@oneuptime/common 12.0.32 → 12.0.33

package/Server/API/LlmProviderAPI.ts

@@ -13,7 +13,12 @@ import BaseAPI from "./BaseAPI";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import PositiveNumber from "../../Types/PositiveNumber";
 import LlmProvider from "../../Models/DatabaseModels/LlmProvider";
-import LLMService, { LLMProviderConfig } from "../Utils/LLM/LLMService";
+import LLMService, {
+  LLMCompletionResponse,
+  LLMProviderConfig,
+  LLMToolCall,
+  LLMToolDefinition,
+} from "../Utils/LLM/LLMService";
 import LlmType from "../../Types/LLM/LlmType";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Exception from "../../Types/Exception/Exception";
@@ -22,6 +27,20 @@ import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import logger from "../Utils/Logger";
 
+/*
+ * The smallest possible tool: no arguments, one obvious reason to call it.
+ * A provider that can call tools at all can call this one.
+ */
+const CONNECTION_TEST_TOOL: LLMToolDefinition = {
+  name: "connection_test_ping",
+  description:
+    "Call this tool to confirm that tool calling works. Takes no arguments.",
+  inputSchema: {
+    type: "object",
+    properties: {},
+  },
+};
+
 export default class LlmProviderAPI extends BaseAPI<
   LlmProvider,
   LlmProviderServiceType
@@ -176,8 +195,12 @@ export default class LlmProviderAPI extends BaseAPI<
             ...(provider.modelName ? { modelName: provider.modelName } : {}),
           };
 
-          try {
-            await LLMService.getCompletion({
+          const runTestCompletion: (
+            withTools: boolean,
+          ) => Promise<LLMCompletionResponse> = (
+            withTools: boolean,
+          ): Promise<LLMCompletionResponse> => {
+            return LLMService.getCompletion({
               messages: [
                 {
                   role: "system",
@@ -186,11 +209,24 @@ export default class LlmProviderAPI extends BaseAPI<
                 },
                 {
                   role: "user",
-                  content: "Reply with the word: OK",
+                  content: withTools
+                    ? `Call the ${CONNECTION_TEST_TOOL.name} tool, then reply with the word: OK`
+                    : "Reply with the word: OK",
                 },
               ],
+              ...(withTools ? { tools: [CONNECTION_TEST_TOOL] } : {}),
               temperature: 0,
-              maxTokens: 16,
+              /*
+               * Wildly generous for a one-word reply, on purpose. The verdict
+               * this route now reports depends on the model getting far
+               * enough to emit a tool call, and on a reasoning model
+               * (gpt-5, o-series) the thinking tokens are billed against this
+               * same cap — at a small cap those models routinely stop at
+               * "length" with nothing emitted, and a perfectly tool-capable
+               * provider would be reported as unverified. One button click,
+               * rarely pressed: the headroom costs nothing worth saving.
+               */
+              maxTokens: 4096,
               /*
                * A connection test is a person waiting on a verdict, not a
                * chat turn worth saving. The default ten-attempt ladder would
@@ -198,37 +234,116 @@ export default class LlmProviderAPI extends BaseAPI<
                * exists to give — take the better part of a minute to arrive.
                * One retry still absorbs a single blip.
                */
-              requestRetries: 1,
+              /*
+               * The retry ladder only fires on retryable errors, so the
+               * fallback attempt below costs one extra round trip rather than
+               * a second ladder — except against an unreachable host, which
+               * is why the fallback takes no retries of its own.
+               */
+              requestRetries: withTools ? 1 : 0,
               llmProviderConfig: llmProviderConfig,
               ...(provider.additionalParams
                 ? { additionalParams: provider.additionalParams }
                 : {}),
             });
-          } catch (err) {
-            logger.error(err);
+          };
 
+          let testResponse: LLMCompletionResponse | null = null;
+          let toolsOfferFailed: boolean = false;
+
+          try {
+            /*
+             * Ask of the provider what Ask AI actually asks of it, not just
+             * "are you reachable". Every OneUptime AI feature reads the
+             * user's data exclusively through tools, so a model or endpoint
+             * that holds a conversation but cannot call one is unusable for
+             * all of them — and the way that surfaces to the user is the
+             * assistant insisting it has no tool for what they asked, which
+             * reads as a missing feature rather than a misconfigured
+             * provider. This button is the only place an operator gets a
+             * verdict, so it has to test the capability the product depends
+             * on.
+             */
+            testResponse = await runTestCompletion(true);
+          } catch (err) {
             /*
-             * Surface the provider's own error (bad key, unknown model,
-             * unreachable base URL, etc.) so the user can fix their config.
+             * Some OpenAI-compatible backends reject an unknown `tools` field
+             * outright. Falling back to the original tool-less prompt keeps
+             * this button answering the question it has always answered —
+             * "is my API key, model and base URL right?" — instead of
+             * reporting a broken connection for a provider that merely
+             * cannot call tools. Only if THAT fails too is the provider
+             * genuinely unreachable.
              */
-            const providerMessage: string =
-              err instanceof Exception
-                ? err.message
-                : "Failed to connect to the LLM provider. Please verify the API key, model name, and base URL.";
+            logger.error(err);
 
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException(
-                `LLM Provider test failed: ${providerMessage.substring(0, 1000)}`,
-              ),
+            try {
+              testResponse = await runTestCompletion(false);
+              toolsOfferFailed = true;
+            } catch (retryErr) {
+              logger.error(retryErr);
+
+              /*
+               * Surface the provider's own error (bad key, unknown model,
+               * unreachable base URL, etc.) so the user can fix their config.
+               */
+              const providerMessage: string =
+                retryErr instanceof Exception
+                  ? retryErr.message
+                  : "Failed to connect to the LLM provider. Please verify the API key, model name, and base URL.";
+
+              return Response.sendErrorResponse(
+                req,
+                res,
+                new BadDataException(
+                  `LLM Provider test failed: ${providerMessage.substring(0, 1000)}`,
+                ),
+              );
+            }
+          }
+
+          /*
+           * A missing tool call is a warning, never a failure: a provider can
+           * be perfectly well configured for everything except tool calling,
+           * and refusing to certify it would block a working setup. Saying
+           * nothing would be worse — the operator would leave believing Ask
+           * AI works, and find out only when it tells a user it has no tool.
+           */
+          const calledTheTestTool: boolean =
+            !toolsOfferFailed &&
+            Boolean(
+              testResponse?.toolCalls?.some((toolCall: LLMToolCall) => {
+                return toolCall.name === CONNECTION_TEST_TOOL.name;
+              }),
             );
+
+          /*
+           * A reply that ran into the output cap proves nothing either way:
+           * the model may have been about to call the tool. Report that as
+           * undetermined rather than sending the operator off to replace a
+           * model that may be entirely capable.
+           */
+          const wasTruncated: boolean =
+            !calledTheTestTool && testResponse?.stopReason === "length";
+
+          let message: string =
+            "Connection successful. The LLM provider responded to a test prompt and used tool calling.";
+
+          if (wasTruncated) {
+            message =
+              "Connection successful, but tool calling could not be determined — the reply hit the output limit before any tool call appeared. This says nothing either way about the model; try the test again.";
+          } else if (!calledTheTestTool) {
+            const why: string = toolsOfferFailed
+              ? "the test request that offered a tool failed, and only a plain prompt succeeded"
+              : "the model answered in prose instead of calling the tool it was offered";
+
+            message = `Connection successful, but tool calling could not be verified — ${why}. OneUptime's AI features (Ask AI, investigations) read your data through tools, so a provider that cannot call them will answer that it has no tool for the question. Check that this model and endpoint support tool/function calling.`;
           }
 
           return Response.sendJsonObjectResponse(req, res, {
             success: true,
-            message:
-              "Connection successful. The LLM provider responded to a test prompt.",
+            supportsToolCalling: calledTheTestTool,
+            message: message,
           });
         } catch (err) {
           next(err);

package/Server/EnvironmentConfig.ts

@@ -830,6 +830,20 @@ export const IpWhitelist: string = process.env["IP_WHITELIST"] || "";
 export const DisableTelemetry: boolean =
   process.env["DISABLE_TELEMETRY"] === "true";
 
+/*
+ * Master switch for fault classification (code-fault / user-error /
+ * expected-denial / infrastructure). When false, ErrorClassResolver reports
+ * CodeFault for everything, so every thrown value is recorded as an exception
+ * event, marked ERROR and logged at ERROR — exactly the pre-classification
+ * behaviour.
+ *
+ * Default ON. It exists so a regression in classification is a config flip on
+ * a running fleet rather than a redeploy, which matters because this runs on
+ * the universal error path of every decorated method in the product.
+ */
+export const TelemetryErrorClassEnabled: boolean =
+  process.env["TELEMETRY_ERROR_CLASS_ENABLED"] !== "false";
+
 /*
  * Opt out of the daily "is a newer OneUptime released?" check against the
  * GitHub API. Deliberately separate from DISABLE_TELEMETRY, which turns off

package/Server/Infrastructure/Postgres/SchemaMigrations/1790700000000-AddNetworkSiteTypeParentHierarchy.ts

@@ -0,0 +1,55 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddNetworkSiteTypeParentHierarchy1790700000000
+  implements MigrationInterface
+{
+  public name: string = "AddNetworkSiteTypeParentHierarchy1790700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_7de8eaaa47632114c6864d67d35"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" ADD "parentNetworkSiteTypeId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_d693eaf5e12242179e348daf09" ON "NetworkSiteType" ("projectId", "parentNetworkSiteTypeId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" ADD CONSTRAINT "FK_ee9400ec824926d129b31d5fcf0" FOREIGN KEY ("parentNetworkSiteTypeId") REFERENCES "NetworkSiteType"("_id") ON DELETE NO ACTION ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_7de8eaaa47632114c6864d67d35" FOREIGN KEY ("networkSiteTypeId") REFERENCES "NetworkSiteType"("_id") ON DELETE NO ACTION ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe" FOREIGN KEY ("parentSiteId") REFERENCES "NetworkSite"("_id") ON DELETE NO ACTION ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_7de8eaaa47632114c6864d67d35"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" DROP CONSTRAINT "FK_ee9400ec824926d129b31d5fcf0"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_d693eaf5e12242179e348daf09"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" DROP COLUMN "parentNetworkSiteTypeId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_7de8eaaa47632114c6864d67d35" FOREIGN KEY ("networkSiteTypeId") REFERENCES "NetworkSiteType"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe" FOREIGN KEY ("parentSiteId") REFERENCES "NetworkSite"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790900000000-AddEnterpriseLicenseUsageProvenance.ts

@@ -0,0 +1,31 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddEnterpriseLicenseUsageProvenance1790900000000
+  implements MigrationInterface
+{
+  public name: string = "AddEnterpriseLicenseUsageProvenance1790900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" ADD "userCountSource" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" ADD "legacyUserCount" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" ADD "legacyUserCountUpdatedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" DROP COLUMN "legacyUserCountUpdatedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" DROP COLUMN "legacyUserCount"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" DROP COLUMN "userCountSource"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790900000000-AddTelemetryExceptionErrorClass.ts

@@ -0,0 +1,124 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The fault class becomes a first-class, always-populated column on the
+ * exception group, instead of a nullable AI verdict.
+ *
+ * Both columns are NOT NULL DEFAULT on purpose, and that is the whole point of
+ * this migration rather than an incidental choice. The Issues list scopes with
+ * `IncludesNone(NON_ACTIONABLE_ERROR_CLASSES)`, which compiles to SQL
+ * `"errorClass" NOT IN ('user-error', 'expected-denial')`. In SQL,
+ * `NULL NOT IN (...)` evaluates to NULL — falsy, not true — so with a nullable
+ * column every unclassified row would fail that predicate and vanish from the
+ * "show me the real failures" view. That is the exact inverse of the intended
+ * fail-safe. With NOT NULL DEFAULT 'unknown', a row nobody classified carries
+ * a value that is not in the suppressed set, so it is an Issue by
+ * construction, and the ADD COLUMN backfills every existing row in one pass.
+ *
+ * aiClassification is left in place: it is the same vocabulary under its older
+ * name (see Types/Telemetry/ErrorClass) and is still what the triage runner
+ * writes, so dropping it here would break that writer. It is copied across
+ * below and can be retired once every writer has moved to errorClass.
+ */
+export class AddTelemetryExceptionErrorClass1790900000000
+  implements MigrationInterface
+{
+  public name: string = "AddTelemetryExceptionErrorClass1790900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" ADD "errorClass" character varying(100) NOT NULL DEFAULT 'unknown'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" ADD "errorClassSource" character varying(100) NOT NULL DEFAULT 'default'`,
+    );
+
+    /*
+     * Carry the existing AI verdicts over. Same five string values, so this is
+     * a rename rather than a translation.
+     *
+     * Deliberately not filtered to the known enum members: a value this does
+     * not recognise still fails the `NOT IN ('user-error', 'expected-denial')`
+     * scope and therefore stays visible, which is the safe direction. Silently
+     * dropping it to 'unknown' would lose information for no gain.
+     */
+    await queryRunner.query(`
+      UPDATE "TelemetryException"
+      SET "errorClass" = "aiClassification", "errorClassSource" = 'ai'
+      WHERE "aiClassification" IS NOT NULL
+    `);
+
+    /*
+     * Reconstruct what the emitting code would have declared, for groups the
+     * AI never looked at, so the Issues list is quiet on day one instead of
+     * only for exceptions raised after this deploy.
+     *
+     * Every class listed here overrides getErrorClass to UserError or
+     * ExpectedDenial. Both collapse to 'user-error' here: the two are
+     * interchangeable for the only thing this backfill drives (they are the
+     * two members of NON_ACTIONABLE_ERROR_CLASSES), and guessing the finer
+     * split from a type name alone would be inventing precision the data does
+     * not have. Live traffic re-stamps the precise class on the next
+     * occurrence.
+     *
+     * Spelling matters here and is easy to get wrong: exceptionType comes from
+     * the constructor name, so it is 'SSOAuthorizationException' (the file is
+     * SsoAuthorizationException.ts) and 'UnableToReachServer' (no trailing
+     * Exception). MasterPasswordRequiredException carries no override of its
+     * own — it inherits ExpectedDenial from NotAuthenticatedException — so it
+     * has to be listed explicitly.
+     *
+     * The bare numeric values are the same exceptions seen through an older
+     * emit path (and through third-party SDKs), which reported the numeric
+     * status as exception.type rather than the class name. 408 and 415 are
+     * deliberately ABSENT: they are TimeoutException and UnableToReachServer,
+     * which are Infrastructure — real failures that must keep showing up as
+     * Issues. 500 and 503 are absent for the same reason.
+     *
+     * Guarded on "aiClassification" IS NULL so it cannot overwrite an AI
+     * verdict. Type name is a class-level GENERALISATION ("BadDataException
+     * usually means the caller sent something wrong"), whereas the AI looked
+     * at this specific group; and the only disagreement that matters is one
+     * where the AI said code-fault and this would flip it to user-error, i.e.
+     * hide a real failure. Deferring keeps the failure mode as
+     * over-reporting.
+     */
+    await queryRunner.query(`
+      UPDATE "TelemetryException"
+      SET "errorClass" = 'user-error', "errorClassSource" = 'declared'
+      WHERE "aiClassification" IS NULL
+        AND (
+          "exceptionType" IN (
+            'BadDataException',
+            'BadRequestException',
+            'NotFoundException',
+            'PayloadTooLargeException',
+            'TenantNotFoundException',
+            'ForbiddenException',
+            'NotAuthenticatedException',
+            'NotAuthorizedException',
+            'PaymentRequiredException',
+            'SSOAuthorizationException',
+            'MasterPasswordRequiredException',
+            'TooManyRequestsException'
+          )
+          OR "exceptionType" IN (
+            '400', '401', '402', '403', '404', '405', '406', '413', '422', '429'
+          )
+        )
+    `);
+  }
+
+  /*
+   * Nothing to un-backfill: both columns go away, and aiClassification — the
+   * only source the backfill read — was never modified.
+   */
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" DROP COLUMN "errorClassSource"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" DROP COLUMN "errorClass"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791000000000-AddUserNotificationEmailRollup.ts

@@ -0,0 +1,132 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The two tables behind owner email burst coalescing: a queue of notifications
+ * that is simultaneously the product's first per-recipient email volume record,
+ * and a ledger of the flushes that drained it.
+ *
+ * Regenerating this migration would silently reverse four decisions, so each is
+ * written down here rather than left to be rediscovered.
+ *
+ * The UNIQUE index on UserNotificationEmailRollupBatch (projectId, userId,
+ * toEmail, claimEpochStartsAt) IS the exactly-once mechanism across worker
+ * replicas, not an integrity nicety. A conditional UPDATE cannot substitute for
+ * it: DatabaseService._updateBy resolves its predicate in a separate _findBy and
+ * then writes per row by _id, never re-checking the predicate at write time, so
+ * "update the row if nobody has claimed it" is a check-then-act race. An INSERT
+ * under this index is atomic in Postgres, and the loser's unique violation is
+ * how the second replica learns to stand down. Because claimEpochStartsAt is a
+ * five-minute wall-clock bucket, the same index also hard-caps a recipient at
+ * twelve rollup emails an hour.
+ *
+ * All four projectId / userId foreign keys are ON DELETE CASCADE. Queued mail
+ * about a deleted project, addressed to a deleted user, must go with them; there
+ * is nothing to preserve and nothing sensible to send.
+ *
+ * rollupBatchId deliberately carries NO foreign key. A CASCADE would delete
+ * items when their batch is pruned at thirty days while the items themselves are
+ * kept for seven, and a SET NULL would un-stamp already-sent items and re-send a
+ * month-old rollup. The column is a stamp, not a relation.
+ *
+ * sentAt is nullable with no default because NULL means "still pending", which
+ * is exactly true of every row that will ever exist. That is what removes the
+ * need for any data migration or backfill: both tables start empty, which is the
+ * correct state on every install, new or upgraded.
+ *
+ * eventType is character varying(500), not (100) like most short text in this
+ * schema. The stored NotificationSettingEventType values are English prose
+ * sentences - the longest today is 92 characters - and
+ * DatabaseService.checkMaxLengthOfFields throws on overflow, which on this code
+ * path would route every notification through the write path's fail-open catch.
+ */
+export class AddUserNotificationEmailRollup1791000000000
+  implements MigrationInterface
+{
+  public name: string = "AddUserNotificationEmailRollup1791000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "UserNotificationEmailRollupItem" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "toEmail" character varying(100) NOT NULL, "eventType" character varying(500) NOT NULL, "rollupCategory" character varying(100) NOT NULL, "subject" character varying(500) NOT NULL, "viewLink" text, "sentAt" TIMESTAMP WITH TIME ZONE, "rollupBatchId" uuid, CONSTRAINT "PK_7a4125bfac97ef5ab00115dda89" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_a801450828b245c04caa1903bb" ON "UserNotificationEmailRollupItem" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_45ee190ea4724e6795ff3d0402" ON "UserNotificationEmailRollupItem" ("userId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_519a1a3aba8c1de67d63137e30" ON "UserNotificationEmailRollupItem" ("rollupBatchId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_103a2b3c5914ddfd4088942798" ON "UserNotificationEmailRollupItem" ("sentAt", "createdAt") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_ed339bd9a070c8299e9ba0a4ad" ON "UserNotificationEmailRollupItem" ("projectId", "userId", "toEmail", "rollupCategory", "createdAt") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "UserNotificationEmailRollupBatch" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "toEmail" character varying(100) NOT NULL, "claimEpochStartsAt" TIMESTAMP WITH TIME ZONE NOT NULL, "claimedAt" TIMESTAMP WITH TIME ZONE NOT NULL, "sentAt" TIMESTAMP WITH TIME ZONE, "itemCount" integer, "status" character varying(100) NOT NULL, "statusMessage" character varying(500), CONSTRAINT "PK_b4fdcbba719e877a310525c134f" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2ae4bc5b89abee188172985d93" ON "UserNotificationEmailRollupBatch" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_c6d5acfdf3f3781427a5ff8349" ON "UserNotificationEmailRollupBatch" ("userId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_6f9067198db90df3e5e4c1d2a2" ON "UserNotificationEmailRollupBatch" ("projectId", "userId", "toEmail", "claimEpochStartsAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" ADD CONSTRAINT "FK_a801450828b245c04caa1903bb7" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" ADD CONSTRAINT "FK_45ee190ea4724e6795ff3d04027" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" ADD CONSTRAINT "FK_2ae4bc5b89abee188172985d93a" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" ADD CONSTRAINT "FK_c6d5acfdf3f3781427a5ff83498" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" DROP CONSTRAINT "FK_c6d5acfdf3f3781427a5ff83498"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" DROP CONSTRAINT "FK_2ae4bc5b89abee188172985d93a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" DROP CONSTRAINT "FK_45ee190ea4724e6795ff3d04027"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" DROP CONSTRAINT "FK_a801450828b245c04caa1903bb7"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6f9067198db90df3e5e4c1d2a2"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_c6d5acfdf3f3781427a5ff8349"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2ae4bc5b89abee188172985d93"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserNotificationEmailRollupBatch"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ed339bd9a070c8299e9ba0a4ad"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_103a2b3c5914ddfd4088942798"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_519a1a3aba8c1de67d63137e30"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_45ee190ea4724e6795ff3d0402"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_a801450828b245c04caa1903bb"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserNotificationEmailRollupItem"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791100000000-AddUserNotificationEmailRollupSetting.ts

@@ -0,0 +1,79 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The per-user escape hatch from owner email burst rollup: one row per
+ * (user, project) saying whether that person's notification emails may be
+ * coalesced during a burst.
+ *
+ * Two decisions here that a regeneration would silently reverse.
+ *
+ * isEnabled is NOT NULL DEFAULT TRUE, and the table starts empty. Rollup is on
+ * by default and there is no backfill, so almost nobody will ever have a row;
+ * the read path treats an absent row and isEnabled = true identically, which
+ * is what lets this ship without writing a row for a single existing member.
+ * Flip the default to false and every project member silently opts out of a
+ * feature they were never asked about.
+ *
+ * Both foreign keys are ON DELETE CASCADE. A preference about a deleted
+ * project, held by a deleted user, has nothing left to express - and the
+ * tenant column is NOT NULL, so SET NULL could not be satisfied anyway.
+ *
+ * There is deliberately no UNIQUE index on (projectId, userId), even though
+ * the service treats the pair as unique. The dashboard creates the row lazily
+ * on the first toggle and the service's check-then-create narrows the race;
+ * adding the constraint would be a correctness improvement but it would turn
+ * the losing side of that race from a harmless duplicate into a 500 on a
+ * settings page, and both rows say the same thing in every flow the UI can
+ * produce. Worth revisiting if the row ever carries more than one field.
+ */
+export class AddUserNotificationEmailRollupSetting1791100000000
+  implements MigrationInterface
+{
+  public name: string = "AddUserNotificationEmailRollupSetting1791100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "UserNotificationEmailRollupSetting" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "isEnabled" boolean NOT NULL DEFAULT true, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_2d06015d532e73decda61f6c729" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_fc43fd93f6c9b84517ec70a756" ON "UserNotificationEmailRollupSetting" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0eb2b532417a885a83ef3a246c" ON "UserNotificationEmailRollupSetting" ("userId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_fc43fd93f6c9b84517ec70a756e" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_0eb2b532417a885a83ef3a246cf" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_b3e85e262ece458665f3b67ec9c" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_4f8b04650019cb0b9e4cee5f561" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_4f8b04650019cb0b9e4cee5f561"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_b3e85e262ece458665f3b67ec9c"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_0eb2b532417a885a83ef3a246cf"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_fc43fd93f6c9b84517ec70a756e"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0eb2b532417a885a83ef3a246c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_fc43fd93f6c9b84517ec70a756"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserNotificationEmailRollupSetting"`);
+  }
+}