@oneuptime/common 11.6.0 → 11.6.2

package/Tests/Types/Log/LogQueryParser.test.ts

@@ -0,0 +1,186 @@
+import parseLogQuery, {
+  FilterOperator,
+  ParsedToken,
+  TokenType,
+  tokensToDisplayString,
+} from "../../../Types/Log/LogQueryParser";
+
+describe("LogQueryParser", () => {
+  describe("parseLogQuery - empty and free text", () => {
+    test("returns an empty array for empty / whitespace input", () => {
+      expect(parseLogQuery("")).toEqual([]);
+      expect(parseLogQuery("   ")).toEqual([]);
+    });
+
+    test("combines free text words into a single Contains token", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery("connection refused");
+      expect(tokens).toHaveLength(1);
+      expect(tokens[0]).toMatchObject({
+        type: TokenType.FreeText,
+        operator: FilterOperator.Contains,
+        value: "connection refused",
+        negated: false,
+      });
+    });
+
+    test("strips quotes from a quoted phrase", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery('"connection refused"');
+      expect(tokens).toHaveLength(1);
+      expect(tokens[0]!.value).toBe("connection refused");
+      expect(tokens[0]!.type).toBe(TokenType.FreeText);
+    });
+  });
+
+  describe("parseLogQuery - field filters and aliases", () => {
+    test("resolves the severity alias to severityText", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery("severity:error");
+      expect(tokens[0]).toMatchObject({
+        type: TokenType.FieldFilter,
+        field: "severityText",
+        operator: FilterOperator.Equals,
+        value: "error",
+        negated: false,
+      });
+    });
+
+    test("resolves the service alias to primaryEntityId", () => {
+      expect(parseLogQuery("service:api")[0]!.field).toBe("primaryEntityId");
+    });
+
+    test("resolves level, message, and trace aliases", () => {
+      expect(parseLogQuery("level:warn")[0]!.field).toBe("severityText");
+      expect(parseLogQuery("message:hello")[0]!.field).toBe("body");
+      expect(parseLogQuery("trace:abc")[0]!.field).toBe("traceId");
+    });
+
+    test("keeps unknown field names as-is", () => {
+      expect(parseLogQuery("customfield:x")[0]!.field).toBe("customfield");
+    });
+  });
+
+  describe("parseLogQuery - attribute filters", () => {
+    test("parses @-prefixed attribute access", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery("@http.status_code:500");
+      expect(tokens[0]).toMatchObject({
+        type: TokenType.AttributeFilter,
+        field: "http.status_code",
+        operator: FilterOperator.Equals,
+        value: "500",
+      });
+    });
+
+    test("does not run aliasing on attribute field names", () => {
+      // "service" is an alias for field filters but must stay literal as an attribute.
+      expect(parseLogQuery("@service:api")[0]!.field).toBe("service");
+    });
+  });
+
+  describe("parseLogQuery - negation", () => {
+    test("negated equals becomes NotEquals", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery("-severity:debug");
+      expect(tokens[0]).toMatchObject({
+        field: "severityText",
+        operator: FilterOperator.NotEquals,
+        value: "debug",
+        negated: true,
+      });
+    });
+
+    test("negated attribute filter", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery("-@http.method:GET");
+      expect(tokens[0]).toMatchObject({
+        type: TokenType.AttributeFilter,
+        field: "http.method",
+        operator: FilterOperator.NotEquals,
+        negated: true,
+      });
+    });
+  });
+
+  describe("parseLogQuery - operators", () => {
+    test("detects wildcard values", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery("service:api-*");
+      expect(tokens[0]).toMatchObject({
+        operator: FilterOperator.Wildcard,
+        value: "api-*",
+      });
+    });
+
+    test("detects numeric comparison operators", () => {
+      expect(parseLogQuery("@duration:>1000")[0]).toMatchObject({
+        operator: FilterOperator.GreaterThan,
+        value: "1000",
+      });
+      expect(parseLogQuery("@duration:>=1000")[0]).toMatchObject({
+        operator: FilterOperator.GreaterThanOrEqual,
+        value: "1000",
+      });
+      expect(parseLogQuery("@duration:<50")[0]).toMatchObject({
+        operator: FilterOperator.LessThan,
+        value: "50",
+      });
+      expect(parseLogQuery("@duration:<=50")[0]).toMatchObject({
+        operator: FilterOperator.LessThanOrEqual,
+        value: "50",
+      });
+    });
+  });
+
+  describe("parseLogQuery - boolean keywords and mixed queries", () => {
+    test("skips bare AND/OR/NOT keywords", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery(
+        "severity:error AND service:api",
+      );
+      expect(tokens).toHaveLength(2);
+      expect(tokens[0]!.field).toBe("severityText");
+      expect(tokens[1]!.field).toBe("primaryEntityId");
+    });
+
+    test("splits free text around a field filter", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery(
+        "connection severity:error refused",
+      );
+      expect(tokens).toHaveLength(3);
+      expect(tokens[0]).toMatchObject({
+        type: TokenType.FreeText,
+        value: "connection",
+      });
+      expect(tokens[1]).toMatchObject({
+        type: TokenType.FieldFilter,
+        field: "severityText",
+      });
+      expect(tokens[2]).toMatchObject({
+        type: TokenType.FreeText,
+        value: "refused",
+      });
+    });
+
+    test("does not split a quoted phrase containing spaces", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery(
+        '"connection refused" severity:error',
+      );
+      expect(tokens).toHaveLength(2);
+      expect(tokens[0]!.value).toBe("connection refused");
+      expect(tokens[1]!.field).toBe("severityText");
+    });
+
+    test("strips quotes from field values", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery('message:"a b c"');
+      expect(tokens[0]!.value).toBe("a b c");
+      expect(tokens[0]!.field).toBe("body");
+    });
+  });
+
+  describe("tokensToDisplayString", () => {
+    test("rejoins tokens using their raw representation", () => {
+      const tokens: Array<ParsedToken> = parseLogQuery(
+        "severity:error service:api",
+      );
+      expect(tokensToDisplayString(tokens)).toBe("severity:error service:api");
+    });
+
+    test("returns an empty string for no tokens", () => {
+      expect(tokensToDisplayString([])).toBe("");
+    });
+  });
+});

package/Tests/Types/Log/LogQueryToFilter.test.ts

@@ -0,0 +1,111 @@
+import GreaterThan from "../../../Types/BaseDatabase/GreaterThan";
+import GreaterThanOrEqual from "../../../Types/BaseDatabase/GreaterThanOrEqual";
+import LessThan from "../../../Types/BaseDatabase/LessThan";
+import NotEqual from "../../../Types/BaseDatabase/NotEqual";
+import Search from "../../../Types/BaseDatabase/Search";
+import {
+  LogFilter,
+  queryStringToFilter,
+} from "../../../Types/Log/LogQueryToFilter";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * queryStringToFilter turns the log search bar's query string into a
+ * Query<Log>-shaped filter. It sits on top of the (separately tested)
+ * LogQueryParser, so these tests focus on the mapping layer: operator ->
+ * BaseDatabase value type, top-level vs @attribute routing, severity casing
+ * normalization, and free-text accumulation into body Search.
+ */
+
+describe("queryStringToFilter - free text", () => {
+  test("empty query yields an empty filter", () => {
+    expect(queryStringToFilter("")).toEqual({});
+  });
+
+  test("bare words become a body Search", () => {
+    const filter: LogFilter = queryStringToFilter("connection refused");
+    expect(filter.body).toBeInstanceOf(Search);
+    expect((filter.body as Search<string>).toString()).toBe(
+      "connection refused",
+    );
+  });
+});
+
+describe("queryStringToFilter - top-level fields", () => {
+  test("severity:error normalizes to title-case Error as an equals match", () => {
+    const filter: LogFilter = queryStringToFilter("severity:error");
+    expect(filter.severityText).toBe("Error");
+  });
+
+  test("level:warn aliases to severityText and normalizes warn -> Warning", () => {
+    const filter: LogFilter = queryStringToFilter("level:warn");
+    expect(filter.severityText).toBe("Warning");
+  });
+
+  test("service:api maps to primaryEntityId", () => {
+    const filter: LogFilter = queryStringToFilter("service:api");
+    expect(filter.primaryEntityId).toBe("api");
+  });
+
+  test("negation produces a NotEqual with normalized severity", () => {
+    const filter: LogFilter = queryStringToFilter("-severity:debug");
+    expect(filter.severityText).toBeInstanceOf(NotEqual);
+    expect((filter.severityText as unknown as NotEqual<string>).value).toBe(
+      "Debug",
+    );
+  });
+
+  test("wildcard produces a Search with the asterisks stripped", () => {
+    const filter: LogFilter = queryStringToFilter("service:api-*");
+    expect(filter.primaryEntityId).toBeInstanceOf(Search);
+    expect(
+      (filter.primaryEntityId as unknown as Search<string>).toString(),
+    ).toBe("api-");
+  });
+});
+
+describe("queryStringToFilter - attribute fields", () => {
+  test("@http.status_code:500 lands under attributes as an equals string", () => {
+    const filter: LogFilter = queryStringToFilter("@http.status_code:500");
+    expect(filter.attributes).toEqual({ "http.status_code": "500" });
+  });
+
+  test("numeric comparison operators parse the value as a number", () => {
+    const gt: LogFilter = queryStringToFilter("@duration:>1000");
+    expect(gt.attributes!["duration"]).toBeInstanceOf(GreaterThan);
+    expect((gt.attributes!["duration"] as GreaterThan<number>).value).toBe(
+      1000,
+    );
+
+    const gte: LogFilter = queryStringToFilter("@duration:>=1000");
+    expect(gte.attributes!["duration"]).toBeInstanceOf(GreaterThanOrEqual);
+
+    const lt: LogFilter = queryStringToFilter("@duration:<50");
+    expect(lt.attributes!["duration"]).toBeInstanceOf(LessThan);
+    expect((lt.attributes!["duration"] as LessThan<number>).value).toBe(50);
+  });
+
+  test("a non-numeric comparison value stays a string", () => {
+    const filter: LogFilter = queryStringToFilter("@version:>abc");
+    expect((filter.attributes!["version"] as GreaterThan<string>).value).toBe(
+      "abc",
+    );
+  });
+
+  test("negated attribute filter produces a NotEqual", () => {
+    const filter: LogFilter = queryStringToFilter("-@http.method:GET");
+    expect(filter.attributes!["http.method"]).toBeInstanceOf(NotEqual);
+    expect((filter.attributes!["http.method"] as NotEqual<string>).value).toBe(
+      "GET",
+    );
+  });
+});
+
+describe("queryStringToFilter - combinations", () => {
+  test("a field filter plus trailing free text populate distinct slots", () => {
+    const filter: LogFilter = queryStringToFilter("severity:error timeout");
+    expect(filter.severityText).toBe("Error");
+    expect(filter.body).toBeInstanceOf(Search);
+    expect((filter.body as Search<string>).toString()).toBe("timeout");
+  });
+});

package/Tests/Types/Monitor/MonitorStepNetworkDeviceMonitor.test.ts

@@ -1,17 +1,44 @@
 import { JSONObject } from "../../../Types/JSON";
+import MonitorStep from "../../../Types/Monitor/MonitorStep";
 import MonitorStepNetworkDeviceMonitor, {
   MonitorStepNetworkDeviceMonitorUtil,
 } from "../../../Types/Monitor/MonitorStepNetworkDeviceMonitor";
+import MonitorType from "../../../Types/Monitor/MonitorType";
 import SnmpOid from "../../../Types/Monitor/SnmpMonitor/SnmpOid";
+import ObjectID from "../../../Types/ObjectID";
+
+const getNetworkDeviceMonitorStep: (
+  overrides?: Partial<MonitorStepNetworkDeviceMonitor>,
+) => MonitorStep = (
+  overrides: Partial<MonitorStepNetworkDeviceMonitor> = {},
+): MonitorStep => {
+  const id: ObjectID = ObjectID.generate();
+  const monitorStep: MonitorStep = MonitorStep.getDefaultMonitorStep({
+    monitorName: "Network device monitor",
+    monitorType: MonitorType.NetworkDevice,
+    onlineMonitorStatusId: id,
+    offlineMonitorStatusId: id,
+    defaultIncidentSeverityId: id,
+    defaultAlertSeverityId: id,
+  });
+
+  return monitorStep.setNetworkDeviceMonitor({
+    ...MonitorStepNetworkDeviceMonitorUtil.getDefault(),
+    networkDeviceId: "device-1",
+    ...overrides,
+  });
+};
 
 describe("MonitorStepNetworkDeviceMonitorUtil", () => {
   describe("getDefault", () => {
-    test("returns no device, interface monitoring on, and no oids", () => {
+    test("returns no device, interface monitoring on, endpoint collection OFF, and no oids", () => {
       const def: MonitorStepNetworkDeviceMonitor =
         MonitorStepNetworkDeviceMonitorUtil.getDefault();
 
       expect(def.networkDeviceId).toBeUndefined();
       expect(def.monitorInterfaces).toBe(true);
+      // Endpoint collection is strictly opt-in, so a new step starts off.
+      expect(def.collectEndpoints).toBe(false);
       expect(def.oids).toEqual([]);
     });
   });
@@ -22,6 +49,7 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
         MonitorStepNetworkDeviceMonitorUtil.fromJSON({
           networkDeviceId: "device-1",
           monitorInterfaces: false,
+          collectEndpoints: false,
           oids: [
             {
               oid: "1.3.6.1.2.1.1.1.0",
@@ -33,6 +61,7 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
 
       expect(monitor.networkDeviceId).toBe("device-1");
       expect(monitor.monitorInterfaces).toBe(false);
+      expect(monitor.collectEndpoints).toBe(false);
       expect(monitor.oids.length).toBe(1);
       expect(monitor.oids[0]!.oid).toBe("1.3.6.1.2.1.1.1.0");
       expect(monitor.oids[0]!.name).toBe("sysDescr");
@@ -58,6 +87,37 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
       ).toBe(false);
     });
 
+    test("defaults collectEndpoints to false unless it is explicitly true", () => {
+      // Missing -> false: steps saved before the flag existed stay opted out.
+      expect(
+        MonitorStepNetworkDeviceMonitorUtil.fromJSON({}).collectEndpoints,
+      ).toBe(false);
+      // Explicit true -> true: the only way to opt in.
+      expect(
+        MonitorStepNetworkDeviceMonitorUtil.fromJSON({
+          collectEndpoints: true,
+        }).collectEndpoints,
+      ).toBe(true);
+      // Explicit false -> false.
+      expect(
+        MonitorStepNetworkDeviceMonitorUtil.fromJSON({
+          collectEndpoints: false,
+        }).collectEndpoints,
+      ).toBe(false);
+      // null (a JSON round trip of undefined) -> false, not "not false".
+      expect(
+        MonitorStepNetworkDeviceMonitorUtil.fromJSON({
+          collectEndpoints: null,
+        }).collectEndpoints,
+      ).toBe(false);
+      // A truthy non-true value is NOT an opt-in.
+      expect(
+        MonitorStepNetworkDeviceMonitorUtil.fromJSON({
+          collectEndpoints: "true",
+        }).collectEndpoints,
+      ).toBe(false);
+    });
+
     test("coerces a missing networkDeviceId to undefined and missing oids to []", () => {
       const monitor: MonitorStepNetworkDeviceMonitor =
         MonitorStepNetworkDeviceMonitorUtil.fromJSON({});
@@ -85,6 +145,7 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
       const monitor: MonitorStepNetworkDeviceMonitor = {
         networkDeviceId: "device-42",
         monitorInterfaces: false,
+        collectEndpoints: false,
         oids: [{ oid: "1.2.3", name: "n", description: "d" }],
       };
 
@@ -93,10 +154,22 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
 
       expect(json["networkDeviceId"]).toBe("device-42");
       expect(json["monitorInterfaces"]).toBe(false);
+      expect(json["collectEndpoints"]).toBe(false);
       expect(json["oids"]).toEqual([
         { oid: "1.2.3", name: "n", description: "d" },
       ]);
     });
+
+    test("passes collectEndpoints through untouched (true stays true)", () => {
+      const json: JSONObject = MonitorStepNetworkDeviceMonitorUtil.toJSON({
+        networkDeviceId: undefined,
+        monitorInterfaces: true,
+        collectEndpoints: true,
+        oids: [],
+      });
+
+      expect(json["collectEndpoints"]).toBe(true);
+    });
   });
 
   describe("round trip", () => {
@@ -104,6 +177,7 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
       const original: MonitorStepNetworkDeviceMonitor = {
         networkDeviceId: "device-7",
         monitorInterfaces: false,
+        collectEndpoints: false,
         oids: [
           { oid: "1.3.6.1.2.1.1.1.0", name: "sysDescr", description: "desc" },
           {
@@ -134,6 +208,26 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
       expect(roundTripped).toEqual(def);
     });
 
+    test("a legacy step without collectEndpoints round-trips to endpoint collection OFF", () => {
+      // Steps saved before the flag existed serialize without it…
+      const legacy: MonitorStepNetworkDeviceMonitor = {
+        networkDeviceId: "device-legacy",
+        monitorInterfaces: true,
+        oids: [],
+      };
+
+      const roundTripped: MonitorStepNetworkDeviceMonitor =
+        MonitorStepNetworkDeviceMonitorUtil.fromJSON(
+          MonitorStepNetworkDeviceMonitorUtil.toJSON(legacy),
+        );
+
+      /*
+       * …and must deserialize opted OUT: an upgrade cannot silently enrol
+       * an existing monitor into extra SNMP walks and per-MAC writes.
+       */
+      expect(roundTripped.collectEndpoints).toBe(false);
+    });
+
     test("preserves oids with only an oid string across a round trip", () => {
       const original: MonitorStepNetworkDeviceMonitor = {
         networkDeviceId: undefined,
@@ -152,4 +246,50 @@ describe("MonitorStepNetworkDeviceMonitorUtil", () => {
       expect(oid.description).toBeUndefined();
     });
   });
+
+  /*
+   * Under device-owned polling a Network Device monitor is a pure alerting
+   * layer: WHAT to collect (interface walks, endpoint discovery, OIDs) lives
+   * on the NetworkDevice resource itself. Step validation therefore only
+   * requires the device reference — the old "enable interface monitoring or
+   * configure at least one OID" rule is gone.
+   */
+  describe("MonitorStep validation", () => {
+    test("accepts a step with only a device reference (interfaces off, zero oids)", () => {
+      const monitorStep: MonitorStep = getNetworkDeviceMonitorStep({
+        monitorInterfaces: false,
+        oids: [],
+      });
+
+      expect(
+        MonitorStep.getValidationError(monitorStep, MonitorType.NetworkDevice),
+      ).toBeNull();
+    });
+
+    test("still rejects a step with no device reference", () => {
+      const monitorStep: MonitorStep = getNetworkDeviceMonitorStep({
+        networkDeviceId: undefined,
+      });
+
+      expect(
+        MonitorStep.getValidationError(monitorStep, MonitorType.NetworkDevice),
+      ).toBe("Network Device is required");
+    });
+
+    test("rejects a step that has no networkDeviceMonitor block at all", () => {
+      const id: ObjectID = ObjectID.generate();
+      const monitorStep: MonitorStep = MonitorStep.getDefaultMonitorStep({
+        monitorName: "Network device monitor",
+        monitorType: MonitorType.NetworkDevice,
+        onlineMonitorStatusId: id,
+        offlineMonitorStatusId: id,
+        defaultIncidentSeverityId: id,
+        defaultAlertSeverityId: id,
+      });
+
+      expect(
+        MonitorStep.getValidationError(monitorStep, MonitorType.NetworkDevice),
+      ).toBe("Network Device is required");
+    });
+  });
 });

package/Tests/Types/Monitor/MonitorType.test.ts

@@ -120,7 +120,6 @@ describe("MonitorTypeHelper", () => {
       MonitorType.SSLCertificate,
       MonitorType.SyntheticMonitor,
       MonitorType.CustomJavaScriptCode,
-      MonitorType.NetworkDevice,
       MonitorType.DNS,
       MonitorType.DNSSEC,
       MonitorType.Domain,
@@ -134,6 +133,8 @@ describe("MonitorTypeHelper", () => {
       MonitorType.Logs,
       MonitorType.Server,
       MonitorType.IncomingRequest,
+      // Device-owned polling: the NetworkDevice resource polls itself.
+      MonitorType.NetworkDevice,
     ])("returns false for %s", (monitorType: MonitorType) => {
       expect(MonitorTypeHelper.isProbableMonitor(monitorType)).toBe(false);
     });
@@ -195,6 +196,63 @@ describe("MonitorTypeHelper", () => {
     });
   });
 
+  /*
+   * NetworkDevice is a pure alerting layer under device-owned polling: the
+   * NetworkDevice resource's assigned probe walks it on the device's own
+   * schedule, and the monitor is evaluated server-side against each walk.
+   * It must therefore never appear probeable (no MonitorProbe rows, no
+   * interval) while keeping its full monitor surface: criteria, graphs,
+   * documentation, creatability, and its place in the Network category.
+   */
+  describe("NetworkDevice under device-owned polling", () => {
+    test("is not probeable and has no interval", () => {
+      expect(
+        MonitorTypeHelper.isProbableMonitor(MonitorType.NetworkDevice),
+      ).toBe(false);
+      expect(
+        MonitorTypeHelper.doesMonitorTypeHaveInterval(
+          MonitorType.NetworkDevice,
+        ),
+      ).toBe(false);
+    });
+
+    test("still has criteria, graphs, and documentation", () => {
+      expect(
+        MonitorTypeHelper.doesMonitorTypeHaveCriteria(
+          MonitorType.NetworkDevice,
+        ),
+      ).toBe(true);
+      expect(
+        MonitorTypeHelper.doesMonitorTypeHaveGraphs(MonitorType.NetworkDevice),
+      ).toBe(true);
+      expect(
+        MonitorTypeHelper.doesMonitorTypeHaveDocumentation(
+          MonitorType.NetworkDevice,
+        ),
+      ).toBe(true);
+    });
+
+    test("is still an active (creatable) monitor type", () => {
+      expect(MonitorTypeHelper.getActiveMonitorTypes()).toContain(
+        MonitorType.NetworkDevice,
+      );
+    });
+
+    test("is still listed under the Network category", () => {
+      const networkCategory: MonitorTypeCategory | undefined =
+        MonitorTypeHelper.getMonitorTypeCategories().find(
+          (category: MonitorTypeCategory) => {
+            return category.label === "Network";
+          },
+        );
+
+      expect(networkCategory).toBeDefined();
+      expect(networkCategory?.monitorTypes).toContain(
+        MonitorType.NetworkDevice,
+      );
+    });
+  });
+
   describe("doesMonitorTypeHaveGraphs", () => {
     test("returns true for graphable types and false otherwise", () => {
       expect(

package/Tests/Types/Monitor/NetworkDeviceAlertPack.test.ts

@@ -0,0 +1,97 @@
+import NetworkDeviceAlertPackUtil, {
+  NetworkDeviceAlertPackItem,
+} from "../../../Types/Monitor/SnmpMonitor/NetworkDeviceAlertPack";
+import MonitorCriteriaInstance from "../../../Types/Monitor/MonitorCriteriaInstance";
+import ObjectID from "../../../Types/ObjectID";
+
+describe("NetworkDeviceAlertPackUtil.getPackItems", () => {
+  test("every pack item has a name, a description and at least one filter", () => {
+    const items: Array<NetworkDeviceAlertPackItem> =
+      NetworkDeviceAlertPackUtil.getPackItems();
+
+    expect(items.length).toBeGreaterThan(0);
+
+    for (const item of items) {
+      expect(item.name).toBeTruthy();
+      expect(item.description).toBeTruthy();
+      expect(item.filters.length).toBeGreaterThan(0);
+    }
+  });
+});
+
+describe("NetworkDeviceAlertPackUtil.buildCriteriaInstances", () => {
+  test("builds one enabled instance per pack item with unique ids", () => {
+    const instances: Array<MonitorCriteriaInstance> =
+      NetworkDeviceAlertPackUtil.buildCriteriaInstances();
+
+    expect(instances.length).toBe(
+      NetworkDeviceAlertPackUtil.getPackItems().length,
+    );
+
+    const ids: Set<string> = new Set<string>();
+    for (const instance of instances) {
+      expect(instance.data?.isEnabled).toBe(true);
+      expect(instance.data?.id).toBeTruthy();
+      ids.add(instance.data!.id);
+    }
+    expect(ids.size).toBe(instances.length);
+  });
+
+  test("with a downMonitorStatusId context, incident-creating criteria carry that status id", () => {
+    const downStatusId: ObjectID = ObjectID.generate();
+
+    const instances: Array<MonitorCriteriaInstance> =
+      NetworkDeviceAlertPackUtil.buildCriteriaInstances({
+        downMonitorStatusId: downStatusId,
+      });
+
+    for (const instance of instances) {
+      expect(instance.data?.monitorStatusId?.toString()).toBe(
+        downStatusId.toString(),
+      );
+
+      /*
+       * changeMonitorStatus must never be true while the target status id
+       * is missing — that combination produces a criteria that "changes"
+       * the monitor to no status at all.
+       */
+      if (instance.data?.changeMonitorStatus) {
+        expect(instance.data?.monitorStatusId).toBeTruthy();
+      }
+    }
+  });
+
+  test("without context, no instance claims to change monitor status to an undefined id", () => {
+    const instances: Array<MonitorCriteriaInstance> =
+      NetworkDeviceAlertPackUtil.buildCriteriaInstances();
+
+    for (const instance of instances) {
+      expect(instance.data?.monitorStatusId).toBeUndefined();
+      /*
+       * Legacy call sites (no context) still exist in principle; the pack
+       * must not produce a status change pointing at nothing.
+       */
+      expect(instance.data?.changeMonitorStatus).toBe(false);
+    }
+  });
+
+  test("only incident-creating pack items request a monitor status change", () => {
+    const downStatusId: ObjectID = ObjectID.generate();
+    const items: Array<NetworkDeviceAlertPackItem> =
+      NetworkDeviceAlertPackUtil.getPackItems();
+    const instances: Array<MonitorCriteriaInstance> =
+      NetworkDeviceAlertPackUtil.buildCriteriaInstances({
+        downMonitorStatusId: downStatusId,
+      });
+
+    for (let i: number = 0; i < items.length; i++) {
+      expect(instances[i]!.data?.createIncidents).toBe(
+        items[i]!.createIncidents,
+      );
+      expect(instances[i]!.data?.createAlerts).toBe(items[i]!.createAlerts);
+      expect(instances[i]!.data?.changeMonitorStatus).toBe(
+        items[i]!.createIncidents,
+      );
+    }
+  });
+});