@oneuptime/common 12.0.25 → 12.0.26

package/build/dist/Server/Services/NetworkDeviceAutoImportRuleEngineService.js

@@ -10,15 +10,24 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import NetworkDeviceAutoImportRuleService from "./NetworkDeviceAutoImportRuleService";
 import NetworkDeviceDiscoveryScanService from "./NetworkDeviceDiscoveryScanService";
 import NetworkDeviceService from "./NetworkDeviceService";
+import MonitorService from "./MonitorService";
+import MonitorTemplateService from "./MonitorTemplateService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import MonitorType from "../../Types/Monitor/MonitorType";
 import { MAX_MATCHED_IP_SAMPLE, } from "../../Types/NetworkAutomation/RuleRunResult";
 import AutoImportRuleMatcher from "../../Utils/NetworkDiscovery/AutoImportRuleMatcher";
 import { buildFallbackDeviceName, buildNetworkDeviceFromDiscoveredHost, } from "../../Utils/NetworkDiscovery/DiscoveredDeviceBuilder";
 import { normalizeDiscoveredHosts } from "../../Utils/NetworkDiscovery/DiscoveredHostUtil";
+import { monitoringMethodForDiscoveredHost } from "../../Utils/NetworkDiscovery/DiscoveryImportEligibility";
+import NetworkDeviceMonitoringMethod, { NetworkDeviceMonitoringMethodUtil, } from "../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
+import NetworkDeviceMonitorTemplateUtil from "../../Utils/Monitor/NetworkDeviceMonitorTemplateUtil";
 import Semaphore from "../Infrastructure/Semaphore";
+import QueryHelper from "../Types/Database/QueryHelper";
+import NetworkDeviceHydrationUtil from "../Utils/Monitor/NetworkDeviceHydrationUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger from "../Utils/Logger";
 /*
@@ -40,8 +49,9 @@ import logger from "../Utils/Logger";
  *
  * Everything here is idempotent by construction: a device exists per
  * (project, address), recurring scans re-report the same hosts every
- * interval, and both paths skip hosts whose address is already registered —
- * so seeing the same results twice creates nothing twice.
+ * interval, and both paths reuse hosts whose address is already registered.
+ * Existing devices are still reconciled for a selected template monitor,
+ * while provenance keys prevent the same monitor from being created twice.
  */
 /*
  * The scan columns an import copies onto an SNMP device — the same set the
@@ -52,6 +62,13 @@ import logger from "../Utils/Logger";
  */
 export const AUTO_IMPORT_SCAN_CREDENTIAL_SELECT = {
     probeId: true,
+    /*
+     * The ordered credential list, so an imported device is built with the
+     * config that ACTUALLY answered its address rather than with the scan's
+     * first one. The flattened columns below are what a scan written out of
+     * band carries, and are the fallback SnmpScanConfigUtil resolves to.
+     */
+    snmpConfigs: true,
     snmpVersion: true,
     snmpCommunityString: true,
     snmpPort: true,
@@ -72,6 +89,15 @@ export const AUTO_IMPORT_SCAN_CREDENTIAL_SELECT = {
  * /16" from an outage into a few paced ticks an operator can catch.
  */
 export const MAX_DEVICES_PER_AUTO_IMPORT_RUN = 500;
+/*
+ * Monitor creates run an even broader service pipeline than device creates:
+ * plan limits, operational status, labels, owners, SLOs and status pages all
+ * participate. Keep a separate cap so reconciling an existing /16 cannot
+ * bypass the device cap merely because all devices are already registered.
+ * A truncated automatic pass leaves its marker NULL whenever it made
+ * progress, and the next sweep resumes from the queryable provenance keys.
+ */
+export const MAX_MONITORS_PER_AUTO_IMPORT_RUN = 500;
 // Scans one manual "Run Now" will read, oldest results last.
 export const MAX_SCANS_PER_AUTO_IMPORT_RULE_RUN = 100;
 /*
@@ -121,7 +147,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
      * the zero-progress note at the stamp below.)
      */
     async processCompletedScan(data) {
-        var _a, _b;
+        var _a, _b, _c;
         const scan = await NetworkDeviceDiscoveryScanService.findOneBy({
             query: {
                 _id: data.scanId,
@@ -156,16 +182,45 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
             await this.stampScan({ scan: scan, createdIpAddresses: [] });
             return null;
         }
-        const existingHostnames = await this.getExistingHostnames({
+        const existingDevices = this.getExistingDevices({
             projectId: projectId,
             cache: data.existingHostnamesByProjectId,
         });
+        const hasMonitorProvisioningRules = rules.some((rule) => {
+            return !rule.isExclusion && Boolean(rule.monitorTemplateId);
+        });
+        const existingMonitors = hasMonitorProvisioningRules
+            ? await this.getExistingMonitors({
+                projectId: projectId,
+                cache: data.existingMonitorsByProjectId || new Map(),
+            })
+            : this.emptyExistingMonitorProvisioningState();
+        const monitorTemplates = hasMonitorProvisioningRules
+            ? await this.loadMonitorTemplates({ projectId, rules })
+            : new Map();
         const result = this.emptyResult(false);
-        const attempts = { count: 0 };
+        const projectBudgetKey = projectId.toString();
+        const attempts = data.attemptBudgetsByProjectId
+            ? data.attemptBudgetsByProjectId.get(projectBudgetKey) || {
+                deviceCount: 0,
+                monitorCount: 0,
+            }
+            : { deviceCount: 0, monitorCount: 0 };
+        /*
+         * A project budget is shared across every scan in one worker sweep. Keep
+         * the starting values so a scan reached after an earlier scan consumed
+         * the budget can be distinguished from a scan whose own create attempts
+         * all failed. The former must remain unprocessed for the next sweep; the
+         * latter is deliberately retired to avoid an infinite retry loop.
+         */
+        const attemptsAtStart = Object.assign({}, attempts);
+        (_b = data.attemptBudgetsByProjectId) === null || _b === void 0 ? void 0 : _b.set(projectBudgetKey, attempts);
         const createdIpAddresses = await this.importHostsFromScan({
             scan: scan,
             rules: rules,
-            existingHostnames: existingHostnames,
+            existingDevices: existingDevices,
+            existingMonitors: existingMonitors,
+            monitorTemplates: monitorTemplates,
             result: result,
             attempts: attempts,
             isDryRun: false,
@@ -179,9 +234,17 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
          * pass, so stamping keeps the two consistent. Run Now remains the
          * deliberate way back into a stamped scan.
          */
-        const shouldResume = result.isTruncated && result.devicesCreated > 0;
-        if (result.isTruncated && result.devicesCreated === 0) {
-            logger.error(`Auto-import: scan ${(_b = scan.id) === null || _b === void 0 ? void 0 : _b.toString()} hit the per-pass cap with every create failing (${result.devicesFailed} failure(s)); stamping it processed so the sweep does not retry it forever. Inspect the failures and use the rule's Run Now to retry deliberately.`, { projectId: projectId.toString() });
+        const inheritedBudget = result.isTruncated &&
+            (attemptsAtStart.deviceCount > 0 || attemptsAtStart.monitorCount > 0);
+        const shouldResume = result.isTruncated &&
+            (result.devicesCreated > 0 ||
+                result.monitorsCreated > 0 ||
+                inheritedBudget);
+        if (result.isTruncated &&
+            result.devicesCreated === 0 &&
+            result.monitorsCreated === 0 &&
+            !inheritedBudget) {
+            logger.error(`Auto-import: scan ${(_c = scan.id) === null || _c === void 0 ? void 0 : _c.toString()} hit a per-pass cap without making progress (${result.devicesFailed} device failure(s), ${result.monitorsFailed} monitor failure(s)); stamping it processed so the sweep does not retry it forever. Inspect the failures and use the rule's Run Now to retry deliberately.`, { projectId: projectId.toString() });
         }
         await this.stampScan({
             scan: scan,
@@ -201,6 +264,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
      * full rule set would.
      */
     async applyRuleToCompletedScans(data) {
+        var _a, _b;
         const rule = await NetworkDeviceAutoImportRuleService.findOneBy({
             query: {
                 _id: data.ruleId,
@@ -216,12 +280,20 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
                 sysDescrPattern: true,
                 sysObjectIdPattern: true,
                 includePingOnlyHosts: true,
+                monitorTemplateId: true,
             },
             props: { isRoot: true },
         });
         if (!rule) {
             throw new BadDataException("Auto-import rule not found.");
         }
+        if (data.expectedMonitorTemplateId !== undefined) {
+            const expectedTemplateId = ((_a = data.expectedMonitorTemplateId) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+            const currentTemplateId = ((_b = rule.monitorTemplateId) === null || _b === void 0 ? void 0 : _b.toString()) || "";
+            if (expectedTemplateId !== currentTemplateId) {
+                throw new BadDataException("This auto-import rule changed while the run was being authorized. Review it and run it again.");
+            }
+        }
         /*
          * A DISABLED rule can still be dry-run — that is the point of the dry
          * run: answer "what would this rule import" BEFORE enabling it against
@@ -283,9 +355,23 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
             data.rule,
             ...exclusionRules,
         ];
-        const existingHostnames = await this.loadExistingHostnames(data.projectId);
+        /*
+         * Starts empty and is primed per scan from the addresses that scan found.
+         * See getExistingDevices.
+         */
+        const existingDevices = new Map();
+        const hasMonitorProvisioningRule = Boolean(data.rule.monitorTemplateId);
+        const existingMonitors = hasMonitorProvisioningRule
+            ? await this.loadExistingMonitors(data.projectId)
+            : this.emptyExistingMonitorProvisioningState();
+        const monitorTemplates = hasMonitorProvisioningRule
+            ? await this.loadMonitorTemplates({
+                projectId: data.projectId,
+                rules: rules,
+            })
+            : new Map();
         const result = this.emptyResult(data.isDryRun);
-        const attempts = { count: 0 };
+        const attempts = { deviceCount: 0, monitorCount: 0 };
         /*
          * Newest results first: a manual run is "bring the estate up to date",
          * and the newest scan of a subnet supersedes its older runs — with
@@ -332,7 +418,9 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
             const createdIpAddresses = await this.importHostsFromScan({
                 scan: scan,
                 rules: rules,
-                existingHostnames: existingHostnames,
+                existingDevices: existingDevices,
+                existingMonitors: existingMonitors,
+                monitorTemplates: monitorTemplates,
                 result: result,
                 attempts: attempts,
                 isDryRun: data.isDryRun,
@@ -381,12 +469,24 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
             hostsSkippedAlreadyRegistered: 0,
             devicesCreated: 0,
             devicesFailed: 0,
+            monitorsWouldCreate: 0,
+            monitorsCreated: 0,
+            monitorsSkippedAlreadyExisting: 0,
+            monitorsSkippedUnsupportedHost: 0,
+            monitorsFailed: 0,
             isTruncated: false,
             hasMoreScans: false,
             isDryRun: isDryRun,
             matchedIpAddressSample: [],
         };
     }
+    emptyExistingMonitorProvisioningState() {
+        return {
+            autoProvisionedKeys: new Set(),
+            manuallyMonitoredDeviceIds: new Set(),
+            attemptedProvisioningKeys: new Set(),
+        };
+    }
     /*
      * ALL enabled rules of the project, paged to completeness — never a capped
      * subset. The label/owner engines cap their fetch at 100 and a dropped
@@ -413,6 +513,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
                     sysDescrPattern: true,
                     sysObjectIdPattern: true,
                     includePingOnlyHosts: true,
+                    monitorTemplateId: true,
                 },
                 sort: {
                     createdAt: SortOrder.Ascending,
@@ -434,15 +535,39 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
         }
         return OneUptimeDate.isBefore(OneUptimeDate.fromString(scan.completedAt), OneUptimeDate.getSomeHoursAgo(MAX_RESULT_AGE_IN_HOURS));
     }
-    async getExistingHostnames(data) {
+    /*
+     * The project's running map of "this address already has a device", shared
+     * across every scan in one sweep.
+     *
+     * It starts EMPTY and is filled per scan by `primeExistingDevices`, from the
+     * addresses that scan actually found. It used to start full — every device
+     * in the project, paged out of the database — which was both a full-table
+     * read per sweep and, on a fleet whose devices share one `createdAt` (what a
+     * bulk import produces), an unstable page walk that SKIPPED hostnames and
+     * let this engine create duplicates. See loadExistingDevices.
+     */
+    getExistingDevices(data) {
         const key = data.projectId.toString();
         const cached = data.cache.get(key);
         if (cached) {
             return cached;
         }
-        const loaded = await this.loadExistingHostnames(data.projectId);
-        data.cache.set(key, loaded);
-        return loaded;
+        const fresh = new Map();
+        data.cache.set(key, fresh);
+        return fresh;
+    }
+    /*
+     * Fills the running map with whatever of THESE addresses already has a
+     * device. Only what is found is recorded, so an address that is not
+     * registered is looked up again if a later scan in the same sweep carries it
+     * — one indexed lookup, and recording absence would go stale the moment this
+     * run creates the device.
+     */
+    async primeExistingDevices(data) {
+        const found = await this.loadExistingDevices(data.projectId, data.hostnames);
+        for (const [hostname, device] of found) {
+            data.into.set(hostname, device);
+        }
     }
     /*
      * Every device address in the project — the same paged walk the probe
@@ -450,43 +575,201 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
      * a truncated answer produces duplicate devices, which is worse than a
      * slow answer. Sorted for stable paging.
      */
-    async loadExistingHostnames(projectId) {
-        const existingHostnames = new Set();
+    /*
+     * The devices already at these addresses, keyed by hostname.
+     *
+     * This used to load EVERY device in the project, paging `ORDER BY
+     * createdAt` — and a bulk discovery import stamps every device it creates
+     * with the same `createdAt`, so on a large fleet the sort key is
+     * single-valued and `LIMIT/OFFSET` over it returns an arbitrary,
+     * non-deterministic slice per call. Pages overlapped and skipped, and a
+     * skipped hostname reads as "not registered", which CREATES A DUPLICATE
+     * DEVICE — the exact failure the paging was added to prevent. It also cost
+     * a full table scan per page.
+     *
+     * Asking about the addresses the scans actually carry is both correct and
+     * an indexed lookup. See NetworkDeviceService.getDevicesByHostnames.
+     */
+    async loadExistingDevices(projectId, hostnames) {
+        return NetworkDeviceService.getDevicesByHostnames({
+            projectId: projectId,
+            hostnames: hostnames,
+            select: {
+                _id: true,
+                projectId: true,
+                name: true,
+                hostname: true,
+                monitoringMethod: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+    }
+    static monitorProvisioningKey(networkDeviceId, monitorTemplateId) {
+        return `${networkDeviceId.toString()}:${monitorTemplateId.toString()}`;
+    }
+    async getExistingMonitors(data) {
+        const key = data.projectId.toString();
+        const cached = data.cache.get(key);
+        if (cached) {
+            return cached;
+        }
+        const loaded = await this.loadExistingMonitors(data.projectId);
+        data.cache.set(key, loaded);
+        return loaded;
+    }
+    /*
+     * Queryable provenance is the concurrency/idempotency key for monitors
+     * created by this engine. Existing manually-created Network Device
+     * monitors are parsed once and suppress automatic duplicates: an operator
+     * who already chose how to monitor a device must not receive a second,
+     * potentially billable monitor merely because an import rule was edited.
+     */
+    async loadExistingMonitors(projectId) {
+        const state = this.emptyExistingMonitorProvisioningState();
         for (let skip = 0;; skip += LIMIT_MAX) {
-            const existing = await NetworkDeviceService.findBy({
+            const monitors = await MonitorService.findBy({
                 query: {
                     projectId: projectId,
+                    monitorType: MonitorType.NetworkDevice,
                 },
                 select: {
-                    hostname: true,
+                    _id: true,
+                    monitorType: true,
+                    monitorSteps: true,
+                    monitorTemplateId: true,
+                    autoProvisionedNetworkDeviceId: true,
                 },
                 sort: {
                     createdAt: SortOrder.Ascending,
                 },
                 limit: LIMIT_MAX,
                 skip: skip,
-                props: {
-                    isRoot: true,
+                props: { isRoot: true },
+            });
+            for (const monitor of monitors) {
+                this.recordExistingMonitor(state, monitor);
+            }
+            if (monitors.length < LIMIT_MAX) {
+                break;
+            }
+        }
+        return state;
+    }
+    /*
+     * Classify one stored monitor from both its queryable provenance and its
+     * actual step binding. Provenance is trusted only while the monitor still
+     * watches the device it was provisioned for. An orphaned template link or
+     * any legacy drift is treated as an operator-managed monitor on its actual
+     * device(s), which is the conservative no-duplicate behavior.
+     */
+    recordExistingMonitor(state, monitor) {
+        var _a;
+        const referencedDeviceIds = new Set(NetworkDeviceHydrationUtil.getReferencedNetworkDeviceIds([monitor]));
+        const provenanceDeviceId = ((_a = monitor.autoProvisionedNetworkDeviceId) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+        if (provenanceDeviceId &&
+            monitor.monitorTemplateId &&
+            referencedDeviceIds.size === 1 &&
+            referencedDeviceIds.has(provenanceDeviceId)) {
+            state.autoProvisionedKeys.add(NetworkDeviceAutoImportRuleEngineServiceClass.monitorProvisioningKey(provenanceDeviceId, monitor.monitorTemplateId));
+            return;
+        }
+        for (const networkDeviceId of referencedDeviceIds) {
+            state.manuallyMonitoredDeviceIds.add(networkDeviceId);
+        }
+    }
+    /*
+     * Close the practical manual-create race left by the project-wide snapshot:
+     * immediately before provisioning a device, search the JSON step payload
+     * for its UUID and classify exact bindings. The automatic (device,template)
+     * partial unique index remains the final concurrent-auto backstop; this
+     * narrow read prevents a monitor a human just created from being ignored by
+     * a long-running sweep.
+     */
+    async refreshExistingMonitorsForDevice(data) {
+        for (let skip = 0;; skip += LIMIT_MAX) {
+            const monitors = await MonitorService.findBy({
+                query: {
+                    projectId: data.projectId,
+                    monitorType: MonitorType.NetworkDevice,
+                    monitorSteps: QueryHelper.search(data.networkDeviceId.toString()),
+                },
+                select: {
+                    _id: true,
+                    monitorType: true,
+                    monitorSteps: true,
+                    monitorTemplateId: true,
+                    autoProvisionedNetworkDeviceId: true,
                 },
+                sort: { createdAt: SortOrder.Ascending },
+                limit: LIMIT_MAX,
+                skip: skip,
+                props: { isRoot: true },
             });
-            for (const device of existing) {
-                if (device.hostname) {
-                    existingHostnames.add(device.hostname);
+            for (const monitor of monitors) {
+                this.recordExistingMonitor(data.state, monitor);
+            }
+            if (monitors.length < LIMIT_MAX) {
+                break;
+            }
+        }
+    }
+    async loadMonitorTemplates(data) {
+        const ids = Array.from(new Map(data.rules
+            .filter((rule) => {
+            return Boolean(rule.monitorTemplateId);
+        })
+            .map((rule) => {
+            const id = rule.monitorTemplateId;
+            return [id.toString(), id];
+        })).values());
+        const templatesById = new Map();
+        if (ids.length === 0) {
+            return templatesById;
+        }
+        for (let skip = 0;; skip += LIMIT_MAX) {
+            const templates = await MonitorTemplateService.findBy({
+                query: {
+                    _id: QueryHelper.any(ids),
+                    projectId: data.projectId,
+                    monitorType: MonitorType.NetworkDevice,
+                },
+                select: {
+                    _id: true,
+                    projectId: true,
+                    monitorName: true,
+                    monitorDescription: true,
+                    monitorType: true,
+                    monitorSteps: true,
+                    monitoringInterval: true,
+                    minimumProbeAgreement: true,
+                    customFields: true,
+                    labels: { _id: true },
+                },
+                sort: { createdAt: SortOrder.Ascending },
+                limit: LIMIT_MAX,
+                skip: skip,
+                props: { isRoot: true },
+            });
+            for (const template of templates) {
+                if (template.id) {
+                    templatesById.set(template.id.toString(), template);
                 }
             }
-            if (existing.length < LIMIT_MAX) {
+            if (templates.length < LIMIT_MAX) {
                 break;
             }
         }
-        return existingHostnames;
+        return templatesById;
     }
     /*
      * The core loop: evaluate every discovered host of one scan against the
-     * rule set, create what should import, and account for every host in the
-     * shared result. Returns the addresses actually created (for the jsonb
-     * write-back). Mutates `existingHostnames` as it creates, which is what
-     * makes duplicate rows, overlapping scans in one sweep, and repeat runs
-     * idempotent.
+     * rule set, create what should import, reconcile selected template monitors,
+     * and account for every host in the shared result. Returns the addresses
+     * actually created (for the jsonb write-back). Mutates `existingDevices` as
+     * it creates, which is what makes duplicate rows, overlapping scans in one
+     * sweep, and repeat runs idempotent.
      */
     async importHostsFromScan(data) {
         const scan = data.scan;
@@ -500,6 +783,17 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
          * Review dialog already learned to survive. See DiscoveredHostUtil.
          */
         const hosts = normalizeDiscoveredHosts(scan.discoveredDevices || []);
+        /*
+         * Ask the database about THESE addresses, once, before the loop — rather
+         * than having loaded every device in the project up front.
+         */
+        await this.primeExistingDevices({
+            projectId: scan.projectId,
+            hostnames: hosts.map((host) => {
+                return host.ipAddress || "";
+            }),
+            into: data.existingDevices,
+        });
         const createdIpAddresses = [];
         for (const host of hosts) {
             /*
@@ -523,52 +817,244 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
                 continue;
             }
             result.hostsMatched++;
+            const templateIds = Array.from(new Set(evaluation.matchedRules
+                .map((matchedRule) => {
+                var _a;
+                return ((_a = matchedRule.monitorTemplateId) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+            })
+                .filter((id) => {
+                return Boolean(id);
+            })));
+            let networkDevice = data.existingDevices.get(host.ipAddress);
+            let deviceWasCreated = false;
             /*
              * The frozen isAlreadyRegistered flag AND the live set: the flag is a
              * point-in-time answer from the last upload, the set covers devices
              * created since — including by this very run, which is what collapses
              * duplicate rows and overlapping scans into one device.
              */
-            if (host.isAlreadyRegistered ||
-                data.existingHostnames.has(host.ipAddress)) {
+            if (host.isAlreadyRegistered || networkDevice) {
                 result.hostsSkippedAlreadyRegistered++;
-                continue;
-            }
-            if (data.attempts.count >= MAX_DEVICES_PER_AUTO_IMPORT_RUN) {
-                result.isTruncated = true;
-                break;
+                /*
+                 * A stale scan can claim a deleted device is still registered. With
+                 * no live row there is neither a safe binding nor enough intent to
+                 * recreate it from old data, so preserve the established skip.
+                 */
+                if (!networkDevice) {
+                    continue;
+                }
             }
             if (result.matchedIpAddressSample.length < MAX_MATCHED_IP_SAMPLE) {
-                result.matchedIpAddressSample.push(host.ipAddress);
+                if (!result.matchedIpAddressSample.includes(host.ipAddress)) {
+                    result.matchedIpAddressSample.push(host.ipAddress);
+                }
             }
-            if (data.isDryRun) {
-                /*
-                 * A dry run reports the device as "created" in no counter at all —
-                 * hostsMatched minus hostsSkippedAlreadyRegistered is exactly what a
-                 * real run would attempt, and the sample above says which hosts.
-                 * The address still joins the set, simulating the create's dedupe:
-                 * without this, a host on duplicate rows (or in two overlapping
-                 * scans) would be counted as importable once per appearance, and
-                 * the dry run would promise more than the real run does.
-                 */
-                data.attempts.count++;
-                data.existingHostnames.add(host.ipAddress);
+            if (!networkDevice) {
+                if (data.attempts.deviceCount >= MAX_DEVICES_PER_AUTO_IMPORT_RUN) {
+                    result.isTruncated = true;
+                    break;
+                }
+                if (data.isDryRun) {
+                    /*
+                     * Add a fully-shaped in-memory device to simulate the create. Its
+                     * generated id never leaves this process; it merely lets monitor
+                     * reconciliation deduplicate the same host across duplicate rows
+                     * and overlapping scans exactly as a real run would.
+                     */
+                    data.attempts.deviceCount++;
+                    networkDevice = buildNetworkDeviceFromDiscoveredHost({
+                        projectId: scan.projectId,
+                        host: host,
+                        scan: scan,
+                        autoApplyVendorHealthTemplate: true,
+                    });
+                    networkDevice.id = ObjectID.generate();
+                    data.existingDevices.set(host.ipAddress, networkDevice);
+                }
+                else {
+                    const createResult = await this.createDeviceForHost({
+                        projectId: scan.projectId,
+                        scan: scan,
+                        host: host,
+                        existingDevices: data.existingDevices,
+                        result: result,
+                        attempts: data.attempts,
+                    });
+                    networkDevice = createResult.device || undefined;
+                    deviceWasCreated = createResult.wasCreated;
+                    if (!networkDevice) {
+                        continue;
+                    }
+                }
+            }
+            if (deviceWasCreated) {
+                createdIpAddresses.push(host.ipAddress);
+            }
+            if (templateIds.length === 0) {
                 continue;
             }
-            const wasCreated = await this.createDeviceForHost({
+            const monitorsWereTruncated = await this.ensureMonitorsForDevice({
                 projectId: scan.projectId,
-                scan: scan,
                 host: host,
-                existingHostnames: data.existingHostnames,
+                networkDevice: networkDevice,
+                templateIds: templateIds,
+                monitorTemplates: data.monitorTemplates,
+                existingMonitors: data.existingMonitors,
                 result: result,
                 attempts: data.attempts,
+                isDryRun: data.isDryRun,
             });
-            if (wasCreated) {
-                createdIpAddresses.push(host.ipAddress);
+            if (monitorsWereTruncated) {
+                result.isTruncated = true;
+                break;
             }
         }
         return createdIpAddresses;
     }
+    async ensureMonitorsForDevice(data) {
+        /*
+         * A Network Device monitor is evaluated from SNMP walks. A ping-only
+         * import intentionally has polling disabled and can never supply those
+         * results. Rule validation prevents this combination, while this guard
+         * keeps legacy or directly-written rows from creating inert monitors.
+         */
+        if (monitoringMethodForDiscoveredHost(data.host) ===
+            NetworkDeviceMonitoringMethod.Monitor ||
+            NetworkDeviceMonitoringMethodUtil.isMonitorBacked(data.networkDevice.monitoringMethod)) {
+            data.result.monitorsSkippedUnsupportedHost += data.templateIds.length;
+            return false;
+        }
+        if (!data.networkDevice.id) {
+            data.result.monitorsFailed += data.templateIds.length;
+            logger.error(`Auto-import: cannot provision monitor(s) for ${data.host.ipAddress} because the Network Device has no id.`, { projectId: data.projectId.toString() });
+            return false;
+        }
+        const networkDeviceId = data.networkDevice.id;
+        const networkDeviceIdString = networkDeviceId.toString();
+        const pendingTemplateIds = [];
+        /*
+         * The project-wide snapshot is complete and indexed. Settle everything
+         * it already covers before issuing the narrow JSON race-check query; an
+         * established fleet whose monitors are already reconciled must not do one
+         * full monitor-table search per discovered device on every scan.
+         */
+        for (const templateId of data.templateIds) {
+            const key = NetworkDeviceAutoImportRuleEngineServiceClass.monitorProvisioningKey(networkDeviceId, templateId);
+            if (data.existingMonitors.autoProvisionedKeys.has(key)) {
+                data.result.monitorsSkippedAlreadyExisting++;
+                continue;
+            }
+            if (data.existingMonitors.attemptedProvisioningKeys.has(key)) {
+                continue;
+            }
+            pendingTemplateIds.push(templateId);
+        }
+        if (pendingTemplateIds.length === 0) {
+            return false;
+        }
+        if (data.existingMonitors.manuallyMonitoredDeviceIds.has(networkDeviceIdString)) {
+            data.result.monitorsSkippedAlreadyExisting += pendingTemplateIds.length;
+            return false;
+        }
+        /*
+         * Do not run the unindexed JSON race-check after this run's monitor-work
+         * budget is already exhausted. The device remains unreconciled and the
+         * truncated marker protocol brings it back on the next bounded pass.
+         */
+        if (data.attempts.monitorCount >= MAX_MONITORS_PER_AUTO_IMPORT_RUN) {
+            return true;
+        }
+        if (!data.isDryRun) {
+            await this.refreshExistingMonitorsForDevice({
+                projectId: data.projectId,
+                networkDeviceId: networkDeviceId,
+                state: data.existingMonitors,
+            });
+        }
+        if (data.existingMonitors.manuallyMonitoredDeviceIds.has(networkDeviceIdString)) {
+            data.result.monitorsSkippedAlreadyExisting += pendingTemplateIds.length;
+            return false;
+        }
+        for (const templateId of pendingTemplateIds) {
+            const key = NetworkDeviceAutoImportRuleEngineServiceClass.monitorProvisioningKey(networkDeviceId, templateId);
+            /* The race-check may have found this key after the initial snapshot. */
+            if (data.existingMonitors.autoProvisionedKeys.has(key)) {
+                data.result.monitorsSkippedAlreadyExisting++;
+                continue;
+            }
+            if (data.attempts.monitorCount >= MAX_MONITORS_PER_AUTO_IMPORT_RUN) {
+                return true;
+            }
+            data.attempts.monitorCount++;
+            data.existingMonitors.attemptedProvisioningKeys.add(key);
+            /*
+             * Invalid or concurrently deleted templates are failed attempts too.
+             * Count them inside the same cap before looking up the cached template;
+             * otherwise one stale rule could walk and log an unbounded estate in a
+             * single API request or worker tick.
+             */
+            const template = data.monitorTemplates.get(templateId);
+            if (!template) {
+                data.result.monitorsFailed++;
+                logger.error(`Auto-import: Network Device monitor template ${templateId} is missing, deleted, or not valid for project ${data.projectId.toString()}.`, { projectId: data.projectId.toString() });
+                continue;
+            }
+            if (data.isDryRun) {
+                data.result.monitorsWouldCreate++;
+                data.existingMonitors.autoProvisionedKeys.add(key);
+                continue;
+            }
+            try {
+                const monitor = NetworkDeviceMonitorTemplateUtil.buildMonitor({
+                    template: template,
+                    networkDevice: data.networkDevice,
+                });
+                await MonitorService.create({
+                    data: monitor,
+                    props: {
+                        isRoot: true,
+                        tenantId: data.projectId,
+                    },
+                });
+                data.existingMonitors.autoProvisionedKeys.add(key);
+                data.result.monitorsCreated++;
+            }
+            catch (error) {
+                /*
+                 * The partial unique index is the final race backstop. If another
+                 * writer won between our cache read and create, classify that as an
+                 * idempotent skip; otherwise expose a real provisioning failure and
+                 * leave the key absent so a later scan or Run Now can retry it.
+                 */
+                const createdMeanwhile = await MonitorService.findOneBy({
+                    query: {
+                        projectId: data.projectId,
+                        monitorType: MonitorType.NetworkDevice,
+                        monitorTemplateId: new ObjectID(templateId),
+                        autoProvisionedNetworkDeviceId: networkDeviceId,
+                    },
+                    select: {
+                        _id: true,
+                        monitorType: true,
+                        monitorSteps: true,
+                        monitorTemplateId: true,
+                        autoProvisionedNetworkDeviceId: true,
+                    },
+                    props: { isRoot: true },
+                });
+                if (createdMeanwhile) {
+                    this.recordExistingMonitor(data.existingMonitors, createdMeanwhile);
+                    if (data.existingMonitors.autoProvisionedKeys.has(key)) {
+                        data.result.monitorsSkippedAlreadyExisting++;
+                        continue;
+                    }
+                }
+                data.result.monitorsFailed++;
+                logger.error(`Auto-import: could not create monitor from template ${templateId} for Network Device ${networkDeviceId.toString()} (${data.host.ipAddress}): ${error}`, { projectId: data.projectId.toString() });
+            }
+        }
+        return false;
+    }
     /*
      * One host -> one device, with the collision protocol the estate needs:
      *
@@ -582,7 +1068,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
      */
     async createDeviceForHost(data) {
         var _a;
-        data.attempts.count++;
+        data.attempts.deviceCount++;
         const attemptCreate = async (name) => {
             const device = buildNetworkDeviceFromDiscoveredHost({
                 projectId: data.projectId,
@@ -597,15 +1083,17 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
                  */
                 autoApplyVendorHealthTemplate: true,
             });
-            await NetworkDeviceService.create({
+            const created = await NetworkDeviceService.create({
                 data: device,
                 props: {
                     isRoot: true,
                 },
             });
+            return created || device;
         };
+        let createdDevice;
         try {
-            await attemptCreate();
+            createdDevice = await attemptCreate();
         }
         catch (firstError) {
             const registeredMeanwhile = await NetworkDeviceService.findOneBy({
@@ -613,27 +1101,33 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
                     projectId: data.projectId,
                     hostname: data.host.ipAddress,
                 },
-                select: { _id: true },
+                select: {
+                    _id: true,
+                    projectId: true,
+                    name: true,
+                    hostname: true,
+                    monitoringMethod: true,
+                },
                 props: { isRoot: true },
             });
             if (registeredMeanwhile) {
                 // Skipped is a sub-bucket of matched, same as the other run results.
                 data.result.hostsSkippedAlreadyRegistered++;
-                data.existingHostnames.add(data.host.ipAddress);
-                return false;
+                data.existingDevices.set(data.host.ipAddress, registeredMeanwhile);
+                return { device: registeredMeanwhile, wasCreated: false };
             }
             try {
-                await attemptCreate(buildFallbackDeviceName(data.host));
+                createdDevice = await attemptCreate(buildFallbackDeviceName(data.host));
             }
             catch (secondError) {
                 data.result.devicesFailed++;
                 logger.error(`Auto-import: could not create a device for ${data.host.ipAddress} (scan ${(_a = data.scan.id) === null || _a === void 0 ? void 0 : _a.toString()}): ${firstError} / retry: ${secondError}`, { projectId: data.projectId.toString() });
-                return false;
+                return { device: null, wasCreated: false };
             }
         }
         data.result.devicesCreated++;
-        data.existingHostnames.add(data.host.ipAddress);
-        return true;
+        data.existingDevices.set(data.host.ipAddress, createdDevice);
+        return { device: createdDevice, wasCreated: true };
     }
     /*
      * The one write this engine makes to the scan row: retire the consumed