@oneuptime/common 13.0.0 → 13.0.1

package/Tests/Server/Services/CloudResourceInstanceStalePrune.test.ts

@@ -0,0 +1,188 @@
+import type { FindOperator } from "../../../Server/Types/Database/QueryHelper";
+import CloudResourceInstanceService from "../../../Server/Services/CloudResourceInstanceService";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
+import OneUptimeDate from "../../../Types/Date";
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * Stale-instance pruning for the cloud environment inventory.
+ *
+ * CloudResourceInstance rows are created by ingest and refreshed behind
+ * the 5-minute maintenance fence, but nothing ever removed them — the
+ * Instances tab and the overview's "running tasks" count grew forever.
+ * The Cloud:CleanupStaleResources worker now ages them out through the
+ * three helpers pinned here:
+ *
+ *   - deleteStaleForResource issues ONE hard delete scoped to the given
+ *     environment AND a strictly-less-than lastSeenAt cutoff, as root
+ *     (the worker has no tenant context), and returns the row count. A
+ *     missing environment predicate would prune every environment in
+ *     the table; a missing cutoff would prune live tasks.
+ *   - getStaleThresholdMinutes parses CLOUD_INSTANCE_STALE_MINUTES with
+ *     a 15-minute default and a 5-minute floor. The floor is the ingest
+ *     maintenance fence TTL: a threshold at or below it would delete a
+ *     live task between two fence-gated refreshes.
+ *   - getStaleThresholdDate subtracts that threshold from the anchor
+ *     the worker passes (the environment's own lastSeenAt), falling
+ *     back to the wall clock only when no anchor is given. The worker
+ *     relies on the anchor winning over the clock: that is what freezes
+ *     the prune cutoff during a collector outage.
+ */
+
+const ENV_KEY: string = "CLOUD_INSTANCE_STALE_MINUTES";
+const RESOURCE_ID: ObjectID = ObjectID.generate();
+const CUTOFF: Date = new Date("2026-09-08T10:00:00.000Z");
+const MINUTE_MS: number = 60 * 1000;
+
+interface DeleteByArgs {
+  query: {
+    cloudResourceId?: ObjectID;
+    lastSeenAt?: FindOperator<Date>;
+  };
+  limit: number;
+  skip: number;
+  props: { isRoot?: boolean };
+}
+
+let savedEnv: string | undefined;
+
+beforeEach(() => {
+  savedEnv = process.env[ENV_KEY];
+  delete process.env[ENV_KEY];
+});
+
+afterEach(() => {
+  if (savedEnv === undefined) {
+    delete process.env[ENV_KEY];
+  } else {
+    process.env[ENV_KEY] = savedEnv;
+  }
+  jest.restoreAllMocks();
+});
+
+describe("CloudResourceInstanceService.deleteStaleForResource", () => {
+  test("issues one root hard-delete scoped to the environment with a lastSeenAt < cutoff predicate", async () => {
+    const deleteBy: jest.SpyInstance = jest
+      .spyOn(CloudResourceInstanceService, "deleteBy")
+      .mockResolvedValue(4);
+
+    const deleted: number =
+      await CloudResourceInstanceService.deleteStaleForResource({
+        cloudResourceId: RESOURCE_ID,
+        olderThan: CUTOFF,
+      });
+
+    expect(deleted).toBe(4);
+    expect(deleteBy).toHaveBeenCalledTimes(1);
+
+    const args: DeleteByArgs = deleteBy.mock
+      .calls[0]![0] as unknown as DeleteByArgs;
+
+    // Scoped to exactly this environment — never a table-wide sweep.
+    expect(args.query.cloudResourceId).toBe(RESOURCE_ID);
+
+    // Strictly older than the cutoff: a row refreshed AT the cutoff survives.
+    const filter: FindOperator<Date> = args.query.lastSeenAt!;
+    expect(filter.getSql!("lastSeenAt")).toMatch(/lastSeenAt < :/);
+    expect(Object.values(filter.objectLiteralParameters!)).toEqual([CUTOFF]);
+
+    // The worker has no tenant context, and one tick must cover the whole table.
+    expect(args.props.isRoot).toBe(true);
+    expect(args.limit).toBe(LIMIT_MAX);
+    expect(args.skip).toBe(0);
+  });
+
+  test("reports zero when nothing was stale", async () => {
+    jest.spyOn(CloudResourceInstanceService, "deleteBy").mockResolvedValue(0);
+
+    const deleted: number =
+      await CloudResourceInstanceService.deleteStaleForResource({
+        cloudResourceId: RESOURCE_ID,
+        olderThan: CUTOFF,
+      });
+
+    expect(deleted).toBe(0);
+  });
+
+  test("lets a delete failure propagate so the worker can log it per environment and continue", async () => {
+    jest
+      .spyOn(CloudResourceInstanceService, "deleteBy")
+      .mockRejectedValue(new Error("db connection reset"));
+
+    await expect(
+      CloudResourceInstanceService.deleteStaleForResource({
+        cloudResourceId: RESOURCE_ID,
+        olderThan: CUTOFF,
+      }),
+    ).rejects.toThrow("db connection reset");
+  });
+});
+
+describe("CloudResourceInstanceService.getStaleThresholdMinutes", () => {
+  test("defaults to 15 minutes — 3x the 5-minute ingest maintenance fence", () => {
+    expect(CloudResourceInstanceService.getStaleThresholdMinutes()).toBe(15);
+  });
+
+  test("honours an override above the floor", () => {
+    process.env[ENV_KEY] = "30";
+    expect(CloudResourceInstanceService.getStaleThresholdMinutes()).toBe(30);
+  });
+
+  test("accepts the 10-minute floor itself", () => {
+    process.env[ENV_KEY] = "10";
+    expect(CloudResourceInstanceService.getStaleThresholdMinutes()).toBe(10);
+  });
+
+  test("ignores an override below the floor — it would prune live tasks", () => {
+    /*
+     * 5 is the fence's nominal TTL, but the armed key carries jitter and a
+     * negative memo sits in front of it, so a live row can be ~7 minutes
+     * old; anything under 10 falls back to the default.
+     */
+    for (const below of ["9", "5", "3"]) {
+      process.env[ENV_KEY] = below;
+      expect(CloudResourceInstanceService.getStaleThresholdMinutes()).toBe(15);
+    }
+  });
+
+  test("ignores an unparseable or empty override", () => {
+    process.env[ENV_KEY] = "garbage";
+    expect(CloudResourceInstanceService.getStaleThresholdMinutes()).toBe(15);
+    process.env[ENV_KEY] = "";
+    expect(CloudResourceInstanceService.getStaleThresholdMinutes()).toBe(15);
+  });
+});
+
+describe("CloudResourceInstanceService.getStaleThresholdDate", () => {
+  test("subtracts the threshold from the anchor the worker passes, not from the wall clock", () => {
+    const anchor: Date = new Date("2026-09-08T09:00:00.000Z");
+    // A wall clock years away from the anchor proves the anchor wins.
+    jest
+      .spyOn(OneUptimeDate, "getCurrentDate")
+      .mockReturnValue(new Date("2030-01-01T00:00:00.000Z"));
+
+    const cutoff: Date =
+      CloudResourceInstanceService.getStaleThresholdDate(anchor);
+
+    expect(cutoff.getTime()).toBe(anchor.getTime() - 15 * MINUTE_MS);
+  });
+
+  test("falls back to the wall clock when no anchor is given", () => {
+    const now: Date = new Date("2026-09-08T10:00:00.000Z");
+    jest.spyOn(OneUptimeDate, "getCurrentDate").mockReturnValue(now);
+
+    const cutoff: Date = CloudResourceInstanceService.getStaleThresholdDate();
+
+    expect(cutoff.getTime()).toBe(now.getTime() - 15 * MINUTE_MS);
+  });
+
+  test("applies the env override to the anchored cutoff", () => {
+    process.env[ENV_KEY] = "30";
+    const anchor: Date = new Date("2026-09-08T09:00:00.000Z");
+
+    const cutoff: Date =
+      CloudResourceInstanceService.getStaleThresholdDate(anchor);
+
+    expect(cutoff.getTime()).toBe(anchor.getTime() - 30 * MINUTE_MS);
+  });
+});

package/Tests/Server/Services/DiscoveryScanClaimHookFreeSafety.test.ts

@@ -3,6 +3,7 @@ import NetworkDeviceDiscoveryScanService, {
 } from "../../../Server/Services/NetworkDeviceDiscoveryScanService";
 import DatabaseService from "../../../Server/Services/DatabaseService";
 import NetworkDeviceDiscoveryScan from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import { DISCOVERY_SCAN_STARTED_MESSAGE } from "../../../Utils/NetworkDiscovery/DiscoveryScanStatus";
 import {
   afterEach,
   beforeEach,
@@ -15,7 +16,7 @@ import {
 /*
  * The /probe-ingest/probe/discovery-scan/list route hands the requesting
  * probe its pending subnet scans and claims them (status "In Progress" +
- * startedAt, and a cleared statusMessage) via
+ * startedAt, and a current-run statusMessage) via
  * DatabaseService.updateColumnsByIdWithoutHooks — one raw
  * parameterized UPDATE that skips ALL on-update hooks: workflow HTTP
  * triggers, audit-log inserts, realtime events, service
@@ -74,6 +75,17 @@ const PROGRESS_WRITE_COLUMNS: Array<string> = [
   "autoImportProcessedAt",
 ];
 
+/*
+ * The stale-scan reaper also writes atomically so a new progress report cannot
+ * race with its decision to fail a silent run. It skips the same service hooks.
+ */
+const REAPER_WRITE_COLUMNS: Array<string> = [
+  "status",
+  "statusMessage",
+  "completedAt",
+  "nextScanAt",
+];
+
 describe("discovery-scan claim hookless write safety preconditions", () => {
   describe("NetworkDeviceDiscoveryScan model (claim write in DiscoveryScan.ts)", () => {
     /*
@@ -115,6 +127,7 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
         "statusMessage",
         // ...and every column the running-sweep progress write stamps.
         ...PROGRESS_WRITE_COLUMNS,
+        ...REAPER_WRITE_COLUMNS,
       ];
       for (const column of fastPathColumns) {
         expect(scan.isTableColumn(column)).toBe(true);
@@ -219,6 +232,7 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
          * skipping it.
          */
         ...PROGRESS_WRITE_COLUMNS,
+        ...REAPER_WRITE_COLUMNS,
       ];
 
       for (const column of claimWriteColumns) {
@@ -324,7 +338,7 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
         data: {
           status: "In Progress",
           startedAt: new Date(0),
-          statusMessage: null,
+          statusMessage: DISCOVERY_SCAN_STARTED_MESSAGE,
         },
         props: { isRoot: true },
         limit: 1,

package/Tests/Server/Services/GoogleSecOpsDiagnosticsModel.test.ts

@@ -0,0 +1,153 @@
+import GoogleSecOpsConnection from "../../../Models/DatabaseModels/GoogleSecOpsConnection";
+import GoogleSecOpsConnectionRun from "../../../Models/DatabaseModels/GoogleSecOpsConnectionRun";
+import GoogleSecOpsConnectionService from "../../../Server/Services/GoogleSecOpsConnectionService";
+import GoogleSecOpsClient from "../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient";
+import Permission from "../../../Types/Permission";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+interface ConnectionHooks {
+  onBeforeCreate: (data: unknown) => Promise<unknown>;
+  onBeforeUpdate: (data: unknown) => Promise<unknown>;
+}
+
+const hooks: ConnectionHooks =
+  GoogleSecOpsConnectionService as unknown as ConnectionHooks;
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Google SecOps diagnostics access boundaries", () => {
+  test("run history is tenant scoped and cannot be created, changed or deleted through CRUD", () => {
+    const run: GoogleSecOpsConnectionRun = new GoogleSecOpsConnectionRun();
+    expect(run.getTenantColumn()).toBe("projectId");
+    expect(run.getCrudApiPath()?.toString()).toBe(
+      "/google-secops-connection-run",
+    );
+    expect(run.createRecordPermissions).toEqual([]);
+    expect(run.updateRecordPermissions).toEqual([]);
+    expect(run.deleteRecordPermissions).toEqual([]);
+    expect(run.readRecordPermissions).toEqual([
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
+    ]);
+    expect(run.readRecordPermissions).not.toContain(Permission.Public);
+  });
+
+  test.each([
+    "projectId",
+    "googleSecOpsConnectionId",
+    "requestedByUserId",
+    "type",
+    "status",
+    "request",
+    "result",
+    "error",
+    "startedAt",
+    "completedAt",
+  ])(
+    "run field %s is readable by security viewers and writable only internally",
+    (field: string) => {
+      const control: ReturnType<
+        GoogleSecOpsConnection["getColumnAccessControlFor"]
+      > = new GoogleSecOpsConnectionRun().getColumnAccessControlFor(field);
+      expect(control?.create).toEqual([]);
+      expect(control?.update).toEqual([]);
+      expect(control?.read).toContain(Permission.SecurityViewer);
+    },
+  );
+
+  test.each(["lastSuccessfulPollAt", "lastEventIngestedAt", "lastPollResult"])(
+    "clients cannot forge the connection's %s",
+    (field: string) => {
+      const control: ReturnType<
+        GoogleSecOpsConnection["getColumnAccessControlFor"]
+      > = new GoogleSecOpsConnection().getColumnAccessControlFor(field);
+      expect(control?.create).toEqual([]);
+      expect(control?.update).toEqual([]);
+      expect(control?.read).toContain(Permission.SecurityMember);
+    },
+  );
+
+  test("only connector administrators can change the detection scope", () => {
+    const control: ReturnType<
+      GoogleSecOpsConnection["getColumnAccessControlFor"]
+    > = new GoogleSecOpsConnection().getColumnAccessControlFor(
+      "includeNonAlertingDetections",
+    );
+    expect(control?.update).toEqual([
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+    ]);
+    expect(control?.create).toEqual(control?.update);
+    expect(control?.read).toContain(Permission.SecurityViewer);
+  });
+
+  test("diagnostics do not make the service account readable or add it to run history", () => {
+    const connection: GoogleSecOpsConnection = new GoogleSecOpsConnection();
+    expect(
+      connection.getColumnAccessControlFor("serviceAccountJson")?.read,
+    ).toEqual([]);
+    expect(Object.keys(new GoogleSecOpsConnectionRun())).not.toContain(
+      "serviceAccountJson",
+    );
+  });
+});
+
+describe("Google SecOps detection scope validation", () => {
+  test.each([true, false, undefined])(
+    "accepts scope %s on update",
+    async (value: boolean | undefined) => {
+      await expect(
+        hooks.onBeforeUpdate({ data: { includeNonAlertingDetections: value } }),
+      ).resolves.toBeDefined();
+    },
+  );
+
+  test.each([null, "true", "false", "", 0, 1, [], {}])(
+    "rejects non-boolean scope %p on update",
+    async (value: unknown) => {
+      await expect(
+        hooks.onBeforeUpdate({ data: { includeNonAlertingDetections: value } }),
+      ).rejects.toThrow("must be true or false");
+    },
+  );
+
+  test.each([true, false])(
+    "accepts scope %s when creating a connection",
+    async (value: boolean) => {
+      jest
+        .spyOn(GoogleSecOpsClient, "parseServiceAccountJson")
+        .mockReturnValue({
+          clientEmail: "test@example.com",
+          privateKey: "test",
+          tokenUri: "https://oauth2.googleapis.com/token",
+        });
+      await expect(
+        hooks.onBeforeCreate({
+          data: {
+            serviceAccountJson: "{}",
+            includeNonAlertingDetections: value,
+          },
+        }),
+      ).resolves.toBeDefined();
+    },
+  );
+
+  test("rejects invalid scope on create before processing credentials", async () => {
+    jest.spyOn(GoogleSecOpsClient, "parseServiceAccountJson");
+    await expect(
+      hooks.onBeforeCreate({
+        data: {
+          serviceAccountJson: "{}",
+          includeNonAlertingDetections: "false",
+        },
+      }),
+    ).rejects.toThrow("must be true or false");
+    expect(GoogleSecOpsClient.parseServiceAccountJson).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Services/HookFreeWriteLengthClamp.test.ts

@@ -8,6 +8,7 @@ import IoTFleetService from "../../../Server/Services/IoTFleetService";
 import KubernetesClusterService from "../../../Server/Services/KubernetesClusterService";
 import PodmanHostService from "../../../Server/Services/PodmanHostService";
 import ProxmoxClusterService from "../../../Server/Services/ProxmoxClusterService";
+import VMwareVCenterService from "../../../Server/Services/VMwareVCenterService";
 import RumApplicationService from "../../../Server/Services/RumApplicationService";
 import ServerlessFunctionService from "../../../Server/Services/ServerlessFunctionService";
 import CephCluster from "../../../Models/DatabaseModels/CephCluster";
@@ -20,6 +21,7 @@ import IoTFleet from "../../../Models/DatabaseModels/IoTFleet";
 import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster";
 import PodmanHost from "../../../Models/DatabaseModels/PodmanHost";
 import ProxmoxCluster from "../../../Models/DatabaseModels/ProxmoxCluster";
+import VMwareVCenter from "../../../Models/DatabaseModels/VMwareVCenter";
 import RumApplication from "../../../Models/DatabaseModels/RumApplication";
 import ServerlessFunction from "../../../Models/DatabaseModels/ServerlessFunction";
 import LogDropFilter from "../../../Models/DatabaseModels/LogDropFilter";
@@ -200,6 +202,17 @@ const CLAMP_CASES: Array<ClampCase> = [
     model: new ProxmoxCluster(),
     columns: ["pveVersion", "agentVersion"],
   },
+  {
+    /*
+     * The vcenter receiver does not report the vSphere version, so
+     * agentVersion is the only collector-supplied string this heartbeat
+     * can write.
+     */
+    name: "VMwareVCenterService",
+    service: VMwareVCenterService,
+    model: new VMwareVCenter(),
+    columns: ["agentVersion"],
+  },
   {
     name: "IoTFleetService",
     service: IoTFleetService,

package/Tests/Server/Services/InventoryItemPromotionGate.test.ts

@@ -168,6 +168,11 @@ describe("promoted entities still become rows", () => {
     EntityType.ProxmoxCluster,
     EntityType.CephCluster,
     EntityType.DockerSwarmCluster,
+    EntityType.VMwareVCenter,
+    EntityType.VMwareCluster,
+    EntityType.VMwareHost,
+    EntityType.VMwareVirtualMachine,
+    EntityType.VMwareDatastore,
   ])("%s is created as a discovered row", async (entityType: EntityType) => {
     await reconcile([entity(entityType)]);
 

package/Tests/Server/Services/InventoryUpsertSchemaParity.test.ts

@@ -7,6 +7,7 @@ import KubernetesContainer from "../../../Models/DatabaseModels/KubernetesContai
 import KubernetesResource from "../../../Models/DatabaseModels/KubernetesResource";
 import PodmanResource from "../../../Models/DatabaseModels/PodmanResource";
 import ProxmoxResource from "../../../Models/DatabaseModels/ProxmoxResource";
+import VMwareResource from "../../../Models/DatabaseModels/VMwareResource";
 import CephResourceService from "../../../Server/Services/CephResourceService";
 import DockerResourceService from "../../../Server/Services/DockerResourceService";
 import DockerSwarmResourceService from "../../../Server/Services/DockerSwarmResourceService";
@@ -15,6 +16,7 @@ import KubernetesContainerService from "../../../Server/Services/KubernetesConta
 import KubernetesResourceService from "../../../Server/Services/KubernetesResourceService";
 import PodmanResourceService from "../../../Server/Services/PodmanResourceService";
 import ProxmoxResourceService from "../../../Server/Services/ProxmoxResourceService";
+import VMwareResourceService from "../../../Server/Services/VMwareResourceService";
 import { getMaxLengthFromTableColumnType } from "../../../Types/Database/ColumnLength";
 import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
 import ObjectID from "../../../Types/ObjectID";
@@ -373,6 +375,40 @@ const CASES: Array<UpsertCase> = [
       });
     },
   },
+  {
+    /*
+     * Ten bounded text columns: nine ShortText plus resourcePoolPath,
+     * which is LongText because vSphere inventory paths nest.
+     */
+    label: "VMwareResourceService.bulkUpsert",
+    service: VMwareResourceService,
+    model: new VMwareResource(),
+    boundedColumnCount: 10,
+    jsonPayloadColumnCount: 0,
+    invoke: async (): Promise<void> => {
+      await VMwareResourceService.bulkUpsert({
+        projectId: PROJECT_ID,
+        vmwareVCenterId: PARENT_ID,
+        resources: [
+          {
+            kind: OVERSIZED,
+            externalId: OVERSIZED,
+            name: OVERSIZED,
+            datacenterName: OVERSIZED,
+            clusterName: OVERSIZED,
+            hostName: OVERSIZED,
+            resourcePoolName: OVERSIZED,
+            resourcePoolPath: OVERSIZED,
+            virtualAppName: OVERSIZED,
+            vmInstanceUuid: OVERSIZED,
+            isTemplate: false,
+            isPoweredOn: true,
+            lastSeenAt: OBSERVED_AT,
+          },
+        ],
+      });
+    },
+  },
   {
     label: "CephResourceService.bulkUpsert",
     service: CephResourceService,

package/Tests/Server/Services/InventoryUpsertTruncationGuard.test.ts

@@ -23,6 +23,9 @@ import PodmanResourceService, {
 import ProxmoxResourceService, {
   ParsedProxmoxResource,
 } from "../../../Server/Services/ProxmoxResourceService";
+import VMwareResourceService, {
+  ParsedVMwareResource,
+} from "../../../Server/Services/VMwareResourceService";
 import logger from "../../../Server/Utils/Logger";
 import ColumnLength from "../../../Types/Database/ColumnLength";
 import ObjectID from "../../../Types/ObjectID";
@@ -637,6 +640,104 @@ describe("ProxmoxResourceService — oversized values can't drop the chunk", ()
   });
 });
 
+describe("VMwareResourceService — oversized values can't drop the chunk", () => {
+  function vmwareResource(
+    overrides: Partial<ParsedVMwareResource> = {},
+  ): ParsedVMwareResource {
+    return {
+      kind: "VirtualMachine",
+      externalId: "vm/5029f9a1-2b3c-4d5e-8f60-71a2b3c4d5e6",
+      name: "web-01",
+      datacenterName: "dc-east",
+      clusterName: "prod-cluster",
+      hostName: "esx-01.example.com",
+      resourcePoolName: "Resources",
+      resourcePoolPath: "/dc-east/host/prod-cluster/Resources",
+      virtualAppName: null,
+      vmInstanceUuid: "5029f9a1-2b3c-4d5e-8f60-71a2b3c4d5e6",
+      isTemplate: false,
+      isPoweredOn: true,
+      lastSeenAt: OBSERVED_AT,
+      ...overrides,
+    };
+  }
+
+  test("bulkUpsert clamps an oversized externalId and keeps its sibling row", async () => {
+    const query: jest.Mock = mockQueryRunner(VMwareResourceService);
+
+    await VMwareResourceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      vmwareVCenterId: PARENT_ID,
+      resources: [vmwareResource({ externalId: OVERSIZED }), vmwareResource()],
+    });
+
+    expect(query).toHaveBeenCalledTimes(1);
+    const params: Array<unknown> = paramsOf(query);
+
+    expect(params).toContain(CLAMPED_TO_SHORT_TEXT);
+    expect(params).not.toContain(OVERSIZED);
+    expect(params).toContain("vm/5029f9a1-2b3c-4d5e-8f60-71a2b3c4d5e6");
+    expectNoParamExceedsLongText(params);
+  });
+
+  test("bulkUpsert clamps a deep resource-pool inventory path to LongText, not ShortText", async () => {
+    const query: jest.Mock = mockQueryRunner(VMwareResourceService);
+
+    await VMwareResourceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      vmwareVCenterId: PARENT_ID,
+      resources: [vmwareResource({ resourcePoolPath: OVERSIZED })],
+    });
+
+    const params: Array<unknown> = paramsOf(query);
+    expect(params).toContain(CLAMPED_TO_LONG_TEXT);
+    expect(params).not.toContain(OVERSIZED);
+    expectNoParamExceedsLongText(params);
+  });
+
+  test("bulkUpdateLatestMetrics clamps identity the same way bulkUpsert does", async () => {
+    const query: jest.Mock = mockQueryRunner(VMwareResourceService);
+
+    await VMwareResourceService.bulkUpdateLatestMetrics({
+      projectId: PROJECT_ID,
+      vmwareVCenterId: PARENT_ID,
+      metrics: [
+        {
+          kind: "VirtualMachine",
+          externalId: OVERSIZED,
+          cpuPercent: null,
+          cpuMhz: null,
+          cpuCapacityMhz: null,
+          cpuEffectiveMhz: null,
+          memoryBytes: null,
+          maxMemoryBytes: null,
+          memoryEffectiveBytes: null,
+          memoryPercent: null,
+          diskBytes: null,
+          maxDiskBytes: null,
+          diskPercent: null,
+          cpuReadinessPercent: null,
+          memoryBalloonedBytes: null,
+          memorySwappedBytes: null,
+          hostCount: null,
+          effectiveHostCount: null,
+          poweredOnHostCount: null,
+          vmCount: null,
+          poweredOnVmCount: null,
+          vmTemplateCount: null,
+          datastoreCount: null,
+          clusterCount: null,
+          observedAt: OBSERVED_AT,
+        },
+      ],
+    });
+
+    const params: Array<unknown> = paramsOf(query);
+    expect(params).toContain(CLAMPED_TO_SHORT_TEXT);
+    expect(params).not.toContain(OVERSIZED);
+  });
+});
+
 describe("CephResourceService — oversized values can't drop the chunk", () => {
   function cephResource(
     overrides: Partial<ParsedCephResource> = {},
@@ -1001,6 +1102,45 @@ describe("NULL stays NULL through the clamp", () => {
     }
   });
 
+  test("VMwareResource passes its nullable identity columns through as null", async () => {
+    const query: jest.Mock = mockQueryRunner(VMwareResourceService);
+
+    // A standalone ESXi host: no cluster, no VM-only attributes.
+    await VMwareResourceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      vmwareVCenterId: PARENT_ID,
+      resources: [
+        {
+          kind: "Host",
+          externalId: "host/dc-east/esx-01.example.com",
+          name: "esx-01.example.com",
+          datacenterName: "dc-east",
+          clusterName: null,
+          hostName: null,
+          resourcePoolName: null,
+          resourcePoolPath: null,
+          virtualAppName: null,
+          vmInstanceUuid: null,
+          isTemplate: null,
+          isPoweredOn: null,
+          lastSeenAt: OBSERVED_AT,
+        },
+      ],
+    });
+
+    const params: Array<unknown> = paramsOf(query);
+    /*
+     * Tuple: projectId, vmwareVCenterId, kind, externalId, name,
+     * datacenterName, clusterName(6), hostName(7), resourcePoolName(8),
+     * resourcePoolPath(9), virtualAppName(10), vmInstanceUuid(11),
+     * isTemplate(12), isPoweredOn(13), lastSeenAt, version.
+     */
+    for (const index of [6, 7, 8, 9, 10, 11, 12, 13]) {
+      expect(params[index]).toBeNull();
+    }
+    expect(params).not.toContain("");
+  });
+
   test("PodmanResource keeps a null imageName null rather than empty", async () => {
     const query: jest.Mock = mockQueryRunner(PodmanResourceService);
 
@@ -1216,6 +1356,17 @@ describe("an empty batch still short-circuits", () => {
         });
       },
     ],
+    [
+      "VMwareResourceService.bulkUpsert",
+      VMwareResourceService,
+      async (): Promise<void> => {
+        await VMwareResourceService.bulkUpsert({
+          projectId: PROJECT_ID,
+          vmwareVCenterId: PARENT_ID,
+          resources: [],
+        });
+      },
+    ],
     [
       "CephResourceService.bulkUpsert",
       CephResourceService,