@oneuptime/common 14.0.9 → 14.0.10

package/Tests/Server/Services/DatabaseServerService.test.ts

@@ -1254,6 +1254,61 @@ describe("DatabaseServerService.findOrCreateByEndpoint", () => {
     expect(feed.feedInfoInMarkdown).toContain("restored from the archive");
   });
 
+  /*
+   * A lookup that saw no traffic (a resource AI agent registering) returns
+   * the owner as it is: an archived row stays archived, and neither the
+   * endpoint's last match nor the row's engine is touched.
+   */
+  test("isSighting: false returns the owner without sighting it", async () => {
+    const archived: DatabaseServer = databaseRow({
+      discoverySource: DatabaseServerDiscoverySource.Collector,
+      isArchived: true,
+      autoArchivedAt: new Date("2026-09-01T00:00:00.000Z"),
+    });
+    const owner: any = { databaseServerId: archived.id };
+    findOwner.mockResolvedValue(owner);
+    findOneBy.mockResolvedValue(archived);
+    rawQuery.mockResolvedValue([{ _id: archived.id!.toString() }]);
+    const markMatched: jest.SpyInstance = getJestSpyOn(
+      DatabaseServerEndpointService,
+      "markEndpointMatched",
+    ).mockResolvedValue(undefined);
+    const evidence: jest.SpyInstance = getJestSpyOn(
+      service,
+      "applyDatabaseSystemEvidence",
+    ).mockResolvedValue(undefined);
+
+    const result: DatabaseServer | null =
+      await DatabaseServerService.findOrCreateByEndpoint({
+        projectId: PROJECT_ID,
+        dbSystem: "postgresql",
+        endpoint: ORDERS_ENDPOINT,
+        discoverySource: DatabaseServerDiscoverySource.Collector,
+        allowCreate: true,
+        isSighting: false,
+      });
+
+    expect(result).toBe(archived);
+    expect(result!.isArchived).toBe(true);
+    expect(result!.autoArchivedAt).toBeDefined();
+    expect(rawQuery).not.toHaveBeenCalled();
+    expect(sideEffects.feed).not.toHaveBeenCalled();
+    expect(markMatched).not.toHaveBeenCalled();
+    expect(evidence).not.toHaveBeenCalled();
+    expect(create).not.toHaveBeenCalled();
+
+    // The same lookup as a sighting restores it.
+    await DatabaseServerService.findOrCreateByEndpoint({
+      projectId: PROJECT_ID,
+      dbSystem: "postgresql",
+      endpoint: ORDERS_ENDPOINT,
+      discoverySource: DatabaseServerDiscoverySource.Collector,
+      allowCreate: true,
+    });
+    expect(markMatched).toHaveBeenCalledWith(owner);
+    expect(rawQuery).toHaveBeenCalledTimes(1);
+  });
+
   test("a restore that lost to someone else writes no second feed item", async () => {
     const archived: DatabaseServer = databaseRow({
       discoverySource: DatabaseServerDiscoverySource.Collector,

package/Tests/Server/Services/GroupTelemetryUsageExcludeNames.test.ts

@@ -0,0 +1,299 @@
+import AnalyticsDatabaseService from "../../../Server/Services/AnalyticsDatabaseService";
+import { LogService } from "../../../Server/Services/LogService";
+import { MetricService } from "../../../Server/Services/MetricService";
+import { SpanService } from "../../../Server/Services/SpanService";
+import { Statement } from "../../../Server/Utils/AnalyticsDatabase/Statement";
+import AnalyticsBaseModel from "../../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import ServiceType from "../../../Types/Telemetry/ServiceType";
+import SessionReplayBudgetMetricTypeUtil from "../../../Utils/SessionReplay/SessionReplayBudgetMetricType";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The metrics billing scan is the only place OneUptime's own session replay
+ * budget rows can be told apart from a RUM application's web vitals: both are
+ * keyed to the application with primaryEntityType RealUserMonitor, so the
+ * (primaryEntityId, primaryEntityType) grouping merges them and only their
+ * names differ. These tests pin the SQL the scan generates - the exclusion
+ * sits inside the WHERE, binds the names as a parameter, and leaves the
+ * statement byte-for-byte unchanged when there is nothing to exclude - with no
+ * ClickHouse in the loop, the same way SessionReplayMetering.test.ts pins the
+ * replay scan.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID("6512f3a9b7c4d2e108f5a3b9");
+const START_OF_DAY: Date = new Date("2026-09-28T00:00:00.000Z");
+const END_OF_DAY: Date = new Date("2026-09-28T23:59:59.999Z");
+
+/*
+ * The statement as the scan generated it before excludeNames existed,
+ * captured from that code, up to the trailing SETTINGS clause (which belongs
+ * to QuerySettingsHelper and is pinned there).
+ */
+const PRE_EXCLUSION_QUERY: string =
+  "SELECT primaryEntityId AS primaryEntityId, primaryEntityType AS primaryEntityType, count() AS rowCount, sum(byteSize(*)) AS estimatedBytes FROM {p0:Identifier}.{p1:Identifier} WHERE projectId = {p2:String} AND {p3:Identifier} >= {p4:DateTime64(9)} AND {p5:Identifier} <= {p6:DateTime64(9)} GROUP BY primaryEntityId, primaryEntityType";
+
+const BUDGET_METRIC_NAMES: Array<string> =
+  SessionReplayBudgetMetricTypeUtil.getAll();
+
+type UsageRow = {
+  primaryEntityId: string;
+  primaryEntityType: string | null;
+  rowCount: number;
+  estimatedBytes: number;
+};
+
+interface CapturedScan {
+  // Null when the scan refused before reaching ClickHouse.
+  query: string | null;
+  params: Record<string, unknown> | null;
+  result: Array<UsageRow>;
+}
+
+/*
+ * Runs the real groupTelemetryUsageByService with executeQuery replaced, so
+ * the generated statement is captured instead of sent. `excludeNames` is
+ * passed only when the key is present, so "absent" and "undefined" are
+ * separate cases.
+ */
+async function captureUsageScan<TBaseModel extends AnalyticsBaseModel>(
+  service: AnalyticsDatabaseService<TBaseModel>,
+  options: {
+    excludeNames?: Array<string> | undefined;
+    responseRows?: Array<JSONObject> | undefined;
+  } = {},
+): Promise<CapturedScan> {
+  const captured: CapturedScan = { query: null, params: null, result: [] };
+
+  service.executeQuery = ((statement: Statement): Promise<unknown> => {
+    captured.query = statement.query;
+    captured.params = statement.query_params;
+
+    return Promise.resolve({
+      json: (): Promise<{ data: Array<JSONObject> }> => {
+        return Promise.resolve({ data: options.responseRows || [] });
+      },
+    });
+  }) as unknown as typeof service.executeQuery;
+
+  captured.result = await service.groupTelemetryUsageByService({
+    projectId: PROJECT_ID,
+    timestampColumnName: "time",
+    startDate: START_OF_DAY,
+    endDate: END_OF_DAY,
+    ...("excludeNames" in options
+      ? { excludeNames: options.excludeNames }
+      : {}),
+  });
+
+  return captured;
+}
+
+function queryBeforeSettings(query: string | null): string {
+  expect(query).not.toBeNull();
+
+  const settingsIndex: number = query!.indexOf(" SETTINGS ");
+  expect(settingsIndex).toBeGreaterThan(-1);
+
+  return query!.slice(0, settingsIndex);
+}
+
+describe("groupTelemetryUsageByService without excludeNames", () => {
+  test("generates exactly the statement it did before the option existed", async () => {
+    const scan: CapturedScan = await captureUsageScan(new MetricService());
+
+    expect(queryBeforeSettings(scan.query)).toBe(PRE_EXCLUSION_QUERY);
+    expect(scan.query).not.toContain("NOT IN");
+
+    // Same parameters too - p0 is the configured database name.
+    expect(Object.keys(scan.params!).sort()).toEqual(
+      ["p0", "p1", "p2", "p3", "p4", "p5", "p6"].sort(),
+    );
+    expect(scan.params!["p1"]).toBe("MetricItemV3");
+    expect(scan.params!["p2"]).toBe(PROJECT_ID.toString());
+    expect(scan.params!["p3"]).toBe("time");
+    expect(scan.params!["p5"]).toBe("time");
+  });
+
+  test.each([
+    ["an empty list", []],
+    ["an explicit undefined", undefined],
+  ])(
+    "treats %s as absent: the same statement, the same parameters",
+    async (_name: string, excludeNames: Array<string> | undefined) => {
+      const absent: CapturedScan = await captureUsageScan(new MetricService());
+      const given: CapturedScan = await captureUsageScan(new MetricService(), {
+        excludeNames,
+      });
+
+      expect(given.query).toBe(absent.query);
+      expect(given.params).toEqual(absent.params);
+    },
+  );
+
+  test("still scans a table with no name column when there is nothing to exclude", async () => {
+    const scan: CapturedScan = await captureUsageScan(new LogService(), {
+      excludeNames: [],
+    });
+
+    expect(scan.query).not.toBeNull();
+    expect(scan.query).not.toContain("NOT IN");
+    expect(scan.params!["p1"]).toBe("LogItemV3");
+  });
+});
+
+describe("groupTelemetryUsageByService with excludeNames", () => {
+  test("adds `AND name NOT IN` inside the WHERE: after the time window, before GROUP BY", async () => {
+    const scan: CapturedScan = await captureUsageScan(new MetricService(), {
+      excludeNames: BUDGET_METRIC_NAMES,
+    });
+
+    const query: string = scan.query!;
+
+    expect(query).toContain(
+      "AND {p5:Identifier} <= {p6:DateTime64(9)} AND name NOT IN {p7:Array(String)} GROUP BY primaryEntityId, primaryEntityType SETTINGS ",
+    );
+    expect(query.indexOf(" WHERE ")).toBeLessThan(query.indexOf("NOT IN"));
+    expect(query.indexOf("NOT IN")).toBeLessThan(query.indexOf(" GROUP BY "));
+    expect(query.indexOf(" GROUP BY ")).toBeLessThan(
+      query.indexOf(" SETTINGS "),
+    );
+
+    // Exactly one exclusion clause, and nothing else about the scan moved.
+    expect(query.split("NOT IN")).toHaveLength(2);
+    expect(
+      queryBeforeSettings(query).replace(
+        " AND name NOT IN {p7:Array(String)}",
+        "",
+      ),
+    ).toBe(PRE_EXCLUSION_QUERY);
+  });
+
+  test("binds every name, in order, as one Array(String) parameter", async () => {
+    const scan: CapturedScan = await captureUsageScan(new MetricService(), {
+      excludeNames: BUDGET_METRIC_NAMES,
+    });
+
+    expect(scan.params!["p7"]).toEqual(BUDGET_METRIC_NAMES);
+
+    // The names never reach the SQL text itself.
+    for (const name of BUDGET_METRIC_NAMES) {
+      expect(scan.query).not.toContain(name);
+    }
+  });
+
+  test("keeps a hostile name a parameter value, never SQL", async () => {
+    const hostileName: string = "x') OR 1=1 GROUP BY name --";
+
+    const scan: CapturedScan = await captureUsageScan(new MetricService(), {
+      excludeNames: [hostileName],
+    });
+
+    expect(scan.params!["p7"]).toEqual([hostileName]);
+    expect(scan.query).not.toContain("OR 1=1");
+    expect(scan.query).not.toContain("--");
+    expect(scan.query!.split("GROUP BY")).toHaveLength(2);
+  });
+
+  test("leaves the caller's list untouched", async () => {
+    const excludeNames: Array<string> = [...BUDGET_METRIC_NAMES];
+
+    await captureUsageScan(new MetricService(), { excludeNames });
+
+    expect(excludeNames).toEqual(BUDGET_METRIC_NAMES);
+  });
+
+  test("parses the grouped rows exactly as before", async () => {
+    const appId: string = ObjectID.generate().toString();
+
+    const scan: CapturedScan = await captureUsageScan(new MetricService(), {
+      excludeNames: BUDGET_METRIC_NAMES,
+      responseRows: [
+        {
+          primaryEntityId: appId,
+          primaryEntityType: ServiceType.RealUserMonitor,
+          rowCount: "12",
+          estimatedBytes: "3456",
+        },
+        // Unattributed rows are skipped, as they always were.
+        {
+          primaryEntityId: "",
+          primaryEntityType: ServiceType.OpenTelemetry,
+          rowCount: "1",
+          estimatedBytes: "1",
+        },
+        // A blank type reads as a legacy row.
+        {
+          primaryEntityId: PROJECT_ID.toString(),
+          primaryEntityType: " ",
+          rowCount: 2,
+          estimatedBytes: 0,
+        },
+      ],
+    });
+
+    expect(scan.result).toEqual([
+      {
+        primaryEntityId: appId,
+        primaryEntityType: ServiceType.RealUserMonitor,
+        rowCount: 12,
+        estimatedBytes: 3456,
+      },
+      {
+        primaryEntityId: PROJECT_ID.toString(),
+        primaryEntityType: null,
+        rowCount: 2,
+        estimatedBytes: 0,
+      },
+    ]);
+  });
+
+  test("refuses a table with no name column before querying it", async () => {
+    const service: LogService = new LogService();
+    let executed: boolean = false;
+    service.executeQuery = (async (): Promise<never> => {
+      executed = true;
+      throw new Error("must not run");
+    }) as unknown as typeof service.executeQuery;
+
+    await expect(
+      service.groupTelemetryUsageByService({
+        projectId: PROJECT_ID,
+        timestampColumnName: "time",
+        startDate: START_OF_DAY,
+        endDate: END_OF_DAY,
+        excludeNames: ["anything"],
+      }),
+    ).rejects.toThrow(BadDataException);
+    expect(executed).toBe(false);
+  });
+
+  test("refuses a Nullable name column, where NOT IN would silently drop every unnamed row", async () => {
+    /*
+     * Span.name is optional. ClickHouse does not treat `NULL NOT IN (...)`
+     * as true, so the scan would lose every span without a name from the
+     * bill - an undercount nobody would notice.
+     */
+    const service: SpanService = new SpanService();
+    let executed: boolean = false;
+    service.executeQuery = (async (): Promise<never> => {
+      executed = true;
+      throw new Error("must not run");
+    }) as unknown as typeof service.executeQuery;
+
+    await expect(
+      service.groupTelemetryUsageByService({
+        projectId: PROJECT_ID,
+        timestampColumnName: "startTime",
+        startDate: START_OF_DAY,
+        endDate: END_OF_DAY,
+        excludeNames: ["anything"],
+      }),
+    ).rejects.toThrow(
+      "excludeNames needs a required name column, and SpanItemV3 has none",
+    );
+    expect(executed).toBe(false);
+  });
+});

package/Tests/Server/Services/HostServiceFindOrCreateMemo.test.ts

@@ -228,6 +228,50 @@ describe("HostService.findOrCreateByHostIdentifier L1 memo", () => {
     expect(findOneBy).toHaveBeenCalledTimes(2);
   });
 
+  /*
+   * A host deleted within the TTL keeps resolving to its old id from the
+   * memo; a caller that found that id gone (a resource AI agent
+   * registering again right after the delete) asks past the memo, gets the
+   * host created anew, and the memo then holds the new id.
+   */
+  test("bypassMemo looks the host up again and refreshes the memo with what it found", async () => {
+    const projectId: ObjectID = ObjectID.generate();
+    const deleted: Host = buildHost();
+    const recreated: Host = buildHost();
+    findOneBy.mockResolvedValue(deleted);
+
+    await HostService.findOrCreateByHostIdentifier({
+      projectId,
+      hostIdentifier: "web-01",
+    });
+
+    // The host is deleted: nothing owns the identifier any more.
+    findOneBy.mockResolvedValue(null);
+    create.mockResolvedValue(recreated);
+
+    const memoed: Host = await HostService.findOrCreateByHostIdentifier({
+      projectId,
+      hostIdentifier: "web-01",
+    });
+    expect(memoed._id).toBe(deleted._id);
+
+    const fresh: Host = await HostService.findOrCreateByHostIdentifier({
+      projectId,
+      hostIdentifier: "web-01",
+      bypassMemo: true,
+    });
+    expect(fresh._id).toBe(recreated._id);
+    expect(findOneBy).toHaveBeenCalledTimes(2);
+    expect(create).toHaveBeenCalledTimes(1);
+
+    const afterwards: Host = await HostService.findOrCreateByHostIdentifier({
+      projectId,
+      hostIdentifier: "web-01",
+    });
+    expect(afterwards._id).toBe(recreated._id);
+    expect(findOneBy).toHaveBeenCalledTimes(2);
+  });
+
   test("memoizes a host it just created", async () => {
     const projectId: ObjectID = ObjectID.generate();
     const created: Host = buildHost({ hostIdentifier: "brand-new" });

package/Tests/Server/Services/MonitorProbeServiceIntervalScheduling.test.ts

@@ -73,6 +73,7 @@ function minutesBetween(from: Date, to: Date): number {
 describe("claimMonitorProbesForProbing computes the schedule the customer asked for", () => {
   afterEach(() => {
     jest.restoreAllMocks();
+    jest.useRealTimers();
   });
 
   describe("the production scenario", () => {
@@ -114,13 +115,51 @@ describe("claimMonitorProbesForProbing computes the schedule the customer asked
       },
     );
 
-    test('a monitor storing "1 day" is scheduled for midnight, not a minute away', async () => {
-      const { nextPingAt, now } = await claimAndReadNextPingAt("1 day");
+    /*
+     * "1 day" means the next midnight, and on the real clock "more than a
+     * minute away" cannot tell that from the old one-minute fallback in the
+     * last minute of the day: at 23:59:14 the right answer IS under a minute
+     * away (this failed CI at exactly that time), and "+1 minute" lands on
+     * 00:00 too. So the clock is pinned - only Date, the harness's promises
+     * run as usual - once mid-day and once in that last minute, and the
+     * schedule must be the next midnight to the millisecond, which "+1
+     * minute" never is: it keeps the seconds.
+     */
+    test.each([
+      ["mid-day", new Date(2026, 8, 29, 10, 17, 42, 123)],
+      ["in the last minute of the day", new Date(2026, 8, 29, 23, 59, 14, 500)],
+    ])(
+      'a monitor storing "1 day" is scheduled for the next midnight, not a minute away (%s)',
+      async (_when: string, pinnedNow: Date) => {
+        jest.useFakeTimers({
+          now: pinnedNow,
+          doNotFake: [
+            "hrtime",
+            "nextTick",
+            "performance",
+            "queueMicrotask",
+            "requestAnimationFrame",
+            "cancelAnimationFrame",
+            "requestIdleCallback",
+            "cancelIdleCallback",
+            "setImmediate",
+            "clearImmediate",
+            "setInterval",
+            "clearInterval",
+            "setTimeout",
+            "clearTimeout",
+          ],
+        });
 
-      expect(nextPingAt.getHours()).toBe(0);
-      expect(nextPingAt.getMinutes()).toBe(0);
-      expect(minutesBetween(now, nextPingAt)).toBeGreaterThan(1);
-    });
+        const { nextPingAt, now } = await claimAndReadNextPingAt("1 day");
+
+        expect(now.getTime()).toBe(pinnedNow.getTime());
+        expect(nextPingAt.getTime()).toBe(
+          new Date(2026, 8, 30, 0, 0, 0, 0).getTime(),
+        );
+        expect(nextPingAt.getTime()).not.toBe(pinnedNow.getTime() + 60 * 1000);
+      },
+    );
   });
 
   describe("values that were always valid are unaffected", () => {

package/Tests/Server/Services/RecordingRuleReservedMetricName.test.ts

@@ -0,0 +1,171 @@
+import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import MetricRecordingRule from "../../../Models/DatabaseModels/MetricRecordingRule";
+import TraceRecordingRule from "../../../Models/DatabaseModels/TraceRecordingRule";
+import MetricRecordingRuleService, {
+  Service as MetricRecordingRuleServiceClass,
+} from "../../../Server/Services/MetricRecordingRuleService";
+import TraceRecordingRuleService from "../../../Server/Services/TraceRecordingRuleService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../../../Server/Types/Database/Hooks";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import SessionReplayBudgetMetricType from "../../../Types/Rum/SessionReplayBudgetMetricType";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Recording rules write their output straight into the metric store, past
+ * OTLP ingest - which is where every other customer-chosen metric name is
+ * checked against the reserved session replay namespace. The budget series
+ * under it open incidents and are left out of telemetry billing by name, so
+ * a rule must not be able to write one either: both services refuse a
+ * reserved output name when a rule is created, and when an update sets it.
+ */
+
+interface Hooks<TModel extends DatabaseBaseModel> {
+  onBeforeCreate: (createBy: CreateBy<TModel>) => Promise<OnCreate<TModel>>;
+  onBeforeUpdate: (updateBy: UpdateBy<TModel>) => Promise<OnUpdate<TModel>>;
+}
+
+const RESERVED_NAMES: Array<string> = [
+  ...Object.values(SessionReplayBudgetMetricType),
+  "oneuptime.rum.session.replay.anything.new",
+  "OneUptime.RUM.Session.Replay.Budget.Project.Daily.Used.Percent",
+  "  oneuptime.rum.session.replay.budget.project.daily.used.bytes  ",
+];
+
+const ALLOWED_NAMES: Array<string> = [
+  "web_vital.lcp",
+  "checkout.latency.p99",
+  "oneuptime.llm.budget.percent.used",
+  "oneuptime.rum.application.id",
+  "oneuptime.rum.session.replayed",
+];
+
+interface ServiceCase {
+  name: string;
+  hooks: Hooks<MetricRecordingRule | TraceRecordingRule>;
+  newRule: () => MetricRecordingRule | TraceRecordingRule;
+}
+
+const SERVICES: Array<ServiceCase> = [
+  {
+    name: "MetricRecordingRuleService",
+    hooks: MetricRecordingRuleService as unknown as Hooks<
+      MetricRecordingRule | TraceRecordingRule
+    >,
+    newRule: (): MetricRecordingRule => {
+      return new MetricRecordingRule();
+    },
+  },
+  {
+    name: "TraceRecordingRuleService",
+    hooks: TraceRecordingRuleService as unknown as Hooks<
+      MetricRecordingRule | TraceRecordingRule
+    >,
+    newRule: (): TraceRecordingRule => {
+      return new TraceRecordingRule();
+    },
+  },
+];
+
+function createBy(
+  rule: MetricRecordingRule | TraceRecordingRule,
+): CreateBy<MetricRecordingRule | TraceRecordingRule> {
+  return {
+    data: rule,
+    props: { isRoot: true },
+  } as unknown as CreateBy<MetricRecordingRule | TraceRecordingRule>;
+}
+
+function updateBy(
+  data: Record<string, unknown>,
+): UpdateBy<MetricRecordingRule | TraceRecordingRule> {
+  return {
+    query: { _id: ObjectID.generate().toString() },
+    data: data,
+    props: { isRoot: true },
+  } as unknown as UpdateBy<MetricRecordingRule | TraceRecordingRule>;
+}
+
+describe("MetricRecordingRuleService.assertOutputMetricNameAllowed", () => {
+  test.each(RESERVED_NAMES)("refuses %p", (name: string) => {
+    expect(() => {
+      MetricRecordingRuleServiceClass.assertOutputMetricNameAllowed(name);
+    }).toThrow(BadDataException);
+  });
+
+  test("says which prefix is reserved and what to do", () => {
+    expect(() => {
+      MetricRecordingRuleServiceClass.assertOutputMetricNameAllowed(
+        SessionReplayBudgetMetricType.ProjectDailyUsedPercent,
+      );
+    }).toThrow(
+      'Metric names that start with "oneuptime.rum.session.replay." are reserved for OneUptime\'s session replay budget metrics. Choose another output metric name.',
+    );
+  });
+
+  test.each(ALLOWED_NAMES)("allows %p", (name: string) => {
+    expect(() => {
+      MetricRecordingRuleServiceClass.assertOutputMetricNameAllowed(name);
+    }).not.toThrow();
+  });
+
+  test.each([undefined, null, "", 42])(
+    "leaves a missing or non-string name %p to the model's own validation",
+    (name: unknown) => {
+      expect(() => {
+        MetricRecordingRuleServiceClass.assertOutputMetricNameAllowed(name);
+      }).not.toThrow();
+    },
+  );
+});
+
+describe.each(SERVICES)("$name", ({ hooks, newRule }: ServiceCase) => {
+  test("refuses to create a rule whose output name is reserved", async () => {
+    const rule: MetricRecordingRule | TraceRecordingRule = newRule();
+    rule.outputMetricName =
+      SessionReplayBudgetMetricType.ApplicationMonthlyUsedPercent;
+
+    await expect(hooks.onBeforeCreate(createBy(rule))).rejects.toThrow(
+      BadDataException,
+    );
+  });
+
+  test("creates a rule with any other output name, untouched", async () => {
+    const rule: MetricRecordingRule | TraceRecordingRule = newRule();
+    rule.outputMetricName = "checkout.latency.p99";
+
+    const result: OnCreate<MetricRecordingRule | TraceRecordingRule> =
+      await hooks.onBeforeCreate(createBy(rule));
+
+    expect(result.createBy.data.outputMetricName).toBe("checkout.latency.p99");
+    expect(result.carryForward).toBeNull();
+  });
+
+  test("refuses an update that renames the output into the reserved namespace", async () => {
+    await expect(
+      hooks.onBeforeUpdate(
+        updateBy({
+          outputMetricName: "oneuptime.rum.session.replay.budget.mine",
+        }),
+      ),
+    ).rejects.toThrow(BadDataException);
+  });
+
+  test("lets through an update that does not touch the output name", async () => {
+    const result: OnUpdate<MetricRecordingRule | TraceRecordingRule> =
+      await hooks.onBeforeUpdate(updateBy({ isEnabled: false }));
+
+    expect(result.carryForward).toBeNull();
+    expect(
+      (result.updateBy.data as unknown as Record<string, unknown>)["isEnabled"],
+    ).toBe(false);
+  });
+
+  test("lets through an update to an allowed output name", async () => {
+    await expect(
+      hooks.onBeforeUpdate(updateBy({ outputMetricName: "web_vital.lcp.p75" })),
+    ).resolves.toBeDefined();
+  });
+});