zabbix_manager 5.1.5 → 6.0.0

data/lib/zabbix_manager/monitoring/expressions.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+class ZabbixManager
+  class Monitoring
+    # 根据 API 版本，将已校验的主机、监控项键和数值转换为触发器表达式。
+    # @api private
+    class Expressions
+      attr_reader :version
+
+      def initialize(client, host)
+        version = client.api_version.to_s
+        unless version.match?(/\A\d+\.\d+(?:\.\d+)?\z/)
+          raise Invalid, "Zabbix API version must be a numeric release version"
+        end
+
+        @host = host
+        @version = Gem::Version.new(version)
+        @modern = @version >= Gem::Version.new("5.4")
+      end
+
+      # 只接受上层已校验的函数、运算符、窗口和主机；这里再次校验嵌入表达式的 item key。
+      # last 不带窗口；其他函数按 5.4 前后语法生成，数值不使用科学计数法。
+      # @return [String] 一个可组合的比较表达式
+      def compare(key, function, window, operator, value)
+        Validation.item_key!(key)
+        call = if @modern
+                 source = "/#{@host}/#{key}"
+                 function == "last" ? "last(#{source})" : "#{function}(#{source},#{window})"
+               else
+                 "{#{@host}:#{key}.#{function}(#{function == 'last' ? '' : window})}"
+               end
+        "#{call}#{operator}#{Validation.format_number(value)}"
+      end
+    end
+  end
+end

data/lib/zabbix_manager/monitoring/line.rb

@@ -0,0 +1,175 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+class ZabbixManager
+  class Monitoring
+    # 线路清单使用一套明确字段；外部文件列名应由导入方转换。
+    # @api private
+    class Line
+      FIELDS = %i[line_id host host_candidates interface_name capacity_mbps high_water recovery_water
+                  problem_window recovery_window severity device isp description low_traffic status speed
+                  reachability_target tags comments event_name opdata].freeze
+      METADATA_FIELDS = %i[comments event_name opdata].freeze
+      attr_reader :host_reference, :interface_name, :threshold, :low_traffic, :status, :speed,
+                  :reachability_target, :metadata
+
+      # 仅解析本地定义，不访问服务器；status/speed 为开关或显式 itemid 选择器。
+      # @param attributes [Hash] 规范化后的单端点清单字段
+      # @raise [Invalid] 字段、阈值或目标格式不合法
+      def initialize(attributes)
+        @attributes = Validation.hash!(attributes, "line")
+        @attributes.assert_valid_keys(*FIELDS)
+        @interface_name = Validation.text!(@attributes[:interface_name], "line interface_name")
+        validate_identity!
+        @host_reference = build_host_reference
+        @threshold = build_threshold
+        Thresholds.validate_config!(:bandwidth, @threshold)
+        @low_traffic = build_low_traffic if @attributes.key?(:low_traffic)
+        @status = item_selection(:status)
+        @speed = item_selection(:speed)
+        @reachability_target = build_reachability_target if @attributes.key?(:reachability_target)
+        @metadata = @attributes.slice(*METADATA_FIELDS)
+        @metadata.each do |key, value|
+          raise Invalid, "line #{key} must be a string" unless value.is_a?(String)
+        end
+      rescue ArgumentError => error
+        raise Invalid, error.message
+      end
+
+      def identity
+        @attributes[:line_id].presence ||
+          [host_identity, TrafficItems.interface_identity(interface_name)]
+      end
+
+      def interface(hostid:)
+        { name: interface_name, line_id: resolved_id(hostid) }
+      end
+
+      # 显式 line_id 优先；缺省身份由已解析 hostid 和规范接口名组成。
+      # @return [String] 用于受管标签的端点身份
+      def resolved_id(hostid)
+        @attributes[:line_id].presence || "#{hostid}:#{TrafficItems.interface_identity(interface_name)}"
+      end
+
+      def safe_identity
+        @attributes.slice(:line_id, :device).merge(interface: interface_name).compact
+      end
+
+      private
+
+      def host_identity
+        host_reference.is_a?(Hash) ? host_reference[:hostid].to_s : host_reference.sort
+      end
+
+      def validate_identity!
+        line_id = @attributes[:line_id]
+        unless line_id.nil? || line_id.is_a?(String) || line_id.is_a?(Integer)
+          raise Invalid, "line_id must be a string or integer"
+        end
+
+        @attributes[:line_id] = line_id.to_s if line_id
+        %i[device isp description].each do |name|
+          next unless @attributes.key?(name)
+
+          Validation.text!(@attributes[name], "line #{name}")
+        end
+      end
+
+      def build_host_reference
+        if @attributes.key?(:host) && @attributes.key?(:host_candidates)
+          raise Invalid, "line must supply either host or host_candidates"
+        end
+
+        host = @attributes[:host]
+        if host.is_a?(Hash)
+          Validation.host!(host)
+          return host.slice(:hostid, :host)
+        end
+
+        candidates = @attributes.key?(:host_candidates) ?
+          Validation.array!(@attributes[:host_candidates], "host_candidates") : [host]
+        candidates = candidates.map { |value| Validation.text!(value, "line host candidate").strip }.uniq
+        raise Invalid, "line host candidate is required" if candidates.empty?
+
+        candidates
+      end
+
+      def build_threshold
+        capacity = Validation.number!(@attributes[:capacity_mbps], "line capacity_mbps")
+        raise Invalid, "line capacity_mbps must be positive" unless capacity.positive?
+
+        high = water_ratio(@attributes.fetch(:high_water, 0.9), "high_water")
+        recovery = water_ratio(@attributes.fetch(:recovery_water, 0.8), "recovery_water")
+        raise Invalid, "recovery_water must be lower than high_water" unless recovery < high
+
+        {
+          capacity_bps: capacity * 1_000_000,
+          high_percent: high * 100, recovery_percent: recovery * 100,
+          window: @attributes.fetch(:problem_window, Thresholds::DEFAULT_WINDOW),
+          recovery_window: @attributes.fetch(:recovery_window, "15m"),
+          priority: @attributes.fetch(:severity, Thresholds::DEFAULT_PRIORITY),
+          description: ["专线流量超阈值", @attributes[:isp], @attributes[:description],
+                        @attributes[:device], interface_name].compact.join(" | "),
+          tags: line_tags
+        }
+      end
+
+      def line_tags
+        extra = Validation.array!(@attributes.fetch(:tags, []), "line tags").map do |tag|
+          tag = Validation.hash!(tag, "line tag")
+          tag.assert_valid_keys(:tag, :value)
+          Validation.text!(tag[:tag], "line tag name")
+          if (Thresholds::MANAGED_TAGS + ["line_id"]).include?(tag[:tag])
+            raise Invalid, "line tag #{tag[:tag]} is reserved"
+          end
+          raise Invalid, "line tag value must be a string" unless tag.fetch(:value, "").is_a?(String)
+
+          { tag: tag[:tag], value: tag.fetch(:value, "") }
+        end
+        [{ tag: "category", value: "line_bandwidth" }] +
+          @attributes.slice(:isp, :description, :device).map { |name, value| { tag: name.to_s, value: value } } + extra
+      end
+
+      def build_low_traffic
+        config = Validation.hash!(@attributes[:low_traffic], "low_traffic")
+        config.assert_valid_keys(:below_bps, :recovery_bps, :window, :recovery_window)
+        below = Validation.number!(config.fetch(:below_bps, 50), "low_traffic below_bps")
+        recovery = Validation.number!(config.fetch(:recovery_bps, 1000), "low_traffic recovery_bps")
+        unless below.positive? && recovery > below
+          raise Invalid, "low_traffic recovery_bps must be greater than positive below_bps"
+        end
+
+        window = Validation.window!(config.fetch(:window, "5m"))
+        { below_bps: below, recovery_bps: recovery, window: window,
+          recovery_window: Validation.window!(config.fetch(:recovery_window, window)) }
+      end
+
+      def item_selection(name)
+        value = @attributes.fetch(name, false)
+        return value if value == true || value == false
+
+        selection = Validation.hash!(value, name.to_s)
+        selection.assert_valid_keys(:itemid)
+        Validation.positive_id!(selection[:itemid], "#{name} itemid")
+        selection
+      end
+
+      def build_reachability_target
+        value = Validation.text!(@attributes[:reachability_target], "reachability_target")
+        raise Invalid, "reachability_target must be an IP address without a prefix" if value.include?("/")
+
+        IPAddr.new(value).to_s
+      rescue IPAddr::InvalidAddressError
+        raise Invalid, "reachability_target must be an IPv4 or IPv6 address"
+      end
+
+      def water_ratio(value, name)
+        ratio = Validation.number!(value, name)
+        raise Invalid, "#{name} must be greater than 0 and at most 1" unless ratio.positive? && ratio <= 1
+
+        ratio
+      end
+    end
+  end
+end

data/lib/zabbix_manager/monitoring/line_items.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+class ZabbixManager
+  class Monitoring
+    # 解析端点的数值监控项，并复用主机已有的共享 ICMP 检查。
+    # 不重命名、启用、删除或接管已有 ICMP 监控项。
+    # @api private
+    class LineItems
+      PATTERNS = {
+        speed: /net\.if\.speed|ifhighspeed|interface speed|接口速率|1\.3\.6\.1\.2\.1\.31\.1\.1\.1\.15\./i,
+        status: /net\.if\.(?:status|oper)|ifoperstatus|operational status|接口状态|1\.3\.6\.1\.2\.1\.2\.2\.1\.8\./i
+      }.freeze
+
+      def initialize(items)
+        @items = items
+      end
+
+      # 两个流量方向必须唯一、不同且属于目标主机；附加指标只在选择器启用时解析。
+      # @return [Hash{Symbol => Hash}] 流量及可选状态/速率监控项
+      # @raise [Invalid, Conflict, ProtocolError] 量纲、身份、归属或响应结构无法确认
+      def resolve(line, candidates, hostid:)
+        unless candidates.is_a?(Array) && candidates.all? { |item| item.is_a?(Hash) }
+          raise ProtocolError, "item.get must return an array of item objects"
+        end
+
+        selected = TrafficItems.new(candidates).for_interface(line.interface_name)
+        %i[status speed].each do |kind|
+          selector = line.public_send(kind)
+          next unless selector
+
+          matches = candidates.select do |item|
+            if selector.is_a?(Hash)
+              item["itemid"].to_s == selector[:itemid].to_s
+            else
+              TrafficItems.interface_matches?(item, line.interface_name) &&
+                [item["key_"], item["name"], item["snmp_oid"]].join(" ").match?(PATTERNS.fetch(kind))
+            end
+          end
+          raise Conflict,
+                "expected one #{kind} item for #{line.interface_name}, found #{matches.length}" unless matches.one?
+
+          selected[kind] = matches.first.deep_symbolize_keys
+        end
+        selected.each do |kind, item|
+          validate_numeric!(item, kind)
+          raise ProtocolError, "#{kind} item belongs to another host" unless item[:hostid].to_s == hostid.to_s
+        end
+        unless selected.values.map { |item| item[:itemid].to_s }.uniq.length == selected.length
+          raise Conflict, "line metrics must refer to distinct items"
+        end
+
+        selected
+      end
+
+      # 查询稳定 ICMP key 并生成候选属性；缺失对象在执行阶段才创建。
+      # @return [Hash] attributes 及已有 itemid（不存在时为 nil）
+      def icmp_plan(hostid, target)
+        attributes = {
+          hostid: hostid, name: "ICMP #{target}", key_: "icmpping[#{target}]", type: 3,
+          value_type: 3, delay: "1m", history: "30d", trends: "365d", status: 0
+        }
+        current = find_icmp(attributes)
+        { attributes: attributes, itemid: current&.fetch(:itemid) }
+      end
+
+      # 在调用方工作流互斥锁内再次查询，不覆盖已有共享监控项。
+      def ensure_icmp(plan)
+        current = find_icmp(plan.fetch(:attributes))
+        return current.fetch(:itemid).to_i if current
+
+        @items.create(plan.fetch(:attributes))
+      end
+
+      private
+
+      def find_icmp(attributes)
+        matches = @items.for_host(attributes[:hostid], keys: attributes[:key_])
+        unless matches.is_a?(Array) && matches.all? { |item| item.is_a?(Hash) }
+          raise ProtocolError, "item.get must return an array of item objects"
+        end
+        raise Conflict, "multiple items use ICMP key #{attributes[:key_]}" if matches.length > 1
+        return if matches.empty?
+
+        item = matches.first.deep_symbolize_keys
+        unless item[:hostid].to_s == attributes[:hostid].to_s && item[:key_] == attributes[:key_]
+          raise ProtocolError, "item.get returned an ICMP item outside the requested host and key"
+        end
+
+        validate_numeric!(item, :reachability)
+        unless item[:type].to_s == "3" && item[:value_type].to_s == "3"
+          raise Conflict, "existing ICMP item must be an unsigned simple check"
+        end
+
+        item
+      end
+
+      def validate_numeric!(item, kind)
+        Validation.positive_id!(item[:itemid], "#{kind} itemid")
+        Validation.item_key!(item[:key_])
+        unless %w[0 3].include?(item[:value_type].to_s)
+          raise Invalid, "#{kind} item must have a numeric value_type"
+        end
+        raise Conflict, "#{kind} item must be enabled" unless item[:status].to_s == "0"
+        return unless kind == :status && item[:value_type].to_s != "3"
+
+        raise Invalid, "status item must use unsigned integer values with 1 meaning up"
+      end
+    end
+  end
+end

data/lib/zabbix_manager/monitoring/line_lifecycle.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+class ZabbixManager
+  class Monitoring
+    # 通过原生 API 核对端点触发器归属、停用旧检查并读取问题。
+    # 不保存持久状态；以已确认的标签和 ID 界定管理范围。
+    # @api private
+    class LineLifecycle
+      KINDS = %i[interface_status bandwidth low_traffic reachability].freeze
+
+      def initialize(manager, hostid, line_id)
+        Validation.positive_id!(hostid, "hostid")
+        unless line_id.is_a?(String) || line_id.is_a?(Integer)
+          raise Invalid, "line_id must be a string or integer"
+        end
+
+        @line_id = Validation.text!(line_id.to_s, "line_id")
+        @prefix = "interface:#{@line_id}:"
+        @keys = KINDS.map { |kind| "#{@prefix}#{kind}" }
+        if @keys.any? { |key| key.length > Triggers::MAX_MANAGED_KEY_LENGTH }
+          raise Invalid, "managed_key is too long"
+        end
+
+        @manager, @hostid = manager, hostid
+      end
+
+      # 服务端前缀过滤后，再以完整受管键筛选并拒绝重复身份。
+      # @return [Array<Hash>] 该端点已知类型的原生触发器；所有者由 owned 继续筛选
+      def inventory
+        records = @manager.client.api_request(
+          method: "trigger.get",
+          params: {
+            hostids: @hostid, tags: [{ tag: "zabbix_manager_id", value: @prefix, operator: 0 }],
+            output: "extend", selectTags: "extend", selectItems: ["itemid", "name"], expandExpression: true
+          }
+        )
+        unless records.is_a?(Array) && records.all? { |record| record.is_a?(Hash) }
+          raise ProtocolError, "trigger.get must return an array of trigger objects"
+        end
+
+        records.each do |record|
+          tags = record["tags"]
+          valid_tags = tags.is_a?(Array) && tags.all? do |tag|
+            tag.is_a?(Hash) && tag["tag"].is_a?(String) && tag["value"].is_a?(String)
+          end
+          raise ProtocolError, "trigger.get must include valid tags for ownership verification" unless valid_tags
+        end
+        selected = records.select { |record| managed_key(record) }
+        selected.each { |record| validate_receipt!(record) }
+        ids = selected.map { |record| record["triggerid"].to_s }
+        raise ProtocolError, "trigger.get returned duplicate trigger IDs" unless ids.uniq == ids
+
+        identities = selected.map { |record| managed_key(record) }
+        raise Conflict, "multiple triggers use the same line managed key" unless identities.uniq == identities
+
+        selected
+      end
+
+      # 兼容缺少 line_id 的既有受管标签，但拒绝其他管理方或矛盾的端点标签。
+      # @return [Array<Hash>] 当前库拥有的触发器
+      def owned(records = inventory)
+        records.select do |record|
+          owner = tag_values(record, "managed_by")
+          ids = tag_values(record, "line_id")
+          owner == ["zabbix_manager"] && (ids.empty? || ids == [@line_id])
+        end
+      end
+
+      def validate_ownership!(records, desired_keys)
+        foreign = records - owned(records)
+        if foreign.any? { |record| desired_keys.include?(managed_key(record)) }
+          raise Conflict, "line managed key belongs to another owner"
+        end
+      end
+
+      def disable(records = owned)
+        return [] if records.empty?
+
+        @manager.triggers.set_status(hostid: @hostid, triggerids: records.map { |record| record.fetch("triggerid") },
+                                     enabled: false)
+      end
+
+      # 仅停用本轮期望之外的受管类型；调用方必须先确认所有期望触发器写入成功。
+      # @return [Array<Integer>] 已确认停用的 ID；不删除对象
+      def retire(records, desired_keys)
+        disable(owned(records).reject { |record| desired_keys.include?(managed_key(record)) })
+      end
+
+      def problems(time_from:, time_till:, limit:)
+        from = timestamp(time_from, "time_from")
+        till = timestamp(time_till, "time_till")
+        raise Invalid, "time_from must not be after time_till" if from > till
+        unless limit.is_a?(Integer) && limit.between?(1, 1000)
+          raise Invalid, "limit must be an integer between 1 and 1000"
+        end
+
+        ids = owned.map { |record| record.fetch("triggerid").to_s }
+        records = if ids.empty?
+                    []
+                  else
+                    @manager.client.api_request(
+                      method: "problem.get",
+                      params: {
+                        hostids: @hostid, objectids: ids, source: 0, object: 0, recent: true,
+                        time_from: from, time_till: till, output: "extend", selectTags: "extend",
+                        sortfield: "eventid", sortorder: "DESC", limit: limit + 1
+                      }
+                    )
+                  end
+        unless records.is_a?(Array) && records.all? { |record| record.is_a?(Hash) }
+          raise ProtocolError, "problem.get must return an array of problem objects"
+        end
+        unless records.all? { |record| ids.include?(record["objectid"].to_s) }
+          raise ProtocolError, "problem.get returned a trigger outside the requested line"
+        end
+        raise ProtocolError, "problem.get exceeded the requested limit" if records.length > limit + 1
+
+        validate_problems!(records, from, till)
+
+        { problems: records.first(limit), truncated: records.length > limit, time_from: from, time_till: till,
+          limit: limit }
+      end
+
+      private
+
+      def tag_values(record, name)
+        Array(record["tags"]).filter_map do |tag|
+          tag["value"] if tag.is_a?(Hash) && tag["tag"] == name
+        end.uniq
+      end
+
+      def managed_key(record)
+        values = tag_values(record, "zabbix_manager_id")
+        matches = values & @keys
+        raise Conflict, "trigger has multiple line managed keys" if matches.any? && values.length > 1
+
+        matches.first
+      end
+
+      def validate_receipt!(record)
+        Validation.positive_id!(record["triggerid"], "triggerid")
+      rescue Invalid => error
+        raise ProtocolError, error.message
+      end
+
+      def timestamp(value, name)
+        value = value.to_i if value.is_a?(Time)
+        raise Invalid, "#{name} must be a non-negative Integer or Time" unless value.is_a?(Integer) && value >= 0
+
+        value
+      end
+
+      def validate_problems!(records, from, till)
+        records.each do |record|
+          Validation.positive_id!(record["eventid"], "eventid")
+          clock = record["clock"]
+          unless (clock.is_a?(Integer) || clock.is_a?(String)) && clock.to_s.match?(/\A\d+\z/) &&
+                 clock.to_i.between?(from, till)
+            raise ProtocolError, "problem.get returned an invalid or out-of-range clock"
+          end
+        end
+        ids = records.map { |record| record["eventid"].to_s }
+        raise ProtocolError, "problem.get returned duplicate event IDs" unless ids.uniq == ids
+      rescue Invalid => error
+        raise ProtocolError, error.message
+      end
+    end
+  end
+end

data/lib/zabbix_manager/monitoring/line_plan.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+class ZabbixManager
+  class Monitoring
+    # 统一生成触发器属性，供预览和实际执行复用。
+    # 状态触发器 ID 确认之前，依赖以指标类型名称表示。
+    # @api private
+    class LinePlan
+      def initialize(client, line, host, items, icmp_item)
+        @client, @line, @host, @items, @icmp_item = client, line, host, items, icmp_item
+        @expressions = Expressions.new(client, host[:host])
+        @line_id = line.resolved_id(host[:hostid])
+        validate_metadata_version!
+      end
+
+      # 纯本地构造计划，不写远端；依赖保留为指标名称，执行时转换为已确认 triggerid。
+      # @return [Hash] 端点身份、监控项 ID、触发器属性及依赖计划
+      def to_h
+        triggers = {}
+        triggers[:interface_status] = status_trigger if @items[:status]
+        triggers[:bandwidth] = bandwidth_trigger
+        triggers[:low_traffic] = low_trigger if @line.low_traffic
+        triggers[:reachability] = reachability_trigger if @icmp_item
+        dependencies = triggers.keys.to_h do |kind|
+          [kind, @items[:status] && kind != :interface_status ? [:interface_status] : []]
+        end
+        itemids = @items.transform_values { |item| item.fetch(:itemid).to_i }
+        itemids[:reachability] = @icmp_item[:itemid].to_i if @icmp_item&.dig(:itemid)
+        {
+          hostid: @host[:hostid].to_i, host: @host[:host], interface: @line.interface_name, line_id: @line_id,
+          itemids: itemids, triggers: triggers, dependencies: dependencies, icmp_item: @icmp_item
+        }
+      end
+
+      private
+
+      def validate_metadata_version!
+        { opdata: "4.4", event_name: "5.2" }.each do |field, minimum|
+          next unless @line.metadata.key?(field) && @expressions.version < Gem::Version.new(minimum)
+
+          raise Invalid, "#{field} requires Zabbix #{minimum} or newer"
+        end
+      end
+
+      def bandwidth_trigger
+        attributes = Thresholds.new(@client).prepare_triggers(
+          host: @host, interface: @line.interface(hostid: @host[:hostid]),
+          items: { inbound_bps: @items[:inbound], outbound_bps: @items[:outbound] },
+          thresholds: { bandwidth: @line.threshold }
+        ).fetch(:bandwidth)
+        attributes[:expression] = guarded(attributes[:expression])
+        attributes[:recovery_expression] = guarded(attributes[:recovery_expression])
+        decorate(attributes)
+      end
+
+      def low_trigger
+        config = @line.low_traffic
+        problem = traffic_expression(config[:window], "<", config[:below_bps], "and")
+        recovery = traffic_expression(config[:recovery_window], ">=", config[:recovery_bps], "or")
+        trigger(:low_traffic, guarded(problem), guarded(recovery), "low traffic")
+      end
+
+      def status_trigger
+        key = @items.fetch(:status).fetch(:key_)
+        trigger(:interface_status, compare(key, "last", nil, "<>", 1),
+                compare(key, "last", nil, "=", 1), "interface down")
+      end
+
+      def reachability_trigger
+        key = @icmp_item.fetch(:attributes).fetch(:key_)
+        trigger(:reachability, compare(key, "max", "5m", "=", 0),
+                compare(key, "min", "2m", "=", 1), "ICMP unreachable")
+      end
+
+      def trigger(kind, problem, recovery, label)
+        key = "interface:#{@line_id}:#{kind}"
+        raise Invalid, "managed_key is too long" if key.length > Triggers::MAX_MANAGED_KEY_LENGTH
+
+        decorate(
+          hostid: @host[:hostid], managed_key: key,
+          description: "#{@line.interface_name} #{label}", expression: problem,
+          recovery_mode: 1, recovery_expression: recovery, priority: @line.threshold[:priority], manual_close: 1,
+          tags: [
+            { tag: "managed_by", value: "zabbix_manager" }, { tag: "interface", value: @line.interface_name },
+            { tag: "metric", value: kind.to_s }
+          ] + @line.threshold[:tags]
+        )
+      end
+
+      def decorate(attributes)
+        attributes.merge(@line.metadata).merge(
+          status: 0, tags: (attributes[:tags] + [{ tag: "line_id", value: @line_id }]).uniq
+        )
+      end
+
+      def guarded(expression)
+        return expression unless @items[:speed]
+
+        "(#{expression}) and #{compare(@items[:speed][:key_], 'last', nil, '>', 0)}"
+      end
+
+      def traffic_expression(window, operator, value, joiner)
+        %i[inbound outbound].map do |direction|
+          compare(@items.fetch(direction).fetch(:key_), "avg", window, operator, value)
+        end.join(" #{joiner} ")
+      end
+
+      def compare(...)
+        @expressions.compare(...)
+      end
+    end
+  end
+end