@oneuptime/common 14.0.9 → 14.0.11

package/Types/Runbook/RunbookStepType.ts

@@ -14,6 +14,15 @@ enum RunbookStepType {
    * commands, remediations run policy-tiered writes); not authored in runbooks.
    */
   Kubectl = "Kubectl",
+  /*
+   * A single command for an infrastructure resource's AI agent (Docker,
+   * Podman, Docker Swarm, Proxmox, VMware, Ceph, a database server or a
+   * host), dispatched as an argv (never a shell line) to that resource's
+   * online ResourceAiAgent — never claimed by a Runner, never run by the
+   * Worker. Composed only by OneUptime AI and tiered by the resource command
+   * policy (Utils/AiRemediation/Resource); not authored in runbooks.
+   */
+  ResourceCommand = "ResourceCommand",
 }
 
 export default RunbookStepType;
@@ -66,3 +75,23 @@ export const PAYLOAD_CARRYING_STEP_TYPES: Array<RunbookStepType> = [
 export function isPayloadCarryingStepType(type: RunbookStepType): boolean {
   return PAYLOAD_CARRYING_STEP_TYPES.includes(type);
 }
+
+/*
+ * Step types executed by an infrastructure resource's AI agent (a
+ * ResourceAiAgent row), a third lane beside the Runner and the Worker. Such
+ * a job is written with targetResourceAiAgentId and no targetAgentId, so no
+ * Runner can claim it: RunnerJobService.enqueue refuses these types (they
+ * are not in RUNNER_EXECUTED_STEP_TYPES), a Runner may not ask for them on a
+ * claim, and the Worker's step switch has no case for them.
+ *
+ * Deliberately NOT in PAYLOAD_CARRYING_STEP_TYPES, which is the payload half
+ * of the Runner lane (a test asserts the two Runner halves are
+ * complementary); these jobs still carry their argv in RunnerJob.payload.
+ */
+export const AI_AGENT_EXECUTED_STEP_TYPES: Array<RunbookStepType> = [
+  RunbookStepType.ResourceCommand,
+];
+
+export function isAiAgentExecutedStepType(type: RunbookStepType): boolean {
+  return AI_AGENT_EXECUTED_STEP_TYPES.includes(type);
+}

package/Types/Team/ComplianceNotificationChannel.ts

@@ -1,7 +1,8 @@
 /*
- * The notification channel an on-call compliance rule can insist on
- * (TeamComplianceSetting.notificationChannel). NULL on a setting means "any
- * channel". The string values are stored, so they must never be renamed.
+ * A notification channel an on-call compliance rule can insist on
+ * (TeamComplianceSetting.notificationChannels, every one of which a member
+ * must be notified on). No channels on a setting means "any channel". The
+ * string values are stored, so they must never be renamed.
  *
  * Every channel a UserNotificationRule can point at is here, because a
  * compliance rule that could only ask about four of the nine would report a

package/Types/Team/ComplianceRule.ts

@@ -18,7 +18,7 @@ export enum ComplianceRuleCategory {
   NotificationMethod = "NotificationMethod",
   /*
    * The member has on-call notification rules for a set of severities,
-   * optionally on one specific channel.
+   * optionally on specific channels - on every one of them.
    */
   OnCallRule = "OnCallRule",
 }
@@ -176,7 +176,7 @@ export const COMPLIANCE_RULE_DEFINITIONS: ReadonlyArray<ComplianceRuleDefinition
       subject: "incident",
       title: "Incident on-call rules",
       description:
-        "Members are notified when an incident on-call policy pages them - for the severities and channel you choose.",
+        "Members are notified when an incident on-call policy pages them - for the severities and channels you choose.",
     }),
     onCallRule({
       ruleType: ComplianceRuleType.HasAlertOnCallRules,
@@ -185,7 +185,7 @@ export const COMPLIANCE_RULE_DEFINITIONS: ReadonlyArray<ComplianceRuleDefinition
       subject: "alert",
       title: "Alert on-call rules",
       description:
-        "Members are notified when an alert on-call policy pages them - for the severities and channel you choose.",
+        "Members are notified when an alert on-call policy pages them - for the severities and channels you choose.",
     }),
     onCallRule({
       ruleType: ComplianceRuleType.HasIncidentEpisodeOnCallRules,
@@ -195,7 +195,7 @@ export const COMPLIANCE_RULE_DEFINITIONS: ReadonlyArray<ComplianceRuleDefinition
       subject: "incident episode",
       title: "Incident episode on-call rules",
       description:
-        "Members are notified when an incident episode on-call policy pages them - for the severities and channel you choose.",
+        "Members are notified when an incident episode on-call policy pages them - for the severities and channels you choose.",
     }),
     onCallRule({
       ruleType: ComplianceRuleType.HasAlertEpisodeOnCallRules,
@@ -204,7 +204,7 @@ export const COMPLIANCE_RULE_DEFINITIONS: ReadonlyArray<ComplianceRuleDefinition
       subject: "alert episode",
       title: "Alert episode on-call rules",
       description:
-        "Members are notified when an alert episode on-call policy pages them - for the severities and channel you choose.",
+        "Members are notified when an alert episode on-call policy pages them - for the severities and channels you choose.",
     }),
     methodRule({
       ruleType: ComplianceRuleType.HasNotificationCallMethod,
@@ -313,6 +313,32 @@ export default class ComplianceRule {
     );
   }
 
+  /*
+   * A rule's channels as one canonical list: the known channels in `value`,
+   * each once, in catalog order - so two lists naming the same channels read,
+   * compare and store alike however they were picked. Anything that is not a
+   * list reads as no channels ("any channel"), and so does a list of nothing
+   * this build recognises; the settings service refuses such input on write,
+   * so only rows it did not write can hold it.
+   */
+  public static normaliseChannels(
+    value: unknown,
+  ): Array<ComplianceNotificationChannel> {
+    if (!Array.isArray(value)) {
+      return [];
+    }
+
+    return COMPLIANCE_CHANNEL_DEFINITIONS.map(
+      (
+        definition: ComplianceChannelDefinition,
+      ): ComplianceNotificationChannel => {
+        return definition.channel;
+      },
+    ).filter((channel: ComplianceNotificationChannel): boolean => {
+      return value.includes(channel);
+    });
+  }
+
   public static isOnCallRule(ruleType: string | undefined | null): boolean {
     return (
       ComplianceRule.getDefinition(ruleType)?.category ===
@@ -321,7 +347,7 @@ export default class ComplianceRule {
   }
 
   /*
-   * Only on-call rules take a severity scope and a channel. A method rule
+   * Only on-call rules take a severity scope and channels. A method rule
    * ("has a verified email") has neither, and any that arrive with one are
    * ignored rather than half-applied.
    */
@@ -356,11 +382,12 @@ export default class ComplianceRule {
 
   /*
    * The rule's name as a list row shows it: "Call for incidents",
-   * "Incident on-call rules", "Verified push device".
+   * "Call and Push notification for incidents", "Incident on-call rules",
+   * "Verified push device".
    */
   public static getTitle(data: {
     ruleType: string | undefined | null;
-    notificationChannel?: string | undefined | null;
+    notificationChannels?: Array<string> | undefined | null;
   }): string {
     const definition: ComplianceRuleDefinition | undefined =
       ComplianceRule.getDefinition(data.ruleType);
@@ -369,11 +396,15 @@ export default class ComplianceRule {
       return data.ruleType || "Unknown rule";
     }
 
-    const channel: ComplianceChannelDefinition | undefined =
-      ComplianceRule.getChannelDefinition(data.notificationChannel);
+    const channelLabels: Array<string> = ComplianceRule.getChannelLabels(
+      data.notificationChannels,
+    );
 
-    if (definition.category === ComplianceRuleCategory.OnCallRule && channel) {
-      return `${channel.label} for ${definition.subject}s`;
+    if (
+      definition.category === ComplianceRuleCategory.OnCallRule &&
+      channelLabels.length > 0
+    ) {
+      return `${joinAsProse(channelLabels)} for ${definition.subject}s`;
     }
 
     return definition.title;
@@ -382,14 +413,16 @@ export default class ComplianceRule {
   /*
    * The rule as one sentence about what every member must have, e.g.
    * "Every member has an incident on-call rule that notifies them by Call for
-   * Critical Incident and Major Incident."
+   * Critical Incident and Major Incident." A rule on several channels needs a
+   * rule on each, and says so: "Every member has incident on-call rules that
+   * notify them by Call and by Push notification for Critical Incident."
    *
    * `severityNames` is the rule's scope. Empty means every severity, which is
    * what a rule with no severities selected enforces.
    */
   public static describe(data: {
     ruleType: string | undefined | null;
-    notificationChannel?: string | undefined | null;
+    notificationChannels?: Array<string> | undefined | null;
     severityNames?: Array<string> | undefined;
   }): string {
     const definition: ComplianceRuleDefinition | undefined =
@@ -416,16 +449,36 @@ export default class ComplianceRule {
         ? `every ${definition.subject} severity`
         : joinAsProse(severityNames);
 
-    const channel: ComplianceChannelDefinition | undefined =
-      ComplianceRule.getChannelDefinition(data.notificationChannel);
+    const channelLabels: Array<string> = ComplianceRule.getChannelLabels(
+      data.notificationChannels,
+    );
+
+    if (channelLabels.length > 1) {
+      return `Every member has ${definition.subject || ""} on-call rules that notify them ${joinAsProse(
+        channelLabels.map((label: string): string => {
+          return `by ${label}`;
+        }),
+      )} for ${scope}.`;
+    }
 
-    if (channel) {
-      return `Every member has ${ComplianceRule.withArticle(definition.subject || "")} on-call rule that notifies them by ${channel.label} for ${scope}.`;
+    if (channelLabels.length === 1) {
+      return `Every member has ${ComplianceRule.withArticle(definition.subject || "")} on-call rule that notifies them by ${channelLabels[0]} for ${scope}.`;
     }
 
     return `Every member has ${ComplianceRule.withArticle(definition.subject || "")} on-call rule for ${scope}.`;
   }
 
+  // The labels of the known channels in `channels`, in catalog order.
+  private static getChannelLabels(
+    channels: Array<string> | undefined | null,
+  ): Array<string> {
+    return ComplianceRule.normaliseChannels(channels).map(
+      (channel: ComplianceNotificationChannel): string => {
+        return ComplianceRule.getChannelDefinition(channel)?.label || channel;
+      },
+    );
+  }
+
   private static withArticle(noun: string): string {
     return "aeiou".includes(noun.charAt(0).toLowerCase())
       ? `an ${noun}`

package/Types/Team/ComplianceRuleType.ts

@@ -9,8 +9,8 @@
  *    method on that channel.
  *  - Has<Incident|Alert>[Episode]OnCallRules: the member has an on-call
  *    notification rule for the chosen severities (all of them when none are
- *    chosen), optionally on one specific channel - "call me for Critical
- *    incidents" is HasIncidentOnCallRules + Call + [Critical].
+ *    chosen), optionally on specific channels - one on each - "call me for
+ *    Critical incidents" is HasIncidentOnCallRules + [Call] + [Critical].
  */
 enum ComplianceRuleType {
   HasNotificationEmailMethod = "HasNotificationEmailMethod",

package/Types/Team/TeamComplianceStatus.ts

@@ -23,8 +23,12 @@ export interface TeamComplianceRuleJSON {
   settingId: string;
   ruleType: ComplianceRuleType;
   enabled: boolean;
-  // Null means "any channel" (and is always null for method rules).
-  notificationChannel: ComplianceNotificationChannel | null;
+  /*
+   * The channels an on-call rule insists on - a member needs a rule on each
+   * - in catalog order. Empty means "any channel", and is always empty for
+   * method rules.
+   */
+  notificationChannels: Array<ComplianceNotificationChannel>;
   // Which severity list scopes the rule; null for method rules.
   severityKind: ComplianceSeverityKind | null;
   /*

package/Types/Telemetry/EntityType.ts

@@ -109,6 +109,22 @@ enum EntityType {
    * dependency cron and keyed by engine + namespace.
    */
   DatabaseServer = "database.server",
+  /*
+   * A message QUEUE — a queue, topic, subscription or event hub (a
+   * "destination" in OpenTelemetry messaging terms) — the identity the
+   * Queues product (the MessageQueue table) scopes telemetry by.
+   * OneUptime-defined and MEMBERSHIP-ONLY, like DatabaseServer: ingest
+   * appends its key (`EntityKey.keyForMessageQueue`: `messaging.system` +
+   * the destination, plus the Azure namespace for Service Bus and Event
+   * Hubs) to the `entityKeys` of every messaging span and broker or
+   * messaging-client datapoint that resolves to a destination
+   * (Types/MessageQueue/MessagingTelemetryResolver). No resolver ever emits
+   * it, it is never promoted to an InventoryItem row, and so it has no
+   * prune TTL. Distinct from `RemoteService`, the node a messaging span's
+   * BROKER becomes on the service map (keyed by `messaging.system` +
+   * `server.address`, never by destination).
+   */
+  MessageQueue = "message.queue",
   /*
    * Inventory-mirrored types. Unlike everything above, these are never
    * derived from an OTLP resource — the estate they describe is collected

package/Types/Telemetry/LockedFilterDetail.ts

@@ -13,6 +13,19 @@
  * the reason it cannot. Display-only: nothing here changes the query.
  */
 
+/**
+ * One kind of thing a scope chip matches — "Endpoints" and every endpoint of
+ * a database, say. Telemetry from ANY listed value is in the scope.
+ */
+export interface LockedFilterScopeMatch {
+  /** What the values are, as the tooltip's heading: "Endpoints". */
+  label: string;
+  /** How telemetry reaches the scope through them, in one sentence. */
+  description?: string | undefined;
+  /** Each value's readable name, e.g. "db.prod.internal:5432". */
+  values: Array<string>;
+}
+
 export interface LockedFilterDetail {
   /**
    * Search-bar text that reproduces this filter on the explorer for the same
@@ -22,4 +35,13 @@ export interface LockedFilterDetail {
   searchToken?: string | undefined;
   /** Why `searchToken` is absent, when it is — shown in place of the syntax. */
   searchTokenUnavailableReason?: string | undefined;
+  /**
+   * For ONE chip that stands for several filters at once — a database is its
+   * own id, each of its endpoints and each pod it runs as — what it matches,
+   * by kind. The tooltip lists them so the reader can see exactly what the
+   * page filters on without a chip per filter.
+   */
+  scopeMatches?: Array<LockedFilterScopeMatch> | undefined;
+  /** The tooltip's opening line above `scopeMatches`. */
+  scopeSummary?: string | undefined;
 }

package/Types/Telemetry/TelemetryIngestSurface.ts

@@ -41,11 +41,20 @@ enum TelemetryIngestSurface {
    * with. Server keys only, for the same reason as the Runner above.
    */
   KubernetesAiAgent = "kubernetes-ai-agent",
+  /*
+   * A resource AI agent (Docker, Podman, Docker Swarm, Proxmox, VMware,
+   * Ceph, a database server or a host) registers itself with the same
+   * project ingestion key its collector uses, and receives an agent key
+   * that every command for its resource is claimed with. Server keys only,
+   * for the same reason as the two above.
+   */
+  ResourceAiAgent = "resource-ai-agent",
 }
 
 /*
- * Surfaces that mint an IDENTITY (a key that kubectl jobs for a cluster are
- * targeted at) rather than accept telemetry. The ingest middleware holds
+ * Surfaces that mint an IDENTITY (a key that kubectl jobs for a cluster, or
+ * commands for another infrastructure resource, are targeted at) rather
+ * than accept telemetry. The ingest middleware holds
  * every one of them to the same two extra rules, keyed on this set so a new
  * identity surface cannot quietly miss one:
  *
@@ -60,6 +69,7 @@ export const IDENTITY_REGISTRATION_SURFACES: ReadonlySet<TelemetryIngestSurface>
   new Set<TelemetryIngestSurface>([
     TelemetryIngestSurface.KubernetesAgentRunner,
     TelemetryIngestSurface.KubernetesAiAgent,
+    TelemetryIngestSurface.ResourceAiAgent,
   ]);
 
 /*
@@ -109,6 +119,8 @@ const INGEST_SURFACE_READABLE_NAMES: Record<TelemetryIngestSurface, string> = {
     "Kubernetes agent Runner registration",
   [TelemetryIngestSurface.KubernetesAiAgent]:
     "Kubernetes AI agent registration",
+  [TelemetryIngestSurface.ResourceAiAgent]:
+    "infrastructure AI agent registration",
 };
 
 type GetIngestSurfaceReadableNameFunction = (

package/Types/XML.ts

@@ -1,6 +1,32 @@
 import BadDataException from "./Exception/BadDataException";
 
+/*
+ * Everything XML 1.0 cannot carry, escaped or not: the C0 controls other
+ * than tab, newline and carriage return, lone surrogates, U+FFFE and U+FFFF.
+ */
+const INVALID_XML_CHARACTERS: RegExp =
+  /[^\t\n\r\u0020-\uD7FF\uE000-\uFFFD\u{10000}-\u{10FFFF}]/gu;
+
 export default class XML {
+  /*
+   * Plain text, made safe to write between two tags or inside a quoted
+   * attribute value, so that a parser reads back exactly what was written.
+   *
+   * The ampersand goes first, so the entities the other four become are not
+   * escaped a second time. Characters XML cannot carry at all are dropped:
+   * no escape makes them legal, and a single one makes a parser reject the
+   * whole document.
+   */
+  public static escape(text: string): string {
+    return String(text)
+      .replace(INVALID_XML_CHARACTERS, "")
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&apos;");
+  }
+
   private _xml: string = "";
   public get xml(): string {
     return this._xml;