@oneuptime/common 12.0.32 → 12.0.34

package/build/dist/Server/Utils/SessionReplay/SessionReplayReadService.js

@@ -11,11 +11,15 @@ import { SQL } from "../AnalyticsDatabase/Statement";
 import { getQuerySettings } from "../AnalyticsDatabase/QuerySettingsHelper";
 import RumSessionService from "../../Services/RumSessionService";
 import RumSessionChunkService from "../../Services/RumSessionChunkService";
+import ExceptionInstanceService from "../../Services/ExceptionInstanceService";
+import logger from "../Logger";
 import AnalyticsTableName from "../../../Types/AnalyticsDatabase/AnalyticsTableName";
 import TableColumnType from "../../../Types/AnalyticsDatabase/TableColumnType";
 import Includes from "../../../Types/BaseDatabase/Includes";
+import OneUptimeDate from "../../../Types/Date";
 import ChunkMath from "../../../Utils/Rum/ChunkMath";
-import { MAX_SESSION_REPLAY_CHUNKS_PER_READ, MAX_SESSION_REPLAY_READ_BYTES, } from "../../../Types/Rum/SessionReplay";
+import { MAX_SESSION_REPLAY_CHUNKS_PER_READ, MAX_SESSION_REPLAY_READ_BYTES, SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH, SESSION_REPLAY_MAX_SESSION_MS, SESSION_REPLAY_MAX_TAG_KEYS, SESSION_REPLAY_RECORDER_CAPABILITIES, SessionReplaySealedReason, } from "../../../Types/Rum/SessionReplay";
+import { SESSION_REPLAY_SORT_BY_VALUES, } from "../../../Types/Rum/SessionReplayApi";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 /*
@@ -47,10 +51,9 @@ import CaptureSpan from "../Telemetry/CaptureSpan";
  *  3. The manifest read must never name the `payload` column, so
  *     ClickHouse never touches (and never decompresses) the only column
  *     in the system that holds a recording of a real person's screen.
- *     The byte-cap pre-check is the one exception, and it measures
- *     `length(payload)` inside ClickHouse without ever shipping the
- *     bytes: the cap has to bound the size of what is actually returned,
- *     and the only honest measure of that is the stored column itself.
+ *     getChunks is the one read that names it, and it measures
+ *     `length(payload)` in the same statement that ships the bytes, so
+ *     the column is decompressed exactly once per page.
  *
  * NOTE on aliases: ClickHouse substitutes SELECT aliases into same-level
  * unqualified WHERE references, and an aggregate alias there is an
@@ -76,6 +79,26 @@ export const DEFAULT_SESSION_REPLAY_LIST_LIMIT = 50;
 export const MAX_SESSION_REPLAY_LIST_LIMIT = 200;
 /* Sessions returned by the exception -> replay lookup. */
 export const MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT = 20;
+/*
+ * Default window for the exception -> replay lookup when the caller gives
+ * none. RumSession is partitioned by day, so an unbounded lookup scans
+ * every partition the project has ever written; 30 days covers every
+ * retention tier a recording can still be played under.
+ */
+export const DEFAULT_SESSION_REPLAY_FOR_EXCEPTION_WINDOW_DAYS = 30;
+/*
+ * Sessions the exception-instance side index may name. The instance table
+ * carries the session id of the page that threw, which is how a session
+ * is found BEFORE the finalizer has written its fingerprint list.
+ */
+const MAX_EXCEPTION_INSTANCE_SESSION_IDS = 100;
+/*
+ * Padding around an exception's own timestamp when the caller pins the
+ * lookup to a moment: a session that contains the error started at most
+ * SESSION_REPLAY_MAX_SESSION_MS before it, and clock skew between the
+ * browser and the server is bounded far below this.
+ */
+export const SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS = 5 * 60 * 1000;
 /*
  * Row ceiling on one manifest. A session is capped at
  * MAX_SESSION_REPLAY_CHUNKS_PER_SESSION (480) chunks PER TAB, and a
@@ -84,6 +107,18 @@ export const MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT = 20;
  * timeline.
  */
 const MAX_MANIFEST_ROWS = 4096;
+/*
+ * How long one application's activity summary is served from memory. The
+ * health card polls every 10-60s per viewer and the summary is a small
+ * aggregate over a day of headers, so a 30s cache turns N viewers into
+ * one ClickHouse query per pod per half minute.
+ */
+export const SESSION_REPLAY_ACTIVITY_SUMMARY_CACHE_TTL_MS = 30 * 1000;
+const MAX_ACTIVITY_SUMMARY_CACHE_ENTRIES = 1000;
+/* The header attribute the ingest writes chunk 0's capability list into. */
+export const RECORDER_CAPABILITIES_ATTRIBUTE = "recorder.capabilities";
+/* Routes projected onto a list row; the table shows three and says "(N pages)". */
+export const MAX_LIST_ROUTES = 5;
 function argMaxColumn(column) {
     return `argMax(${column}, version)`;
 }
@@ -93,6 +128,34 @@ function argMaxNumeric(column) {
 function argMaxDateTime(column) {
     return `toFloat64(toUnixTimestamp64Milli(${argMaxColumn(column)}))`;
 }
+/* A Date column (retentionDate) as unix milliseconds. */
+function argMaxDate(column) {
+    return `toFloat64(toUnixTimestamp(${argMaxColumn(column)})) * 1000`;
+}
+/*
+ * Duration that stays honest for a session the finalizer has not reached.
+ *
+ * The provisional header is written on chunk 0 with durationMs 0 and
+ * endTime = chunk 0's end, and it stays that way for the 10+ minutes of
+ * idleness the finalizer waits for. Reported verbatim, every live or
+ * recently finished session read "0s" in the list and a "longer than"
+ * filter hid all of them - the first thing a person testing their install
+ * sees is a session that claims to be empty. Until the finalized row
+ * exists, the span the header itself asserts (endTime - startTime) is the
+ * best lower bound there is, so the live value is the larger of the two.
+ * The finalized row's durationMs is authoritative and is used as-is.
+ */
+/*
+ * durationMs is Int128 on disk while the clock arithmetic is Int64; both
+ * branches are cast to Int64 (a session is capped at four hours, so the
+ * cast cannot overflow) so `if` and `greatest` see one type.
+ */
+const LIVE_DURATION_EXPRESSION = `toFloat64(if(${argMaxColumn("isFinalized")}, toInt64(${argMaxColumn("durationMs")}), greatest(toInt64(${argMaxColumn("durationMs")}), toUnixTimestamp64Milli(${argMaxColumn("endTime")}) - toUnixTimestamp64Milli(${argMaxColumn("startTime")}))))`;
+/*
+ * The frustration total, shared by the hasFrustration predicate and the
+ * "frustration" sort so the two can never disagree about what counts.
+ */
+const FRUSTRATION_TOTAL_EXPRESSION = "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount)";
 /*
  * Aliases deliberately differ from the physical column names. See the
  * ILLEGAL_AGGREGATION note in the file header.
@@ -100,7 +163,7 @@ function argMaxDateTime(column) {
 const HEADER_AGGREGATES = [
     { alias: "aggStartTime", expression: argMaxDateTime("startTime") },
     { alias: "aggEndTime", expression: argMaxDateTime("endTime") },
-    { alias: "aggDurationMs", expression: argMaxNumeric("durationMs") },
+    { alias: "aggDurationMs", expression: LIVE_DURATION_EXPRESSION },
     { alias: "aggIsFinalized", expression: argMaxColumn("isFinalized") },
     { alias: "aggSealedReason", expression: argMaxColumn("sealedReason") },
     { alias: "aggChunkCount", expression: argMaxNumeric("chunkCount") },
@@ -124,6 +187,12 @@ const HEADER_AGGREGATES = [
     { alias: "aggTriggerReason", expression: argMaxColumn("triggerReason") },
     { alias: "aggEntryUrl", expression: argMaxColumn("entryUrl") },
     { alias: "aggExitUrl", expression: argMaxColumn("exitUrl") },
+    /*
+     * The full routes array: the list projects the first MAX_LIST_ROUTES and
+     * the urlPrefix / search predicates run over the argMax'd whole, never
+     * the raw column (which would match a superseded header version).
+     */
+    { alias: "aggRoutes", expression: argMaxColumn("routes") },
     { alias: "aggBrowserName", expression: argMaxColumn("browserName") },
     { alias: "aggBrowserVersion", expression: argMaxColumn("browserVersion") },
     { alias: "aggOsName", expression: argMaxColumn("osName") },
@@ -139,6 +208,36 @@ const HEADER_AGGREGATES = [
         alias: "aggSamplePercentage",
         expression: argMaxNumeric("samplePercentageAtCapture"),
     },
+    /*
+     * Counts rather than the arrays themselves: the list only says "3 traces"
+     * and "2 exception groups", and the hasTraces predicate needs a number.
+     */
+    {
+        alias: "aggTraceCount",
+        expression: `toFloat64(length(${argMaxColumn("traceIds")}))`,
+    },
+    {
+        alias: "aggExceptionGroupCount",
+        expression: `toFloat64(length(${argMaxColumn("exceptionFingerprints")}))`,
+    },
+    /*
+     * The first fingerprint, so the list's "3 errors" badge can link at the
+     * exception group instead of at an unfiltered Exceptions page. Empty
+     * string when the session recorded no exception group; arrayElement on
+     * an empty array returns the type's default, which for String is ''.
+     */
+    {
+        alias: "aggTopExceptionFingerprint",
+        expression: `arrayElement(${argMaxColumn("exceptionFingerprints")}, 1)`,
+    },
+    { alias: "aggClickCount", expression: argMaxNumeric("clickCount") },
+    { alias: "aggActiveMs", expression: argMaxNumeric("activeMs") },
+    {
+        alias: "aggFirstErrorOffsetMs",
+        expression: argMaxNumeric("firstErrorOffsetMs"),
+    },
+    { alias: "aggExpiresAt", expression: argMaxDate("retentionDate") },
+    { alias: "aggTags", expression: argMaxColumn("tags") },
 ];
 /* Only the manifest needs these; the list never renders them. */
 const HEADER_DETAIL_AGGREGATES = [
@@ -149,7 +248,6 @@ const HEADER_DETAIL_AGGREGATES = [
     { alias: "aggRrwebVersion", expression: argMaxColumn("rrwebVersion") },
     { alias: "aggSchemaVersion", expression: argMaxNumeric("schemaVersion") },
     { alias: "aggWireVersion", expression: argMaxNumeric("wireVersion") },
-    { alias: "aggRoutes", expression: argMaxColumn("routes") },
     { alias: "aggFidelityNotices", expression: argMaxColumn("fidelityNotices") },
     {
         alias: "aggFullSnapshotChunkIndexes",
@@ -161,6 +259,30 @@ const HEADER_DETAIL_AGGREGATES = [
         expression: argMaxColumn("exceptionFingerprints"),
     },
     { alias: "aggClockSkewMs", expression: argMaxNumeric("clockSkewMs") },
+    {
+        alias: "aggClientReportedStart",
+        expression: argMaxDateTime("clientReportedStartTime"),
+    },
+    {
+        alias: "aggCustomEventCount",
+        expression: argMaxNumeric("customEventCount"),
+    },
+    { alias: "aggAttributes", expression: argMaxColumn("attributes") },
+];
+/*
+ * The two columns under the identity ACL. Named in a statement ONLY when
+ * the caller has already passed canReadIdentifiedUserLabel for the
+ * application the statement is pinned to.
+ */
+const IDENTITY_AGGREGATES = [
+    {
+        alias: "aggIdentifiedUserLabel",
+        expression: argMaxColumn("identifiedUserLabel"),
+    },
+    {
+        alias: "aggIdentifiedUserTraits",
+        expression: argMaxColumn("identifiedUserTraits"),
+    },
 ];
 function toSelectList(columns) {
     return columns
@@ -223,6 +345,28 @@ function readNumberArray(row, key) {
     }
     return numbers;
 }
+/*
+ * A Map(String, String) column. ClickHouse serialises it as a JSON object;
+ * anything else (including an array, or a row that predates the column)
+ * reads as an empty map.
+ */
+function readStringMap(row, key) {
+    const value = row[key];
+    const result = {};
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return result;
+    }
+    for (const entryKey of Object.keys(value)) {
+        const entry = value[entryKey];
+        if (typeof entry === "string") {
+            result[entryKey] = entry;
+        }
+        else if (typeof entry === "number" || typeof entry === "boolean") {
+            result[entryKey] = String(entry);
+        }
+    }
+    return result;
+}
 /*
  * Unix millis -> Date. The queries return epoch milliseconds as a Float64
  * precisely so no ClickHouse datetime string ever has to be re-parsed
@@ -232,7 +376,47 @@ function readNumberArray(row, key) {
 function readDate(row, key) {
     return new Date(readNumber(row, key));
 }
+/*
+ * The capability list chunk 0 declared, filtered to the vocabulary this
+ * build knows so a stored typo never reaches the player as a capability.
+ */
+function readRecorderCapabilities(row) {
+    const attributes = readStringMap(row, "aggAttributes");
+    const raw = attributes[RECORDER_CAPABILITIES_ATTRIBUTE];
+    if (!raw) {
+        return [];
+    }
+    return raw
+        .split(",")
+        .map((capability) => {
+        return capability.trim();
+    })
+        .filter((capability) => {
+        return SESSION_REPLAY_RECORDER_CAPABILITIES.includes(capability);
+    });
+}
+const activitySummaryCache = new Map();
+let publishedRecorderVersionProvider = null;
 export default class SessionReplayReadService {
+    static setPublishedRecorderVersionProvider(provider) {
+        publishedRecorderVersionProvider = provider;
+    }
+    static getPublishedRecorderVersion() {
+        if (!publishedRecorderVersionProvider) {
+            return null;
+        }
+        try {
+            const version = publishedRecorderVersionProvider();
+            return typeof version === "string" && version.length > 0 ? version : null;
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    /* Test seam: the summary cache is process-local. */
+    static clearActivitySummaryCache() {
+        activitySummaryCache.clear();
+    }
     /*
      * Session list.
      *
@@ -240,7 +424,10 @@ export default class SessionReplayReadService {
      * are the first three elements of the sort key AND they are part of the
      * ReplacingMergeTree replace key, so they are byte-identical on every
      * duplicate row of a session. Filtering on them before the GROUP BY is
-     * therefore both index-friendly and safe.
+     * therefore both index-friendly and safe. Nothing else is ever added to
+     * the WHERE: any other predicate would have to run over raw rows and
+     * would either match a superseded header version or force a scan that
+     * the (projectId, rumApplicationId, startTime) prefix cannot prune.
      *
      * Everything else is filtered in HAVING against the argMax'd value.
      * That is not a style choice: a provisional header (written on chunk 0,
@@ -251,6 +438,17 @@ export default class SessionReplayReadService {
      */
     static async listSessions(request) {
         const limit = Math.max(1, Math.min(request.limit, MAX_SESSION_REPLAY_LIST_LIMIT));
+        const sortBy = request.sortBy || "startTime";
+        if (!SESSION_REPLAY_SORT_BY_VALUES.includes(sortBy)) {
+            throw new BadDataException(`sortBy must be one of ${SESSION_REPLAY_SORT_BY_VALUES.join(", ")}.`);
+        }
+        if (request.cursor && request.cursor.sortBy !== sortBy) {
+            /*
+             * A cursor is a position in ONE ordering. Applying a "most errors"
+             * cursor to a "newest" list would silently skip or repeat sessions.
+             */
+            throw new BadDataException(`The cursor belongs to a list sorted by ${request.cursor.sortBy}, not ${sortBy}. Start from the first page.`);
+        }
         const selectList = toSelectList(HEADER_AGGREGATES);
         const statement = SQL `
       SELECT
@@ -259,7 +457,7 @@ export default class SessionReplayReadService {
     `;
         statement.append(`    ${selectList}`);
         if (request.includeIdentifiedUserLabel) {
-            statement.append(`,\n        ${argMaxColumn("identifiedUserLabel")} AS aggIdentifiedUserLabel`);
+            statement.append(`,\n        ${toSelectList(IDENTITY_AGGREGATES)}`);
         }
         statement.append(SQL `
       FROM ${AnalyticsTableName.RumSession}
@@ -283,36 +481,45 @@ export default class SessionReplayReadService {
         statement.append(RETENTION_FILTER);
         /*
          * Keyset cursor. The sort key is (projectId, rumApplicationId,
-         * startTime, sessionId) and the list is ordered by the same tuple
-         * descending, so the previous page's last startTime is a valid
-         * WHERE-level upper bound: it prunes granules instead of paging with
-         * OFFSET, which on a wide time window would re-read and re-aggregate
-         * everything already returned. The exact ties are removed by the
-         * HAVING tiebreak below - the WHERE bound is deliberately inclusive
-         * so a row sharing the boundary timestamp is not skipped.
+         * startTime, sessionId) and the newest-first list is ordered by the
+         * same tuple descending, so the previous page's last startTime is a
+         * valid WHERE-level upper bound: it prunes granules instead of paging
+         * with OFFSET, which on a wide time window would re-read and
+         * re-aggregate everything already returned. The exact ties are
+         * removed by the HAVING tiebreak below - the WHERE bound is
+         * deliberately inclusive so a row sharing the boundary timestamp is
+         * not skipped.
+         *
+         * Only for the startTime sort: for any other key the cursor value is
+         * an aggregate, and a WHERE on startTime would drop sessions that
+         * belong on later pages.
          */
-        if (request.cursor) {
+        if (request.cursor && sortBy === "startTime") {
             statement.append(SQL ` AND startTime <= ${{
                 type: TableColumnType.DateTime64,
-                value: new Date(request.cursor.startTimeUnixMs),
+                value: new Date(request.cursor.sortValue),
             }}`);
         }
         statement.append(" GROUP BY projectId, rumApplicationId, sessionId\n      HAVING 1 = 1");
-        SessionReplayReadService.appendListHavingFilters(statement, request.filters);
+        SessionReplayReadService.appendListHavingFilters(statement, request.filters, request.includeIdentifiedUserLabel);
+        const sortExpression = SessionReplayReadService.getSortExpression(sortBy);
         if (request.cursor) {
-            statement.append(SQL ` AND (aggStartTime < ${{
+            statement.append(` AND (${sortExpression} < `);
+            statement.append(SQL `${{
                 type: TableColumnType.Decimal,
-                value: request.cursor.startTimeUnixMs,
-            }} OR (aggStartTime = ${{
+                value: request.cursor.sortValue,
+            }}`);
+            statement.append(` OR (${sortExpression} = `);
+            statement.append(SQL `${{
                 type: TableColumnType.Decimal,
-                value: request.cursor.startTimeUnixMs,
+                value: request.cursor.sortValue,
             }} AND sessionId < ${{
                 type: TableColumnType.Text,
                 value: request.cursor.sessionId,
             }}))`);
         }
-        statement.append(SQL ` ORDER BY aggStartTime DESC, sessionId DESC
-           LIMIT ${{
+        statement.append(` ORDER BY ${sortExpression} DESC, sessionId DESC`);
+        statement.append(SQL ` LIMIT ${{
             type: TableColumnType.Number,
             value: limit + 1,
         }}`);
@@ -328,11 +535,13 @@ export default class SessionReplayReadService {
         const hasMore = rows.length > limit;
         const pageRows = hasMore ? rows.slice(0, limit) : rows;
         const sessions = pageRows.map((row) => {
+            const startTime = readDate(row, "aggStartTime");
+            const endTime = readDate(row, "aggEndTime");
             const item = {
                 sessionId: readString(row, "sessionId"),
                 rumApplicationId: readString(row, "applicationId"),
-                startTime: readDate(row, "aggStartTime"),
-                endTime: readDate(row, "aggEndTime"),
+                startTime: startTime,
+                endTime: endTime,
                 durationMs: readNumber(row, "aggDurationMs"),
                 isFinalized: readBoolean(row, "aggIsFinalized"),
                 sealedReason: readString(row, "aggSealedReason"),
@@ -360,9 +569,21 @@ export default class SessionReplayReadService {
                 viewportHeight: readNumber(row, "aggViewportHeight"),
                 identifiedUserKey: readString(row, "aggIdentifiedUserKey"),
                 samplePercentageAtCapture: readNumber(row, "aggSamplePercentage"),
+                routes: readStringArray(row, "aggRoutes").slice(0, MAX_LIST_ROUTES),
+                traceCount: readNumber(row, "aggTraceCount"),
+                exceptionGroupCount: readNumber(row, "aggExceptionGroupCount"),
+                topExceptionFingerprint: readString(row, "aggTopExceptionFingerprint"),
+                clickCount: readNumber(row, "aggClickCount"),
+                activeMs: readNumber(row, "aggActiveMs"),
+                firstErrorOffsetMs: readNumber(row, "aggFirstErrorOffsetMs"),
+                expiresAtUnixMs: readNumber(row, "aggExpiresAt"),
+                tags: readStringMap(row, "aggTags"),
+                startTimeUnixMs: startTime.getTime(),
+                endTimeUnixMs: endTime.getTime(),
             };
             if (request.includeIdentifiedUserLabel) {
                 item.identifiedUserLabel = readString(row, "aggIdentifiedUserLabel");
+                item.identifiedUserTraits = readStringMap(row, "aggIdentifiedUserTraits");
             }
             return item;
         });
@@ -371,7 +592,8 @@ export default class SessionReplayReadService {
             sessions: sessions,
             nextCursor: hasMore && lastSession
                 ? {
-                    startTimeUnixMs: lastSession.startTime.getTime(),
+                    sortBy: sortBy,
+                    sortValue: SessionReplayReadService.getSortValue(sortBy, lastSession),
                     sessionId: lastSession.sessionId,
                 }
                 : null,
@@ -383,9 +605,10 @@ export default class SessionReplayReadService {
      *
      * This is also what resolves a sessionId to its owning RUM application
      * for the handler-level authorization check, which is why it is keyed
-     * on (projectId, sessionId) only and never accepts an application id
-     * from the caller: an application id supplied in the request body would
-     * make the check circular.
+     * on (projectId, sessionId) and the optional rumApplicationId is a
+     * DISAMBIGUATOR, never a substitute for the check: a supplied id only
+     * narrows which header row is read, and the handler still authorizes
+     * the application that row names.
      */
     static async getSessionHeader(data) {
         const selectList = toSelectList([
@@ -410,6 +633,12 @@ export default class SessionReplayReadService {
             value: data.sessionId,
         }}
     `);
+        if (data.rumApplicationId) {
+            statement.append(SQL ` AND rumApplicationId = ${{
+                type: TableColumnType.ObjectID,
+                value: data.rumApplicationId,
+            }}`);
+        }
         statement.append(RETENTION_FILTER);
         /*
          * Grouped by the full replace-key identity minus startTime, so one
@@ -422,9 +651,10 @@ export default class SessionReplayReadService {
          * sessionId share a key space. Picking the newest group would let
          * anyone who can write to application A resolve a sessionId belonging
          * to application B onto their own application and pass the label
-         * check. An ambiguous sessionId is refused outright instead: it is
-         * either an attack or a collision, and neither has a correct
-         * recording to return.
+         * check. An ambiguous sessionId is refused outright unless the caller
+         * named the application it wants (which is then authorized on its own
+         * merits): it is either an attack or a collision, and neither has a
+         * single correct recording to return.
          */
         statement.append(" GROUP BY projectId, rumApplicationId, sessionId ORDER BY aggStartTime DESC LIMIT 2");
         statement.append(READ_QUERY_SETTINGS);
@@ -432,18 +662,20 @@ export default class SessionReplayReadService {
         const response = await dbResult.json();
         const rows = response.data || [];
         if (rows.length > 1) {
-            throw new BadDataException("This session id resolves to more than one RUM application and cannot be played back.");
+            throw new BadDataException("This session id was recorded under more than one application in this project. Open it from the session list of the application you want to watch, which passes rumApplicationId to choose the recording.");
         }
         const row = rows[0];
         if (!row) {
             return null;
         }
+        const startTime = readDate(row, "aggStartTime");
+        const endTime = readDate(row, "aggEndTime");
         return {
             sessionId: readString(row, "sessionId"),
             projectId: readString(row, "headerProjectId"),
             rumApplicationId: readString(row, "applicationId"),
-            startTime: readDate(row, "aggStartTime"),
-            endTime: readDate(row, "aggEndTime"),
+            startTime: startTime,
+            endTime: endTime,
             durationMs: readNumber(row, "aggDurationMs"),
             isFinalized: readBoolean(row, "aggIsFinalized"),
             sealedReason: readString(row, "aggSealedReason"),
@@ -482,6 +714,106 @@ export default class SessionReplayReadService {
             traceIds: readStringArray(row, "aggTraceIds"),
             exceptionFingerprints: readStringArray(row, "aggExceptionFingerprints"),
             clockSkewMs: readNumber(row, "aggClockSkewMs"),
+            startTimeUnixMs: startTime.getTime(),
+            endTimeUnixMs: endTime.getTime(),
+            clientReportedStartUnixMs: readNumber(row, "aggClientReportedStart"),
+            tags: readStringMap(row, "aggTags"),
+            expiresAtUnixMs: readNumber(row, "aggExpiresAt"),
+            clickCount: readNumber(row, "aggClickCount"),
+            customEventCount: readNumber(row, "aggCustomEventCount"),
+            activeMs: readNumber(row, "aggActiveMs"),
+            firstErrorOffsetMs: readNumber(row, "aggFirstErrorOffsetMs"),
+            recorderCapabilities: readRecorderCapabilities(row),
+        };
+    }
+    /*
+     * The identity columns for one session, pinned to the application the
+     * caller was authorized against. This is the ONLY statement outside the
+     * identity-gated list projection that names identifiedUserLabel or
+     * identifiedUserTraits, and the manifest handler calls it strictly
+     * after canReadIdentifiedUserLabel has passed for this application. It
+     * is a separate, tiny read rather than two more columns on
+     * getSessionHeader because the header is resolved BEFORE the
+     * application (and therefore the identity decision) is known.
+     */
+    static async getSessionIdentity(data) {
+        const statement = SQL `
+      SELECT
+    `;
+        statement.append(`    ${toSelectList(IDENTITY_AGGREGATES)}`);
+        statement.append(SQL `
+      FROM ${AnalyticsTableName.RumSession}
+      WHERE projectId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.projectId,
+        }}
+        AND rumApplicationId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.rumApplicationId,
+        }}
+        AND sessionId = ${{
+            type: TableColumnType.Text,
+            value: data.sessionId,
+        }}
+    `);
+        statement.append(RETENTION_FILTER);
+        statement.append(" GROUP BY projectId, rumApplicationId, sessionId LIMIT 1");
+        statement.append(READ_QUERY_SETTINGS);
+        const dbResult = await RumSessionService.executeQuery(statement);
+        const response = await dbResult.json();
+        const row = (response.data || [])[0];
+        if (!row) {
+            return { identifiedUserLabel: "", identifiedUserTraits: {} };
+        }
+        return {
+            identifiedUserLabel: readString(row, "aggIdentifiedUserLabel"),
+            identifiedUserTraits: readStringMap(row, "aggIdentifiedUserTraits"),
+        };
+    }
+    /*
+     * For a sessionId that getSessionHeader could not find: did a header
+     * ever exist, and when did (or does) it expire? Runs WITHOUT the
+     * retention filter, which is safe only because it returns dates and an
+     * application id and never a row's content - it lets the handler say
+     * "this recording expired on <date>" instead of "not found".
+     *
+     * null when no row exists at all (never recorded, or already dropped by
+     * the ClickHouse TTL, or erased).
+     */
+    static async getExpiredSessionInfo(data) {
+        const statement = SQL `
+      SELECT
+        toString(rumApplicationId) AS applicationId,
+        toFloat64(toUnixTimestamp(max(retentionDate))) * 1000 AS expiresAtUnixMs,
+        toFloat64(toUnixTimestamp64Milli(min(startTime))) AS startTimeUnixMs
+      FROM ${AnalyticsTableName.RumSession}
+      WHERE projectId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.projectId,
+        }}
+        AND sessionId = ${{
+            type: TableColumnType.Text,
+            value: data.sessionId,
+        }}
+    `;
+        if (data.rumApplicationId) {
+            statement.append(SQL ` AND rumApplicationId = ${{
+                type: TableColumnType.ObjectID,
+                value: data.rumApplicationId,
+            }}`);
+        }
+        statement.append(" GROUP BY rumApplicationId ORDER BY expiresAtUnixMs DESC LIMIT 1");
+        statement.append(READ_QUERY_SETTINGS);
+        const dbResult = await RumSessionService.executeQuery(statement);
+        const response = await dbResult.json();
+        const row = (response.data || [])[0];
+        if (!row) {
+            return null;
+        }
+        return {
+            rumApplicationId: readString(row, "applicationId"),
+            startTime: readDate(row, "startTimeUnixMs"),
+            expiresAt: readDate(row, "expiresAtUnixMs"),
         };
     }
     /*
@@ -501,6 +833,11 @@ export default class SessionReplayReadService {
          * tabId/chunkIndex first (rather than by version alone) leaves the
          * output already sorted for the caller - LIMIT BY runs after ORDER
          * BY, so the version DESC tiebreak still selects the right row.
+         *
+         * clickCount and url are narrow columns: the activity lane and the
+         * URL bar read them before any chunk is decoded. payloadBytes stays
+         * the WIRE size the recorder posted; the stored size is only ever
+         * measured by getChunks, which is the read the cap actually bounds.
          */
         const statement = SQL `
       SELECT
@@ -516,7 +853,9 @@ export default class SessionReplayReadService {
         deadClickCount,
         errorClickCount,
         refreshRageCount,
-        routeCount
+        routeCount,
+        clickCount,
+        url
       FROM ${AnalyticsTableName.RumSessionChunk}
       WHERE projectId = ${{
             type: TableColumnType.ObjectID,
@@ -543,6 +882,9 @@ export default class SessionReplayReadService {
         const response = await dbResult.json();
         const rows = response.data || [];
         const tabsById = new Map();
+        let liveDurationMs = 0;
+        let liveEventCount = 0;
+        let liveMaxChunkIndex = 0;
         for (const row of rows) {
             const tabId = readString(row, "tabId");
             const entry = {
@@ -559,7 +901,12 @@ export default class SessionReplayReadService {
                 errorClickCount: readNumber(row, "errorClickCount"),
                 refreshRageCount: readNumber(row, "refreshRageCount"),
                 routeCount: readNumber(row, "routeCount"),
+                clickCount: readNumber(row, "clickCount"),
+                url: readString(row, "url"),
             };
+            liveDurationMs = Math.max(liveDurationMs, entry.chunkEndOffsetMs);
+            liveEventCount += entry.eventCount;
+            liveMaxChunkIndex = Math.max(liveMaxChunkIndex, entry.chunkIndex);
             const existing = tabsById.get(tabId);
             if (existing) {
                 existing.push(entry);
@@ -596,161 +943,179 @@ export default class SessionReplayReadService {
                 totalPayloadBytes: entries.reduce((total, entry) => {
                     return total + entry.payloadBytes;
                 }, 0),
+                firstChunkStartOffsetMs: entries.reduce((min, entry) => {
+                    return Math.min(min, entry.chunkStartOffsetMs);
+                }, Number.POSITIVE_INFINITY),
             });
         }
+        for (const tab of tabs) {
+            if (!Number.isFinite(tab.firstChunkStartOffsetMs)) {
+                tab.firstChunkStartOffsetMs = 0;
+            }
+        }
         return {
-            header: data.header,
+            header: SessionReplayReadService.reconcileLiveHeader({
+                header: data.header,
+                chunkRowCount: rows.length,
+                liveDurationMs: liveDurationMs,
+                liveEventCount: liveEventCount,
+                liveMaxChunkIndex: liveMaxChunkIndex,
+            }),
             tabs: tabs,
             isChunkIndexTruncated: rows.length >= MAX_MANIFEST_ROWS,
         };
     }
     /*
-     * Total STORED bytes for a specific set of chunks, without shipping the
-     * payload column to the application.
-     *
-     * `length(payload)`, deliberately NOT `payloadBytes`. Those are two
-     * different quantities: payloadBytes is the post-gzip WIRE size the
-     * recorder uploaded (the metering signal), while the payload column
-     * holds the DECOMPRESSED JSON and is what this endpoint actually
-     * returns. rrweb JSON gzips 10-20x, so a cap applied to payloadBytes
-     * bounds a number an order of magnitude smaller than the response and
-     * therefore bounds nothing useful.
-     *
-     * The cost is that ClickHouse has to decompress the column to measure
-     * it, which is exactly what naming `payload` was meant to avoid. It is
-     * still worth doing before the read rather than after: the bytes are
-     * measured inside ClickHouse and never cross the wire, and the marks
-     * the following read needs are warm by the time it runs.
+     * A provisional header (isFinalized false) says durationMs 0, chunkCount
+     * 0 and eventCount 0 while its chunk rows say otherwise; the manifest
+     * has just read every chunk row, so it reports what the rows prove. A
+     * finalized header is authoritative and returned untouched.
      */
-    static async getChunkStoredBytes(data) {
-        if (data.chunkIndexes.length === 0) {
-            return 0;
+    static reconcileLiveHeader(data) {
+        if (data.header.isFinalized || data.chunkRowCount === 0) {
+            return data.header;
         }
-        const statement = SQL `
-      SELECT
-        chunkIndex,
-        toFloat64(length(payload)) AS chunkStoredBytes
-      FROM ${AnalyticsTableName.RumSessionChunk}
-      WHERE projectId = ${{
-            type: TableColumnType.ObjectID,
-            value: data.projectId,
-        }}
-        AND rumApplicationId = ${{
-            type: TableColumnType.ObjectID,
-            value: data.rumApplicationId,
-        }}
-        AND sessionId = ${{
-            type: TableColumnType.Text,
-            value: data.sessionId,
-        }}
-        AND tabId = ${{
-            type: TableColumnType.Text,
-            value: data.tabId,
-        }}
-        AND chunkIndex IN (${{
-            type: TableColumnType.Number,
-            value: new Includes(data.chunkIndexes),
-        }})
-    `;
-        statement.append(RETENTION_FILTER);
-        /*
-         * Deduplicated exactly like the payload read, so the pre-check and
-         * the read it guards can never disagree about which rows count.
-         * Summed in TypeScript rather than in SQL because the row count is
-         * bounded by MAX_SESSION_REPLAY_CHUNKS_PER_READ, and a wrapping
-         * aggregate would need a subquery whose LIMIT BY semantics are
-         * easier to get subtly wrong than to read.
-         */
-        statement.append(" ORDER BY chunkIndex ASC, version DESC LIMIT 1 BY chunkIndex");
-        statement.append(READ_QUERY_SETTINGS);
-        const dbResult = await RumSessionChunkService.executeQuery(statement);
-        const response = await dbResult.json();
-        return (response.data || []).reduce((total, row) => {
-            return total + readNumber(row, "chunkStoredBytes");
-        }, 0);
+        const durationMs = Math.max(data.header.durationMs, data.liveDurationMs);
+        const endTimeUnixMs = Math.max(data.header.endTimeUnixMs, data.header.startTimeUnixMs + durationMs);
+        return Object.assign(Object.assign({}, data.header), { durationMs: durationMs, endTime: new Date(endTimeUnixMs), endTimeUnixMs: endTimeUnixMs, chunkCount: Math.max(data.header.chunkCount, data.chunkRowCount), eventCount: Math.max(data.header.eventCount, data.liveEventCount), maxChunkIndex: Math.max(data.header.maxChunkIndex, data.liveMaxChunkIndex) });
     }
     /*
      * The payload read. The only query in the system that names the
      * `payload` column.
      *
+     * The byte cap is measured on `length(payload)` - the DECOMPRESSED
+     * stored JSON that is actually returned - in the SAME statement that
+     * ships the bytes, so the column is decompressed once per page rather
+     * than once for a pre-check and again for the read. `payloadBytes` is
+     * the post-gzip WIRE size the recorder uploaded; rrweb JSON gzips
+     * 10-20x, so a cap on it bounds a number an order of magnitude smaller
+     * than the response and therefore bounds nothing useful.
+     *
+     * Prefix semantics rather than refusal. A page that does not fit is
+     * answered with the longest prefix of whole chunks that does, and ALWAYS
+     * with at least the first chunk: the ingest cap
+     * (SESSION_REPLAY_MAX_DECOMPRESSED_FRAME_BYTES) already bounds a single
+     * frame, so a lone chunk can never exceed what the ingest let in, and a
+     * single oversized snapshot that could never be served would dead-end
+     * playback at that chunk forever. The player plans pages against the
+     * wire size it has, requests, and reads back whichever chunks arrived.
+     *
      * Both caps are enforced here rather than only at the route so no
      * future caller can reach the payload column without them.
      */
     static async getChunks(data) {
         if (data.chunkIndexes.length === 0) {
-            return [];
+            return { chunks: [], omittedChunkIndexes: [] };
         }
         if (data.chunkIndexes.length > MAX_SESSION_REPLAY_CHUNKS_PER_READ) {
             throw new BadDataException(`A maximum of ${MAX_SESSION_REPLAY_CHUNKS_PER_READ} chunks may be requested at a time.`);
         }
-        const totalBytes = await SessionReplayReadService.getChunkStoredBytes(data);
-        if (totalBytes > MAX_SESSION_REPLAY_READ_BYTES) {
-            throw new BadDataException(`The requested chunks total ${totalBytes} bytes, which exceeds the ${MAX_SESSION_REPLAY_READ_BYTES} byte limit for a single read. Request fewer chunks.`);
-        }
+        /*
+         * Innermost: the de-duplicated rows. A retried delivery is two
+         * physically present rows on a ReplacingMergeTree until a merge runs.
+         * Feeding both to the player would replay the same mutations twice,
+         * which rrweb resolves against node ids and would either throw or
+         * render a DOM that never existed.
+         *
+         * Middle: a running total of stored bytes in chunk order. Outermost:
+         * a row is SERVED when the total up to and including it is under the
+         * cap, or when it is the first row; a row that is not served keeps
+         * its index (so the caller can name what was omitted) but ships an
+         * empty payload, so the bytes crossing the wire are bounded inside
+         * ClickHouse and never in the application.
+         *
+         * The outer projection is aliased servedPayload rather than payload:
+         * an alias that names the column its own expression reads is a
+         * cyclic alias to ClickHouse.
+         */
         const statement = SQL `
       SELECT
         chunkIndex,
-        payload
-      FROM ${AnalyticsTableName.RumSessionChunk}
-      WHERE projectId = ${{
+        if(isServed, payload, '') AS servedPayload,
+        isServed
+      FROM (
+        SELECT
+          chunkIndex,
+          payload,
+          (sum(length(payload)) OVER (ORDER BY chunkIndex ASC ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW) <= ${{
+            type: TableColumnType.Decimal,
+            value: MAX_SESSION_REPLAY_READ_BYTES,
+        }}
+            OR row_number() OVER (ORDER BY chunkIndex ASC) = 1) AS isServed
+        FROM (
+          SELECT
+            chunkIndex,
+            payload
+          FROM ${AnalyticsTableName.RumSessionChunk}
+          WHERE projectId = ${{
             type: TableColumnType.ObjectID,
             value: data.projectId,
         }}
-        AND rumApplicationId = ${{
+            AND rumApplicationId = ${{
             type: TableColumnType.ObjectID,
             value: data.rumApplicationId,
         }}
-        AND sessionId = ${{
+            AND sessionId = ${{
             type: TableColumnType.Text,
             value: data.sessionId,
         }}
-        AND tabId = ${{
+            AND tabId = ${{
             type: TableColumnType.Text,
             value: data.tabId,
         }}
-        AND chunkIndex IN (${{
+            AND chunkIndex IN (${{
             type: TableColumnType.Number,
             value: new Includes(data.chunkIndexes),
         }})
     `;
         statement.append(RETENTION_FILTER);
-        /*
-         * A retried delivery is two physically present rows on a
-         * ReplacingMergeTree until a merge runs. Feeding both to the player
-         * would replay the same mutations twice, which rrweb resolves against
-         * node ids and would either throw or render a DOM that never existed.
-         */
-        statement.append(" ORDER BY chunkIndex ASC, version DESC LIMIT 1 BY chunkIndex");
+        statement.append(" ORDER BY chunkIndex ASC, version DESC LIMIT 1 BY chunkIndex\n        )\n      )\n      ORDER BY chunkIndex ASC");
         statement.append(READ_QUERY_SETTINGS);
         const dbResult = await RumSessionChunkService.executeQuery(statement);
         const response = await dbResult.json();
         /*
          * The cap is re-applied to the bytes actually being handed back, not
-         * only to what the pre-check believed. The pre-check reads a
-         * different snapshot of a ReplacingMergeTree than the read it guards,
-         * and any future change to how stored size is derived would otherwise
-         * silently unbound the response. Accumulated as the rows are mapped
-         * so an oversized read fails before the caller ever holds the whole
-         * set.
+         * only to what ClickHouse computed: any future change to how stored
+         * size is derived would otherwise silently unbound the response. The
+         * prefix is also re-established here - a served row behind an
+         * unserved one would be a hole the player cannot play across, so the
+         * served set stops at the first omission.
          */
         let totalReturnedBytes = 0;
         const chunks = [];
-        for (const row of response.data || []) {
-            const payload = readString(row, "payload");
-            totalReturnedBytes += Buffer.byteLength(payload, "utf8");
-            if (totalReturnedBytes > MAX_SESSION_REPLAY_READ_BYTES) {
-                throw new BadDataException(`The requested chunks exceed the ${MAX_SESSION_REPLAY_READ_BYTES} byte limit for a single read. Request fewer chunks.`);
+        const omittedChunkIndexes = [];
+        const chunkRows = response.data || [];
+        for (const row of chunkRows) {
+            const chunkIndex = readNumber(row, "chunkIndex");
+            const payload = readString(row, "servedPayload");
+            const isServed = row["isServed"] === undefined ? true : readBoolean(row, "isServed");
+            const payloadBytes = Buffer.byteLength(payload, "utf8");
+            const fits = chunks.length === 0 ||
+                totalReturnedBytes + payloadBytes <= MAX_SESSION_REPLAY_READ_BYTES;
+            if (!isServed || !fits || omittedChunkIndexes.length > 0) {
+                omittedChunkIndexes.push(chunkIndex);
+                continue;
             }
+            totalReturnedBytes += payloadBytes;
             chunks.push({
-                chunkIndex: readNumber(row, "chunkIndex"),
+                chunkIndex: chunkIndex,
                 payload: payload,
             });
         }
-        return chunks;
+        return { chunks: chunks, omittedChunkIndexes: omittedChunkIndexes };
     }
     /*
      * Sessions that observed a given exception fingerprint.
      *
+     * Two sources, one header query. The header's exceptionFingerprints
+     * array is written by the finalizer, so for the first 10+ minutes after
+     * the error - the whole incident, from the reporter's point of view -
+     * the session's header knows nothing about it. The exception instance
+     * table, however, carries the session id of the page that threw, from
+     * the moment the exception is ingested. Those ids are looked up first
+     * (cheap: bloom-indexed fingerprint, bounded window) and OR-ed into the
+     * header predicate, so a live session is found as soon as its error is.
+     *
      * hasAny() appears twice on purpose. In the WHERE it is a bloom-pruned
      * pre-filter over physical rows; a group survives it if ANY of its rows
      * carries the fingerprint, which necessarily includes the case where
@@ -758,6 +1123,10 @@ export default class SessionReplayReadService {
      * drop a true match. The HAVING then re-checks the argMax'd array so a
      * fingerprint present only on a superseded row does not produce a false
      * positive.
+     *
+     * Always windowed. RumSession is partitioned by day, so without a
+     * window this scanned every partition the project ever wrote on every
+     * exception page load.
      */
     static async getSessionsForException(data) {
         if (data.accessibleRumApplicationIds &&
@@ -765,10 +1134,20 @@ export default class SessionReplayReadService {
             return [];
         }
         const limit = Math.max(1, Math.min(data.limit, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT));
+        const endTime = data.endTime || OneUptimeDate.getCurrentDate();
+        const startTime = data.startTime ||
+            OneUptimeDate.addRemoveDays(endTime, -DEFAULT_SESSION_REPLAY_FOR_EXCEPTION_WINDOW_DAYS);
+        const instanceSessionIds = await SessionReplayReadService.getSessionIdsForExceptionInstances({
+            projectId: data.projectId,
+            exceptionFingerprint: data.exceptionFingerprint,
+            startTime: startTime,
+            endTime: endTime,
+            sessionId: data.sessionId,
+        });
         const selectList = toSelectList([
             { alias: "aggStartTime", expression: argMaxDateTime("startTime") },
             { alias: "aggEndTime", expression: argMaxDateTime("endTime") },
-            { alias: "aggDurationMs", expression: argMaxNumeric("durationMs") },
+            { alias: "aggDurationMs", expression: LIVE_DURATION_EXPRESSION },
             { alias: "aggHasError", expression: argMaxColumn("hasError") },
             { alias: "aggErrorCount", expression: argMaxNumeric("errorCount") },
             /*
@@ -817,36 +1196,51 @@ export default class SessionReplayReadService {
             type: TableColumnType.ObjectID,
             value: data.projectId,
         }}
-        AND hasAny(exceptionFingerprints, [${{
-            type: TableColumnType.Text,
-            value: data.exceptionFingerprint,
-        }}])
     `);
-        statement.append(RETENTION_FILTER);
         if (data.accessibleRumApplicationIds) {
             statement.append(SQL ` AND rumApplicationId IN (${{
                 type: TableColumnType.ObjectID,
                 value: new Includes(data.accessibleRumApplicationIds),
             }})`);
         }
-        if (data.startTime) {
-            statement.append(SQL ` AND startTime >= ${{
-                type: TableColumnType.DateTime64,
-                value: data.startTime,
+        statement.append(SQL ` AND startTime >= ${{
+            type: TableColumnType.DateTime64,
+            value: startTime,
+        }} AND startTime <= ${{
+            type: TableColumnType.DateTime64,
+            value: endTime,
+        }}`);
+        statement.append(RETENTION_FILTER);
+        if (data.sessionId) {
+            statement.append(SQL ` AND sessionId = ${{
+                type: TableColumnType.Text,
+                value: data.sessionId,
             }}`);
         }
-        if (data.endTime) {
-            statement.append(SQL ` AND startTime <= ${{
-                type: TableColumnType.DateTime64,
-                value: data.endTime,
-            }}`);
+        statement.append(SQL ` AND (hasAny(exceptionFingerprints, [${{
+            type: TableColumnType.Text,
+            value: data.exceptionFingerprint,
+        }}])`);
+        if (instanceSessionIds.length > 0) {
+            statement.append(SQL ` OR sessionId IN (${{
+                type: TableColumnType.Text,
+                value: new Includes(instanceSessionIds),
+            }})`);
         }
+        statement.append(")");
         statement.append(SQL ` GROUP BY projectId, rumApplicationId, sessionId
-           HAVING hasAny(aggExceptionFingerprints, [${{
+           HAVING (hasAny(aggExceptionFingerprints, [${{
             type: TableColumnType.Text,
             value: data.exceptionFingerprint,
-        }}])
-           ORDER BY aggStartTime DESC
+        }}])`);
+        if (instanceSessionIds.length > 0) {
+            statement.append(SQL ` OR sessionId IN (${{
+                type: TableColumnType.Text,
+                value: new Includes(instanceSessionIds),
+            }})`);
+        }
+        statement.append(")");
+        statement.append(SQL ` ORDER BY aggStartTime DESC
            LIMIT ${{
             type: TableColumnType.Number,
             value: limit,
@@ -877,7 +1271,273 @@ export default class SessionReplayReadService {
             };
         });
     }
-    static appendListHavingFilters(statement, filters) {
+    /*
+     * Session ids of the pages that threw this exception, from the
+     * exception instance table. The instance's `time` sits inside its
+     * session, so a session that started inside the window threw inside
+     * [startTime, endTime + max session length].
+     *
+     * Best-effort: the side index only ADDS live sessions to the answer, so
+     * a failure here degrades to the finalized-only lookup with a warning
+     * rather than failing the exception page's replay card.
+     *
+     * A caller-pinned sessionId narrows the lookup rather than bypassing it,
+     * so the pin can never assert that a session threw something the
+     * instance table has no record of it throwing.
+     */
+    static async getSessionIdsForExceptionInstances(data) {
+        const statement = SQL `
+      SELECT DISTINCT sessionId
+      FROM ${AnalyticsTableName.ExceptionInstance}
+      WHERE projectId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.projectId,
+        }}
+        AND fingerprint = ${{
+            type: TableColumnType.Text,
+            value: data.exceptionFingerprint,
+        }}
+        AND sessionId != ''
+        AND time >= ${{
+            type: TableColumnType.DateTime64,
+            value: data.startTime,
+        }}
+        AND time <= ${{
+            type: TableColumnType.DateTime64,
+            value: new Date(data.endTime.getTime() + SESSION_REPLAY_MAX_SESSION_MS),
+        }}
+    `;
+        /*
+         * A pinned sessionId narrows this lookup; it does NOT replace it.
+         *
+         * Returning the pinned id unchecked made the caller's statement read
+         * `sessionId = X AND (hasAny(fingerprints, [f]) OR sessionId IN (X))`,
+         * whose second arm is trivially true - so the fingerprint constrained
+         * nothing and the "Watch what the user saw" card would present any
+         * accessible session as having observed this exception, on nothing but
+         * a stale occurrence row. Asking the instance table whether THAT
+         * session threw THIS fingerprint keeps the pin's real purpose (a live
+         * session whose header has no fingerprints yet) while keeping the
+         * claim true. A failure here answers [] and the header's mandatory
+         * hasAny() predicate decides alone - fail closed.
+         */
+        if (data.sessionId) {
+            statement.append(SQL ` AND sessionId = ${{
+                type: TableColumnType.Text,
+                value: data.sessionId,
+            }}`);
+        }
+        statement.append(SQL `
+      ORDER BY sessionId ASC
+      LIMIT ${{
+            type: TableColumnType.Number,
+            value: MAX_EXCEPTION_INSTANCE_SESSION_IDS,
+        }}
+    `);
+        statement.append(READ_QUERY_SETTINGS);
+        try {
+            const dbResult = await ExceptionInstanceService.executeQuery(statement);
+            const response = await dbResult.json();
+            return (response.data || [])
+                .map((row) => {
+                return readString(row, "sessionId");
+            })
+                .filter((sessionId) => {
+                return sessionId.length > 0;
+            });
+        }
+        catch (err) {
+            logger.warn("SessionReplayReadService: could not look up exception instances by session; answering from finalized headers only");
+            logger.warn(err);
+            return [];
+        }
+    }
+    /*
+     * Recording activity for one application over the last 24 hours, for
+     * the health surface. No GROUP BY and no payload: uniqExact over the
+     * sort-key range for the counts, and an ORDER BY startTime DESC LIMIT 1
+     * (read in sort-key order, stops after one granule) for the most recent
+     * start, which is NOT bounded to 24h so "the most recent was 3 days
+     * ago" can be said when today is quiet.
+     *
+     * "Playable" is counted by subtraction: a session is unplayable only
+     * when its FINALIZED row says it holds no chunks or was sealed as
+     * recording-lost. Every other session - live, or finalized with footage
+     * - can be watched. Counted that way because a finalized session still
+     * has its provisional row on disk until a merge runs, and that row
+     * would otherwise count a lost recording as live.
+     *
+     * ClickHouse trouble answers null (the UI says "unknown"), never 0:
+     * "no sessions" and "could not count" are different diagnoses.
+     */
+    static async getApplicationActivitySummary(data) {
+        var _a;
+        const nowUnixMs = (_a = data.nowUnixMs) !== null && _a !== void 0 ? _a : Date.now();
+        const cacheKey = `${data.projectId.toString()}:${data.rumApplicationId.toString()}`;
+        const cached = activitySummaryCache.get(cacheKey);
+        if (cached && cached.expiresAt > nowUnixMs) {
+            return cached.summary;
+        }
+        const summary = await SessionReplayReadService.readApplicationActivitySummary({
+            projectId: data.projectId,
+            rumApplicationId: data.rumApplicationId,
+            nowUnixMs: nowUnixMs,
+        });
+        /*
+         * Coarse LRU: evict the oldest entry when full and the key is new, so
+         * a burst of distinct applications cannot grow the map without bound.
+         */
+        if (activitySummaryCache.size >= MAX_ACTIVITY_SUMMARY_CACHE_ENTRIES &&
+            !activitySummaryCache.has(cacheKey)) {
+            const oldest = activitySummaryCache
+                .keys()
+                .next().value;
+            if (oldest !== undefined) {
+                activitySummaryCache.delete(oldest);
+            }
+        }
+        activitySummaryCache.delete(cacheKey);
+        activitySummaryCache.set(cacheKey, {
+            summary: summary,
+            expiresAt: nowUnixMs + SESSION_REPLAY_ACTIVITY_SUMMARY_CACHE_TTL_MS,
+        });
+        return summary;
+    }
+    static async readApplicationActivitySummary(data) {
+        const countsStatement = SQL `
+      SELECT
+        toFloat64(uniqExact(sessionId)) AS sessionCount,
+        toFloat64(uniqExactIf(sessionId, isFinalized AND (chunkCount = 0 OR sealedReason = ${{
+            type: TableColumnType.Text,
+            value: SessionReplaySealedReason.RecordingLost,
+        }}))) AS unplayableCount
+      FROM ${AnalyticsTableName.RumSession}
+      WHERE projectId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.projectId,
+        }}
+        AND rumApplicationId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.rumApplicationId,
+        }}
+        AND startTime >= ${{
+            type: TableColumnType.DateTime64,
+            value: new Date(data.nowUnixMs - 24 * 60 * 60 * 1000),
+        }}
+    `;
+        countsStatement.append(RETENTION_FILTER);
+        countsStatement.append(READ_QUERY_SETTINGS);
+        const lastStartStatement = SQL `
+      SELECT
+        toFloat64(toUnixTimestamp64Milli(startTime)) AS lastStartUnixMs,
+        /*
+         * The newest session's recorder capabilities, read off the same row
+         * that answers "when did recording last start". Named directly (not
+         * through the argMax alias set) because this statement has no GROUP
+         * BY: it is one row, read in sort-key order, LIMIT 1.
+         */
+        attributes AS aggAttributes
+      FROM ${AnalyticsTableName.RumSession}
+      WHERE projectId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.projectId,
+        }}
+        AND rumApplicationId = ${{
+            type: TableColumnType.ObjectID,
+            value: data.rumApplicationId,
+        }}
+    `;
+        lastStartStatement.append(RETENTION_FILTER);
+        lastStartStatement.append(" ORDER BY startTime DESC LIMIT 1");
+        lastStartStatement.append(READ_QUERY_SETTINGS);
+        try {
+            const [countsResult, lastStartResult] = await Promise.all([
+                RumSessionService.executeQuery(countsStatement),
+                RumSessionService.executeQuery(lastStartStatement),
+            ]);
+            const countsResponse = await countsResult.json();
+            const lastStartResponse = await lastStartResult.json();
+            const countsRow = (countsResponse.data || [])[0];
+            const lastStartRow = (lastStartResponse.data ||
+                [])[0];
+            const sessionCount = countsRow
+                ? readNumber(countsRow, "sessionCount")
+                : 0;
+            const unplayableCount = countsRow
+                ? readNumber(countsRow, "unplayableCount")
+                : 0;
+            const lastStartUnixMs = lastStartRow
+                ? readNumber(lastStartRow, "lastStartUnixMs")
+                : 0;
+            /*
+             * An empty list means "the newest session declared none" (an old
+             * recorder artifact), which is not the same as "we could not tell" -
+             * but the health copy renders both as "not reported yet", and
+             * claiming a recorder has NO capabilities would be a stronger
+             * statement than the row supports. So an empty list answers null and
+             * only a non-empty one is reported.
+             */
+            const recorderCapabilities = lastStartRow
+                ? readRecorderCapabilities(lastStartRow)
+                : [];
+            return {
+                sessionsLast24h: sessionCount,
+                playableSessionsLast24h: Math.max(0, sessionCount - unplayableCount),
+                lastSessionStartedAt: lastStartUnixMs > 0 ? new Date(lastStartUnixMs) : null,
+                recorderCapabilities: recorderCapabilities.length > 0 ? recorderCapabilities : null,
+            };
+        }
+        catch (err) {
+            logger.warn("SessionReplayReadService: could not read the application activity summary");
+            logger.warn(err);
+            return {
+                sessionsLast24h: null,
+                playableSessionsLast24h: null,
+                lastSessionStartedAt: null,
+                recorderCapabilities: null,
+            };
+        }
+    }
+    /* The HAVING/ORDER BY expression for a sort key. */
+    static getSortExpression(sortBy) {
+        switch (sortBy) {
+            case "durationMs":
+                return "aggDurationMs";
+            case "errorCount":
+                return "aggErrorCount";
+            case "frustration":
+                return FRUSTRATION_TOTAL_EXPRESSION;
+            case "startTime":
+            default:
+                return "aggStartTime";
+        }
+    }
+    /* The cursor value of a row under a sort key: what the expression above yields. */
+    static getSortValue(sortBy, item) {
+        switch (sortBy) {
+            case "durationMs":
+                return item.durationMs;
+            case "errorCount":
+                return item.errorCount;
+            case "frustration":
+                return (item.rageClickCount +
+                    item.deadClickCount +
+                    item.errorClickCount +
+                    item.refreshRageCount);
+            case "startTime":
+            default:
+                return item.startTime.getTime();
+        }
+    }
+    /*
+     * Every list predicate, in cost order: booleans and equality over
+     * aliases first, IN lists next, array membership after, and the
+     * substring predicates (tags, urlPrefix, search) LAST. ClickHouse
+     * evaluates HAVING per group after aggregation, so the order does not
+     * change what is scanned, but a cheap predicate that fails first spares
+     * the string work for every group it eliminates.
+     */
+    static appendListHavingFilters(statement, filters, includeIdentifiedUserLabel) {
         if (filters.hasError !== undefined) {
             statement.append(SQL ` AND aggHasError = ${{
                 type: TableColumnType.Boolean,
@@ -895,8 +1555,9 @@ export default class SessionReplayReadService {
              * honour false, so accepting the value and ignoring it returned the
              * whole unfiltered list with a 200 and no indication why.
              */
-            const total = "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount)";
-            statement.append(filters.hasFrustration ? ` AND ${total} > 0` : ` AND ${total} = 0`);
+            statement.append(filters.hasFrustration
+                ? ` AND ${FRUSTRATION_TOTAL_EXPRESSION} > 0`
+                : ` AND ${FRUSTRATION_TOTAL_EXPRESSION} = 0`);
         }
         if (filters.isFinalized !== undefined) {
             statement.append(SQL ` AND aggIsFinalized = ${{
@@ -904,6 +1565,27 @@ export default class SessionReplayReadService {
                 value: filters.isFinalized,
             }}`);
         }
+        if (filters.hasIdentifiedUser !== undefined) {
+            /*
+             * The digest column, not the label: it is under the ordinary session
+             * ACL, and "did somebody identify" discloses nothing about who.
+             */
+            statement.append(filters.hasIdentifiedUser
+                ? " AND aggIdentifiedUserKey != ''"
+                : " AND aggIdentifiedUserKey = ''");
+        }
+        if (filters.isPlayable !== undefined) {
+            /*
+             * A live session is playable (its chunks are being written); a
+             * finalized one only when the finalizer counted chunks and did not
+             * seal it as lost.
+             */
+            const playable = `((aggIsFinalized = 0 OR aggChunkCount > 0) AND aggSealedReason != '${SessionReplaySealedReason.RecordingLost}')`;
+            statement.append(filters.isPlayable ? ` AND ${playable}` : ` AND NOT ${playable}`);
+        }
+        if (filters.hasTraces !== undefined) {
+            statement.append(filters.hasTraces ? " AND aggTraceCount > 0" : " AND aggTraceCount = 0");
+        }
         if (filters.triggerReasons && filters.triggerReasons.length > 0) {
             statement.append(SQL ` AND aggTriggerReason IN (${{
                 type: TableColumnType.Text,
@@ -942,16 +1624,10 @@ export default class SessionReplayReadService {
         }
         if (filters.route) {
             /*
-             * `has`, not a Search/LIKE. StatementGenerator's own comment calls
-             * restoring the exact-match array fast path "the single biggest
-             * performance fix" - a lowerUTF8 arrayExists has no bloom
-             * pre-filter and full-scans the table.
-             *
-             * The argMax expression is appended as raw SQL rather than
-             * interpolated into the template: a plain string substituted into
-             * an SQL`` literal is bound as an Identifier and would be quoted.
+             * `has`, not a Search/LIKE: exact membership is the cheap array
+             * path. Over the argMax alias, never the raw column.
              */
-            statement.append(` AND has(${argMaxColumn("routes")}, `);
+            statement.append(" AND has(aggRoutes, ");
             statement.append(SQL `${{
                 type: TableColumnType.Text,
                 value: filters.route,
@@ -964,6 +1640,99 @@ export default class SessionReplayReadService {
                 value: filters.minDurationMs,
             }}`);
         }
+        if (filters.tags) {
+            /*
+             * Every pair must match. mapContains first so an absent key never
+             * matches the empty string a Map subscript returns for it. Bounded
+             * by the number of tags a session can even carry.
+             */
+            const pairs = Object.entries(filters.tags)
+                .filter(([key, value]) => {
+                return key.length > 0 && typeof value === "string";
+            })
+                .slice(0, SESSION_REPLAY_MAX_TAG_KEYS);
+            for (const [key, value] of pairs) {
+                statement.append(" AND mapContains(aggTags, ");
+                statement.append(SQL `${{
+                    type: TableColumnType.Text,
+                    value: key,
+                }}) AND aggTags[${{
+                    type: TableColumnType.Text,
+                    value: key,
+                }}] = ${{
+                    type: TableColumnType.Text,
+                    value: value,
+                }}`);
+            }
+        }
+        if (filters.urlPrefix) {
+            /*
+             * "sessions that touched /checkout/*": a prefix over every route the
+             * session visited and over the entry URL, which for a pre-migration
+             * session is the only URL the header holds.
+             *
+             * The stored values are scrubbed ABSOLUTE urls (https://host/path),
+             * but the filter a human types is a PATH - the search box routes any
+             * value beginning with "/" here, and the docs promise `url:/checkout`
+             * outright. Matching only the full string meant that documented
+             * search never matched anything, in any project, with no error to
+             * say so. So the path of each route and of the entry URL is matched
+             * as well as the whole URL: an absolute prefix still matches on the
+             * first arm, a path prefix on the second. ClickHouse's path() returns
+             * the path component without host or query, which is exactly the
+             * shape the recorder's route list is scrubbed down to.
+             */
+            const prefixParameter = {
+                type: TableColumnType.Text,
+                value: filters.urlPrefix,
+            };
+            statement.append(" AND (arrayExists(r -> startsWith(r, ");
+            statement.append(SQL `${prefixParameter}`);
+            statement.append(") OR startsWith(path(r), ");
+            statement.append(SQL `${prefixParameter}`);
+            statement.append("), aggRoutes) OR startsWith(aggEntryUrl, ");
+            statement.append(SQL `${prefixParameter}`);
+            statement.append(") OR startsWith(path(aggEntryUrl), ");
+            statement.append(SQL `${prefixParameter}`);
+            statement.append("))");
+        }
+        if (filters.search) {
+            SessionReplayReadService.appendSearchPredicate(statement, filters.search, includeIdentifiedUserLabel);
+        }
+    }
+    /*
+     * Free-text search, last of the predicates because it is the only one
+     * that does substring work per group. The identified user label is
+     * searched ONLY when the caller may read it: without that gate a caller
+     * denied the label could ask "is jane@example.com here" and read every
+     * other field of the answer.
+     */
+    static appendSearchPredicate(statement, search, includeIdentifiedUserLabel) {
+        const term = search
+            .trim()
+            .substring(0, SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH);
+        if (!term) {
+            return;
+        }
+        const textParameter = {
+            type: TableColumnType.Text,
+            value: term,
+        };
+        statement.append(" AND (startsWith(sessionId, ");
+        statement.append(SQL `${textParameter})`);
+        statement.append(" OR positionCaseInsensitiveUTF8(aggEntryUrl, ");
+        statement.append(SQL `${textParameter}) > 0`);
+        statement.append(" OR positionCaseInsensitiveUTF8(aggExitUrl, ");
+        statement.append(SQL `${textParameter}) > 0`);
+        statement.append(" OR arrayExists(r -> positionCaseInsensitiveUTF8(r, ");
+        statement.append(SQL `${textParameter}) > 0, aggRoutes)`);
+        statement.append(` OR has(${argMaxColumn("traceIds")}, `);
+        statement.append(SQL `${textParameter})`);
+        if (includeIdentifiedUserLabel) {
+            statement.append(" OR positionCaseInsensitiveUTF8(aggIdentifiedUserLabel, ");
+            statement.append(SQL `${textParameter}) > 0`);
+        }
+        statement.append(")");
     }
 }
 __decorate([
@@ -983,13 +1752,19 @@ __decorate([
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
-], SessionReplayReadService, "getManifest", null);
+], SessionReplayReadService, "getSessionIdentity", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
-], SessionReplayReadService, "getChunkStoredBytes", null);
+], SessionReplayReadService, "getExpiredSessionInfo", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SessionReplayReadService, "getManifest", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
@@ -1002,4 +1777,10 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], SessionReplayReadService, "getSessionsForException", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], SessionReplayReadService, "getApplicationActivitySummary", null);
 //# sourceMappingURL=SessionReplayReadService.js.map