@oneuptime/common 12.0.6 → 12.0.8

package/Tests/__mocks__/i18next-browser-languagedetector.js

@@ -0,0 +1,21 @@
+"use strict";
+
+/*
+ * The real detector is only installed in the frontend feature sets. Tests that
+ * render status page components import Utils/i18n, which registers this plugin,
+ * so a minimal stand-in that always resolves to English is enough.
+ */
+class LanguageDetector {
+  init() {}
+
+  detect() {
+    return "en";
+  }
+
+  cacheUserLanguage() {}
+}
+
+LanguageDetector.type = "languageDetector";
+
+module.exports = LanguageDetector;
+module.exports.default = LanguageDetector;

package/Types/AI/FixPullRequestCiStatus.ts

@@ -3,7 +3,7 @@ import CodeFixTaskType from "./CodeFixTaskType";
 /*
  * The rolled-up CI conclusion recorded on an AI fix pull request
  * (AIAgentTaskPullRequest.ciStatus) — B4 Tier 1: verification via the
- * customer's OWN CI on the draft PRs. We read check-run conclusions through
+ * customer's OWN CI on the fix PRs. We read check-run conclusions through
  * the GitHub App; we never re-run or gate the customer's CI.
  *
  * G9 honesty rule: only Green and ExpectedFailureObserved ever count as

package/Types/AI/FixVerificationStatus.ts

@@ -7,8 +7,8 @@
  *   - Passed: every configured command (setup, build, test) exited 0 —
  *     possibly after bounded agent repair attempts.
  *   - Failed: a configured command still failed after the repair attempts
- *     were exhausted. The PR still opens (as a draft, clearly labeled) so
- *     the work is not lost — the human reviewer decides.
+ *     were exhausted. The PR still opens, with the failure clearly labeled
+ *     in its body, so the work is not lost — the human reviewer decides.
  *   - Skipped: the repository has no verification commands configured, so
  *     nothing could be verified.
  */

package/Types/API/Hostname.ts

@@ -5,6 +5,27 @@ import Port from "../Port";
 import Typeof from "../Typeof";
 import { FindOperator } from "typeorm";
 
+/*
+ * A chain of DNS labels (which also covers IPv4 literals). Labels are
+ * alphanumeric plus "-" and "_", may not start or end with "-", and are
+ * capped at 63 characters; a single trailing dot (the fully-qualified form)
+ * is allowed. "_" is permitted because internal and service-discovery names
+ * use it and it is not a URL delimiter.
+ */
+const HOST_REGEX: RegExp =
+  /^[a-zA-Z0-9_](?:[a-zA-Z0-9_-]{0,61}[a-zA-Z0-9_])?(?:\.[a-zA-Z0-9_](?:[a-zA-Z0-9_-]{0,61}[a-zA-Z0-9_])?)*\.?$/;
+
+/*
+ * Anything that is not a URL delimiter. The point is not to validate
+ * credentials, it is to make sure userinfo cannot smuggle a path, a query, a
+ * fragment or a second authority past the host check.
+ */
+const USER_INFO_REGEX: RegExp = /^[^@/?#\s[\]]*$/;
+
+const IPV6_CHARS_REGEX: RegExp = /^[0-9a-fA-F:.]+$/;
+
+const PORT_REGEX: RegExp = /^\d{1,5}$/;
+
 export default class Hostname extends DatabaseProperty {
   private _route: string = "";
   public get hostname(): string {
@@ -31,13 +52,80 @@ export default class Hostname extends DatabaseProperty {
     }
   }
 
+  /*
+   * True when the value is a usable authority: an optional "userinfo@"
+   * prefix, a host (DNS name, IPv4, or IPv6 literal) and an optional ":port".
+   *
+   * The old check was a character allowlist that permitted "/", "?", "#" and
+   * "@" anywhere, which made "169.254.169.254/latest/meta-data/#" a valid
+   * Hostname. Anything that stores a Hostname and later interpolates it into
+   * a URL therefore inherited full control of the host, port and path of the
+   * resulting request. Structure, not a charset, is what rules that out.
+   *
+   * Userinfo is still accepted because "https://user:token@host/path" is a
+   * real thing customers put in webhook URLs, and those values are already in
+   * the database — rejecting them here would fail on read, not just on write.
+   * Callers that need the bare host must not split this string themselves;
+   * SSRFProtection.getBareHostname exists for that.
+   */
   public static isValid(value: string): boolean {
-    const re: RegExp = /^[a-zA-Z-\d!#$&'*+,/:;=?@[\].]*$/;
-    const isValid: boolean = re.test(value);
-    if (!isValid) {
+    const authorityWithUserInfo: string = value.trim();
+
+    /*
+     * 253 for a DNS name, plus room for ":65535" and a userinfo prefix.
+     * A bound here also keeps the label regex from being handed something
+     * pathological.
+     */
+    if (!authorityWithUserInfo || authorityWithUserInfo.length > 512) {
+      return false;
+    }
+
+    /*
+     * Split on the LAST "@": userinfo may itself contain "@" percent-encoded
+     * or not, and everything after the final one is the authority.
+     */
+    const atIndex: number = authorityWithUserInfo.lastIndexOf("@");
+
+    if (atIndex !== -1) {
+      const userInfo: string = authorityWithUserInfo.substring(0, atIndex);
+      if (!USER_INFO_REGEX.test(userInfo)) {
+        return false;
+      }
+    }
+
+    const authority: string = authorityWithUserInfo.substring(atIndex + 1);
+
+    if (!authority) {
       return false;
     }
-    return true;
+
+    // Bracketed IPv6, with or without a port: "[::1]", "[::1]:8080".
+    const bracketedIpv6Match: RegExpMatchArray | null = authority.match(
+      /^\[([0-9a-fA-F:.]+)\](?::(\d{1,5}))?$/,
+    );
+    if (bracketedIpv6Match) {
+      return true;
+    }
+
+    /*
+     * Unbracketed IPv6 literal. Two or more colons cannot be a "host:port",
+     * so the colons must be part of the address itself.
+     */
+    if ((authority.match(/:/g) || []).length > 1) {
+      return IPV6_CHARS_REGEX.test(authority);
+    }
+
+    const colonIndex: number = authority.indexOf(":");
+    const host: string =
+      colonIndex === -1 ? authority : authority.substring(0, colonIndex);
+    const port: string =
+      colonIndex === -1 ? "" : authority.substring(colonIndex + 1);
+
+    if (colonIndex !== -1 && !PORT_REGEX.test(port)) {
+      return false;
+    }
+
+    return HOST_REGEX.test(host);
   }
 
   public constructor(hostname: string, port?: Port | string | number) {

package/Types/API/URL.ts

@@ -131,37 +131,55 @@ export default class URL extends DatabaseProperty {
   public static fromString(url: string): URL {
     let protocol: Protocol = Protocol.HTTPS;
 
-    if (url.startsWith("https://")) {
-      protocol = Protocol.HTTPS;
-      url = url.replace("https://", "");
-    }
-
-    if (url.startsWith("http://")) {
-      protocol = Protocol.HTTP;
-      url = url.replace("http://", "");
-    }
-
-    if (url.startsWith("wss://")) {
-      protocol = Protocol.WSS;
-      url = url.replace("wss://", "");
+    /*
+     * Schemes are case-insensitive (RFC 3986), so match on a lower-cased
+     * copy and strip by length. Matching the literal prefix left "HTTPS://"
+     * in place, which then read as an authority of "HTTPS:".
+     *
+     * Longest-first: "https://" has to be tested before "http://", and only
+     * the first match is stripped.
+     */
+    const schemePrefixes: Array<[string, Protocol]> = [
+      ["https://", Protocol.HTTPS],
+      ["http://", Protocol.HTTP],
+      ["wss://", Protocol.WSS],
+      ["ws://", Protocol.WS],
+      ["mongodb://", Protocol.MONGO_DB],
+      ["mailto:", Protocol.MAIL],
+    ];
+
+    const lowerCasedUrl: string = url.toLowerCase();
+
+    for (const [prefix, prefixProtocol] of schemePrefixes) {
+      if (lowerCasedUrl.startsWith(prefix)) {
+        protocol = prefixProtocol;
+        url = url.substring(prefix.length);
+        break;
+      }
     }
 
-    if (url.startsWith("ws://")) {
-      protocol = Protocol.WS;
-      url = url.replace("ws://", "");
-    }
+    if (protocol === Protocol.MAIL) {
+      /*
+       * Hand the bare address to the constructor so it is recognised as an
+       * Email. Routing it through Hostname instead would ask a host validator
+       * to accept an email address — and "?subject=..." along with it.
+       */
+      const address: string = url.split("?")[0] || "";
+      const mailQueryString: string = url.split("?")[1] || "";
 
-    if (url.startsWith("mongodb://")) {
-      protocol = Protocol.MONGO_DB;
-      url = url.replace("mongodb://", "");
+      return new URL(protocol, address, undefined, mailQueryString);
     }
 
-    if (url.startsWith("mailto:")) {
-      protocol = Protocol.MAIL;
-      url = url.replace("mailto:", "");
-    }
+    /*
+     * The authority ends at the first "/", "?" or "#". Splitting on "/" alone
+     * left the query and fragment glued to the host for URLs with no path
+     * ("https://host?token=x" parsed to a host of "host?token=x"), which both
+     * round-tripped wrong and handed anything that later interpolated the
+     * host a way to smuggle a path.
+     */
+    const authority: string = (url.split("/")[0] || "").split(/[?#]/)[0] || "";
 
-    const hostname: Hostname = new Hostname(url.split("/")[0] || "");
+    const hostname: Hostname = new Hostname(authority);
 
     let route: Route | undefined;
 

package/Types/Billing/BalanceAdjustmentType.ts

@@ -0,0 +1,14 @@
+/*
+ * How a manual balance adjustment is applied. Add and Deduct are relative and
+ * land as a single atomic SQL delta, so they cannot lose a usage charge that
+ * is being written at the same moment. Set is absolute - last writer wins -
+ * and is only there for the case where staff need the balance to read a
+ * specific number regardless of what it holds now.
+ */
+enum BalanceAdjustmentType {
+  Add = "Add",
+  Deduct = "Deduct",
+  Set = "Set",
+}
+
+export default BalanceAdjustmentType;

package/Types/Billing/ProjectBalanceType.ts

@@ -0,0 +1,13 @@
+/*
+ * The prepaid balances a project carries. Each one maps to its own column on
+ * the project and is drawn down by a different kind of usage, so they are
+ * topped up and corrected independently.
+ */
+enum ProjectBalanceType {
+  // Drawn down by SMS, voice calls, WhatsApp messages and incoming numbers.
+  SmsOrCall = "SmsOrCall",
+  // Drawn down by LLM spend - AI agents, investigations and code fixes.
+  AI = "AI",
+}
+
+export default ProjectBalanceType;

package/Types/Domain.ts

@@ -67,6 +67,32 @@ export default class Domain extends DatabaseProperty {
     return domainRegex.test(domain);
   }
 
+  /**
+   * Validates a subdomain: one or more DNS labels, no scheme, no port, no
+   * path, no userinfo.
+   *
+   * This is a security control, not a nicety. A subdomain is concatenated
+   * with a verified base domain to build fullDomain, and fullDomain is
+   * interpolated into a URL that the certificate-provisioning cron fetches
+   * unattended. URL parsing takes everything before the first "/" as the
+   * host, so a subdomain of "169.254.169.254/latest/meta-data/#" yields a URL
+   * whose host, port and path are all attacker-chosen. Restricting the value
+   * to DNS labels removes the ability to smuggle any of those.
+   *
+   * The empty string is NOT valid here: callers use "" (or "@") to mean the
+   * apex and must check for that before calling.
+   */
+  public static isValidSubdomain(subdomain: string): boolean {
+    if (!subdomain || subdomain.length > 253) {
+      return false;
+    }
+
+    const subdomainRegex: RegExp =
+      /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
+
+    return subdomainRegex.test(subdomain);
+  }
+
   public constructor(domain: string) {
     super();
     this.domain = domain;

package/Types/File/MimeType.ts

@@ -8,6 +8,17 @@ enum MimeType {
   svg = "image/svg+xml",
   gif = "image/gif",
   webp = "image/webp",
+  /*
+   * Raster formats a browser or an API client can legitimately report but the
+   * file picker never names. Listed so those uploads are not rejected outright
+   * now that FileService validates fileType against this enum, and so rows
+   * written before the picker normalised types are still servable.
+   */
+  ico = "image/x-icon",
+  bmp = "image/bmp",
+  tiff = "image/tiff",
+  avif = "image/avif",
+  heic = "image/heic",
   pdf = "application/pdf",
   doc = "application/msword",
   docx = "application/vnd.openxmlformats-officedocument.wordprocessingml.document",

package/Types/JSONFunctions.ts

@@ -297,6 +297,21 @@ export default class JSONFunctions {
       Object.keys(ObjectType).includes((val as JSONObject)["_type"] as string)
     ) {
       return val;
+    } else if (Array.isArray(val)) {
+      /*
+       * This has to be checked before the plain-object branch below: arrays are
+       * typeof "object", so falling through to serialize() would walk them by
+       * key and hand back { "0": ..., "1": ... } instead of an array. That
+       * silently corrupts every nested array persisted into a JSON column —
+       * e.g. the [facetKey, value] filter tuples of a telemetry saved view.
+       */
+      const arr: Array<JSONValue> = [];
+
+      for (const v of val) {
+        arr.push(this.serializeValue(v));
+      }
+
+      return arr;
     } else if (typeof val === Typeof.Object) {
       return this.serialize(val as JSONObject);
     }

package/Types/Monitor/SnmpMonitor/NetworkTopology.ts

@@ -26,6 +26,31 @@ export type NetworkTopologyLinkProtocol = "lldp" | "cdp" | "fdb";
  */
 export type NetworkTopologyNodeKind = "device" | "unmanaged" | "endpoint";
 
+/*
+ * What the node DOES on the network, as opposed to what we know about it
+ * (`kind`). Derived server-side from the identity SNMP and the discovery
+ * protocols already report — sysObjectId, sysDescr, model/platform, and
+ * finally the hostname — because a map on which a router, a switch and a
+ * camera are the same circle cannot be read at a glance.
+ *
+ * "unknown" is a real answer, not a failure: guessing a role from thin
+ * evidence is worse than drawing a neutral node, so the classifier only
+ * commits when the evidence names a product family or says the word.
+ */
+export type NetworkTopologyDeviceRole =
+  | "router"
+  | "switch"
+  | "firewall"
+  | "wirelessAccessPoint"
+  | "loadBalancer"
+  | "server"
+  | "storage"
+  | "printer"
+  | "camera"
+  | "phone"
+  | "host"
+  | "unknown";
+
 export interface NetworkTopologyNode {
   // Device id for managed nodes; a synthetic "unmanaged:<key>" id otherwise.
   id: string;
@@ -34,6 +59,12 @@ export interface NetworkTopologyNode {
   status: NetworkTopologyNodeStatus;
   // Missing on older payloads — derive from isManaged.
   kind?: NetworkTopologyNodeKind | undefined;
+  /*
+   * What the node does on the network (router, switch, firewall, ...).
+   * Missing on older payloads, and "unknown" when the evidence did not
+   * name one — readers must treat both the same way.
+   */
+  role?: NetworkTopologyDeviceRole | undefined;
   interfacesUp?: number | undefined;
   interfacesDown?: number | undefined;
   // Extra device identity for search and the detail panel (managed nodes).

package/Types/SerializableObjectDictionary.ts

@@ -40,46 +40,140 @@ import Phone from "./Phone";
 import Port from "./Port";
 import Version from "./Version";
 
+/*
+ * Every entry is a getter, not a direct reference.
+ *
+ * Three of these classes — Includes, IncludesAll and IncludesNone — import
+ * JSONFunctions so their fromJSON can deserialize the values inside them, and
+ * JSONFunctions imports this dictionary. That is a cycle, and with a plain
+ * object literal the entry a cycle passes through is captured as `undefined`:
+ * whichever of the two modules loads second sees the first only half
+ * initialized. Which of them loads first depends on the whole app's import
+ * graph, so `{"_type":"Includes","value":[...]}` deserialized into a real
+ * Includes in some entry points and stayed a plain object in others — and a
+ * plain object reaching TypeORM is a silently wrong query, not an error.
+ *
+ * A getter defers the lookup to the first property access, by which time every
+ * module has finished initializing.
+ */
 const SerializableObjectDictionary: Dictionary<any> = {
-  [ObjectType.Phone]: Phone,
-  [ObjectType.DateTime]: OneUptimeDate,
-  [ObjectType.ObjectID]: ObjectID,
-  [ObjectType.Name]: Name,
-  [ObjectType.EqualTo]: EqualTo,
-  [ObjectType.EqualToOrNull]: EqualToOrNull,
-  [ObjectType.MonitorSteps]: MonitorSteps,
-  [ObjectType.MonitorStep]: MonitorStep,
-  [ObjectType.MonitorCriteria]: MonitorCriteria,
-  [ObjectType.MonitorCriteriaInstance]: MonitorCriteriaInstance,
-  [ObjectType.NotEqual]: NotEqual,
-  [ObjectType.Email]: Email,
-  [ObjectType.Color]: Color,
-  [ObjectType.Domain]: Domain,
-  [ObjectType.Version]: Version,
-  [ObjectType.Route]: Route,
-  [ObjectType.URL]: URL,
-  [ObjectType.IP]: IP,
-  [ObjectType.Search]: Search,
-  [ObjectType.MultiSearch]: MultiSearch,
-  [ObjectType.GreaterThan]: GreaterThan,
-  [ObjectType.GreaterThanOrEqual]: GreaterThanOrEqual,
-  [ObjectType.LessThan]: LessThan,
-  [ObjectType.LessThanOrEqual]: LessThanOrEqual,
-  [ObjectType.LessThanOrNull]: LessThanOrNull,
-  [ObjectType.GreaterThanOrNull]: GreaterThanOrNull,
-  [ObjectType.Port]: Port,
-  [ObjectType.Hostname]: Hostname,
-  [ObjectType.HashedString]: HashedString,
-  [ObjectType.InBetween]: InBetween,
-  [ObjectType.Includes]: Includes,
-  [ObjectType.IncludesAll]: IncludesAll,
-  [ObjectType.IncludesNone]: IncludesNone,
-  [ObjectType.StartsWith]: StartsWith,
-  [ObjectType.EndsWith]: EndsWith,
-  [ObjectType.NotContains]: NotContains,
-  [ObjectType.NotNull]: NotNull,
-  [ObjectType.IsNull]: IsNull,
-  [ObjectType.Recurring]: Recurring,
+  get [ObjectType.Phone](): any {
+    return Phone;
+  },
+  get [ObjectType.DateTime](): any {
+    return OneUptimeDate;
+  },
+  get [ObjectType.ObjectID](): any {
+    return ObjectID;
+  },
+  get [ObjectType.Name](): any {
+    return Name;
+  },
+  get [ObjectType.EqualTo](): any {
+    return EqualTo;
+  },
+  get [ObjectType.EqualToOrNull](): any {
+    return EqualToOrNull;
+  },
+  get [ObjectType.MonitorSteps](): any {
+    return MonitorSteps;
+  },
+  get [ObjectType.MonitorStep](): any {
+    return MonitorStep;
+  },
+  get [ObjectType.MonitorCriteria](): any {
+    return MonitorCriteria;
+  },
+  get [ObjectType.MonitorCriteriaInstance](): any {
+    return MonitorCriteriaInstance;
+  },
+  get [ObjectType.NotEqual](): any {
+    return NotEqual;
+  },
+  get [ObjectType.Email](): any {
+    return Email;
+  },
+  get [ObjectType.Color](): any {
+    return Color;
+  },
+  get [ObjectType.Domain](): any {
+    return Domain;
+  },
+  get [ObjectType.Version](): any {
+    return Version;
+  },
+  get [ObjectType.Route](): any {
+    return Route;
+  },
+  get [ObjectType.URL](): any {
+    return URL;
+  },
+  get [ObjectType.IP](): any {
+    return IP;
+  },
+  get [ObjectType.Search](): any {
+    return Search;
+  },
+  get [ObjectType.MultiSearch](): any {
+    return MultiSearch;
+  },
+  get [ObjectType.GreaterThan](): any {
+    return GreaterThan;
+  },
+  get [ObjectType.GreaterThanOrEqual](): any {
+    return GreaterThanOrEqual;
+  },
+  get [ObjectType.LessThan](): any {
+    return LessThan;
+  },
+  get [ObjectType.LessThanOrEqual](): any {
+    return LessThanOrEqual;
+  },
+  get [ObjectType.LessThanOrNull](): any {
+    return LessThanOrNull;
+  },
+  get [ObjectType.GreaterThanOrNull](): any {
+    return GreaterThanOrNull;
+  },
+  get [ObjectType.Port](): any {
+    return Port;
+  },
+  get [ObjectType.Hostname](): any {
+    return Hostname;
+  },
+  get [ObjectType.HashedString](): any {
+    return HashedString;
+  },
+  get [ObjectType.InBetween](): any {
+    return InBetween;
+  },
+  get [ObjectType.Includes](): any {
+    return Includes;
+  },
+  get [ObjectType.IncludesAll](): any {
+    return IncludesAll;
+  },
+  get [ObjectType.IncludesNone](): any {
+    return IncludesNone;
+  },
+  get [ObjectType.StartsWith](): any {
+    return StartsWith;
+  },
+  get [ObjectType.EndsWith](): any {
+    return EndsWith;
+  },
+  get [ObjectType.NotContains](): any {
+    return NotContains;
+  },
+  get [ObjectType.NotNull](): any {
+    return NotNull;
+  },
+  get [ObjectType.IsNull](): any {
+    return IsNull;
+  },
+  get [ObjectType.Recurring](): any {
+    return Recurring;
+  },
 };
 
 export default SerializableObjectDictionary;

package/Types/Telemetry/EntitySource.ts

@@ -0,0 +1,40 @@
+/*
+ * How a `TelemetryEntity` registry row came to exist. The registry started
+ * as a forward-only catalog populated purely from OTLP resource attributes;
+ * two later sources join it, and the three differ in exactly one way that
+ * matters — who owns the row's lifecycle.
+ *
+ * That ownership is what `PruneStaleEntities` keys on. It reaps rows whose
+ * `lastSeenAt` has aged past their type's TTL, which is only a correct
+ * staleness signal when something is actively re-bumping `lastSeenAt`. Two
+ * of the three sources have nothing doing that, so the prune sweep is
+ * scoped to `Discovered` alone — see the guard there.
+ */
+enum EntitySource {
+  /**
+   * Derived from telemetry resource attributes at ingest and re-bumped on
+   * every reconcile window for as long as the entity keeps emitting. Silence
+   * past the type's TTL genuinely means gone, so these are TTL-pruned.
+   */
+  Discovered = "discovered",
+
+  /**
+   * Mirrored from a OneUptime inventory table (NetworkDevice, CloudResource,
+   * IoTDevice, ...). These are collected by pollers rather than OTLP, so no
+   * ingest path bumps `lastSeenAt` — the owning row IS the liveness signal,
+   * and the mirror is kept in step by that table's create/delete hooks. TTL
+   * pruning one of these would delete the registry row for a device that is
+   * still very much registered.
+   */
+  Inventory = "inventory",
+
+  /**
+   * Created by a user for something that emits no telemetry at all — a
+   * third-party API, a vendor-managed database, an appliance. Nothing will
+   * ever bump `lastSeenAt`, so these are never TTL-pruned; they live until
+   * the user deletes them.
+   */
+  Manual = "manual",
+}
+
+export default EntitySource;

package/Types/Telemetry/EntityType.ts

@@ -51,6 +51,33 @@ enum EntityType {
   DockerSwarmService = "docker.swarm.service",
   DockerSwarmTask = "docker.swarm.task",
   TelemetrySdk = "telemetry.sdk",
+  /*
+   * Inventory-mirrored types. Unlike everything above, these are never
+   * derived from an OTLP resource — the estate they describe is collected
+   * by pollers (SNMP, cloud APIs, MQTT) into rich typed tables, and the
+   * registry row is a mirror of that row so the entity explorer can show
+   * one estate instead of one telemetry pipeline. Their identity is the
+   * owning row's own project-unique key, and their lifecycle follows it
+   * (see InventoryEntityRegistry); they carry EntitySource.Inventory and
+   * are deliberately absent from the prune TTL map.
+   */
+  NetworkDevice = "network.device",
+  CloudResource = "cloud.resource",
+  ServerlessFunction = "serverless.function",
+  RumApplication = "rum.application",
+  IoTDevice = "iot.device",
+  DockerHost = "docker.host",
+  PodmanHost = "podman.host",
+  /*
+   * Manual (user-authored) types, for the parts of an estate that emit no
+   * telemetry and appear in no inventory table: a third-party payment API,
+   * a vendor-managed database, a physical appliance. They exist so a
+   * dependency edge can terminate somewhere real instead of dangling at
+   * the boundary of what OneUptime can see. Carry EntitySource.Manual.
+   */
+  ExternalService = "external.service",
+  ExternalDatabase = "external.database",
+  Appliance = "appliance",
 }
 
 export default EntityType;