@oneuptime/common 12.0.30 → 12.0.32

package/Types/Monitor/SnmpMonitor/SnmpOidListUtil.ts

@@ -0,0 +1,333 @@
+import BadDataException from "../../Exception/BadDataException";
+import SnmpOid from "./SnmpOid";
+
+/*
+ * The one place that decides what a network device actually polls.
+ *
+ * A device's health OIDs come from two places now: the OID Collection
+ * Template it is linked to, and its own `snmpOids` column. Nothing is ever
+ * copied between them — the two lists are merged fresh on every poll in
+ * NetworkDevicePoll, which is why editing a template changes collection for
+ * every linked device without a single write to NetworkDevice.
+ *
+ * That makes this file load-bearing in three places at once: the poll path
+ * that builds the probe payload, the two service validators that reject a
+ * bad list at save time, and the dashboard, which has to show an operator
+ * the same effective list the probe will receive. Keep it pure so all three
+ * can share it.
+ */
+
+/*
+ * A numeric dotted OID: at least two arcs, digits only. Deliberately not a
+ * MIB-name parser — the probe issues these verbatim to net-snmp, which
+ * accepts nothing else, and a symbolic name that reaches it is a silent
+ * "no such object" rather than an error.
+ */
+const OID_SYNTAX: RegExp = /^\d+(\.\d+)+$/;
+
+/*
+ * The three caps COMPOSE, and that is the whole point of the numbers.
+ *
+ * A template may hold 150 OIDs and a device may add 50 of its own, so the
+ * merged list can never exceed 200. Both write paths validate their own side
+ * against their own cap, and together they make the poll-time truncation
+ * further down unreachable - which matters because truncation drops from the
+ * END, and template entries are deliberately the stable prefix, so the
+ * entries lost would always be the operator's own device-specific ones.
+ * Somebody growing a shared template must never be able to silently stop a
+ * device collecting an OID they never touched.
+ *
+ * Validating each side independently against one 200 cap would NOT compose:
+ * 200 plus 200 is 400, and the operator who loses OIDs is not the operator
+ * who made the edit.
+ */
+export const MAX_OIDS_PER_TEMPLATE: number = 150;
+export const MAX_DEVICE_SPECIFIC_OIDS: number = 50;
+export const MAX_EFFECTIVE_OIDS_PER_DEVICE: number =
+  MAX_OIDS_PER_TEMPLATE + MAX_DEVICE_SPECIFIC_OIDS;
+
+/*
+ * A name is carried to the probe and lands on every metric row as an
+ * attribute, so it is bounded here rather than left an unbounded string
+ * multiplied by every device in a poll batch.
+ */
+export const MAX_OID_NAME_LENGTH: number = 100;
+
+/*
+ * Per-walk metric caps, previously a private const in
+ * NetworkDeviceMetricUtil and a bare literal in MonitorMetricUtil. Both now
+ * import these. The OID cap was 50 while nothing capped how many OIDs a
+ * device could be configured with, so a long list silently charted its first
+ * 50 in jsonb array order and warned to a log nobody reads.
+ */
+export const MAX_OID_METRIC_SERIES: number = MAX_EFFECTIVE_OIDS_PER_DEVICE;
+export const MAX_INTERFACE_METRIC_SERIES: number = 200;
+
+/*
+ * The specific OIDs the poll already turns into a real, per-port metric
+ * series - and ONLY those.
+ *
+ * Deliberately a short list of columns rather than the whole ifTable
+ * subtree. The walk parses twelve ifTable columns, but most of them go
+ * nowhere a user can reach: in and out errors are emitted only as a COMBINED
+ * rate, discards are parsed and dropped, and speed and admin status are
+ * stored on NetworkInterface without ever becoming metrics. For those,
+ * typing the OID by hand is currently the only way to get a series, so
+ * warning "this is already collected" would be false and would talk an
+ * operator out of the only thing that works.
+ *
+ * What IS listed here is the set behind issue #3507: the reporter was about
+ * to hand-type a hundred per-port OIDs for exactly these counters, which the
+ * interface walk already emits per port, keyed by interfaceName and
+ * interfaceIndex.
+ */
+const ALREADY_COLLECTED_OID_COLUMNS: Array<{
+  prefix: string;
+  collectedBy: string;
+}> = [
+  {
+    // ifOperStatus
+    prefix: "1.3.6.1.2.1.2.2.1.8.",
+    collectedBy: "an up/down series for every port",
+  },
+  {
+    // ifInOctets
+    prefix: "1.3.6.1.2.1.2.2.1.10.",
+    collectedBy: "an inbound bits/second series for every port",
+  },
+  {
+    // ifOutOctets
+    prefix: "1.3.6.1.2.1.2.2.1.16.",
+    collectedBy: "an outbound bits/second series for every port",
+  },
+  {
+    // ifHCInOctets
+    prefix: "1.3.6.1.2.1.31.1.1.1.6.",
+    collectedBy: "an inbound bits/second series for every port",
+  },
+  {
+    // ifHCOutOctets
+    prefix: "1.3.6.1.2.1.31.1.1.1.10.",
+    collectedBy: "an outbound bits/second series for every port",
+  },
+];
+
+export interface ValidateOidListOptions {
+  max: number;
+  // Names the list in every error message: "OID Collection Template", etc.
+  label: string;
+}
+
+export interface ResolveEffectiveOidsData {
+  deviceOids: Array<SnmpOid> | undefined;
+  templateOids: Array<SnmpOid> | undefined;
+}
+
+export interface EffectiveOidResolution {
+  oids: Array<SnmpOid>;
+  // How many entries the cap removed. Zero on every well-formed list.
+  truncatedCount: number;
+}
+
+export default class SnmpOidListUtil {
+  /**
+   * Canonical form of an OID string, for comparison and for storage.
+   *
+   * The single leading dot is the one that matters: ".1.3.6.1" and "1.3.6.1"
+   * are the same object, operators type both, and net-snmp answers with the
+   * dotless form. Storing the canonical form is what lets criteria compare
+   * a configured OID against a walk response with ===.
+   */
+  public static normalizeOid(oid: string | undefined): string {
+    let normalized: string = (oid || "").trim();
+
+    if (normalized.startsWith(".")) {
+      normalized = normalized.slice(1);
+    }
+
+    return normalized;
+  }
+
+  public static isValidOid(oid: string | undefined): boolean {
+    return OID_SYNTAX.test(SnmpOidListUtil.normalizeOid(oid));
+  }
+
+  /**
+   * What the poll already collects this OID as, or undefined. Advisory only:
+   * the editor warns, it never blocks, because an operator may still want an
+   * undimensioned scalar series for one specific port.
+   */
+  public static getAlreadyCollectedBy(
+    oid: string | undefined,
+  ): string | undefined {
+    const normalized: string = SnmpOidListUtil.normalizeOid(oid);
+
+    for (const entry of ALREADY_COLLECTED_OID_COLUMNS) {
+      if (normalized.startsWith(entry.prefix)) {
+        return entry.collectedBy;
+      }
+    }
+
+    return undefined;
+  }
+
+  /**
+   * Sanitize an OID list at save time, refusing what an operator has to fix
+   * by hand and quietly dropping what is only an editor artifact.
+   *
+   * Both write paths use this: the template service and the device service.
+   * Nothing validated snmpOids before, which was survivable when one bad row
+   * broke one device; with a template it would break every device linked to
+   * it.
+   *
+   * The split between dropping and throwing is deliberate, and it is about
+   * NOT locking anyone out of a settings card they need. Blank rows are what
+   * SnmpOidEditor's "Add OID" button leaves behind when a user clicks it and
+   * changes their mind, and duplicates can already exist in data written
+   * before any of this validation did - both are dropped silently, because
+   * refusing them would mean a device carrying one legacy artifact could
+   * never be linked to a template until somebody hunted the row down. A
+   * genuinely malformed OID does throw: it has never collected anything, the
+   * message names it, and the editor that reports the error is on the same
+   * card.
+   */
+  public static validateOidList(
+    oids: Array<SnmpOid> | undefined,
+    options: ValidateOidListOptions,
+  ): Array<SnmpOid> {
+    const list: Array<SnmpOid> = oids || [];
+
+    const seen: Set<string> = new Set();
+    const sanitized: Array<SnmpOid> = [];
+
+    for (const entry of list) {
+      const normalized: string = SnmpOidListUtil.normalizeOid(entry.oid);
+
+      // Editor artifact, not user intent.
+      if (!normalized) {
+        continue;
+      }
+
+      if (!OID_SYNTAX.test(normalized)) {
+        throw new BadDataException(
+          `${options.label}: "${entry.oid}" is not a numeric OID. Use dotted numbers, for example 1.3.6.1.2.1.1.3.0.`,
+        );
+      }
+
+      // Keep the first spelling of a duplicate, drop the rest.
+      if (seen.has(normalized)) {
+        continue;
+      }
+
+      seen.add(normalized);
+
+      const name: string | undefined = entry.name?.trim()
+        ? entry.name.trim().substring(0, MAX_OID_NAME_LENGTH)
+        : undefined;
+
+      sanitized.push({
+        ...entry,
+        oid: normalized,
+        ...(name === undefined ? {} : { name: name }),
+      });
+    }
+
+    /*
+     * Counted AFTER sanitizing, so blank rows and duplicates cannot push a
+     * legitimate list over the limit.
+     */
+    if (sanitized.length > options.max) {
+      throw new BadDataException(
+        `${options.label}: ${sanitized.length} OIDs is more than the limit of ${options.max}. Remove some, or move them to another template.`,
+      );
+    }
+
+    return sanitized;
+  }
+
+  /**
+   * Merge a template's OIDs with a device's own into the list the probe
+   * receives.
+   *
+   * Template entries come FIRST, in template order, and that ordering is
+   * load-bearing rather than cosmetic: the effective cap truncates from the
+   * end, so the shared items a whole device type depends on have to be the
+   * stable prefix. If device additions came first, adding one local OID
+   * could silently push a template OID off the end of every device that has
+   * one.
+   *
+   * A duplicate resolves to the DEVICE's entry — it keeps whatever name and
+   * description the operator gave it — but it stays at the TEMPLATE's
+   * position, for the same reason.
+   *
+   * Malformed rows are dropped rather than thrown on, because this runs on
+   * the poll path against data that was already persisted. The validators
+   * above are where a bad row is refused; here, one bad row must not stop a
+   * device polling the other ninety-nine.
+   */
+  public static mergeOidLists(
+    templateOids: Array<SnmpOid> | undefined,
+    deviceOids: Array<SnmpOid> | undefined,
+  ): Array<SnmpOid> {
+    const merged: Array<SnmpOid> = [];
+    const indexByOid: Map<string, number> = new Map();
+
+    const all: Array<SnmpOid> = [
+      ...(templateOids || []),
+      ...(deviceOids || []),
+    ];
+
+    for (const entry of all) {
+      const normalized: string = SnmpOidListUtil.normalizeOid(entry.oid);
+
+      if (!normalized || !OID_SYNTAX.test(normalized)) {
+        continue;
+      }
+
+      const normalizedEntry: SnmpOid = {
+        ...entry,
+        oid: normalized,
+      };
+
+      const existingIndex: number | undefined = indexByOid.get(normalized);
+
+      if (existingIndex === undefined) {
+        indexByOid.set(normalized, merged.length);
+        merged.push(normalizedEntry);
+        continue;
+      }
+
+      // Device entry wins on content, template keeps the position.
+      merged[existingIndex] = normalizedEntry;
+    }
+
+    return merged;
+  }
+
+  /**
+   * What this device polls, capped. The cap should be unreachable — both
+   * write paths reject an over-cap list with an error the operator can see —
+   * so this is the backstop for a template that grew after devices linked to
+   * it.
+   */
+  public static resolveEffectiveOids(
+    data: ResolveEffectiveOidsData,
+  ): EffectiveOidResolution {
+    const merged: Array<SnmpOid> = SnmpOidListUtil.mergeOidLists(
+      data.templateOids,
+      data.deviceOids,
+    );
+
+    if (merged.length <= MAX_EFFECTIVE_OIDS_PER_DEVICE) {
+      return {
+        oids: merged,
+        truncatedCount: 0,
+      };
+    }
+
+    return {
+      oids: merged.slice(0, MAX_EFFECTIVE_OIDS_PER_DEVICE),
+      truncatedCount: merged.length - MAX_EFFECTIVE_OIDS_PER_DEVICE,
+    };
+  }
+}

package/Types/NetworkDevice/DefaultNetworkDeviceRole.ts

@@ -0,0 +1,145 @@
+import {
+  NetworkTopologyDeviceRole,
+  NetworkTopologyNodeShape,
+} from "../Monitor/SnmpMonitor/NetworkTopology";
+
+/*
+ * The device roles seeded into every project.
+ *
+ * Device roles used to be a fixed union (NetworkTopologyDeviceRole) with the
+ * label, the silhouette and the "is this a core device?" flag each hardcoded
+ * in a different module. They are now the per-project NetworkDeviceRole
+ * lookup table, so a project can rename "Wireless AP" to "Access Point",
+ * change what a firewall is drawn as, or add a role of its own.
+ *
+ * This file is the single source of truth for the DEFAULTS, shared by
+ * ProjectService (which seeds new projects) and the BackfillNetworkDeviceRoles
+ * data migration (which seeds projects that predate the table), so the two can
+ * never disagree about what a fresh project starts with.
+ *
+ * `key` is deliberately the built-in NetworkTopologyDeviceRole value. The SNMP
+ * classifier speaks that vocabulary and always will — it is evidence-driven
+ * and cannot invent a project's custom role — so matching its answer back to a
+ * configured row is a lookup by this key. That is also why the key is stable
+ * and the name is not: renaming a role must not stop the classifier finding it.
+ */
+export interface DefaultNetworkDeviceRole {
+  key: NetworkTopologyDeviceRole;
+  name: string;
+  description: string;
+  topologyShape: NetworkTopologyNodeShape;
+  isCoreLayer: boolean;
+  isSnmpWalkable: boolean;
+}
+
+/*
+ * Ordered exactly as the map legend lists them, because the seeded `order`
+ * column is this array's index — a fresh project's settings page and its map
+ * legend therefore read in the same sequence.
+ *
+ * The shapes reproduce the renderer's historical SHAPE_BY_ROLE map and the
+ * isCoreLayer flags reproduce its CORE_DEVICE_ROLES set, so a project seeded
+ * from this list draws exactly the map it drew before roles were configurable.
+ *
+ * "unknown" is not here on purpose. It is not a role an operator assigns; it
+ * is the classifier saying it has no answer, and offering it as a choice would
+ * mean "stop classifying this device forever" rather than "I don't know".
+ */
+export const DEFAULT_NETWORK_DEVICE_ROLES: ReadonlyArray<DefaultNetworkDeviceRole> =
+  [
+    {
+      key: "router",
+      name: "Router",
+      description:
+        "Moves traffic between networks. Sits at the top of the topology with the other core devices.",
+      topologyShape: "circle",
+      isCoreLayer: true,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "switch",
+      name: "Switch",
+      description:
+        "Access or distribution switching. Endpoints hang off it, and it hangs off a core device.",
+      topologyShape: "rounded-square",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "firewall",
+      name: "Firewall",
+      description:
+        "Security appliance at a network boundary. Drawn at core level.",
+      topologyShape: "diamond",
+      isCoreLayer: true,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "wirelessAccessPoint",
+      name: "Wireless AP",
+      description: "Wireless access point serving client devices.",
+      topologyShape: "triangle",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "loadBalancer",
+      name: "Load balancer",
+      description:
+        "Distributes traffic across a pool of servers. Drawn at core level.",
+      topologyShape: "hexagon",
+      isCoreLayer: true,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "server",
+      name: "Server",
+      description: "A general purpose server or compute node.",
+      topologyShape: "tower",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "storage",
+      name: "Storage",
+      description: "A NAS, SAN or other storage appliance.",
+      topologyShape: "cylinder",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "printer",
+      name: "Printer",
+      description: "A network printer or multifunction device.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+    {
+      key: "camera",
+      name: "Camera",
+      description: "An IP camera or other video endpoint.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+    {
+      key: "phone",
+      name: "IP phone",
+      description: "A VoIP handset or conference phone.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+    {
+      key: "host",
+      name: "Host",
+      description:
+        "Anything plugged into an access port that is not one of the roles above.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+  ];
+
+export default DEFAULT_NETWORK_DEVICE_ROLES;

package/Types/Permission.ts

@@ -101,6 +101,25 @@ enum Permission {
   TelemetryMember = "TelemetryMember",
   TelemetryViewer = "TelemetryViewer",
 
+  /*
+   * SIEM data is its own domain, not a fourth telemetry signal. Security
+   * events, the Sigma detection rules over them, the threat-intel feeds and
+   * their indicators, and the SecOps connector credentials all read through
+   * these three tiers and through nothing else that is handed out broadly -
+   * not ProjectMember, not the project-wide Viewer, not the Telemetry tiers.
+   *
+   * That exclusion is the whole point of the family. A SIEM holds authentication
+   * failures, privilege escalations and the analyst's own investigation trail;
+   * "everyone who can open a dashboard can read it" is not an access policy an
+   * organisation deploying one can accept. Whoever should see it is given a
+   * Security tier deliberately, the same way BillingViewer is given
+   * deliberately, and everybody else - including a Telemetry Admin with the run
+   * of every log, metric and trace in the project - sees nothing.
+   */
+  SecurityAdmin = "SecurityAdmin",
+  SecurityMember = "SecurityMember",
+  SecurityViewer = "SecurityViewer",
+
   SettingsAdmin = "SettingsAdmin",
   SettingsMember = "SettingsMember",
   SettingsViewer = "SettingsViewer",
@@ -617,6 +636,11 @@ enum Permission {
   EditNetworkDeviceAutoImportRule = "EditNetworkDeviceAutoImportRule",
   ReadNetworkDeviceAutoImportRule = "ReadNetworkDeviceAutoImportRule",
 
+  CreateNetworkDeviceOidTemplate = "CreateNetworkDeviceOidTemplate",
+  DeleteNetworkDeviceOidTemplate = "DeleteNetworkDeviceOidTemplate",
+  EditNetworkDeviceOidTemplate = "EditNetworkDeviceOidTemplate",
+  ReadNetworkDeviceOidTemplate = "ReadNetworkDeviceOidTemplate",
+
   // Podman Host Label Rule Permissions
   CreatePodmanHostLabelRule = "CreatePodmanHostLabelRule",
   DeletePodmanHostLabelRule = "DeletePodmanHostLabelRule",
@@ -1369,6 +1393,11 @@ enum Permission {
   EditNetworkSiteType = "EditNetworkSiteType",
   ReadNetworkSiteType = "ReadNetworkSiteType",
 
+  CreateNetworkDeviceRole = "CreateNetworkDeviceRole",
+  DeleteNetworkDeviceRole = "DeleteNetworkDeviceRole",
+  EditNetworkDeviceRole = "EditNetworkDeviceRole",
+  ReadNetworkDeviceRole = "ReadNetworkDeviceRole",
+
   CreateRecommendationDismissal = "CreateRecommendationDismissal",
   DeleteRecommendationDismissal = "DeleteRecommendationDismissal",
   EditRecommendationDismissal = "EditRecommendationDismissal",
@@ -2371,6 +2400,36 @@ export class PermissionHelper {
         isRolePermission: true,
         group: PermissionGroup.Telemetry,
       },
+      {
+        permission: Permission.SecurityAdmin,
+        title: "Security Admin",
+        description:
+          "Full control over the SIEM: security events, Sigma detection rules, threat intelligence feeds and indicators, and Google SecOps connections. Security data is not readable through any other role.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: true,
+        group: PermissionGroup.Security,
+      },
+      {
+        permission: Permission.SecurityMember,
+        title: "Security Member",
+        description:
+          "Can read security events and threat intelligence, and create, edit, and delete detection rules and threat intel feeds. Cannot configure Google SecOps connections.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: true,
+        group: PermissionGroup.Security,
+      },
+      {
+        permission: Permission.SecurityViewer,
+        title: "Security Viewer",
+        description:
+          "Read-only access to security events, detection rules, threat intelligence feeds, and indicators.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: true,
+        group: PermissionGroup.Security,
+      },
       {
         permission: Permission.SettingsAdmin,
         title: "Settings Admin",
@@ -8518,6 +8577,46 @@ export class PermissionHelper {
         isRolePermission: false,
         group: PermissionGroup.Monitor,
       },
+      {
+        permission: Permission.CreateNetworkDeviceRole,
+        title: "Create Network Device Role",
+        description:
+          "This permission can create Network Device Role in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Monitor,
+      },
+      {
+        permission: Permission.DeleteNetworkDeviceRole,
+        title: "Delete Network Device Role",
+        description:
+          "This permission can delete Network Device Role of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: true,
+        isRolePermission: false,
+        group: PermissionGroup.Monitor,
+      },
+      {
+        permission: Permission.EditNetworkDeviceRole,
+        title: "Edit Network Device Role",
+        description:
+          "This permission can edit Network Device Role of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: true,
+        isRolePermission: false,
+        group: PermissionGroup.Monitor,
+      },
+      {
+        permission: Permission.ReadNetworkDeviceRole,
+        title: "Read Network Device Role",
+        description:
+          "This permission can read Network Device Role of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: true,
+        isRolePermission: false,
+        group: PermissionGroup.Monitor,
+      },
       {
         permission: Permission.CreateRecommendationDismissal,
         title: "Create Recommendation Dismissal",
@@ -12341,6 +12440,48 @@ export class PermissionHelper {
         group: PermissionGroup.Telemetry,
       },
 
+      // OID Collection Template Permissions
+      {
+        permission: Permission.CreateNetworkDeviceOidTemplate,
+        title: "Create OID Collection Template",
+        description:
+          "This permission can create OID Collection Templates in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.DeleteNetworkDeviceOidTemplate,
+        title: "Delete OID Collection Template",
+        description:
+          "This permission can delete OID Collection Templates of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.EditNetworkDeviceOidTemplate,
+        title: "Edit OID Collection Template",
+        description:
+          "This permission can edit OID Collection Templates of this project. Editing a template changes what every linked device collects on its next poll.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.ReadNetworkDeviceOidTemplate,
+        title: "Read OID Collection Template",
+        description:
+          "This permission can read OID Collection Templates of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+
       // Podman Host Label Rule Permissions
       {
         permission: Permission.CreatePodmanHostLabelRule,

package/Types/Rum/SessionReplay.ts

@@ -35,6 +35,27 @@ export const MAX_SESSION_REPLAY_CHUNK_BYTES: number = 2 * 1024 * 1024;
 /* Frames a single catch-up request may concatenate. */
 export const MAX_SESSION_REPLAY_CHUNKS_PER_REQUEST: number = 8;
 
+/*
+ * Largest DECOMPRESSED payload the ingest worker will inflate for one frame,
+ * and therefore the largest single indivisible rrweb event the recorder may
+ * put on the wire.
+ *
+ * The two numbers have to be the same number, which is why this lives in
+ * Common rather than in either side. A FullSnapshot is one rrweb event: it
+ * cannot be cut in half and still parse, so when it is bigger than the flush
+ * threshold the recorder posts it whole in a chunk of its own rather than
+ * cutting it. That is only safe while the recorder's ceiling is exactly the
+ * worker's — a recorder willing to send more than the worker will inflate
+ * produces a chunk that is accepted, queued, and then dropped at decode time,
+ * leaving a hole in the chunk sequence with nothing anywhere reporting it.
+ *
+ * Compression is what makes the number affordable: a snapshot this size gzips
+ * to a small fraction of MAX_SESSION_REPLAY_CHUNK_BYTES, which is the cap on
+ * the bytes actually posted.
+ */
+export const SESSION_REPLAY_MAX_DECOMPRESSED_FRAME_BYTES: number =
+  8 * 1024 * 1024;
+
 /*
  * Hard stop per session. At the 15s flush cadence this is ~2 hours of
  * continuous recording, comfortably past the 4-hour session cap once

package/Types/Telemetry/SourceMap.ts

@@ -53,4 +53,12 @@ export interface ResolveStackTraceResult {
   resolvedCount: number;
   /** Number of source maps found for the (service, release) pair. */
   sourceMapCount: number;
+  /**
+   * Maps that a frame matched but that were not loaded, because loading them
+   * would have exceeded the resolver's per-request byte budget
+   * (SOURCE_MAP_MAX_BYTES_PER_RESOLVE). Non-zero means symbols are missing
+   * for a reason an operator can fix by raising the budget — as opposed to
+   * the maps simply never having been uploaded.
+   */
+  sourceMapsSkippedForSize: number;
 }