DatabaseService.ts

@@ -68,6 +68,7 @@ import {
   EntityManager,
   Repository,
   SelectQueryBuilder,
+  UpdateResult,
 } from "typeorm";
 import { ColumnMetadata } from "typeorm/metadata/ColumnMetadata";
 import { EntityMetadata } from "typeorm/metadata/EntityMetadata";
@@ -1950,6 +1951,49 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
           })
         : [];
 
+      /*
+       * save() has upsert semantics: if the located row is hard-deleted by a
+       * concurrent request between the _findBy above and the write below,
+       * save() INSERTs a resurrected "zombie" row carrying only the update's
+       * columns. Zombies with enough NOT NULL columns persist and then hold
+       * foreign keys forever (e.g. a probe status-update racing a monitor
+       * delete resurrected the Monitor and permanently blocked deleting the
+       * MonitorStatus it referenced). Updates therefore go through
+       * repository.update(), which never inserts and simply affects zero
+       * rows when the target is gone.
+       *
+       * Only EntityArray (many-to-many) columns still need save(), because
+       * their junction rows cannot be written by a plain UPDATE. Entity
+       * (many-to-one) columns must NOT route to save(): they are ordinary
+       * foreign-key columns on this same table, and TypeORM's update()
+       * resolves a relation property to its join columns
+       * (EntityMetadata.findColumnsWithPropertyPath). Routing them to save()
+       * left the resurrection hole open for any caller that expressed the
+       * write as the relation member rather than the scalar id — e.g.
+       * Monitor.currentMonitorStatus vs Monitor.currentMonitorStatusId,
+       * which are two decorated members over the SAME physical column.
+       */
+      const relationColumnNames: Set<string> = new Set<string>(
+        this.getModel()
+          .getTableColumns()
+          .columns.filter((column: string) => {
+            const metadata: TableColumnMetadata | undefined =
+              this.getModel().getTableColumnMetadata(column);
+            return metadata?.type === TableColumnType.EntityArray;
+          }),
+      );
+      const hasRelationUpdates: boolean = dataKeys.some((key: string) => {
+        return relationColumnNames.has(key);
+      });
+
+      /*
+       * Rows the write actually touched. A row hard-deleted between the find
+       * above and the write is reported by update() as zero rows affected;
+       * it must not fire success hooks (they re-read the row and would
+       * dereference null) nor be counted as updated.
+       */
+      const affectedItems: Array<TBaseModel> = [];
+
       for (const item of items) {
         /*
          * _id must be set AFTER the spread: update data can carry an
@@ -1971,7 +2015,37 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
           projectId: updateBy.props.tenantId?.toString(),
         } as LogAttributes);
 
-        await this.getRepository().save(updatedItem);
+        if (hasRelationUpdates) {
+          await this.getRepository().save(updatedItem);
+        } else {
+          const { _id, ...updateData } = updatedItem;
+          const updateResult: UpdateResult = await this.getRepository().update(
+            { _id: _id } as any,
+            {
+              ...updateData,
+              /*
+               * save() bumps the @VersionColumn automatically; update() does
+               * not, so emulate it to keep the audit counter behaviour
+               * identical.
+               */
+              version: () => {
+                return '"version" + 1';
+              },
+            } as any,
+          );
+
+          /*
+           * The row was hard-deleted between the find above and this write.
+           * Nothing was updated, so skip the success hooks for it: they
+           * re-read the row and would dereference null (and would report a
+           * change that never happened).
+           */
+          if (updateResult.affected === 0) {
+            continue;
+          }
+        }
+
+        affectedItems.push(item);
 
         // hit workflow.
         if (
@@ -2033,16 +2107,22 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
        *     ).affected || 0;
        */
 
+      /*
+       * onUpdateSuccess always fires — subclasses rely on it being called
+       * even when nothing matched — but it is handed only the rows the write
+       * actually affected, so a row deleted mid-update never appears as a
+       * phantom id that hooks would then fail to re-read.
+       */
       if (!updateBy.props.ignoreHooks) {
         await this.onUpdateSuccess(
           { updateBy, carryForward },
-          items.map((i: TBaseModel) => {
+          affectedItems.map((i: TBaseModel) => {
             return new ObjectID(i._id!);
           }),
         );
       }
 
-      return items.length;
+      return affectedItems.length;
     } catch (error) {
       await this.onUpdateError(error as Exception);
       throw this.getException(error as Exception);
@@ -2173,6 +2253,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   public async updateColumnsByIdWithoutHooks(input: {
     id: ObjectID;
     data: PartialEntity<TBaseModel>;
+    /*
+     * Leave `updatedAt` untouched. For passive bookkeeping writes (liveness
+     * timestamps, ingest health markers) where consumers key change
+     * detection off updatedAt - e.g. the session replay configEpoch - a
+     * refreshed updateDate would broadcast "configuration changed" on every
+     * heartbeat.
+     */
+    skipUpdateDateColumn?: boolean;
   }): Promise<void> {
     if (!input.id) {
       throw new BadDataException("id is required");
@@ -2222,7 +2310,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
 
     // The raw path has no entity machinery to touch updateDate — do it here.
-    if (metadata.updateDateColumn) {
+    if (metadata.updateDateColumn && !input.skipUpdateDateColumn) {
       setClauses.push(
         `"${metadata.updateDateColumn.databaseName}" = CURRENT_TIMESTAMP`,
       );

package/Server/Services/IncidentService.ts

@@ -71,6 +71,7 @@ import IncidentOnCallRuleEngineService from "./IncidentOnCallRuleEngineService";
 import IncidentOwnerRuleEngineService from "./IncidentOwnerRuleEngineService";
 import IncidentPrivacyRuleEngineService from "./IncidentPrivacyRuleEngineService";
 import RunbookRuleEngineService from "./RunbookRuleEngineService";
+import AutoRemediationRuleEngineService from "./AutoRemediationRuleEngineService";
 import { Blue500, Gray500, Red500 } from "../../Types/BrandColors";
 import Label from "../../Models/DatabaseModels/Label";
 import LabelService from "./LabelService";
@@ -1081,6 +1082,14 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Incident not found");
     }
 
+    /*
+     * Whether an AI investigation run was enqueued for this incident — set
+     * by the investigation step below and read by the auto-remediation step
+     * after it: an enqueued investigation DEFERS remediation until the run
+     * settles (RCA-first ordering, see RemediationHandoff).
+     */
+    let aiInvestigationEnqueued: boolean = false;
+
     // Execute operations sequentially with error handling
     Promise.resolve()
       .then(async () => {
@@ -1383,10 +1392,11 @@ export class Service extends DatabaseService<Model> {
          */
         try {
           if (createdItem.projectId && createdItem.id) {
-            await AIIncidentInvestigationRunner.investigateNewIncident({
-              incidentId: createdItem.id,
-              projectId: createdItem.projectId,
-            });
+            aiInvestigationEnqueued =
+              await AIIncidentInvestigationRunner.investigateNewIncident({
+                incidentId: createdItem.id,
+                projectId: createdItem.projectId,
+              });
           }
         } catch (error) {
           logger.error(
@@ -1398,6 +1408,33 @@ export class Service extends DatabaseService<Model> {
           );
         }
       })
+      .then(async () => {
+        /*
+         * Auto-remediation runs LAST — and only when NO AI investigation
+         * was enqueued above. RCA-first ordering: when an investigation is
+         * in flight, remediation is deferred until that run settles
+         * (RemediationHandoff releases it on any terminal outcome), so the
+         * remediation planner always has the posted root cause analysis as
+         * input instead of racing it. Without an investigation (opt-out,
+         * gates, budget) remediation fires here immediately — it must
+         * never silently depend on the AI lane being enabled.
+         */
+        try {
+          if (!aiInvestigationEnqueued) {
+            await AutoRemediationRuleEngineService.applyRulesToIncident(
+              createdItem,
+            );
+          }
+        } catch (error) {
+          logger.error(
+            `Apply auto-remediation rules failed in IncidentService.onCreateSuccess: ${error}`,
+            {
+              projectId: createdItem.projectId?.toString(),
+              incidentId: createdItem.id?.toString(),
+            } as LogAttributes,
+          );
+        }
+      })
       .catch((error: Error) => {
         logger.error(
           `Critical error in IncidentService sequential operations: ${error}`,
@@ -2643,12 +2680,27 @@ ${incidentSeverity.name}
 
     if (monitors.length > 0) {
       // get resolved monitor state.
+      /*
+       * Resolve monitors back to the project's operational status. A project
+       * can hold more than one operational state, so this lookup MUST be
+       * deterministic: without an explicit sort findOneBy falls back to
+       * `createdAt DESC` and would resolve monitors into whichever operational
+       * status was created most recently (e.g. a user- or fixture-added one)
+       * rather than the seeded default. Order by priority ascending (the
+       * seeded default operational status is priority 0), tie-broken by the
+       * oldest row, matching MonitorService.onBeforeCreate so a monitor's
+       * operational status is the same canonical one throughout its lifecycle.
+       */
       const resolvedMonitorState: MonitorStatus | null =
         await MonitorStatusService.findOneBy({
           query: {
             projectId: projectId!,
             isOperationalState: true,
           },
+          sort: {
+            priority: SortOrder.Ascending,
+            createdAt: SortOrder.Ascending,
+          },
           props: {
             isRoot: true,
           },

package/Server/Services/IncidentSeverityService.ts

@@ -1,3 +1,4 @@
+import logger from "../Utils/Logger";
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
@@ -145,17 +146,30 @@ export class Service extends DatabaseService<Model> {
         newOrder = incidentSeverity.order! - 1;
       }
 
-      await this.updateOneBy({
-        query: {
-          _id: incidentSeverity._id!,
-        },
-        data: {
-          order: newOrder,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
+      /*
+       * Concurrent deletes (e.g. Terraform destroying several items in
+       * parallel) can soft-delete a row between the findBy above and
+       * this update; save() would then INSERT with a null projectId and
+       * fail the whole delete with a 500. A row that vanished
+       * mid-rearrange needs no repositioning - skip it.
+       */
+      try {
+        await this.updateOneBy({
+          query: {
+            _id: incidentSeverity._id!,
+          },
+          data: {
+            order: newOrder,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+      } catch (err) {
+        logger.warn(
+          `rearrange: skipping row (likely deleted concurrently): ${err}`,
+        );
+      }
     }
   }
 }

package/Server/Services/IncidentStateService.ts

@@ -1,3 +1,4 @@
+import logger from "../Utils/Logger";
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
@@ -143,17 +144,30 @@ export class Service extends DatabaseService<IncidentState> {
         newOrder = incidentState.order! - 1;
       }
 
-      await this.updateOneBy({
-        query: {
-          _id: incidentState._id!,
-        },
-        data: {
-          order: newOrder,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
+      /*
+       * Concurrent deletes (e.g. Terraform destroying several items in
+       * parallel) can soft-delete a row between the findBy above and
+       * this update; save() would then INSERT with a null projectId and
+       * fail the whole delete with a 500. A row that vanished
+       * mid-rearrange needs no repositioning - skip it.
+       */
+      try {
+        await this.updateOneBy({
+          query: {
+            _id: incidentState._id!,
+          },
+          data: {
+            order: newOrder,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+      } catch (err) {
+        logger.warn(
+          `rearrange: skipping row (likely deleted concurrently): ${err}`,
+        );
+      }
     }
   }
 

package/Server/Services/Index.ts

@@ -90,6 +90,7 @@ import MonitorOwnerTeamService from "./MonitorOwnerTeamService";
 import MonitorOwnerUserService from "./MonitorOwnerUserService";
 import MonitorProbeService from "./MonitorProbeService";
 import MonitorSecretService from "./MonitorSecretService";
+import RunbookCredentialService from "./RunbookCredentialService";
 import RunbookSecretService from "./RunbookSecretService";
 import AIInsightService from "./AIInsightService";
 
@@ -121,6 +122,11 @@ import ProjectService from "./ProjectService";
 import ProjectUserProfileService from "./ProjectUserProfileService";
 import ProfileService from "./ProfileService";
 import ProfileSampleService from "./ProfileSampleService";
+import RumSessionService from "./RumSessionService";
+import RumSessionChunkService from "./RumSessionChunkService";
+import RumSessionReplayViewService from "./RumSessionReplayViewService";
+import RumSessionErasureRequestService from "./RumSessionErasureRequestService";
+import RumSessionPinService from "./RumSessionPinService";
 // Project SMTP Config.
 import ProjectSmtpConfigService from "./ProjectSmtpConfigService";
 import ProjectSsoService from "./ProjectSsoService";
@@ -372,6 +378,7 @@ const services: Array<BaseService> = [
   MonitorStatusService,
   MonitorStatusTimelineService,
   MonitorSecretService,
+  RunbookCredentialService,
   RunbookSecretService,
   AIInsightService,
   MonitorFeedService,
@@ -546,6 +553,11 @@ const services: Array<BaseService> = [
 
   ProjectSCIMLogService,
   StatusPageSCIMLogService,
+
+  // Session replay control tables (the recordings themselves are in ClickHouse).
+  RumSessionReplayViewService,
+  RumSessionErasureRequestService,
+  RumSessionPinService,
 ];
 
 export const AnalyticsServices: Array<
@@ -573,6 +585,13 @@ export const AnalyticsServices: Array<
   NetworkFlowService,
   ProfileService,
   ProfileSampleService,
+  /*
+   * Session replay. THIS is the array boot-time createTables() iterates —
+   * omitting it here means the tables are silently never created, however
+   * correctly the models are registered elsewhere.
+   */
+  RumSessionService,
+  RumSessionChunkService,
   AuditLogService,
 ];