@oneuptime/common 12.0.33 → 13.0.0

package/build/dist/Server/API/TelemetryAPI.js

@@ -33,9 +33,13 @@ import ProjectService from "../Services/ProjectService";
 import SessionReplayIdentity from "../Utils/SessionReplay/SessionReplayIdentity";
 import SessionReplayTargeting from "../Utils/SessionReplay/SessionReplayTargeting";
 import SessionReplayUsage from "../Utils/SessionReplay/SessionReplayUsage";
-import RumSessionReplayViewService from "../Services/RumSessionReplayViewService";
-import SessionReplayReadService, { DEFAULT_SESSION_REPLAY_LIST_LIMIT, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT, } from "../Utils/SessionReplay/SessionReplayReadService";
-import { DEFAULT_SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY, MAX_SESSION_REPLAY_CHUNKS_PER_READ, MAX_SESSION_REPLAY_READ_BYTES, SESSION_REPLAY_MAX_USER_REF_LENGTH, } from "../../Types/Rum/SessionReplay";
+import RumSessionReplayViewService, { normalizeSecondsWatched, } from "../Services/RumSessionReplayViewService";
+import SessionReplayReadService, { DEFAULT_SESSION_REPLAY_LIST_LIMIT, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT, MAX_SESSION_REPLAY_LIST_LIMIT, SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS, } from "../Utils/SessionReplay/SessionReplayReadService";
+import SessionReplayHealthCounters from "../Utils/SessionReplay/SessionReplayHealthCounters";
+import { isSessionErased } from "../Utils/SessionReplay/SessionReplayErasureTombstone";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import { DEFAULT_SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY, MAX_SESSION_REPLAY_CHUNKS_PER_READ, MAX_SESSION_REPLAY_READ_BYTES, SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH, SESSION_REPLAY_LIST_SEARCH_MAX_WINDOW_DAYS, SESSION_REPLAY_MAX_SESSION_MS, SESSION_REPLAY_MAX_TAG_KEYS, SESSION_REPLAY_MAX_TAG_KEY_LENGTH, SESSION_REPLAY_MAX_TAG_VALUE_LENGTH, SESSION_REPLAY_MAX_USER_REF_LENGTH, } from "../../Types/Rum/SessionReplay";
+import { SESSION_REPLAY_SORT_BY_VALUES, parseSessionReplayListCursor, } from "../../Types/Rum/SessionReplayApi";
 const router = Express.getRouter();
 const createTelemetryReadAccessGuard = (signalReadPermission) => {
     return [
@@ -2269,8 +2273,49 @@ const isApplicationInSessionReplayScope = (data) => {
         return applicationLabelIds.includes(labelId.toString());
     });
 };
-const assertSessionReplayApplicationAccess = async (data) => {
-    const scope = getSessionReplayLabelScope(data.databaseProps, data.permissions);
+/*
+ * Returns the application so callers that need its labels for a second,
+ * narrower decision (the identity column) do not have to load it twice.
+ */
+/*
+ * Process-local memory of what the two playback hot paths re-derive on
+ * every call: which application a session belongs to (a ClickHouse GROUP
+ * BY over the header table) and which labels that application carries (a
+ * Postgres lookup). A 480-chunk session is 60 chunk pages, and a live
+ * player heartbeats every 15s; without this every one of those paid both
+ * lookups again for an answer that had not changed.
+ *
+ * What is cached is the DATA, never the decision: the label intersection
+ * is recomputed against the caller's current permissions on every
+ * request, so a revoked grant takes effect immediately. A label edit on
+ * the application, or a header re-resolution, lags by at most the TTL -
+ * the same lag the ingest gate's policy cache already accepts. The
+ * manifest route always resolves fresh (a live session's header changes)
+ * and refills the entries the chunk and heartbeat routes then read.
+ */
+const SESSION_REPLAY_AUTHORIZATION_CACHE_TTL_MS = 30 * 1000;
+const MAX_SESSION_REPLAY_AUTHORIZATION_CACHE_ENTRIES = 2000;
+const rumApplicationCache = new Map();
+const sessionHeaderCache = new Map();
+const boundedCacheSet = (map, key, value) => {
+    if (map.size >= MAX_SESSION_REPLAY_AUTHORIZATION_CACHE_ENTRIES &&
+        !map.has(key)) {
+        const oldest = map.keys().next().value;
+        if (oldest !== undefined) {
+            map.delete(oldest);
+        }
+    }
+    map.delete(key);
+    map.set(key, value);
+};
+const loadRumApplicationForAccess = async (data) => {
+    const cacheKey = `${data.projectId.toString()}:${data.rumApplicationId.toString()}`;
+    if (data.allowCached) {
+        const cached = rumApplicationCache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.application;
+        }
+    }
     const application = await RumApplicationService.findOneBy({
         query: {
             _id: data.rumApplicationId.toString(),
@@ -2286,6 +2331,21 @@ const assertSessionReplayApplicationAccess = async (data) => {
             isRoot: true,
         },
     });
+    if (application) {
+        boundedCacheSet(rumApplicationCache, cacheKey, {
+            application: application,
+            expiresAt: Date.now() + SESSION_REPLAY_AUTHORIZATION_CACHE_TTL_MS,
+        });
+    }
+    return application;
+};
+const assertSessionReplayApplicationAccess = async (data) => {
+    const scope = getSessionReplayLabelScope(data.databaseProps, data.permissions);
+    const application = await loadRumApplicationForAccess({
+        projectId: data.projectId,
+        rumApplicationId: data.rumApplicationId,
+        allowCached: data.allowCached === true,
+    });
     /*
      * An application that does not exist in this project is refused the
      * same way an out-of-scope one is, so the endpoint cannot be used to
@@ -2367,21 +2427,177 @@ const resolveAccessibleRumApplicationIds = async (data) => {
     }
     return { applicationIds: accessibleIds, isTruncated: isTruncated };
 };
-const resolveAuthorizedSession = async (data) => {
-    const header = await SessionReplayReadService.getSessionHeader({
+/*
+ * Why a sessionId has no playable header. Each answer carries a
+ * different code word in its message so a client can tell them apart
+ * without parsing prose, and each is a 404: the id was well-formed, there
+ * is simply nothing at it.
+ */
+const GENERIC_MISSING_SESSION_MESSAGE = "not-found: No session replay exists with this id in this project.";
+const isApplicationInSessionReplayScopeById = async (data) => {
+    let scope;
+    try {
+        scope = getSessionReplayLabelScope(data.databaseProps, SESSION_REPLAY_PAYLOAD_PERMISSIONS);
+    }
+    catch (_a) {
+        /* A scope this path cannot enforce is refused, never widened. */
+        return false;
+    }
+    if (scope.isUnrestricted) {
+        return true;
+    }
+    if (!ObjectID.isValidUUID(data.rumApplicationId)) {
+        return false;
+    }
+    const application = await loadRumApplicationForAccess({
+        projectId: data.projectId,
+        rumApplicationId: new ObjectID(data.rumApplicationId),
+        allowCached: true,
+    });
+    if (!application) {
+        return false;
+    }
+    return isApplicationInSessionReplayScope({
+        scope: scope,
+        application: application,
+    });
+};
+const explainMissingSession = async (data) => {
+    /*
+     * The expired header is resolved FIRST, and not because it is the more
+     * likely answer: it is the only lookup that names an application, and
+     * nothing specific may be disclosed until that application has been
+     * authorized.
+     *
+     * The expiry answer carries the recording's existence, when it started
+     * and what retention the owning application runs. Answered before the
+     * access check - which is where it used to sit, since this runs on the
+     * path where getSessionHeader found nothing to authorize AGAINST - it let
+     * a label-scoped reviewer probe session ids and learn all three for
+     * applications outside their scope. That is precisely the existence
+     * probing assertSessionReplayApplicationAccess refuses "the same way" for
+     * a session that DOES exist.
+     *
+     * This read is deliberately retention-free (an expired row is the whole
+     * point), so it is the one place a scope check has to be written out by
+     * hand rather than inherited from resolveAuthorizedSession.
+     */
+    const expired = await SessionReplayReadService.getExpiredSessionInfo({
         projectId: data.projectId,
         sessionId: data.sessionId,
+        rumApplicationId: data.rumApplicationId,
     });
+    if (expired && expired.rumApplicationId) {
+        if (!(await isApplicationInSessionReplayScopeById({
+            projectId: data.projectId,
+            rumApplicationId: expired.rumApplicationId,
+            databaseProps: data.databaseProps,
+        }))) {
+            return new NotFoundException(GENERIC_MISSING_SESSION_MESSAGE);
+        }
+    }
+    /*
+     * Erasure is checked only once the caller is entitled to a specific
+     * answer. An erased session may still have a header row until the
+     * ClickHouse mutation lands, and "expired" would be the wrong story for
+     * a recording that was deliberately destroyed - so it is reported ahead
+     * of expiry. The tombstone throws when Redis cannot answer; that is a
+     * "cannot tell", which falls through to the header-based answers.
+     */
+    let isErased = false;
+    try {
+        isErased = await isSessionErased({
+            projectId: data.projectId.toString(),
+            sessionId: data.sessionId,
+        });
+    }
+    catch (_a) {
+        isErased = false;
+    }
+    if (isErased) {
+        return new NotFoundException("erased: This recording was erased by a data subject request and cannot be played back.");
+    }
+    if (expired) {
+        const retentionDays = Math.max(1, Math.round((expired.expiresAt.getTime() - expired.startTime.getTime()) /
+            (24 * 60 * 60 * 1000)));
+        return new NotFoundException(`expired: This recording expired on ${expired.expiresAt.toISOString()} under the application's ${retentionDays}-day retention. Its session signals may still be available from logs, traces and exceptions.`);
+    }
+    return new NotFoundException(GENERIC_MISSING_SESSION_MESSAGE);
+};
+const resolveAuthorizedSession = async (data) => {
+    const headerCacheKey = `${data.projectId.toString()}:${data.sessionId}:${data.rumApplicationId ? data.rumApplicationId.toString() : ""}`;
+    let header = null;
+    if (data.allowCached) {
+        const cached = sessionHeaderCache.get(headerCacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            header = cached.header;
+        }
+    }
     if (!header) {
-        throw new BadDataException("Session replay not found.");
+        header = await SessionReplayReadService.getSessionHeader({
+            projectId: data.projectId,
+            sessionId: data.sessionId,
+            rumApplicationId: data.rumApplicationId,
+        });
+        if (header) {
+            boundedCacheSet(sessionHeaderCache, headerCacheKey, {
+                header: header,
+                expiresAt: Date.now() + SESSION_REPLAY_AUTHORIZATION_CACHE_TTL_MS,
+            });
+        }
     }
-    await assertSessionReplayApplicationAccess({
+    if (!header) {
+        throw await explainMissingSession({
+            projectId: data.projectId,
+            sessionId: data.sessionId,
+            rumApplicationId: data.rumApplicationId,
+            databaseProps: data.databaseProps,
+        });
+    }
+    const application = await assertSessionReplayApplicationAccess({
         projectId: data.projectId,
         rumApplicationId: new ObjectID(header.rumApplicationId),
         databaseProps: data.databaseProps,
         permissions: SESSION_REPLAY_PAYLOAD_PERMISSIONS,
+        allowCached: data.allowCached,
     });
-    return header;
+    return { header: header, application: application };
+};
+const readOptionalObjectIdFromBody = (body, key) => {
+    const value = body[key];
+    if (value === undefined || value === null || value === "") {
+        return undefined;
+    }
+    if (typeof value !== "string" || !ObjectID.isValidUUID(value)) {
+        throw new BadDataException(`${key} is not a valid id`);
+    }
+    return new ObjectID(value);
+};
+const readOptionalDateFromBody = (body, key) => {
+    const value = body[key];
+    if (value === undefined || value === null || value === "") {
+        return undefined;
+    }
+    if (typeof value !== "string" && typeof value !== "number") {
+        throw new BadDataException(`${key} must be an ISO-8601 timestamp`);
+    }
+    const parsed = typeof value === "number"
+        ? new Date(value)
+        : OneUptimeDate.fromString(value);
+    if (!Number.isFinite(parsed.getTime())) {
+        throw new BadDataException(`${key} must be an ISO-8601 timestamp`);
+    }
+    return parsed;
+};
+const readLimitFromBody = (body, defaultLimit, maxLimit) => {
+    const value = body["limit"];
+    if (value === undefined || value === null) {
+        return defaultLimit;
+    }
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+        throw new BadDataException(`limit must be a whole number between 1 and ${maxLimit}`);
+    }
+    return Math.min(value, maxLimit);
 };
 const readObjectIdFromBody = (body, key) => {
     const value = body[key];
@@ -2393,23 +2609,91 @@ const readObjectIdFromBody = (body, key) => {
     }
     return new ObjectID(value);
 };
+/*
+ * A session id is 32 hex characters minted in the browser. The cap is
+ * generous rather than exact - older recorders and hand-written API
+ * callers exist - but it is a cap: an unbounded caller-supplied string
+ * reaches ClickHouse as a bound parameter on a hot path.
+ */
+const MAX_SESSION_REPLAY_SESSION_ID_LENGTH = 128;
 const readSessionIdFromBody = (body) => {
     const sessionId = body["sessionId"];
     if (typeof sessionId !== "string" || sessionId.length === 0) {
         throw new BadDataException("sessionId is required");
     }
+    if (sessionId.length > MAX_SESSION_REPLAY_SESSION_ID_LENGTH) {
+        throw new BadDataException(`sessionId must be at most ${MAX_SESSION_REPLAY_SESSION_ID_LENGTH} characters.`);
+    }
     return sessionId;
 };
+/*
+ * Caps on the list's filter inputs.
+ *
+ * Every array filter becomes an `IN (...)` inside a HAVING, which
+ * ClickHouse evaluates per GROUP over the whole window - so the cost of a
+ * request is the caller's array length times the number of sessions in
+ * range. Uncapped, one request carrying tens of thousands of browser names
+ * is a cheap denial of service against the list for any holder of the list
+ * permission. The limits are far above any real UI: the filter panel
+ * offers a couple of dozen browsers, and no session has more than a
+ * handful of routes.
+ *
+ * Values are TRUNCATED and the array is SLICED rather than refused: an
+ * over-long value simply cannot match anything a bounded column holds, so
+ * a 400 would add nothing but a confusing error.
+ */
+const MAX_SESSION_REPLAY_FILTER_ARRAY_LENGTH = 50;
+const MAX_SESSION_REPLAY_FILTER_VALUE_LENGTH = 256;
 const readStringArrayFromBody = (body, key) => {
     const value = body[key];
     if (!Array.isArray(value)) {
         return undefined;
     }
-    const strings = value.filter((item) => {
-        return typeof item === "string" && item.length > 0;
-    });
+    const strings = [];
+    for (const item of value) {
+        if (typeof item !== "string" || item.length === 0) {
+            continue;
+        }
+        strings.push(item.substring(0, MAX_SESSION_REPLAY_FILTER_VALUE_LENGTH));
+        if (strings.length >= MAX_SESSION_REPLAY_FILTER_ARRAY_LENGTH) {
+            break;
+        }
+    }
     return strings.length > 0 ? strings : undefined;
 };
+const readBoundedStringFromBody = (body, key) => {
+    const value = body[key];
+    if (typeof value !== "string" || value.length === 0) {
+        return undefined;
+    }
+    return value.substring(0, MAX_SESSION_REPLAY_FILTER_VALUE_LENGTH);
+};
+const readTagFilterFromBody = (filters) => {
+    const value = filters["tags"];
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    const tags = {};
+    let count = 0;
+    for (const key of Object.keys(value)) {
+        const entry = value[key];
+        if (typeof entry !== "string" || key.length === 0) {
+            continue;
+        }
+        if (count >= SESSION_REPLAY_MAX_TAG_KEYS) {
+            break;
+        }
+        tags[key.substring(0, SESSION_REPLAY_MAX_TAG_KEY_LENGTH)] = entry.substring(0, SESSION_REPLAY_MAX_TAG_VALUE_LENGTH);
+        count++;
+    }
+    return count > 0 ? tags : undefined;
+};
+const isBindableCursorSortValue = (cursor, sortBy) => {
+    if (sortBy === "startTime") {
+        return Number.isFinite(new Date(cursor.sortValue).getTime());
+    }
+    return cursor.sortValue >= 0;
+};
 // --- Session Replay List Endpoint ---
 router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAccess, async (req, res, next) => {
     try {
@@ -2433,12 +2717,29 @@ router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAcc
             databaseProps: databaseProps,
             permissions: SESSION_REPLAY_LIST_PERMISSIONS,
         });
-        const startTime = body["startTime"]
-            ? OneUptimeDate.fromString(body["startTime"])
-            : OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), -7);
-        const endTime = body["endTime"]
-            ? OneUptimeDate.fromString(body["endTime"])
-            : OneUptimeDate.getCurrentDate();
+        const startTime = readOptionalDateFromBody(body, "startTime") ||
+            OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), -7);
+        const endTime = readOptionalDateFromBody(body, "endTime") ||
+            OneUptimeDate.getCurrentDate();
+        /*
+         * An inverted window matches nothing, and an empty list with a 200
+         * is exactly the answer a client cannot distinguish from "no
+         * sessions" - so it is a 400 with the reason instead.
+         */
+        if (startTime.getTime() > endTime.getTime()) {
+            return Response.sendErrorResponse(req, res, new BadDataException("startTime must not be after endTime"));
+        }
+        const limit = readLimitFromBody(body, DEFAULT_SESSION_REPLAY_LIST_LIMIT, MAX_SESSION_REPLAY_LIST_LIMIT);
+        const rawSortBy = body["sortBy"];
+        if (rawSortBy !== undefined &&
+            rawSortBy !== null &&
+            (typeof rawSortBy !== "string" ||
+                !SESSION_REPLAY_SORT_BY_VALUES.includes(rawSortBy))) {
+            return Response.sendErrorResponse(req, res, new BadDataException(`sortBy must be one of ${SESSION_REPLAY_SORT_BY_VALUES.join(", ")}.`));
+        }
+        const sortBy = typeof rawSortBy === "string"
+            ? rawSortBy
+            : "startTime";
         /*
          * The narrower identity ACL, resolved BEFORE the filters are built.
          *
@@ -2473,7 +2774,29 @@ router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAcc
             !SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"])) {
             return Response.sendErrorResponse(req, res, new BadDataException(`identifiedUserRef must be a non-empty string of at most ${SESSION_REPLAY_MAX_USER_REF_LENGTH} characters.`));
         }
-        const filters = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (typeof rawFilters["hasError"] === "boolean" && {
+        /*
+         * A filter the server understood but did not apply, named in the
+         * response.
+         *
+         * The identity filter is gated on the narrower identity permission.
+         * Dropping it silently is the dangerous half of that gate: the
+         * request "show me jane@example.com's sessions" then answers 200 with
+         * EVERY session in the application, and the caller has no way to tell
+         * - least of all when the application has no sessions at all, where
+         * even inspecting the rows cannot reveal it. A support engineer opens
+         * the wrong recording, and each opening writes an audit row against a
+         * real end user.
+         *
+         * Answered as data rather than as a 403 because the rest of the list
+         * IS something the caller may read: the page renders the sessions and
+         * says the filter was ignored, instead of failing outright.
+         */
+        const ignoredFilters = [];
+        if (!includeIdentifiedUserLabel &&
+            SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"])) {
+            ignoredFilters.push("identifiedUserRef");
+        }
+        const filters = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (typeof rawFilters["hasError"] === "boolean" && {
             hasError: rawFilters["hasError"],
         })), (typeof rawFilters["hasFrustration"] === "boolean" && {
             hasFrustration: rawFilters["hasFrustration"],
@@ -2495,31 +2818,92 @@ router.post("/telemetry/rum/session-replay/list", ...requireSessionReplayListAcc
                 projectId: projectId,
                 userRef: rawFilters["identifiedUserRef"],
             }),
-        })), (typeof rawFilters["identifiedUserKey"] === "string" &&
+        })), (readBoundedStringFromBody(rawFilters, "identifiedUserKey") &&
             !SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"]) && {
-            identifiedUserKey: rawFilters["identifiedUserKey"],
-        })), (typeof rawFilters["route"] === "string" && {
-            route: rawFilters["route"],
-        })), (typeof rawFilters["minDurationMs"] === "number" && {
+            identifiedUserKey: readBoundedStringFromBody(rawFilters, "identifiedUserKey"),
+        })), (readBoundedStringFromBody(rawFilters, "route") && {
+            route: readBoundedStringFromBody(rawFilters, "route"),
+        })), (typeof rawFilters["minDurationMs"] === "number" &&
+            Number.isFinite(rawFilters["minDurationMs"]) && {
             minDurationMs: rawFilters["minDurationMs"],
+        })), (typeof rawFilters["hasIdentifiedUser"] === "boolean" && {
+            hasIdentifiedUser: rawFilters["hasIdentifiedUser"],
+        })), (typeof rawFilters["isPlayable"] === "boolean" && {
+            isPlayable: rawFilters["isPlayable"],
+        })), (typeof rawFilters["hasTraces"] === "boolean" && {
+            hasTraces: rawFilters["hasTraces"],
+        })), (typeof rawFilters["urlPrefix"] === "string" &&
+            rawFilters["urlPrefix"].length > 0 && {
+            urlPrefix: rawFilters["urlPrefix"].substring(0, SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH),
+        })), (readTagFilterFromBody(rawFilters) && {
+            tags: readTagFilterFromBody(rawFilters),
         }));
-        const rawCursor = body["cursor"]
-            ? body["cursor"]
-            : undefined;
-        const cursor = rawCursor &&
-            typeof rawCursor["startTimeUnixMs"] === "number" &&
-            typeof rawCursor["sessionId"] === "string"
-            ? {
-                startTimeUnixMs: rawCursor["startTimeUnixMs"],
-                sessionId: rawCursor["sessionId"],
+        /*
+         * Free text is the one predicate that cannot use an index: it is a
+         * substring scan of every header in the window. The string cap
+         * keeps each comparison cheap; the window cap keeps the number of
+         * comparisons bounded, and is answered with its own message so the
+         * list can say "narrow the range" rather than "no sessions".
+         */
+        const rawSearch = rawFilters["search"];
+        if (rawSearch !== undefined && rawSearch !== null && rawSearch !== "") {
+            if (typeof rawSearch !== "string") {
+                return Response.sendErrorResponse(req, res, new BadDataException("search must be a string"));
             }
-            : undefined;
-        const result = await SessionReplayReadService.listSessions(Object.assign(Object.assign({ projectId: projectId, rumApplicationId: rumApplicationId, startTime: startTime, endTime: endTime, filters: filters, limit: typeof body["limit"] === "number"
-                ? body["limit"]
-                : DEFAULT_SESSION_REPLAY_LIST_LIMIT }, (cursor !== undefined && { cursor })), { includeIdentifiedUserLabel: includeIdentifiedUserLabel }));
+            if (rawSearch.length > SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH) {
+                return Response.sendErrorResponse(req, res, new BadDataException(`search must be at most ${SESSION_REPLAY_LIST_SEARCH_MAX_LENGTH} characters.`));
+            }
+            const windowMs = endTime.getTime() - startTime.getTime();
+            if (windowMs >
+                SESSION_REPLAY_LIST_SEARCH_MAX_WINDOW_DAYS * 24 * 60 * 60 * 1000) {
+                return Response.sendErrorResponse(req, res, new BadDataException(`Search covers at most ${SESSION_REPLAY_LIST_SEARCH_MAX_WINDOW_DAYS} days at a time. Narrow the range to search it.`));
+            }
+            if (rawSearch.trim().length > 0) {
+                filters.search = rawSearch.trim();
+            }
+        }
+        /*
+         * Both cursor shapes are accepted: the legacy {startTimeUnixMs,
+         * sessionId} one an older Dashboard or a bookmark still sends (it
+         * means "newest first"), and the sorted one. A cursor for a
+         * different ordering than the one requested is refused by the
+         * service rather than silently mis-paged.
+         */
+        const cursor = body["cursor"] !== undefined && body["cursor"] !== null
+            ? parseSessionReplayListCursor(body["cursor"])
+            : null;
+        if (body["cursor"] !== undefined &&
+            body["cursor"] !== null &&
+            (cursor === null || !isBindableCursorSortValue(cursor, sortBy))) {
+            return Response.sendErrorResponse(req, res, new BadDataException("cursor must be the nextCursor of a previous page."));
+        }
+        const result = await SessionReplayReadService.listSessions(Object.assign(Object.assign({ projectId: projectId, rumApplicationId: rumApplicationId, startTime: startTime, endTime: endTime, filters: filters, limit: limit, sortBy: sortBy }, (cursor !== null && { cursor })), { includeIdentifiedUserLabel: includeIdentifiedUserLabel }));
+        /*
+         * The legacy cursor shape is still EMITTED for the newest-first sort
+         * so an older Dashboard keeps paging; every other sort emits the
+         * generalised shape, which such a client never asks for.
+         */
+        const nextCursor = result.nextCursor
+            ? sortBy === "startTime"
+                ? {
+                    startTimeUnixMs: result.nextCursor.sortValue,
+                    sessionId: result.nextCursor.sessionId,
+                }
+                : {
+                    sortBy: result.nextCursor.sortBy,
+                    sortValue: result.nextCursor.sortValue,
+                    sessionId: result.nextCursor.sessionId,
+                }
+            : null;
         return Response.sendJsonObjectResponse(req, res, {
             sessions: result.sessions,
-            nextCursor: result.nextCursor,
+            nextCursor: nextCursor,
+            /*
+             * Always present, empty when everything asked for was applied, so a
+             * client can read it without having to distinguish "no ignored
+             * filters" from "an older server that never said".
+             */
+            ignoredFilters: ignoredFilters,
         });
     }
     catch (err) {
@@ -2537,11 +2921,18 @@ router.post("/telemetry/rum/session-replay/manifest", ...requireSessionReplayPay
         const projectId = databaseProps.tenantId;
         const body = req.body;
         const sessionId = readSessionIdFromBody(body);
-        const header = await resolveAuthorizedSession({
+        /*
+         * Optional disambiguator, validated but NOT trusted: the header it
+         * selects still names the application that gets authorized.
+         */
+        const requestedApplicationId = readOptionalObjectIdFromBody(body, "rumApplicationId");
+        const authorized = await resolveAuthorizedSession({
             projectId: projectId,
             sessionId: sessionId,
             databaseProps: databaseProps,
+            rumApplicationId: requestedApplicationId,
         });
+        const header = authorized.header;
         /*
          * The authorized application, resolved server-side from the header.
          * Every chunk-table read below is pinned to it: that table's replace
@@ -2551,44 +2942,108 @@ router.post("/telemetry/rum/session-replay/manifest", ...requireSessionReplayPay
          */
         const authorizedApplicationId = new ObjectID(header.rumApplicationId);
         /*
-         * The audit row is written BEFORE the manifest is built, not after.
-         * A read that fails halfway through still happened, and an audit
-         * that only records successful reads is an audit an attacker can
-         * evade by aborting the request.
+         * A live-session poll reuses the view row the first read created.
+         *
+         * The player re-fetches the manifest every 30s while a session is
+         * still recording, and each of those is the same person continuing
+         * the same viewing, not a new disclosure. Writing a row per poll
+         * would turn one viewing into dozens of audit entries and bury the
+         * signal the audit exists for. The row is reused ONLY when the
+         * caller proves it is theirs (looked up by viewedByUserId) AND it
+         * is for this session; anything else - somebody else's viewId, a
+         * different session, an id that no longer exists - is a fresh
+         * recordView, exactly as if isRefresh had not been sent.
          */
-        const view = await RumSessionReplayViewService.recordView({
-            projectId: projectId,
-            rumApplicationId: authorizedApplicationId,
-            sessionId: sessionId,
-            viewedByUserId: databaseProps.userId,
-            ipAddress: getClientIp(req),
-            userAgent: typeof req.headers["user-agent"] === "string"
-                ? req.headers["user-agent"]
-                : undefined,
-            accessReason: typeof body["accessReason"] === "string"
-                ? body["accessReason"]
-                : undefined,
-            linkedIncidentId: typeof body["linkedIncidentId"] === "string" &&
-                body["linkedIncidentId"].length > 0
-                ? new ObjectID(body["linkedIncidentId"])
-                : undefined,
-            linkedExceptionFingerprint: typeof body["linkedExceptionFingerprint"] === "string"
-                ? body["linkedExceptionFingerprint"]
-                : undefined,
-        });
+        let viewId = null;
+        const isRefresh = body["isRefresh"] === true;
+        const refreshViewId = isRefresh
+            ? readOptionalObjectIdFromBody(body, "viewId")
+            : undefined;
+        if (refreshViewId && databaseProps.userId) {
+            const ownView = await RumSessionReplayViewService.findOwnView({
+                viewId: refreshViewId,
+                projectId: projectId,
+                viewedByUserId: databaseProps.userId,
+                sessionId: sessionId,
+            });
+            if (ownView &&
+                ownView.id &&
+                ownView.rumApplicationId &&
+                ownView.rumApplicationId.toString() ===
+                    authorizedApplicationId.toString()) {
+                viewId = ownView.id.toString();
+            }
+        }
+        if (viewId === null) {
+            /*
+             * The audit row is written BEFORE the manifest is built, not
+             * after. A read that fails halfway through still happened, and
+             * an audit that only records successful reads is an audit an
+             * attacker can evade by aborting the request.
+             *
+             * linkedIncidentId is validated rather than constructed blindly:
+             * ObjectID's constructor checks nothing, and a malformed id would
+             * fail the audit insert - and with it the playback it audits. A
+             * bad link is dropped; the view is still recorded.
+             */
+            const rawLinkedIncidentId = body["linkedIncidentId"];
+            const view = await RumSessionReplayViewService.recordView({
+                projectId: projectId,
+                rumApplicationId: authorizedApplicationId,
+                sessionId: sessionId,
+                viewedByUserId: databaseProps.userId,
+                ipAddress: getClientIp(req),
+                userAgent: typeof req.headers["user-agent"] === "string"
+                    ? req.headers["user-agent"]
+                    : undefined,
+                accessReason: typeof body["accessReason"] === "string"
+                    ? body["accessReason"]
+                    : undefined,
+                linkedIncidentId: typeof rawLinkedIncidentId === "string" &&
+                    ObjectID.isValidUUID(rawLinkedIncidentId)
+                    ? new ObjectID(rawLinkedIncidentId)
+                    : undefined,
+                linkedExceptionFingerprint: typeof body["linkedExceptionFingerprint"] === "string" &&
+                    body["linkedExceptionFingerprint"].length > 0
+                    ? body["linkedExceptionFingerprint"]
+                    : undefined,
+            });
+            viewId = view.id ? view.id.toString() : null;
+        }
         const manifest = await SessionReplayReadService.getManifest({
             header: header,
             projectId: projectId,
             rumApplicationId: authorizedApplicationId,
             sessionId: sessionId,
         });
+        /*
+         * The identity columns are read by a SEPARATE statement that runs
+         * only after the narrower identity check passes for the application
+         * the caller was just authorized against. Nothing above named them,
+         * so a caller without the permission never causes a statement that
+         * touches identifiedUserLabel or identifiedUserTraits to exist.
+         */
+        let identity = null;
+        if (canReadIdentifiedUserLabel({
+            databaseProps: databaseProps,
+            application: authorized.application,
+        })) {
+            identity = await SessionReplayReadService.getSessionIdentity({
+                projectId: projectId,
+                rumApplicationId: authorizedApplicationId,
+                sessionId: sessionId,
+            });
+        }
+        const responseHeader = identity
+            ? Object.assign(Object.assign({}, manifest.header), { identifiedUserLabel: identity.identifiedUserLabel, identifiedUserTraits: identity.identifiedUserTraits }) : manifest.header;
         return Response.sendJsonObjectResponse(req, res, {
             /*
              * viewId is echoed back so the player's heartbeat can advance the
-             * very row this read created, instead of guessing at one.
+             * very row this read created (or reused), instead of guessing at
+             * one.
              */
-            viewId: view.id ? view.id.toString() : null,
-            header: manifest.header,
+            viewId: viewId,
+            header: responseHeader,
             tabs: manifest.tabs,
             isChunkIndexTruncated: manifest.isChunkIndexTruncated,
         });
@@ -2631,12 +3086,22 @@ router.post("/telemetry/rum/session-replay/chunks", ...requireSessionReplayPaylo
         if (chunkIndexes.length > MAX_SESSION_REPLAY_CHUNKS_PER_READ) {
             return Response.sendErrorResponse(req, res, new BadDataException(`A maximum of ${MAX_SESSION_REPLAY_CHUNKS_PER_READ} chunks may be requested at a time.`));
         }
-        const header = await resolveAuthorizedSession({
+        /*
+         * Served from the 30s authorization cache: a session is 60 chunk
+         * pages at most, and re-aggregating its header plus re-loading the
+         * application's labels for every one of them is what made seeks
+         * stutter. The label decision itself is still made against the
+         * caller's current permissions on every request.
+         */
+        const authorized = await resolveAuthorizedSession({
             projectId: projectId,
             sessionId: sessionId,
             databaseProps: databaseProps,
+            rumApplicationId: readOptionalObjectIdFromBody(body, "rumApplicationId"),
+            allowCached: true,
         });
-        const chunks = await SessionReplayReadService.getChunks({
+        const header = authorized.header;
+        const read = await SessionReplayReadService.getChunks({
             projectId: projectId,
             /* Always the application the caller was authorized against. */
             rumApplicationId: new ObjectID(header.rumApplicationId),
@@ -2656,18 +3121,26 @@ router.post("/telemetry/rum/session-replay/chunks", ...requireSessionReplayPaylo
         const frames = [];
         /*
          * The byte cap is re-checked here against the bytes actually being
-         * framed, not only against what the pre-check in the read service
-         * believed. This is the last place the size of the response is
-         * knowable, so it is the one place a cap on the response can be
-         * absolute regardless of how stored size was estimated upstream.
+         * framed, not only against what the read service believed. This is
+         * the last place the size of the response is knowable, so it is the
+         * one place a cap on the response can be absolute regardless of how
+         * stored size was estimated upstream. Like the service, it answers
+         * with the prefix that fits rather than refusing - and never with
+         * nothing: a single chunk is bounded by the ingest cap, and a chunk
+         * that could never be served would dead-end playback at it forever.
          */
         let responseBytes = 0;
-        for (const chunk of chunks) {
+        const omittedChunkIndexes = [...read.omittedChunkIndexes];
+        for (const chunk of read.chunks) {
             const payloadBuffer = Buffer.from(chunk.payload, "utf8");
-            responseBytes += payloadBuffer.length + 8;
-            if (responseBytes > MAX_SESSION_REPLAY_READ_BYTES) {
-                return Response.sendErrorResponse(req, res, new BadDataException(`The requested chunks exceed the ${MAX_SESSION_REPLAY_READ_BYTES} byte limit for a single read. Request fewer chunks.`));
+            const framedBytes = payloadBuffer.length + 8;
+            if (frames.length > 0 &&
+                (responseBytes + framedBytes > MAX_SESSION_REPLAY_READ_BYTES ||
+                    omittedChunkIndexes.length > 0)) {
+                omittedChunkIndexes.push(chunk.chunkIndex);
+                continue;
             }
+            responseBytes += framedBytes;
             const headerBuffer = Buffer.alloc(8);
             headerBuffer.writeUInt32LE(chunk.chunkIndex, 0);
             headerBuffer.writeUInt32LE(payloadBuffer.length, 4);
@@ -2676,6 +3149,18 @@ router.post("/telemetry/rum/session-replay/chunks", ...requireSessionReplayPaylo
         const responseBody = Buffer.concat(frames);
         res.setHeader("Content-Type", "application/octet-stream");
         res.setHeader("Content-Length", responseBody.length.toString());
+        /*
+         * Which requested chunks exist but were left out for size, so a
+         * client that cares can ask for them in a smaller page instead of
+         * reading their absence as a gap in the recording.
+         */
+        if (omittedChunkIndexes.length > 0) {
+            res.setHeader("X-OneUptime-Replay-Omitted-Chunks", omittedChunkIndexes
+                .sort((a, b) => {
+                return a - b;
+            })
+                .join(","));
+        }
         /*
          * A recording is personal data. Nothing about it may sit in a
          * shared cache, and the browser should not keep it on disk either.
@@ -2704,13 +3189,16 @@ router.post("/telemetry/rum/session-replay/heartbeat", ...requireSessionReplayPa
             return Response.sendErrorResponse(req, res, new BadDataException("secondsWatched must be a number"));
         }
         /*
-         * Floored to the 15s heartbeat cadence. recordSecondsWatched is
-         * monotonic and returns without writing when the value does not
-         * advance, so flooring here turns a chatty client into at most one
-         * UPDATE per 15 seconds watched without any server-side timer or
-         * cross-pod throttle state.
+         * SEMANTICS: secondsWatched is the cumulative seconds of footage the
+         * player has PLAYED for this view (accumulated client-side while
+         * playback runs, scaled by speed), not the furthest offset reached.
+         * Floored to the 15s heartbeat cadence and clamped by the service,
+         * which is monotonic and writes nothing when the value does not
+         * advance, so a chatty client costs at most one UPDATE per 15
+         * seconds watched without any server-side timer or cross-pod
+         * throttle state.
          */
-        const throttledSeconds = Math.floor(Math.max(0, secondsWatched) / 15) * 15;
+        const throttledSeconds = normalizeSecondsWatched(secondsWatched);
         /*
          * secondsWatched is a privacy control, not telemetry: it is shown on
          * the player as "who watched how much of this recording". Scoping
@@ -2723,24 +3211,16 @@ router.post("/telemetry/rum/session-replay/heartbeat", ...requireSessionReplayPa
          * viewId belonging to anyone else matches nothing and is refused
          * indistinguishably from one that does not exist - and the
          * application it points at is authorized exactly as a payload read
-         * would be.
+         * would be. That ONE lookup also carries the row's current figure,
+         * so a heartbeat that does not advance it ends here with no write.
          */
         if (!databaseProps.userId) {
             return Response.sendErrorResponse(req, res, new NotAuthorizedException("You do not have access to this session replay view."));
         }
-        const view = await RumSessionReplayViewService.findOneBy({
-            query: {
-                _id: viewId.toString(),
-                projectId: projectId,
-                viewedByUserId: databaseProps.userId,
-            },
-            select: {
-                _id: true,
-                rumApplicationId: true,
-            },
-            props: {
-                isRoot: true,
-            },
+        const view = await RumSessionReplayViewService.findOwnView({
+            viewId: viewId,
+            projectId: projectId,
+            viewedByUserId: databaseProps.userId,
         });
         if (!view || !view.rumApplicationId) {
             return Response.sendErrorResponse(req, res, new NotAuthorizedException("You do not have access to this session replay view."));
@@ -2750,14 +3230,85 @@ router.post("/telemetry/rum/session-replay/heartbeat", ...requireSessionReplayPa
             rumApplicationId: view.rumApplicationId,
             databaseProps: databaseProps,
             permissions: SESSION_REPLAY_PAYLOAD_PERMISSIONS,
+            allowCached: true,
         });
+        const currentSecondsWatched = view.secondsWatched || 0;
         await RumSessionReplayViewService.recordSecondsWatched({
             viewId: viewId,
             projectId: projectId,
             secondsWatched: throttledSeconds,
+            currentSecondsWatched: currentSecondsWatched,
         });
         return Response.sendJsonObjectResponse(req, res, {
-            secondsWatched: throttledSeconds,
+            secondsWatched: Math.max(currentSecondsWatched, throttledSeconds),
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
+// --- Session Replay Views Endpoint ---
+/*
+ * Who has watched this recording. The audit table has been written on
+ * every manifest read since the feature shipped and nothing surfaced it;
+ * the player header now can. Payload permission, because the list of
+ * viewers is a fact about a recording of a real person and belongs to
+ * the people who may watch it. Pinned to the application the session was
+ * authorized under: sessionId is only unique within an application.
+ */
+const MAX_SESSION_REPLAY_VIEWS_LIMIT = 50;
+router.post("/telemetry/rum/session-replay/views", ...requireSessionReplayPayloadAccess, async (req, res, next) => {
+    try {
+        const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        if (!(databaseProps === null || databaseProps === void 0 ? void 0 : databaseProps.tenantId)) {
+            return Response.sendErrorResponse(req, res, new BadDataException("Invalid Project ID"));
+        }
+        assertSessionReplayPlan(databaseProps);
+        const projectId = databaseProps.tenantId;
+        const body = req.body;
+        const sessionId = readSessionIdFromBody(body);
+        const authorized = await resolveAuthorizedSession({
+            projectId: projectId,
+            sessionId: sessionId,
+            databaseProps: databaseProps,
+            rumApplicationId: readOptionalObjectIdFromBody(body, "rumApplicationId"),
+            allowCached: true,
+        });
+        const views = await RumSessionReplayViewService.getViewsForSession({
+            projectId: projectId,
+            rumApplicationId: new ObjectID(authorized.header.rumApplicationId),
+            sessionId: sessionId,
+            limit: readLimitFromBody(body, MAX_SESSION_REPLAY_VIEWS_LIMIT, MAX_SESSION_REPLAY_VIEWS_LIMIT),
+        });
+        return Response.sendJsonObjectResponse(req, res, {
+            views: views.map((view) => {
+                var _a;
+                return {
+                    id: view.id ? view.id.toString() : null,
+                    viewedAt: view.viewedAt ? view.viewedAt.toISOString() : null,
+                    secondsWatched: (_a = view.secondsWatched) !== null && _a !== void 0 ? _a : 0,
+                    accessReason: view.accessReason || "",
+                    viewedByUserId: view.viewedByUserId
+                        ? view.viewedByUserId.toString()
+                        : null,
+                    viewedByUser: view.viewedByUser
+                        ? {
+                            id: view.viewedByUser.id
+                                ? view.viewedByUser.id.toString()
+                                : null,
+                            name: view.viewedByUser.name
+                                ? view.viewedByUser.name.toString()
+                                : "",
+                            email: view.viewedByUser.email
+                                ? view.viewedByUser.email.toString()
+                                : "",
+                            profilePictureId: view.viewedByUser.profilePictureId
+                                ? view.viewedByUser.profilePictureId.toString()
+                                : null,
+                        }
+                        : null,
+                };
+            }),
         });
     }
     catch (err) {
@@ -2788,15 +3339,34 @@ router.post("/telemetry/rum/session-replay/for-exception", ...requireSessionRepl
             databaseProps: databaseProps,
             permissions: SESSION_REPLAY_LIST_PERMISSIONS,
         });
-        const startTime = body["startTime"]
-            ? OneUptimeDate.fromString(body["startTime"])
-            : undefined;
-        const endTime = body["endTime"]
-            ? OneUptimeDate.fromString(body["endTime"])
-            : undefined;
-        const sessions = await SessionReplayReadService.getSessionsForException(Object.assign(Object.assign(Object.assign({ projectId: projectId, exceptionFingerprint: fingerprint, accessibleRumApplicationIds: accessibleApplications.applicationIds }, (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), { limit: typeof body["limit"] === "number"
-                ? body["limit"]
-                : MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT }));
+        let startTime = readOptionalDateFromBody(body, "startTime");
+        let endTime = readOptionalDateFromBody(body, "endTime");
+        /*
+         * The exception page knows WHEN the error happened. A session that
+         * contains that moment started at most one maximum session length
+         * before it (plus skew padding), so the window is derived from the
+         * moment rather than left to the 30-day default - a fraction of
+         * the partitions, and the card finds the session of THIS instance
+         * rather than the newest session that ever hit the fingerprint.
+         */
+        const rawErrorTime = body["errorTimeUnixMs"];
+        if (startTime === undefined &&
+            endTime === undefined &&
+            typeof rawErrorTime === "number" &&
+            Number.isFinite(rawErrorTime) &&
+            rawErrorTime > 0) {
+            startTime = new Date(rawErrorTime -
+                SESSION_REPLAY_MAX_SESSION_MS -
+                SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS);
+            endTime = new Date(rawErrorTime + SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS);
+        }
+        if (startTime && endTime && startTime.getTime() > endTime.getTime()) {
+            return Response.sendErrorResponse(req, res, new BadDataException("startTime must not be after endTime"));
+        }
+        /* Pin to the session the caller already knows threw, when it does. */
+        const pinnedSessionId = body["sessionId"];
+        const sessions = await SessionReplayReadService.getSessionsForException(Object.assign(Object.assign(Object.assign(Object.assign({ projectId: projectId, exceptionFingerprint: fingerprint, accessibleRumApplicationIds: accessibleApplications.applicationIds }, (startTime !== undefined && { startTime })), (endTime !== undefined && { endTime })), (typeof pinnedSessionId === "string" &&
+            pinnedSessionId.length > 0 && { sessionId: pinnedSessionId })), { limit: readLimitFromBody(body, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT, MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT) }));
         return Response.sendJsonObjectResponse(req, res, {
             sessions: sessions,
             /*
@@ -2863,9 +3433,20 @@ router.post("/telemetry/rum/session-replay/ingest-status", ...requireSessionRepl
                 sessionReplayAllowedOrigins: true,
                 sessionReplaySamplePercentage: true,
                 sessionReplayCaptureTrigger: true,
+                sessionReplayConsentMode: true,
+                sessionReplayMaskingMode: true,
+                sessionReplayRetentionInDays: true,
                 sessionReplayMonthlyBudgetInGB: true,
                 sessionReplayLastChunkReceivedAt: true,
                 sessionReplayBudgetExceededAt: true,
+                /*
+                 * Stamped by the /config route on every recorder load (through
+                 * the throttled updateLastSeen path), so this is "when did the
+                 * recorder last run on the customer's site" - the fact that
+                 * separates "never installed" from "installed but uploading
+                 * nothing".
+                 */
+                lastSeenAt: true,
             },
             props: {
                 isRoot: true,
@@ -2885,12 +3466,36 @@ router.post("/telemetry/rum/session-replay/ingest-status", ...requireSessionRepl
                 isRoot: true,
             },
         });
-        const [projectBytesUsedToday, applicationBytesUsedThisMonth] = await Promise.all([
+        const appIdentifier = String(application["appIdentifier"] || "");
+        /*
+         * Every counter below is independent and every one answers null on
+         * its own failure: the Redis-backed ones when Redis is down, the
+         * ClickHouse-backed summary when the query fails. null is rendered
+         * as "unknown", never as 0 - "nothing was refused" and "we could
+         * not count" are different diagnoses.
+         */
+        const [projectBytesUsedToday, applicationBytesUsedThisMonth, refusalsLast24h, dropsLast24h, activity,] = await Promise.all([
             SessionReplayUsage.getProjectBytesUsedToday(projectId),
             SessionReplayUsage.getApplicationBytesUsedThisMonth({
                 projectId: projectId,
                 rumApplicationId: rumApplicationId,
             }),
+            appIdentifier
+                ? SessionReplayHealthCounters.readRefusalsLast24h({
+                    projectId: projectId,
+                    appIdentifier: appIdentifier,
+                })
+                : Promise.resolve(null),
+            appIdentifier
+                ? SessionReplayHealthCounters.readDropsLast24h({
+                    projectId: projectId,
+                    appIdentifier: appIdentifier,
+                })
+                : Promise.resolve(null),
+            SessionReplayReadService.getApplicationActivitySummary({
+                projectId: projectId,
+                rumApplicationId: rumApplicationId,
+            }),
         ]);
         /*
          * Same env var, same default, as the value the ingest gate enforces
@@ -2902,10 +3507,23 @@ router.post("/telemetry/rum/session-replay/ingest-status", ...requireSessionRepl
             ? dailyCapEnv
             : DEFAULT_SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY;
         const applicationView = application;
+        const toIsoOrNull = (value) => {
+            if (value instanceof Date) {
+                return Number.isFinite(value.getTime()) ? value.toISOString() : null;
+            }
+            if (typeof value === "string" && value.length > 0) {
+                const parsed = Date.parse(value);
+                return Number.isFinite(parsed)
+                    ? new Date(parsed).toISOString()
+                    : null;
+            }
+            return null;
+        };
+        const retentionInDays = applicationView["sessionReplayRetentionInDays"];
         return Response.sendJsonObjectResponse(req, res, {
             isProjectAllowed: Boolean(project === null || project === void 0 ? void 0 : project["isSessionReplayAllowed"]),
             isApplicationEnabled: Boolean(applicationView["isSessionReplayEnabled"]),
-            appIdentifier: String(applicationView["appIdentifier"] || ""),
+            appIdentifier: appIdentifier,
             allowedOrigins: (applicationView["sessionReplayAllowedOrigins"] ||
                 []),
             samplePercentage: Number(applicationView["sessionReplaySamplePercentage"] || 0),
@@ -2918,6 +3536,48 @@ router.post("/telemetry/rum/session-replay/ingest-status", ...requireSessionRepl
             dailyByteLimit: dailyByteLimit,
             applicationBytesUsedThisMonth: applicationBytesUsedThisMonth,
             monthlyBudgetInGB: (_a = applicationView["sessionReplayMonthlyBudgetInGB"]) !== null && _a !== void 0 ? _a : null,
+            /*
+             * ---- Additive: the rest of RecordingHealthStatus. ----
+             * Every timestamp is ISO-8601 or null; every counter is a number
+             * or null (unknown). The Dashboard parses this with
+             * parseRecordingHealthStatus and diagnoses it with
+             * diagnoseRecordingHealth.
+             */
+            consentMode: String(applicationView["sessionReplayConsentMode"] || ""),
+            maskingMode: String(applicationView["sessionReplayMaskingMode"] || ""),
+            retentionInDays: typeof retentionInDays === "number" &&
+                Number.isFinite(retentionInDays)
+                ? retentionInDays
+                : null,
+            publishedRecorderVersion: SessionReplayReadService.getPublishedRecorderVersion(),
+            lastConfigFetchAt: toIsoOrNull(applicationView["lastSeenAt"]),
+            lastSessionStartedAt: activity.lastSessionStartedAt
+                ? activity.lastSessionStartedAt.toISOString()
+                : null,
+            sessionsLast24h: activity.sessionsLast24h,
+            playableSessionsLast24h: activity.playableSessionsLast24h,
+            /*
+             * What the newest session's recorder said it could capture.
+             *
+             * This is the row the docs point operators at for spotting a stale
+             * cached recorder artifact ("click labels: no"); without it the
+             * health card and the installation test both said "not reported
+             * yet" for every application forever, which reads as a bug rather
+             * than as information. null (not []) when there is no session, when
+             * the newest one predates the attribute, or when the query failed -
+             * all three are "we cannot say", never "this recorder can do
+             * nothing". It rides on the last-session query the summary already
+             * runs, so the row costs no extra ClickHouse round trip.
+             */
+            recorderCapabilities: activity.recorderCapabilities,
+            refusalsLast24h: refusalsLast24h,
+            /*
+             * Kept apart from refusals: a refusal was answered to the
+             * recorder, a drop happened after a 202 inside the worker. "12
+             * chunks dropped after acceptance: scrub-incomplete" is a
+             * different sentence from "212 uploads refused".
+             */
+            dropsLast24h: dropsLast24h,
         });
     }
     catch (err) {