@oneuptime/common 13.0.4 → 13.0.5

package/Tests/Utils/Telemetry/OriginAllowList.test.ts

@@ -121,6 +121,26 @@ const VALID_PATTERNS: Array<ValidPatternCase> = [
     pattern: "HTTPS://APP.EXAMPLE.COM",
     coveredOrigin: "https://app.example.com",
   },
+  {
+    name: "an exact mobile bundle identifier",
+    pattern: "app://com.example.checkout",
+    coveredOrigin: "app://com.example.checkout",
+  },
+  {
+    name: "an uppercase mobile package identifier with surrounding whitespace",
+    pattern: "  APP://COM.EXAMPLE.CHECKOUT  ",
+    coveredOrigin: "app://com.example.checkout",
+  },
+  {
+    name: "a mobile identifier containing platform-valid hyphens and underscores",
+    pattern: "app://com.example.checkout-beta_native",
+    coveredOrigin: "app://com.example.checkout-beta_native",
+  },
+  {
+    name: "an exact mobile origin with one trailing slash",
+    pattern: "app://com.example.checkout/",
+    coveredOrigin: "app://com.example.checkout",
+  },
 ];
 
 /*
@@ -238,6 +258,36 @@ const INVALID_PATTERNS: Array<InvalidPatternCase> = [
     pattern: "https://exa_mple.com",
     expectedMessageFragment: "not valid in a host name",
   },
+  {
+    name: "a wildcard mobile identifier",
+    pattern: "app://*.example.com",
+    expectedMessageFragment: "wildcard",
+  },
+  {
+    name: "a mobile identifier with a port",
+    pattern: "app://com.example.checkout:443",
+    expectedMessageFragment: "port",
+  },
+  {
+    name: "a mobile identifier with a path",
+    pattern: "app://com.example.checkout/screen",
+    expectedMessageFragment: "path",
+  },
+  {
+    name: "a single-label mobile identifier",
+    pattern: "app://checkout",
+    expectedMessageFragment: "reverse-DNS",
+  },
+  {
+    name: "a mobile identifier with an empty label",
+    pattern: "app://com..checkout",
+    expectedMessageFragment: "empty label",
+  },
+  {
+    name: "a mobile identifier with userinfo",
+    pattern: "app://user@com.example.checkout",
+    expectedMessageFragment: "username",
+  },
 ];
 
 /*
@@ -326,6 +376,78 @@ describe("OriginAllowList.normalizeOrigin", () => {
   });
 });
 
+describe("OriginAllowList mobile app identifiers", () => {
+  test("normalizes a bundle identifier for a stable app:// identity", () => {
+    expect(
+      OriginAllowList.normalizeMobileAppIdentifier(
+        "  COM.Example.Checkout-Beta  ",
+      ),
+    ).toBe("com.example.checkout-beta");
+    expect(
+      OriginAllowList.getMobileAppOrigin("  COM.Example.Checkout-Beta  "),
+    ).toBe("app://com.example.checkout-beta");
+  });
+
+  test.each([
+    "com.example.checkout",
+    "io.oneuptime.app_beta",
+    "uk.co.example.checkout-2",
+    "1.example.app2",
+  ])(
+    "accepts the valid package or bundle identifier %s",
+    (identifier: string) => {
+      expect(
+        OriginAllowList.validateMobileAppIdentifier(identifier),
+      ).toBeNull();
+    },
+  );
+
+  test.each([
+    "",
+    "   ",
+    "checkout",
+    ".com.example",
+    "com.example.",
+    "com..example",
+    "com.example/app",
+    "com.example:443",
+    "com.example app",
+    "com.*.example",
+    "com._example.app",
+    "com.example_.app",
+    "com.-example.app",
+    "com.example-.app",
+    "cøm.example.app",
+  ])("refuses malformed mobile identifier %j", (identifier: string) => {
+    expect(
+      OriginAllowList.validateMobileAppIdentifier(identifier),
+    ).not.toBeNull();
+    expect(OriginAllowList.normalizeMobileAppIdentifier(identifier)).toBe("");
+    expect(OriginAllowList.getMobileAppOrigin(identifier)).toBeUndefined();
+  });
+
+  test("refuses an identifier above the header length cap", () => {
+    const identifier: string = `com.example.${"a".repeat(245)}`;
+
+    expect(identifier.length).toBeGreaterThan(255);
+    expect(OriginAllowList.validateMobileAppIdentifier(identifier)).toContain(
+      "255",
+    );
+    expect(OriginAllowList.getMobileAppOrigin(identifier)).toBeUndefined();
+  });
+
+  test("returns validation errors instead of throwing on non-string input", () => {
+    expect(
+      OriginAllowList.validateMobileAppIdentifier(
+        undefined as unknown as string,
+      ),
+    ).toContain("text");
+    expect(
+      OriginAllowList.getMobileAppOrigin(undefined as unknown as string),
+    ).toBeUndefined();
+  });
+});
+
 describe("OriginAllowList.matches - origins that are allowed", () => {
   test("an exact origin matches its own allowlist entry", () => {
     expect(
@@ -416,6 +538,22 @@ describe("OriginAllowList.matches - origins that are allowed", () => {
       ]),
     ).toBe(true);
   });
+
+  test("an exact app:// mobile identity matches case-insensitively", () => {
+    expect(
+      OriginAllowList.matches("app://com.example.checkout", [
+        "APP://COM.EXAMPLE.CHECKOUT",
+      ]),
+    ).toBe(true);
+  });
+
+  test("a trailing slash does not change an exact app:// identity", () => {
+    expect(
+      OriginAllowList.matches("app://com.example.checkout/", [
+        "app://com.example.checkout",
+      ]),
+    ).toBe(true);
+  });
 });
 
 describe("OriginAllowList.matches - origins that are refused", () => {
@@ -576,6 +714,22 @@ describe("OriginAllowList.matches - origins that are refused", () => {
       ]),
     ).toBe(false);
   });
+
+  test("an app:// wildcard never covers a sibling mobile application", () => {
+    expect(
+      OriginAllowList.matches("app://checkout.example.com", [
+        "app://*.example.com",
+      ]),
+    ).toBe(false);
+  });
+
+  test("a sibling package id does not match an exact app:// entry", () => {
+    expect(
+      OriginAllowList.matches("app://com.example.attacker", [
+        "app://com.example.checkout",
+      ]),
+    ).toBe(false);
+  });
 });
 
 describe("OriginAllowList.validateOriginPattern - accepted patterns", () => {

package/Tests/Utils/Traces/CriticalPath.test.ts

@@ -175,4 +175,29 @@ describe("CriticalPathUtil.computeServiceBreakdown", () => {
     expect(breakdown[0]!.spanCount).toBe(2);
     expect(breakdown[0]!.totalDurationUnixNano).toBe(150);
   });
+
+  test("computes percentages for real epoch-nanosecond timestamps", () => {
+    /*
+     * Regression: the trace start was seeded with Number.MAX_SAFE_INTEGER
+     * (~9e15). Real span times are ~1.7e18 ns, so the start never moved, the
+     * trace looked 1.7e18 ns long and every service rendered as 0.0%.
+     */
+    const epoch: number = 1_757_890_000_000 * 1_000_000;
+    const ms: number = 1_000_000;
+    const breakdown: Array<ServiceBreakdown> =
+      CriticalPathUtil.computeServiceBreakdown([
+        span("root", undefined, epoch, epoch + 1000 * ms, "A"),
+        span("child", "root", epoch + 100 * ms, epoch + 350 * ms, "B"),
+      ]);
+
+    expect(epoch).toBeGreaterThan(Number.MAX_SAFE_INTEGER);
+    expect(breakdown[0]!.primaryEntityId).toBe("A");
+    expect(breakdown[0]!.percentOfTrace).toBeCloseTo(75, 3);
+    expect(breakdown[1]!.primaryEntityId).toBe("B");
+    expect(breakdown[1]!.percentOfTrace).toBeCloseTo(25, 3);
+  });
+
+  test("an empty span list has no breakdown", () => {
+    expect(CriticalPathUtil.computeServiceBreakdown([])).toEqual([]);
+  });
 });

package/Types/AI/AIChatTypes.ts

@@ -210,6 +210,14 @@ export interface AIRunEventResultSummary {
   message?: string | undefined;
   // Log severity for ProgressLog events (Info/Warning/Error/…).
   severity?: string | undefined;
+  /*
+   * The server-minted citation label and deep-link target of the tool call
+   * that completed (ToolCallCompleted events of autonomous investigations).
+   * Persisted so the investigation panel can show exactly what each [C#]
+   * checked without re-parsing the report text.
+   */
+  citationLabel?: string | undefined;
+  citationTarget?: AIChatCitationTarget | undefined;
 }
 
 /*

package/Types/AI/InvestigationEvidence.ts

@@ -0,0 +1,96 @@
+import { JSONObject } from "../JSON";
+import { AIChatCitationTarget, AIChatWidget } from "./AIChatTypes";
+
+/*
+ * Structured evidence for an AI investigation report. The report markdown only
+ * carries a flat "Evidence checked" list of labels; the investigation panel
+ * needs to know what each citation actually queried so a responder can open
+ * it, see its arguments and load the rows behind it.
+ *
+ * Everything here is derived server-side from the run's own AIRunEvents
+ * (never from model-authored text), so a prompt-injected report cannot forge
+ * a citation's tool, arguments or deep link.
+ */
+
+/*
+ * One read-only query the investigation ran, keyed by its citation id. The
+ * report's inline [C#] markers refer to these.
+ */
+export interface InvestigationEvidenceItem {
+  // "C1", "C2" — sequential within the attempt that produced the report.
+  citationId: string;
+  toolName: string;
+  // Server-minted citation label, e.g. "Active incidents (7 total)".
+  label: string;
+  // Rows the query returned. 0 is meaningful: checked, found nothing.
+  rowCount: number;
+  durationInMs?: number | undefined;
+  /*
+   * The tool arguments as executed, reduced to primitives and arrays of
+   * primitives with long strings clipped, so the panel can show what was
+   * asked without shipping arbitrary JSON to every viewer.
+   */
+  queryArguments: JSONObject;
+  // Where the underlying data lives in the dashboard, when there is a page for it.
+  target?: AIChatCitationTarget | undefined;
+  // ISO timestamp of when the query ran.
+  executedAt?: string | undefined;
+  /*
+   * Whether POST /ai-investigation/evidence can re-run this query for the
+   * viewer. False for tools that are not part of the read-only toolbox.
+   */
+  canLoadRows: boolean;
+}
+
+export type InvestigationReferenceKind = "incident" | "alert";
+
+/*
+ * An incident or alert the report mentions by number ("#6954"), resolved
+ * against the project's own records under the VIEWER's permissions. Only
+ * numbers that resolve become links; everything else stays plain text.
+ */
+export interface InvestigationEventReference {
+  kind: InvestigationReferenceKind;
+  number: number;
+  // ObjectID of the incident/alert as a string.
+  id: string;
+  // incidentNumberWithPrefix / alertNumberWithPrefix, or "#<number>".
+  displayNumber: string;
+  title: string;
+  stateName?: string | undefined;
+  // Hex color of the current state, e.g. "#10b981".
+  stateColor?: string | undefined;
+}
+
+/*
+ * Response of POST /ai-investigation/evidence: one citation's query re-run
+ * with the viewer's own permissions.
+ */
+export interface InvestigationEvidenceRowsResponse {
+  citationId: string;
+  toolName: string;
+  label: string;
+  rowCount: number;
+  /*
+   * Rendered with the dashboard's AI chat widget renderers (incident list,
+   * table, chart, trace waterfall...). Built from rows the viewer can read.
+   */
+  widget?: AIChatWidget | undefined;
+  /*
+   * Plain-text rows for tools that have no widget. Never markdown — the panel
+   * renders it inside a <pre>.
+   */
+  text?: string | undefined;
+  isTruncated: boolean;
+  // When this re-run executed (ISO).
+  executedAt: string;
+  /*
+   * True when the query's time window was pinned to the original
+   * investigation (explicit start/end), so the rows match what the AI saw
+   * apart from retention and permissions. False means the query reflects
+   * current data (e.g. "active incidents").
+   */
+  isPinnedToInvestigationTime: boolean;
+  // When the original query ran (ISO), if known.
+  investigatedAt?: string | undefined;
+}

package/Types/Monitor/MonitorEvaluationSummary.ts

@@ -13,6 +13,10 @@ export type MonitorEvaluationEventType =
   | "monitor-status-changed"
   | "probe-agreement";
 
+export type MonitorEvaluationCriteriaSkipCause =
+  | "disabled"
+  | "earlier-criterion-matched";
+
 export interface MonitorEvaluationFilterResult {
   checkOn: CheckOn;
   filterType?: FilterType | undefined;
@@ -30,6 +34,7 @@ export interface MonitorEvaluationCriteriaResult {
   filters: Array<MonitorEvaluationFilterResult>;
   skipped?: boolean | undefined;
   skipReason?: string | undefined;
+  skipCause?: MonitorEvaluationCriteriaSkipCause | undefined;
 }
 
 export interface MonitorEvaluationEvent {

package/Types/Permission.ts

@@ -2445,7 +2445,7 @@ export class PermissionHelper {
         permission: Permission.SecurityAdmin,
         title: "Security Admin",
         description:
-          "Full control over the SIEM: security events, Sigma detection rules, threat intelligence feeds and indicators, and Google SecOps connections. Security data is not readable through any other role.",
+          "Full control over the SIEM: security events, Sigma detection rules, threat intelligence feeds and indicators, and security event connections (Google SecOps, Microsoft Sentinel, CrowdStrike Falcon and other sources). Security data is not readable through any other role.",
         isAssignableToTenant: true,
         isAccessControlPermission: false,
         isRolePermission: true,
@@ -2455,7 +2455,7 @@ export class PermissionHelper {
         permission: Permission.SecurityMember,
         title: "Security Member",
         description:
-          "Can read security events and threat intelligence, and create, edit, and delete detection rules and threat intel feeds. Cannot configure Google SecOps connections.",
+          "Can read security events and threat intelligence, and create, edit, and delete detection rules and threat intel feeds. Cannot configure security event connections.",
         isAssignableToTenant: true,
         isAccessControlPermission: false,
         isRolePermission: true,

package/Types/Rum/SessionReplay.ts

@@ -130,6 +130,48 @@ export const SESSION_REPLAY_ROLLING_BUFFER_BYTES: number = 2 * 1024 * 1024;
 export const SESSION_REPLAY_IDLE_ROLLOVER_MS: number = 30 * 60 * 1000;
 export const SESSION_REPLAY_MAX_SESSION_MS: number = 4 * 60 * 60 * 1000;
 
+/*
+ * When a recording counts as over.
+ *
+ * A session is finalized - its aggregates counted and its "Recording now"
+ * badge dropped - either when no chunk has arrived for
+ * SESSION_REPLAY_IDLE_FINALIZE_MS, or, much sooner, once every tab of it
+ * has ended (see Common/Utils/Rum/SessionReplayRecordingEnded.ts: the
+ * recorder seals a tab on pagehide) and SESSION_REPLAY_ENDED_FINALIZE_GRACE_MS
+ * has passed since the server stored the newest chunk of any of those tabs.
+ * The Dashboard applies the same grace before it calls a session "ended",
+ * so the list, the player and the finalizer agree.
+ *
+ * The idle window stays long because a live tab can be silent for minutes:
+ * the recorder only flushes when something happened. The grace is short
+ * because a final chunk says the tab is gone; it only has to cover the next
+ * page of a multi-page app registering its first chunk under the same
+ * session id (up to one flush interval after it loads), and a queue backlog
+ * between the two.
+ */
+export const SESSION_REPLAY_IDLE_FINALIZE_MS: number = 10 * 60 * 1000;
+export const SESSION_REPLAY_ENDED_FINALIZE_GRACE_MS: number = 60 * 1000;
+
+/*
+ * How long after its final chunk's END a tab may still have started a chunk
+ * and be counted as ended.
+ *
+ * Older recorders, which stay cached on customer pages for as long as the
+ * pinned artifact lives, can post one more non-final chunk after the final
+ * one: on a visible tab the browser fires pagehide BEFORE visibilitychange,
+ * and their hidden handler flushed the visibility event it had just
+ * recorded. That trailing chunk starts at pagehide, but a chunk's end is
+ * its LAST BUFFERED EVENT, which can be up to one flush interval before
+ * pagehide when the user sat still before closing the tab. Hence one flush
+ * interval plus a margin for timer throttling.
+ *
+ * Nothing legitimate records under the same (session, tab) after a seal
+ * other than a back/forward-cache restore, and current recorders give a
+ * restored page a new tab id, so a wider bound cannot hide a live tab.
+ */
+export const SESSION_REPLAY_ENDED_TRAILING_CHUNK_TOLERANCE_MS: number =
+  SESSION_REPLAY_FLUSH_INTERVAL_MS + 10 * 1000;
+
 /*
  * fetch(keepalive) quota is 64KB combined per origin across all in-flight
  * keepalive requests, so the terminal flush gets one request under this
@@ -153,6 +195,27 @@ export const SESSION_REPLAY_CONTENT_TYPE: string =
 export const SESSION_REPLAY_APP_IDENTIFIER_HEADER: string =
   "x-oneuptime-app-identifier";
 
+/*
+ * The transport surface that is asking for replay policy. This is separate
+ * from the recorderKind inside a chunk envelope because authentication runs
+ * before the request body is read. Absence deliberately means the historic
+ * DOM recorder; only the exact `rn-view-tree` value selects the mobile
+ * contract.
+ */
+export const SESSION_REPLAY_RECORDER_KIND_HEADER: string =
+  "x-oneuptime-replay-recorder-kind";
+
+/*
+ * Native applications have no browser-controlled Origin header. The mobile
+ * recorder sends its Android package name / iOS bundle identifier here and
+ * the ingest guard maps it to an exact app:// origin for allowlist matching.
+ * It is not the RUM application identifier above: several app binaries may
+ * intentionally report to one configured RUM application.
+ */
+export const SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER: string =
+  "x-oneuptime-mobile-app-identifier";
+export const SESSION_REPLAY_MAX_MOBILE_APP_IDENTIFIER_LENGTH: number = 255;
+
 /*
  * Header carrying the host page's end-user reference on the CONFIG fetch,
  * URI-component-encoded so a non-ASCII reference cannot make fetch() throw
@@ -329,12 +392,50 @@ export const SESSION_REPLAY_RECORDER_CAPABILITIES: ReadonlyArray<string> = [
   "mousemove-50ms",
 ];
 
+/*
+ * Capabilities emitted by the React Native recorder on its first chunk.
+ * Kept separate from the DOM baseline above: otherwise every perfectly
+ * healthy web recording would appear to be missing mobile-only features.
+ */
+export const SESSION_REPLAY_MOBILE_RECORDER_CAPABILITIES: ReadonlyArray<string> =
+  [
+    "mobile-view-tree",
+    "mobile-touch-events",
+    "custom-events",
+    "traits",
+    "tags",
+    "visibility",
+    "visitor-id",
+    "route-events",
+    "js-errors",
+  ];
+
 /* How the payload bytes were compressed by the recorder. */
 export type SessionReplayPayloadEncoding = "gzip" | "identity";
 
 /* Which recorder produced the frame — web DOM, or a mobile view tree. */
 export type SessionReplayRecorderKind = "dom" | "rn-view-tree";
 
+/*
+ * Strict parser for the recorder-kind REQUEST header. The wire envelope has
+ * a backwards-compatible fallback for old stored chunks, but a config fetch
+ * must never silently reinterpret a typo as web policy. Header absence is
+ * the only legacy fallback.
+ */
+export function parseSessionReplayRecorderKindHeader(
+  value: unknown,
+): SessionReplayRecorderKind | null {
+  if (value === undefined || value === null) {
+    return "dom";
+  }
+
+  if (value === "dom" || value === "rn-view-tree") {
+    return value;
+  }
+
+  return null;
+}
+
 /* State of the consent handshake at the moment the chunk was cut. */
 export type SessionReplayConsentState = "Granted" | "NotRequired" | "Unknown";
 
@@ -383,6 +484,14 @@ export enum SessionReplayFidelityNotice {
    * footage recovers, but playback may skip or freeze around those points.
    */
   RecorderError = "recorder-error",
+  /* Native Image pixels are represented by an opaque placeholder. */
+  MobileImagesOpaque = "mobile-images-opaque",
+  /* WebView contents cannot be inspected from the React Native view tree. */
+  MobileWebViewOpaque = "mobile-webview-opaque",
+  /* Native canvas / drawing surfaces are represented as opaque regions. */
+  MobileCanvasOpaque = "mobile-canvas-opaque",
+  /* Animation state is sampled at snapshots rather than reproduced framewise. */
+  MobileAnimationSampled = "mobile-animation-sampled",
 }
 
 /* Why a session stopped accumulating chunks. */

package/Types/Rum/SessionReplayApi.ts

@@ -191,6 +191,17 @@ export interface SessionReplayListItemDto {
    * and what the player's "other sessions from this visitor" reads.
    */
   visitorId?: string;
+  /*
+   * Additive. True when the session is not finalized yet but every tab of
+   * it has ended - sent its final chunk, or stored its last permitted chunk
+   * index - and the newest of its chunks was stored at least
+   * SESSION_REPLAY_ENDED_FINALIZE_GRACE_MS ago (see
+   * Common/Utils/Rum/SessionReplayRecordingEnded.ts): the recording is
+   * over and only the finalizer's counting is pending. Always false for a
+   * finalized session, and absent from an older server, where the
+   * Dashboard falls back to reading "not finalized" as "recording".
+   */
+  hasRecordingEnded?: boolean;
 }
 
 export interface SessionReplayListResponseDto {
@@ -435,6 +446,12 @@ export interface SessionReplayManifestHeaderDto {
    */
   identifiedUserKey?: string;
   visitorId?: string;
+  /*
+   * Additive; same meaning as SessionReplayListItemDto.hasRecordingEnded.
+   * The player uses it to stop calling a session "Live" once every tab has
+   * closed, while it keeps polling until the finalized header arrives.
+   */
+  hasRecordingEnded?: boolean;
 }
 
 export interface SessionReplayManifestTabDto {
@@ -532,6 +549,20 @@ export interface SessionReplayViewsResponseDto {
 
 export interface SessionReplayForExceptionRequestDto {
   fingerprint: string;
+  /*
+   * Optional exception-group scope. Fingerprints are unique only within a
+   * primary entity, so callers that know the group must send this to avoid
+   * matching an identically fingerprinted exception from another service.
+   */
+  primaryEntityId?: string;
+  /*
+   * New callers send this wire value with primaryEntityId. The server validates
+   * it against ServiceType before using it; keeping the transport contract a
+   * string also keeps this dependency-free Rum module safe to inline in the
+   * browser recorder. The server accepts an ID-only rolling-compatibility
+   * request through a conservative scoped-unknown path.
+   */
+  primaryEntityType?: string;
   /* ISO-8601 bounds; without them the server defaults to a 30-day window. */
   startTime?: string;
   endTime?: string;

package/Types/SecurityEvent/Connectors/ConnectorDiagnostics.ts

@@ -0,0 +1,111 @@
+import { JSONObject } from "../../JSON";
+
+/*
+ * The shape every "Test connection" produces, whichever source is behind
+ * it — Google SecOps and every provider in the Security Event Connections
+ * framework return the same report, so one dashboard component renders
+ * all of them.
+ *
+ * A report is a checklist, not a boolean. The customer complaint this was
+ * built for ("connected, but nothing is ingested") is never answered by
+ * "credentials accepted": it needs, in order, whether the source can be
+ * reached, whether it allows reading detections, whether there is
+ * anything to import right now, and whether OneUptime's own scheduler and
+ * workers are actually running. Each of those is a check with its own
+ * remediation text, so a failed step tells the reader what to do next
+ * instead of leaving them with a status word.
+ */
+
+export type SecurityConnectorCheckStatus = "pass" | "fail" | "warn" | "skip";
+
+export interface SecurityConnectorCheck {
+  /*
+   * Stable machine key (kebab-case), e.g. "authentication",
+   * "worker-consumers". UI groups and tests key off it; the human name may
+   * be reworded freely.
+   */
+  key: string;
+  name: string;
+  status: SecurityConnectorCheckStatus;
+  durationMs: number;
+  // What was observed, in one or two sentences. Credentials are never here.
+  message: string;
+  // What to do when the check did not pass. Omitted for passing checks.
+  remediation?: string | undefined;
+  // Structured extras for the UI (counts, timestamps). Never credentials.
+  details?: JSONObject | undefined;
+}
+
+/*
+ * What the tester could learn about the OneUptime deployment itself. Every
+ * probe is independently best-effort: `null` means "could not determine",
+ * which the UI renders as unknown rather than as healthy.
+ */
+export interface ConnectorPlatformStatus {
+  // Processes consuming the Worker queue (BullMQ getWorkersCount).
+  workerConsumers: number | null;
+  // Whether the minute-cadence poll scheduler is registered on the queue.
+  schedulerRegistered: boolean | null;
+  schedulerNextRunAt?: string | undefined;
+  queueWaiting: number | null;
+  queueFailed: number | null;
+  // Whether the analytics database that stores security events answered.
+  storageReachable: boolean | null;
+}
+
+export interface SecurityConnectorSample {
+  id: string;
+  title: string;
+  severity: string;
+  // When the source created the record.
+  createdTime?: string | undefined;
+  // The record's own event/detection time, which may be much earlier.
+  eventTime?: string | undefined;
+}
+
+export type SecurityConnectorTestStatus = "pass" | "fail" | "warn";
+
+export interface SecurityConnectorTestReport {
+  // Provider identifier, e.g. "google-secops" or a SecurityEventConnectorProvider value.
+  provider: string;
+  status: SecurityConnectorTestStatus;
+  startedAt: string;
+  completedAt: string;
+  durationMs: number;
+  checks: Array<SecurityConnectorCheck>;
+  // One-paragraph verdict written for the person reading the modal.
+  summary: string;
+  platform?: ConnectorPlatformStatus | undefined;
+  /*
+   * Availability counts, keyed by a stable name the UI knows how to label,
+   * e.g. { createdLast24h: 12, createdLast7d: 140, hasMoreLast7d: false }.
+   */
+  counts?: JSONObject | undefined;
+  samples?: Array<SecurityConnectorSample> | undefined;
+}
+
+/*
+ * Fold check statuses into the report verdict: any failure fails the
+ * report; otherwise any warning makes it a warning; skips are neutral.
+ */
+export function summarizeCheckStatuses(
+  checks: Array<SecurityConnectorCheck>,
+): SecurityConnectorTestStatus {
+  if (
+    checks.some((check: SecurityConnectorCheck): boolean => {
+      return check.status === "fail";
+    })
+  ) {
+    return "fail";
+  }
+
+  if (
+    checks.some((check: SecurityConnectorCheck): boolean => {
+      return check.status === "warn";
+    })
+  ) {
+    return "warn";
+  }
+
+  return "pass";
+}