@oneuptime/common 12.0.24 → 12.0.26

package/Tests/Utils/Telemetry/LlmMetricQuery.test.ts

@@ -6,6 +6,7 @@ import Query from "../../../Types/BaseDatabase/Query";
 import ObjectID from "../../../Types/ObjectID";
 import {
   LlmCostMetricNames,
+  LlmMicroUsdCostMetricNames,
   LlmTokenUsageMetricNames,
 } from "../../../Types/Telemetry/LlmMetricConventions";
 import LlmMetricQuery, {
@@ -13,6 +14,8 @@ import LlmMetricQuery, {
   LlmMetricTokenTotals,
   METRIC_MODEL_ATTRIBUTE_KEY,
   METRIC_SYSTEM_ATTRIBUTE_KEY,
+  METRIC_TEAM_ATTRIBUTE_KEY,
+  METRIC_USER_ATTRIBUTE_KEY,
 } from "../../../Utils/Telemetry/LlmMetricQuery";
 import { describe, expect, test } from "@jest/globals";
 
@@ -470,3 +473,298 @@ describe("LlmMetricQuery", () => {
     });
   });
 });
+
+/*
+ * Employee / team scoping of metric-sourced spend.
+ *
+ * The bug class: a scoping dimension that silently does nothing. If a filter
+ * is dropped, mis-keyed, or written to the wrong attribute name, the query
+ * quietly returns the WHOLE project's spend under one person's name — a
+ * number that renders perfectly and attributes an org-wide bill to one
+ * engineer. Nothing about that failure looks like a failure.
+ */
+describe("LlmMetricQuery — employee and team scoping", () => {
+  test("narrows by employee email using the primary identity key", () => {
+    const query: Record<string, unknown> = LlmMetricQuery.buildBaseQuery({
+      scope: scope({ llmUserEmail: "ada@example.com" }),
+      metricNames: ["a"],
+    }) as unknown as Record<string, unknown>;
+
+    expect(query["attributes"]).toEqual({
+      [METRIC_USER_ATTRIBUTE_KEY]: "ada@example.com",
+    });
+    expect(METRIC_USER_ATTRIBUTE_KEY).toBe("user.email");
+  });
+
+  test("narrows by employee id on the same primary identity key", () => {
+    /*
+     * The metric stream has ONE identity attribute, unlike the span side
+     * where id and email are separate columns — so an id-scoped query filters
+     * the same key.
+     */
+    const query: Record<string, unknown> = LlmMetricQuery.buildBaseQuery({
+      scope: scope({ llmUserId: "acct-9f2" }),
+      metricNames: ["a"],
+    }) as unknown as Record<string, unknown>;
+
+    expect(query["attributes"]).toEqual({
+      [METRIC_USER_ATTRIBUTE_KEY]: "acct-9f2",
+    });
+  });
+
+  test("email wins over id when a caller supplies both", () => {
+    /*
+     * Both map to one key, so one has to win deterministically rather than by
+     * object-literal order. Email is the preferred spelling of the list.
+     */
+    const query: Record<string, unknown> = LlmMetricQuery.buildBaseQuery({
+      scope: scope({ llmUserEmail: "ada@example.com", llmUserId: "acct-9f2" }),
+      metricNames: ["a"],
+    }) as unknown as Record<string, unknown>;
+
+    expect(query["attributes"]).toEqual({
+      [METRIC_USER_ATTRIBUTE_KEY]: "ada@example.com",
+    });
+  });
+
+  test("narrows by team using the primary team key", () => {
+    const query: Record<string, unknown> = LlmMetricQuery.buildBaseQuery({
+      scope: scope({ llmTeam: "platform" }),
+      metricNames: ["a"],
+    }) as unknown as Record<string, unknown>;
+
+    expect(query["attributes"]).toEqual({
+      [METRIC_TEAM_ATTRIBUTE_KEY]: "platform",
+    });
+    expect(METRIC_TEAM_ATTRIBUTE_KEY).toBe("team.id");
+  });
+
+  test("identity filters compose with provider, model and service", () => {
+    const query: Record<string, unknown> = LlmMetricQuery.buildBaseQuery({
+      scope: scope({
+        serviceId: SERVICE_ID,
+        llmSystem: "anthropic",
+        llmModel: "claude-opus-4-8",
+        llmUserEmail: "ada@example.com",
+        llmTeam: "platform",
+      }),
+      metricNames: ["a"],
+    }) as unknown as Record<string, unknown>;
+
+    expect(query["primaryEntityId"]).toBe(SERVICE_ID);
+    expect(query["attributes"]).toEqual({
+      [METRIC_SYSTEM_ATTRIBUTE_KEY]: "anthropic",
+      [METRIC_MODEL_ATTRIBUTE_KEY]: "claude-opus-4-8",
+      [METRIC_USER_ATTRIBUTE_KEY]: "ada@example.com",
+      [METRIC_TEAM_ATTRIBUTE_KEY]: "platform",
+    });
+  });
+
+  test("the user and team filters never collide on one key", () => {
+    // A shared key would make a team filter silently overwrite the person.
+    expect(METRIC_USER_ATTRIBUTE_KEY).not.toBe(METRIC_TEAM_ATTRIBUTE_KEY);
+  });
+
+  test("empty-string identity values leave the query unscoped", () => {
+    /*
+     * The dangerous direction is the opposite of under-counting: an empty
+     * filter that still emits an attribute predicate would match NOTHING and
+     * report $0 for a person who spent thousands.
+     */
+    const query: Record<string, unknown> = LlmMetricQuery.buildBaseQuery({
+      scope: scope({ llmUserEmail: "", llmUserId: "", llmTeam: "" }),
+      metricNames: ["a"],
+    }) as unknown as Record<string, unknown>;
+
+    expect(query).not.toHaveProperty("attributes");
+  });
+
+  test("every cost and token query carries the identity scoping", () => {
+    const scoped: LlmMetricScope = scope({
+      llmUserEmail: "ada@example.com",
+      llmTeam: "platform",
+    });
+
+    for (const query of [
+      LlmMetricQuery.buildCostQuery(scoped),
+      LlmMetricQuery.buildMicroUsdCostQuery(scoped),
+      LlmMetricQuery.buildTokenQuery(scoped),
+    ] as Array<Query<Metric>>) {
+      const record: Record<string, unknown> = query as unknown as Record<
+        string,
+        unknown
+      >;
+
+      expect(record["attributes"]).toEqual({
+        [METRIC_USER_ATTRIBUTE_KEY]: "ada@example.com",
+        [METRIC_TEAM_ATTRIBUTE_KEY]: "platform",
+      });
+    }
+  });
+});
+
+/*
+ * Micro-USD cost, and the single place its scale factor is applied.
+ *
+ * The bug class this block exists for is a MILLION-FOLD unit error. The
+ * OpenAI Codex CLI reports spend in millionths of a dollar. If its metric
+ * name reaches the USD query, or the 1e-6 factor is dropped or typo'd, a $3
+ * turn lands in a cost budget as $3,000,000 and instantly breaches every
+ * threshold a customer has configured. Nothing throws; the alerts just fire.
+ */
+describe("LlmMetricQuery — micro-USD cost", () => {
+  test("the micro-USD query selects exactly the micro-USD metric names", () => {
+    const query: Record<string, unknown> =
+      LlmMetricQuery.buildMicroUsdCostQuery(scope()) as unknown as Record<
+        string,
+        unknown
+      >;
+
+    expect((query["name"] as Includes).values).toEqual(
+      LlmMicroUsdCostMetricNames,
+    );
+  });
+
+  test("the USD and micro-USD queries never select the same metric name", () => {
+    const usd: Includes = (
+      LlmMetricQuery.buildCostQuery(scope()) as unknown as Record<
+        string,
+        unknown
+      >
+    )["name"] as Includes;
+
+    const micro: Includes = (
+      LlmMetricQuery.buildMicroUsdCostQuery(scope()) as unknown as Record<
+        string,
+        unknown
+      >
+    )["name"] as Includes;
+
+    const overlap: Array<string> = (usd.values as Array<string>).filter(
+      (name: string) => {
+        return (micro.values as Array<string>).includes(name);
+      },
+    );
+
+    expect(overlap).toEqual([]);
+  });
+
+  test("the micro-USD query bounds rows with the same time predicate", () => {
+    const query: Record<string, unknown> =
+      LlmMetricQuery.buildMicroUsdCostQuery(scope()) as unknown as Record<
+        string,
+        unknown
+      >;
+
+    const time: InBetween<Date> = query["time"] as InBetween<Date>;
+
+    expect(time).toBeInstanceOf(InBetween);
+    expect(time.startValue).toBe(START);
+    expect(time.endValue).toBe(END);
+  });
+
+  describe("combineCostTotals", () => {
+    test("a 1,500,000 micro-USD datapoint is $1.50", () => {
+      // The canonical Codex figure. This is the whole point of the function.
+      expect(
+        LlmMetricQuery.combineCostTotals({ usd: 0, microUsd: 1_500_000 }),
+      ).toBeCloseTo(1.5, 10);
+    });
+
+    test("one million micro-USD is exactly one dollar", () => {
+      expect(
+        LlmMetricQuery.combineCostTotals({ usd: 0, microUsd: 1_000_000 }),
+      ).toBe(1);
+    });
+
+    test("adds a USD total and a micro-USD total in the same unit", () => {
+      expect(
+        LlmMetricQuery.combineCostTotals({ usd: 4.25, microUsd: 1_500_000 }),
+      ).toBeCloseTo(5.75, 10);
+    });
+
+    test("a micro-USD total is NOT added raw", () => {
+      /*
+       * The regression guard, stated as the failure it prevents: without the
+       * scale factor this returns 3,000,000 instead of 3.
+       */
+      const combined: number = LlmMetricQuery.combineCostTotals({
+        usd: 0,
+        microUsd: 3_000_000,
+      });
+
+      expect(combined).toBeCloseTo(3, 10);
+      expect(combined).toBeLessThan(10);
+    });
+
+    test("sub-cent micro-USD figures survive as fractions", () => {
+      // A single cheap turn: 1250 micro-USD = $0.00125.
+      expect(
+        LlmMetricQuery.combineCostTotals({ usd: 0, microUsd: 1250 }),
+      ).toBeCloseTo(0.00125, 10);
+    });
+
+    test("returns 0 when both totals are 0", () => {
+      expect(LlmMetricQuery.combineCostTotals({ usd: 0, microUsd: 0 })).toBe(0);
+    });
+
+    test("preserves a negative micro-USD total, which a delta counter can emit", () => {
+      expect(
+        LlmMetricQuery.combineCostTotals({ usd: 2, microUsd: -1_000_000 }),
+      ).toBeCloseTo(1, 10);
+    });
+
+    /*
+     * Non-finite inputs contribute 0 rather than poisoning the result, exactly
+     * as sumAggregatedRows does. A NaN spend compares false against every
+     * threshold, which silently DISABLES a budget monitor instead of tripping
+     * it — the failure mode a cost alert must never have.
+     */
+    test.each([
+      ["NaN usd", NaN, 1_000_000, 1],
+      ["NaN microUsd", 2, NaN, 2],
+      ["Infinity usd", Infinity, 1_000_000, 1],
+      ["-Infinity usd", -Infinity, 2_000_000, 2],
+      ["Infinity microUsd", 3, Infinity, 3],
+      ["-Infinity microUsd", 3, -Infinity, 3],
+      ["both non-finite", NaN, Infinity, 0],
+    ])(
+      "%s contributes 0 instead of poisoning the total",
+      (
+        _label: string,
+        usd: number,
+        microUsd: number,
+        expected: number,
+      ): void => {
+        const combined: number = LlmMetricQuery.combineCostTotals({
+          usd: usd,
+          microUsd: microUsd,
+        });
+
+        expect(isFinite(combined)).toBe(true);
+        expect(combined).toBeCloseTo(expected, 10);
+      },
+    );
+
+    test("composes with sumAggregatedRows end to end", () => {
+      /*
+       * The realistic shape: a Claude Code cost metric in dollars and three
+       * Codex turns in micro-USD, folded the way getCostInUSD folds them.
+       */
+      const usd: number = LlmMetricQuery.sumAggregatedRows([
+        row(0.5),
+        row(0.25),
+      ] as Array<AggregatedModel>);
+
+      const microUsd: number = LlmMetricQuery.sumAggregatedRows([
+        row(1_500_000),
+        row(500_000),
+        row("not-a-number"),
+      ] as Array<AggregatedModel>);
+
+      expect(
+        LlmMetricQuery.combineCostTotals({ usd: usd, microUsd: microUsd }),
+      ).toBeCloseTo(2.75, 10);
+    });
+  });
+});

package/Types/API/URL.ts

@@ -191,6 +191,23 @@ export default class URL extends DatabaseProperty {
     this.setParamsFromQueryString(queryString);
   }
 
+  /*
+   * Everything after the FIRST "?". split("?")[1] stopped at the second one,
+   * so a query that legitimately contains "?" — an encoded redirect target,
+   * say — lost its tail. RFC 3986 3.4 lets "?" appear inside a query.
+   */
+  private static queryStringOf(url: string): string {
+    const separatorIndex: number = url.indexOf("?");
+    return separatorIndex === -1 ? "" : url.substring(separatorIndex + 1);
+  }
+
+  /*
+   * Each pair splits on its FIRST "=" only. Splitting on every "=" and taking
+   * element [1] silently dropped everything after the second one, so a Jira
+   * JQL search ("?jql=project = OPS"), an OData "$filter", or a base64
+   * signature padded with "==" went out as a different query than the caller
+   * wrote — and the request still reported success.
+   */
   private setParamsFromQueryString(queryString?: string): void {
     if (!queryString) {
       return;
@@ -198,13 +215,25 @@ export default class URL extends DatabaseProperty {
 
     const keyValues: Array<string> = queryString.split("&");
     for (const keyValue of keyValues) {
-      if (keyValue.split("=")[0] && keyValue.split("=")[1]) {
-        const key: string | undefined = keyValue.split("=")[0];
-        const value: string | undefined = keyValue.split("=")[1];
-        if (key && value) {
-          this._params[key] = value;
-        }
+      const separatorIndex: number = keyValue.indexOf("=");
+
+      /*
+       * No "=" at all is a value-less param ("?flag"). It is kept with an
+       * empty value instead of being dropped, and queryStringSuffix re-emits
+       * it bare. A pair with no key ("?=v", or the empty segment in "?a=1&&b=2")
+       * has nothing to key on, so it is skipped.
+       */
+      const key: string =
+        separatorIndex === -1
+          ? keyValue
+          : keyValue.substring(0, separatorIndex);
+
+      if (!key) {
+        continue;
       }
+
+      this._params[key] =
+        separatorIndex === -1 ? "" : keyValue.substring(separatorIndex + 1);
     }
   }
 
@@ -221,7 +250,13 @@ export default class URL extends DatabaseProperty {
       "?" +
       Object.keys(this.params)
         .map((key: string) => {
-          return key + "=" + this.params[key];
+          /*
+           * An empty value re-emits as a bare key, so "?flag" survives a round
+           * trip. Values go back out verbatim: whatever encoding the caller
+           * supplied is what reaches the wire.
+           */
+          const value: string | undefined = this.params[key];
+          return value ? key + "=" + value : key;
         })
         .join("&")
     );
@@ -354,7 +389,7 @@ export default class URL extends DatabaseProperty {
        * to accept an email address — and "?subject=..." along with it.
        */
       const address: string = url.split("?")[0] || "";
-      const mailQueryString: string = url.split("?")[1] || "";
+      const mailQueryString: string = URL.queryStringOf(url);
 
       return new URL(protocol, address, undefined, mailQueryString);
     }
@@ -366,7 +401,7 @@ export default class URL extends DatabaseProperty {
        * Hostname.
        */
       const number: string = url.split("?")[0] || "";
-      const opaqueQueryString: string = url.split("?")[1] || "";
+      const opaqueQueryString: string = URL.queryStringOf(url);
 
       return new URL(protocol, number, undefined, opaqueQueryString);
     }
@@ -390,7 +425,7 @@ export default class URL extends DatabaseProperty {
       route = new Route(paths.join("/").split("?")[0]);
     }
 
-    const queryString: string | undefined = url.split("?")[1] || "";
+    const queryString: string = URL.queryStringOf(url);
 
     return new URL(protocol, hostname, route, queryString);
   }

package/Types/AnalyticsDatabase/AnalyticsTableName.ts

@@ -7,6 +7,14 @@ enum AnalyticsTableName {
    * attributes with a keys sidecar for arbitrary-field filtering.
    */
   SecurityEvent = "SecurityEventItemV1",
+  /*
+   * Normalized IOC rows from STIX/TAXII threat-intel feeds. Keyed by
+   * (projectId, feedId, indicatorValue, stixId) on ReplacingMergeTree so
+   * a re-polled indicator upserts by its `version` (STIX modified
+   * timestamp) instead of duplicating; per-row retentionDate TTL expires
+   * indicators at valid_until.
+   */
+  ThreatIntelIndicator = "ThreatIntelIndicatorItemV1",
   /*
    * Deploy/config-change markers posted by CI/CD, rendered as dashed
    * vertical lines on metric charts. Peer of LogItemV3 in layout (tenant

package/Types/BaseDatabase/NotWildcard.ts

@@ -0,0 +1,86 @@
+import BadDataException from "../Exception/BadDataException";
+import { JSONObject, ObjectType } from "../JSON";
+import QueryOperator from "./QueryOperator";
+import { toLikePattern } from "./WildcardPattern";
+
+/**
+ * "matches none of these globs" — the negation of {@link Wildcard}, produced
+ * by `-@key:value*` in the telemetry search bar.
+ *
+ * It is a class of its own rather than a flag because every compiler in the
+ * codebase dispatches on operator identity, and because the negated form is
+ * not simply `NOT <positive form>` at the edges: on a nullable scalar the
+ * predicate has to let NULL through, and on a map sub-key it has to let rows
+ * that lack the key entirely through — the same asymmetry `NotContains`
+ * carries.
+ */
+export default class NotWildcard<T extends string> extends QueryOperator<T> {
+  private _values: Array<T> = [];
+
+  public get values(): Array<T> {
+    return this._values;
+  }
+
+  public set values(v: Array<T>) {
+    this._values = v;
+  }
+
+  /** The first glob. Convenience for the overwhelmingly common single case. */
+  public get value(): T {
+    return (this._values[0] ?? "") as T;
+  }
+
+  public constructor(value: T | Array<T>) {
+    super();
+    this.values = Array.isArray(value) ? value : [value];
+  }
+
+  /**
+   * The canonical DSL rendering, so that a value which slips into a
+   * string-coercing code path degrades to something a human can read rather
+   * than to `[object Object]`.
+   */
+  public override toString(): T {
+    if (this._values.length === 1) {
+      return (this._values[0] ?? "") as T;
+    }
+
+    return `(${this._values.join(" OR ")})` as T;
+  }
+
+  /** The globs compiled to LIKE/ILIKE patterns, in order. */
+  public toPatterns(): Array<string> {
+    return this._values.map((glob: T) => {
+      return toLikePattern(glob?.toString() || "");
+    });
+  }
+
+  public override toJSON(): JSONObject {
+    return {
+      _type: ObjectType.NotWildcard,
+      value: (this as NotWildcard<T>).values.map((glob: T) => {
+        return glob?.toString() || "";
+      }),
+    };
+  }
+
+  public static override fromJSON<T extends string>(
+    json: JSONObject,
+  ): NotWildcard<T> {
+    if (json["_type"] === ObjectType.NotWildcard) {
+      const value: unknown = json["value"];
+
+      if (Array.isArray(value)) {
+        return new NotWildcard<T>(
+          value.map((entry: unknown) => {
+            return String(entry ?? "") as T;
+          }),
+        );
+      }
+
+      return new NotWildcard<T>((value as T) || ("" as T));
+    }
+
+    throw new BadDataException("Invalid JSON: " + JSON.stringify(json));
+  }
+}

package/Types/BaseDatabase/Wildcard.ts

@@ -0,0 +1,89 @@
+import BadDataException from "../Exception/BadDataException";
+import { JSONObject, ObjectType } from "../JSON";
+import QueryOperator from "./QueryOperator";
+import { toLikePattern } from "./WildcardPattern";
+
+/**
+ * "matches any of these globs" — `api-*`, `*.internal`, `svc-?`.
+ *
+ * The payload is an ARRAY of globs so that one operator covers both a single
+ * pattern (`@k:a*`) and an any-of list that mixes patterns with literals
+ * (`@k:(a* OR bravo)`). `Query<T>` has no OR node and is not getting one, so
+ * folding the disjunction into the operator is what makes an OR over one key
+ * expressible at all.
+ *
+ * The globs are stored exactly as the user typed them, escapes intact: the
+ * LIKE pattern is derived at compile time by `toLikePattern`, so the client
+ * never has to know which database it is talking to and a filter that
+ * round-trips through a saved view or a URL stays readable.
+ */
+export default class Wildcard<T extends string> extends QueryOperator<T> {
+  private _values: Array<T> = [];
+
+  public get values(): Array<T> {
+    return this._values;
+  }
+
+  public set values(v: Array<T>) {
+    this._values = v;
+  }
+
+  /** The first glob. Convenience for the overwhelmingly common single case. */
+  public get value(): T {
+    return (this._values[0] ?? "") as T;
+  }
+
+  public constructor(value: T | Array<T>) {
+    super();
+    this.values = Array.isArray(value) ? value : [value];
+  }
+
+  /**
+   * The canonical DSL rendering, so that a value which slips into a
+   * string-coercing code path degrades to something a human can read rather
+   * than to `[object Object]`.
+   */
+  public override toString(): T {
+    if (this._values.length === 1) {
+      return (this._values[0] ?? "") as T;
+    }
+
+    return `(${this._values.join(" OR ")})` as T;
+  }
+
+  /** The globs compiled to LIKE/ILIKE patterns, in order. */
+  public toPatterns(): Array<string> {
+    return this._values.map((glob: T) => {
+      return toLikePattern(glob?.toString() || "");
+    });
+  }
+
+  public override toJSON(): JSONObject {
+    return {
+      _type: ObjectType.Wildcard,
+      value: (this as Wildcard<T>).values.map((glob: T) => {
+        return glob?.toString() || "";
+      }),
+    };
+  }
+
+  public static override fromJSON<T extends string>(
+    json: JSONObject,
+  ): Wildcard<T> {
+    if (json["_type"] === ObjectType.Wildcard) {
+      const value: unknown = json["value"];
+
+      if (Array.isArray(value)) {
+        return new Wildcard<T>(
+          value.map((entry: unknown) => {
+            return String(entry ?? "") as T;
+          }),
+        );
+      }
+
+      return new Wildcard<T>((value as T) || ("" as T));
+    }
+
+    throw new BadDataException("Invalid JSON: " + JSON.stringify(json));
+  }
+}