@oneuptime/common 12.0.25 → 12.0.27

package/build/dist/Server/Utils/Monitor/MonitorIncident.js

@@ -61,15 +61,18 @@ export default class MonitorIncident {
             },
         });
         // check if should close the incident.
+        const resolvedIncidentIds = new Set();
         for (const openIncident of openIncidents) {
             const shouldClose = this.shouldCloseIncident({
                 openIncident,
                 autoResolveCriteriaInstanceIdIncidentIdsDictionary: input.autoResolveCriteriaInstanceIdIncidentIdsDictionary,
                 criteriaInstance: input.criteriaInstance,
                 breachingSeriesFingerprints: input.breachingSeriesFingerprints,
+                breachingSeriesFingerprintsByCriteriaId: input.breachingSeriesFingerprintsByCriteriaId,
                 disableSeriesAbsenceResolution: input.disableSeriesAbsenceResolution,
             });
             if (shouldClose) {
+                resolvedIncidentIds.add(openIncident.id.toString());
                 // then resolve incident.
                 await this.resolveOpenIncident({
                     openIncident: openIncident,
@@ -88,7 +91,19 @@ export default class MonitorIncident {
                 });
             }
         }
-        return openIncidents;
+        /*
+         * Return the incidents still open AFTER this pass. The create path
+         * dedupes against this list, and an incident this pass just resolved
+         * must not count as "already active" — that combination resolved a
+         * stale whole-monitor incident and then refused to create the
+         * per-series incidents meant to replace it.
+         */
+        if (resolvedIncidentIds.size === 0) {
+            return openIncidents;
+        }
+        return openIncidents.filter((openIncident) => {
+            return !resolvedIncidentIds.has(openIncident.id.toString());
+        });
     }
     /**
      * Event-driven (incoming-request / webhook) resolution: resolve the
@@ -163,7 +178,7 @@ export default class MonitorIncident {
         }
     }
     static async criteriaMetCreateIncidentsAndUpdateMonitorStatus(input) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, _15, _16;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, _15, _16, _17, _18, _19;
         const incidentLogAttributes = {
             projectId: (_a = input.monitor.projectId) === null || _a === void 0 ? void 0 : _a.toString(),
         };
@@ -180,19 +195,37 @@ export default class MonitorIncident {
             }))
             : undefined;
         // check active incidents and if there are open incidents, do not cretae anothr incident.
-        const openIncidents = await this.checkOpenIncidentsAndCloseIfResolved({
-            monitorId: input.monitor.id,
-            autoResolveCriteriaInstanceIdIncidentIdsDictionary: input.autoResolveCriteriaInstanceIdIncidentIdsDictionary,
-            rootCause: input.rootCause,
-            criteriaInstance: input.criteriaInstance,
-            dataToProcess: input.dataToProcess,
-            evaluationSummary: input.evaluationSummary,
-            breachingSeriesFingerprints,
-            disableSeriesAbsenceResolution: input.disableSeriesAbsenceResolution,
-        });
+        const openIncidents = input.openIncidents !== undefined
+            ? input.openIncidents
+            : await this.checkOpenIncidentsAndCloseIfResolved({
+                monitorId: input.monitor.id,
+                autoResolveCriteriaInstanceIdIncidentIdsDictionary: input.autoResolveCriteriaInstanceIdIncidentIdsDictionary,
+                rootCause: input.rootCause,
+                criteriaInstance: input.criteriaInstance,
+                dataToProcess: input.dataToProcess,
+                evaluationSummary: input.evaluationSummary,
+                breachingSeriesFingerprints,
+                breachingSeriesFingerprintsByCriteriaId: input.breachingSeriesFingerprintsByCriteriaId,
+                disableSeriesAbsenceResolution: input.disableSeriesAbsenceResolution,
+            });
         if (!((_c = input.criteriaInstance.data) === null || _c === void 0 ? void 0 : _c.createIncidents)) {
             return;
         }
+        /*
+         * Checked once, up front. It used to be tested deep inside the
+         * template x series loops with a `return`, which on a grouped
+         * monitor abandoned every series after the first.
+         */
+        if (DisableAutomaticIncidentCreation) {
+            (_d = input.evaluationSummary) === null || _d === void 0 ? void 0 : _d.events.push({
+                type: "incident-skipped",
+                title: "Incident creation skipped",
+                message: "Automatic incident creation is disabled by environment configuration.",
+                relatedCriteriaId: (_e = input.criteriaInstance.data) === null || _e === void 0 ? void 0 : _e.id,
+                at: OneUptimeDate.getCurrentDate(),
+            });
+            return;
+        }
         /*
          * Alert-dependency suppression: a parent monitor is in a suppressing
          * status (offline by default), so skip creating any incident for this
@@ -200,14 +233,14 @@ export default class MonitorIncident {
          * purpose — an incident raised before the parent went down must still
          * resolve normally; only new creation is silenced.
          */
-        if ((_d = input.dependencySuppression) === null || _d === void 0 ? void 0 : _d.isSuppressed) {
+        if ((_f = input.dependencySuppression) === null || _f === void 0 ? void 0 : _f.isSuppressed) {
             const suppressionReason = MonitorDependencySuppression.buildSuppressionReason(input.dependencySuppression.suppressingParents);
-            logger.debug(`${(_e = input.monitor.id) === null || _e === void 0 ? void 0 : _e.toString()} - Skipping incident creation: ${suppressionReason}.`, incidentLogAttributes);
-            (_f = input.evaluationSummary) === null || _f === void 0 ? void 0 : _f.events.push({
+            logger.debug(`${(_g = input.monitor.id) === null || _g === void 0 ? void 0 : _g.toString()} - Skipping incident creation: ${suppressionReason}.`, incidentLogAttributes);
+            (_h = input.evaluationSummary) === null || _h === void 0 ? void 0 : _h.events.push({
                 type: "incident-skipped",
                 title: "Incident suppressed by monitor dependency",
                 message: `Skipped creating incidents because ${suppressionReason}. This monitor's status still updates normally; open incidents still auto-resolve.`,
-                relatedCriteriaId: (_g = input.criteriaInstance.data) === null || _g === void 0 ? void 0 : _g.id,
+                relatedCriteriaId: (_j = input.criteriaInstance.data) === null || _j === void 0 ? void 0 : _j.id,
                 at: OneUptimeDate.getCurrentDate(),
             });
             return;
@@ -247,320 +280,337 @@ export default class MonitorIncident {
          * created incident's owners alongside the criteria-configured ones.
          */
         let networkDeviceOwners = null;
-        for (const criteriaIncident of ((_h = input.criteriaInstance.data) === null || _h === void 0 ? void 0 : _h.incidents) ||
+        for (const criteriaIncident of ((_k = input.criteriaInstance.data) === null || _k === void 0 ? void 0 : _k.incidents) ||
             []) {
             for (const seriesMatch of seriesToProcess) {
-                const seriesFingerprint = seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.fingerprint;
-                const seriesLabels = seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.labels;
-                const seriesRootCause = (seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.rootCause) || input.rootCause;
-                /*
-                 * Per-series scheduled-maintenance suppression: this series'
-                 * resource is inside an ongoing maintenance window, so skip
-                 * creating an incident for it. Other series on the same monitor
-                 * whose resources are not under maintenance still get incidents.
-                 * Note: we only suppress *new* creation — any incident already
-                 * open for this series is left to the normal resolve path
-                 * (checkOpenIncidentsAndCloseIfResolved still sees the full
-                 * breaching set), so a real incident raised before maintenance
-                 * is not silently closed.
-                 */
-                if (seriesFingerprint &&
-                    ((_j = input.suppressedSeriesFingerprints) === null || _j === void 0 ? void 0 : _j.has(seriesFingerprint))) {
-                    logger.debug(`${(_k = input.monitor.id) === null || _k === void 0 ? void 0 : _k.toString()} - Skipping incident for series ${seriesFingerprint}: its resource is under an active scheduled maintenance window.`, incidentLogAttributes);
-                    (_l = input.evaluationSummary) === null || _l === void 0 ? void 0 : _l.events.push({
-                        type: "incident-skipped",
-                        title: "Incident suppressed by scheduled maintenance",
-                        message: "Skipped creating an incident because the resource for this series is under an active scheduled maintenance window.",
-                        relatedCriteriaId: (_m = input.criteriaInstance.data) === null || _m === void 0 ? void 0 : _m.id,
-                        at: OneUptimeDate.getCurrentDate(),
-                    });
-                    continue;
-                }
-                /*
-                 * Dedupe match must mirror the create path below (which sets
-                 * `createdCriteriaId` / `createdIncidentTemplateId` only when the
-                 * corresponding id is present). A criteria incident template can be
-                 * missing its `id` (legacy/API-authored criteria), so guard the
-                 * `.toString()` with `?.` — an unguarded call previously threw
-                 * "Cannot read properties of undefined (reading 'toString')" here and
-                 * failed the probe/telemetry queue job on every cycle for the affected
-                 * monitor. Normalise both sides to `undefined` on missing so a created
-                 * incident (whose template id was left NULL) still matches itself next
-                 * cycle instead of being recreated as a duplicate.
-                 */
-                const alreadyOpenIncident = openIncidents.find((incident) => {
-                    var _a, _b, _c;
-                    return ((incident.createdCriteriaId || undefined) ===
-                        (((_b = (_a = input.criteriaInstance.data) === null || _a === void 0 ? void 0 : _a.id) === null || _b === void 0 ? void 0 : _b.toString()) || undefined) &&
-                        (incident.createdIncidentTemplateId || undefined) ===
-                            (((_c = criteriaIncident.id) === null || _c === void 0 ? void 0 : _c.toString()) || undefined) &&
-                        (incident.seriesFingerprint || undefined) === seriesFingerprint);
-                });
-                const hasAlreadyOpenIncident = Boolean(alreadyOpenIncident);
-                logger.debug(`${(_o = input.monitor.id) === null || _o === void 0 ? void 0 : _o.toString()} - Open Incident ${(_p = alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.id) === null || _p === void 0 ? void 0 : _p.toString()}`, incidentLogAttributes);
-                logger.debug(`${(_q = input.monitor.id) === null || _q === void 0 ? void 0 : _q.toString()} - Has open incident ${hasAlreadyOpenIncident}`, incidentLogAttributes);
-                if (hasAlreadyOpenIncident) {
+                try {
+                    const seriesFingerprint = seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.fingerprint;
+                    const seriesLabels = seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.labels;
+                    const seriesRootCause = (seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.rootCause) || input.rootCause;
                     /*
-                     * Use the open incident's already-rendered title when
-                     * available — the template (`criteriaIncident.title`) still
-                     * contains unresolved `{{…}}` placeholders because it's the
-                     * criterion's template string, not the instance's rendered
-                     * output. Falling back to the template only when the open
-                     * incident somehow has no title.
+                     * Per-series scheduled-maintenance suppression: this series'
+                     * resource is inside an ongoing maintenance window, so skip
+                     * creating an incident for it. Other series on the same monitor
+                     * whose resources are not under maintenance still get incidents.
+                     * Note: we only suppress *new* creation — any incident already
+                     * open for this series is left to the normal resolve path
+                     * (checkOpenIncidentsAndCloseIfResolved still sees the full
+                     * breaching set), so a real incident raised before maintenance
+                     * is not silently closed.
                      */
-                    const renderedTitle = (alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.title) || criteriaIncident.title;
-                    (_r = input.evaluationSummary) === null || _r === void 0 ? void 0 : _r.events.push({
-                        type: "incident-skipped",
-                        title: `Incident already active: ${renderedTitle}`,
-                        message: "Skipped creating a new incident because an active incident exists for this criteria.",
-                        relatedCriteriaId: (_s = input.criteriaInstance.data) === null || _s === void 0 ? void 0 : _s.id,
-                        relatedIncidentId: (_t = alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.id) === null || _t === void 0 ? void 0 : _t.toString(),
-                        relatedIncidentNumber: alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.incidentNumber,
-                        relatedIncidentNumberWithPrefix: alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.incidentNumberWithPrefix,
-                        at: OneUptimeDate.getCurrentDate(),
-                    });
-                    continue;
-                }
-                logger.debug(`${(_u = input.monitor.id) === null || _u === void 0 ? void 0 : _u.toString()} - Create incident.`, incidentLogAttributes);
-                const incident = new Incident();
-                const storageMap = MonitorTemplateUtil.buildTemplateStorageMap({
-                    monitorType: input.monitor.monitorType,
-                    dataToProcess: input.dataToProcess,
-                    monitor: input.monitor,
-                    seriesLabels,
-                });
-                incident.title = MonitorTemplateUtil.processTemplateString({
-                    value: criteriaIncident.title,
-                    storageMap,
-                });
-                incident.description = MonitorTemplateUtil.processTemplateString({
-                    value: criteriaIncident.description,
-                    storageMap,
-                });
-                /*
-                 * Resolve the incident severity. `criteriaIncident.incidentSeverityId`
-                 * can be a truthy-but-EMPTY ObjectID (id === "") — a stored
-                 * `{"_type":"ObjectID","value":""}` deserializes to `new ObjectID("")`,
-                 * which is an object so `!incidentSeverityId` is false. That empty id
-                 * serializes to "" for the `uuid` (not-null) column and lands as NULL,
-                 * throwing 23502 inside the probe-ingest worker and retrying forever.
-                 * Use `?.toString()` truthiness so an empty/blank ObjectID is treated
-                 * the same as "missing" and falls through to the project-default lookup.
-                 */
-                /*
-                 * A criteria severity that belongs to *another* project is rejected by
-                 * IncidentService on create. Throwing here would fail the whole
-                 * probe/telemetry ingest job for this monitor — no incident, and no
-                 * payload or monitor log persisted either, because those run after the
-                 * create. Treat it as "missing" and fall back to this project's own
-                 * default, which is also what stops the bad id spreading onto new
-                 * incidents. monitorSteps can still hold one: the 1785240000000
-                 * repair skipped ids it could not resolve.
-                 */
-                const isCriteriaSeverityUsable = await ProjectScopedReferenceValidator.isUsableInProject({
-                    projectId: input.monitor.projectId,
-                    id: criteriaIncident.incidentSeverityId,
-                    service: IncidentSeverityService,
-                });
-                if (((_v = criteriaIncident.incidentSeverityId) === null || _v === void 0 ? void 0 : _v.toString()) &&
-                    !isCriteriaSeverityUsable) {
-                    logger.error(`${(_w = input.monitor.id) === null || _w === void 0 ? void 0 : _w.toString()} - Criteria "${(_x = input.criteriaInstance.data) === null || _x === void 0 ? void 0 : _x.name}" references incident severity ${criteriaIncident.incidentSeverityId.toString()}, which does not belong to project ${(_y = input.monitor.projectId) === null || _y === void 0 ? void 0 : _y.toString()}. Falling back to this project's default severity.`);
-                }
-                if (!isCriteriaSeverityUsable) {
-                    // pick the critical (first/lowest-order root) severity.
-                    const severity = await IncidentSeverityService.findOneBy({
-                        query: {
-                            projectId: input.monitor.projectId,
-                        },
-                        sort: {
-                            order: SortOrder.Ascending,
-                        },
-                        props: {
-                            isRoot: true,
-                        },
-                        select: {
-                            _id: true,
-                        },
+                    if (seriesFingerprint &&
+                        ((_l = input.suppressedSeriesFingerprints) === null || _l === void 0 ? void 0 : _l.has(seriesFingerprint))) {
+                        logger.debug(`${(_m = input.monitor.id) === null || _m === void 0 ? void 0 : _m.toString()} - Skipping incident for series ${seriesFingerprint}: its resource is under an active scheduled maintenance window.`, incidentLogAttributes);
+                        (_o = input.evaluationSummary) === null || _o === void 0 ? void 0 : _o.events.push({
+                            type: "incident-skipped",
+                            title: "Incident suppressed by scheduled maintenance",
+                            message: "Skipped creating an incident because the resource for this series is under an active scheduled maintenance window.",
+                            relatedCriteriaId: (_p = input.criteriaInstance.data) === null || _p === void 0 ? void 0 : _p.id,
+                            at: OneUptimeDate.getCurrentDate(),
+                        });
+                        continue;
+                    }
+                    /*
+                     * Dedupe match must mirror the create path below (which sets
+                     * `createdCriteriaId` / `createdIncidentTemplateId` only when the
+                     * corresponding id is present). A criteria incident template can be
+                     * missing its `id` (legacy/API-authored criteria), so guard the
+                     * `.toString()` with `?.` — an unguarded call previously threw
+                     * "Cannot read properties of undefined (reading 'toString')" here and
+                     * failed the probe/telemetry queue job on every cycle for the affected
+                     * monitor. Normalise both sides to `undefined` on missing so a created
+                     * incident (whose template id was left NULL) still matches itself next
+                     * cycle instead of being recreated as a duplicate.
+                     */
+                    const alreadyOpenIncident = openIncidents.find((incident) => {
+                        var _a, _b, _c;
+                        return ((incident.createdCriteriaId || undefined) ===
+                            (((_b = (_a = input.criteriaInstance.data) === null || _a === void 0 ? void 0 : _a.id) === null || _b === void 0 ? void 0 : _b.toString()) || undefined) &&
+                            (incident.createdIncidentTemplateId || undefined) ===
+                                (((_c = criteriaIncident.id) === null || _c === void 0 ? void 0 : _c.toString()) || undefined) &&
+                            (incident.seriesFingerprint || undefined) === seriesFingerprint);
                     });
-                    if (!((_z = severity === null || severity === void 0 ? void 0 : severity.id) === null || _z === void 0 ? void 0 : _z.toString())) {
+                    const hasAlreadyOpenIncident = Boolean(alreadyOpenIncident);
+                    logger.debug(`${(_q = input.monitor.id) === null || _q === void 0 ? void 0 : _q.toString()} - Open Incident ${(_r = alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.id) === null || _r === void 0 ? void 0 : _r.toString()}`, incidentLogAttributes);
+                    logger.debug(`${(_s = input.monitor.id) === null || _s === void 0 ? void 0 : _s.toString()} - Has open incident ${hasAlreadyOpenIncident}`, incidentLogAttributes);
+                    if (hasAlreadyOpenIncident) {
                         /*
-                         * The project has no incident severity configured. Throwing here
-                         * would fail the entire probe/telemetry ingest job, which then
-                         * retries forever for a misconfiguration the worker cannot fix.
-                         * Skip incident creation gracefully and log instead.
+                         * Use the open incident's already-rendered title when
+                         * available — the template (`criteriaIncident.title`) still
+                         * contains unresolved `{{…}}` placeholders because it's the
+                         * criterion's template string, not the instance's rendered
+                         * output. Falling back to the template only when the open
+                         * incident somehow has no title.
                          */
-                        logger.error(`${(_0 = input.monitor.id) === null || _0 === void 0 ? void 0 : _0.toString()} - Cannot create incident: project ${(_1 = input.monitor.projectId) === null || _1 === void 0 ? void 0 : _1.toString()} has no incident severity configured. Skipping incident creation for criteria "${(_2 = input.criteriaInstance.data) === null || _2 === void 0 ? void 0 : _2.name}".`);
-                        (_3 = input.evaluationSummary) === null || _3 === void 0 ? void 0 : _3.events.push({
+                        const renderedTitle = (alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.title) || criteriaIncident.title;
+                        (_t = input.evaluationSummary) === null || _t === void 0 ? void 0 : _t.events.push({
                             type: "incident-skipped",
-                            title: "Incident creation skipped",
-                            message: "Skipped creating an incident because the project has no incident severity configured.",
-                            relatedCriteriaId: (_4 = input.criteriaInstance.data) === null || _4 === void 0 ? void 0 : _4.id,
+                            title: `Incident already active: ${renderedTitle}`,
+                            message: "Skipped creating a new incident because an active incident exists for this criteria.",
+                            relatedCriteriaId: (_u = input.criteriaInstance.data) === null || _u === void 0 ? void 0 : _u.id,
+                            relatedIncidentId: (_v = alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.id) === null || _v === void 0 ? void 0 : _v.toString(),
+                            relatedIncidentNumber: alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.incidentNumber,
+                            relatedIncidentNumberWithPrefix: alreadyOpenIncident === null || alreadyOpenIncident === void 0 ? void 0 : alreadyOpenIncident.incidentNumberWithPrefix,
                             at: OneUptimeDate.getCurrentDate(),
                         });
                         continue;
                     }
-                    incident.incidentSeverityId = severity.id;
-                }
-                else {
-                    incident.incidentSeverityId = criteriaIncident.incidentSeverityId;
-                }
-                incident.monitors = [input.monitor];
-                incident.projectId = input.monitor.projectId;
-                incident.rootCause = seriesRootCause;
-                incident.createdStateLog = JSON.parse(JSON.stringify(input.dataToProcess, null, 2));
-                /*
-                 * Same capture on every incident this evaluation opens - they all
-                 * came from the one check.
-                 */
-                const serializedMonitorSummary = MonitorSummarySnapshotUtil.serialize(input.monitorSummary);
-                if (serializedMonitorSummary) {
-                    incident.monitorSummary = serializedMonitorSummary;
-                }
-                /*
-                 * Guard against missing ids — these are optional reference fields and
-                 * must not crash incident creation (which runs inside the probe /
-                 * telemetry queue workers). A missing id previously threw
-                 * "Cannot read properties of undefined (reading 'toString')" and failed
-                 * the job on every cycle for the affected monitor.
-                 */
-                if ((_5 = input.criteriaInstance.data) === null || _5 === void 0 ? void 0 : _5.id) {
-                    incident.createdCriteriaId =
-                        input.criteriaInstance.data.id.toString();
-                }
-                if (criteriaIncident.id) {
-                    incident.createdIncidentTemplateId = criteriaIncident.id.toString();
-                }
-                if (seriesFingerprint) {
-                    incident.seriesFingerprint = seriesFingerprint;
-                }
-                if (seriesLabels && Object.keys(seriesLabels).length > 0) {
-                    incident.seriesLabels = seriesLabels;
-                    await SeriesResourceLinker.linkSeriesResourcesToModel({
-                        model: incident,
-                        seriesLabels,
-                        projectId: input.monitor.projectId,
+                    logger.debug(`${(_w = input.monitor.id) === null || _w === void 0 ? void 0 : _w.toString()} - Create incident.`, incidentLogAttributes);
+                    const incident = new Incident();
+                    const storageMap = MonitorTemplateUtil.buildTemplateStorageMap({
                         monitorType: input.monitor.monitorType,
+                        dataToProcess: input.dataToProcess,
+                        monitor: input.monitor,
+                        seriesLabels,
                     });
-                }
-                /*
-                 * Deterministic resource link from the monitor's step config
-                 * (resolved once above). Runs for both grouped and ungrouped
-                 * incidents and merges with anything the series-label path
-                 * resolved, so the per-resource Activity tabs always see
-                 * monitor-created incidents.
-                 */
-                SeriesResourceLinker.attachResolvedResources({
-                    model: incident,
-                    resolved: resourceContext,
-                });
-                incident.onCallDutyPolicies =
-                    ((_6 = criteriaIncident.onCallPolicyIds) === null || _6 === void 0 ? void 0 : _6.map((id) => {
-                        const onCallPolicy = new OnCallDutyPolicy();
-                        onCallPolicy._id = id.toString();
-                        return onCallPolicy;
-                    })) || [];
-                // Set labels from criteria
-                incident.labels =
-                    ((_7 = criteriaIncident.labelIds) === null || _7 === void 0 ? void 0 : _7.map((id) => {
-                        const label = new Label();
-                        label._id = id.toString();
-                        return label;
-                    })) || [];
-                incident.isCreatedAutomatically = true;
-                // Set status page visibility (defaults to true if not specified)
-                if (criteriaIncident.showIncidentOnStatusPage !== undefined) {
-                    incident.isVisibleOnStatusPage =
-                        criteriaIncident.showIncidentOnStatusPage;
-                }
-                if (criteriaIncident.isPrivate === true) {
-                    incident.isPrivate = true;
-                }
-                if (input.props.telemetryQuery) {
-                    incident.telemetryQuery = input.props.telemetryQuery;
-                }
-                if (input.dataToProcess &&
-                    input.dataToProcess.probeId) {
-                    incident.createdByProbeId = input.dataToProcess.probeId;
-                }
-                if (criteriaIncident.remediationNotes) {
-                    incident.remediationNotes = MonitorTemplateUtil.processTemplateString({
-                        value: criteriaIncident.remediationNotes,
+                    incident.title = MonitorTemplateUtil.processTemplateString({
+                        value: criteriaIncident.title,
                         storageMap,
                     });
-                }
-                if (DisableAutomaticIncidentCreation) {
-                    (_8 = input.evaluationSummary) === null || _8 === void 0 ? void 0 : _8.events.push({
-                        type: "incident-skipped",
-                        title: "Incident creation skipped",
-                        message: "Automatic incident creation is disabled by environment configuration.",
-                        relatedCriteriaId: (_9 = input.criteriaInstance.data) === null || _9 === void 0 ? void 0 : _9.id,
-                        at: OneUptimeDate.getCurrentDate(),
+                    incident.description = MonitorTemplateUtil.processTemplateString({
+                        value: criteriaIncident.description,
+                        storageMap,
                     });
-                    return;
-                }
-                const createdIncident = await IncidentService.create({
-                    data: incident,
-                    props: {
-                        isRoot: true,
-                    },
-                });
-                /*
-                 * Add owner teams and users after incident creation. Owners
-                 * configured on the criteria template are merged (deduped) with the
-                 * owners of the network device this monitor watches, so device
-                 * ownership flows into the incidents its monitor raises.
-                 */
-                if (networkDeviceOwners === null) {
-                    networkDeviceOwners =
-                        await NetworkDeviceOwnerUserService.getDeviceOwnersForMonitor({
-                            monitor: input.monitor,
-                            monitorStepId: (_10 = input.dataToProcess.monitorStepId) === null || _10 === void 0 ? void 0 : _10.toString(),
+                    /*
+                     * Resolve the incident severity. `criteriaIncident.incidentSeverityId`
+                     * can be a truthy-but-EMPTY ObjectID (id === "") — a stored
+                     * `{"_type":"ObjectID","value":""}` deserializes to `new ObjectID("")`,
+                     * which is an object so `!incidentSeverityId` is false. That empty id
+                     * serializes to "" for the `uuid` (not-null) column and lands as NULL,
+                     * throwing 23502 inside the probe-ingest worker and retrying forever.
+                     * Use `?.toString()` truthiness so an empty/blank ObjectID is treated
+                     * the same as "missing" and falls through to the project-default lookup.
+                     */
+                    /*
+                     * A criteria severity that belongs to *another* project is rejected by
+                     * IncidentService on create. Throwing here would fail the whole
+                     * probe/telemetry ingest job for this monitor — no incident, and no
+                     * payload or monitor log persisted either, because those run after the
+                     * create. Treat it as "missing" and fall back to this project's own
+                     * default, which is also what stops the bad id spreading onto new
+                     * incidents. monitorSteps can still hold one: the 1785240000000
+                     * repair skipped ids it could not resolve.
+                     */
+                    const isCriteriaSeverityUsable = await ProjectScopedReferenceValidator.isUsableInProject({
+                        projectId: input.monitor.projectId,
+                        id: criteriaIncident.incidentSeverityId,
+                        service: IncidentSeverityService,
+                    });
+                    if (((_x = criteriaIncident.incidentSeverityId) === null || _x === void 0 ? void 0 : _x.toString()) &&
+                        !isCriteriaSeverityUsable) {
+                        logger.error(`${(_y = input.monitor.id) === null || _y === void 0 ? void 0 : _y.toString()} - Criteria "${(_z = input.criteriaInstance.data) === null || _z === void 0 ? void 0 : _z.name}" references incident severity ${criteriaIncident.incidentSeverityId.toString()}, which does not belong to project ${(_0 = input.monitor.projectId) === null || _0 === void 0 ? void 0 : _0.toString()}. Falling back to this project's default severity.`);
+                    }
+                    if (!isCriteriaSeverityUsable) {
+                        // pick the critical (first/lowest-order root) severity.
+                        const severity = await IncidentSeverityService.findOneBy({
+                            query: {
+                                projectId: input.monitor.projectId,
+                            },
+                            sort: {
+                                order: SortOrder.Ascending,
+                            },
+                            props: {
+                                isRoot: true,
+                            },
+                            select: {
+                                _id: true,
+                            },
                         });
-                }
-                const ownerUserIds = this.mergeOwnerIds(criteriaIncident.ownerUserIds || [], networkDeviceOwners.ownerUserIds);
-                const ownerTeamIds = this.mergeOwnerIds(criteriaIncident.ownerTeamIds || [], networkDeviceOwners.ownerTeamIds);
-                if (ownerTeamIds.length || ownerUserIds.length) {
-                    await IncidentService.addOwners(input.monitor.projectId, createdIncident.id, ownerUserIds, ownerTeamIds, true, // notify owners
-                    {
-                        isRoot: true,
+                        if (!((_1 = severity === null || severity === void 0 ? void 0 : severity.id) === null || _1 === void 0 ? void 0 : _1.toString())) {
+                            /*
+                             * The project has no incident severity configured. Throwing here
+                             * would fail the entire probe/telemetry ingest job, which then
+                             * retries forever for a misconfiguration the worker cannot fix.
+                             * Skip incident creation gracefully and log instead.
+                             */
+                            logger.error(`${(_2 = input.monitor.id) === null || _2 === void 0 ? void 0 : _2.toString()} - Cannot create incident: project ${(_3 = input.monitor.projectId) === null || _3 === void 0 ? void 0 : _3.toString()} has no incident severity configured. Skipping incident creation for criteria "${(_4 = input.criteriaInstance.data) === null || _4 === void 0 ? void 0 : _4.name}".`);
+                            (_5 = input.evaluationSummary) === null || _5 === void 0 ? void 0 : _5.events.push({
+                                type: "incident-skipped",
+                                title: "Incident creation skipped",
+                                message: "Skipped creating an incident because the project has no incident severity configured.",
+                                relatedCriteriaId: (_6 = input.criteriaInstance.data) === null || _6 === void 0 ? void 0 : _6.id,
+                                at: OneUptimeDate.getCurrentDate(),
+                            });
+                            continue;
+                        }
+                        incident.incidentSeverityId = severity.id;
+                    }
+                    else {
+                        incident.incidentSeverityId = criteriaIncident.incidentSeverityId;
+                    }
+                    incident.monitors = [input.monitor];
+                    incident.projectId = input.monitor.projectId;
+                    incident.rootCause = seriesRootCause;
+                    incident.createdStateLog = JSON.parse(JSON.stringify(input.dataToProcess, null, 2));
+                    /*
+                     * Same capture on every incident this evaluation opens - they all
+                     * came from the one check.
+                     */
+                    const serializedMonitorSummary = MonitorSummarySnapshotUtil.serialize(input.monitorSummary);
+                    if (serializedMonitorSummary) {
+                        incident.monitorSummary = serializedMonitorSummary;
+                    }
+                    /*
+                     * Guard against missing ids — these are optional reference fields and
+                     * must not crash incident creation (which runs inside the probe /
+                     * telemetry queue workers). A missing id previously threw
+                     * "Cannot read properties of undefined (reading 'toString')" and failed
+                     * the job on every cycle for the affected monitor.
+                     */
+                    if ((_7 = input.criteriaInstance.data) === null || _7 === void 0 ? void 0 : _7.id) {
+                        incident.createdCriteriaId =
+                            input.criteriaInstance.data.id.toString();
+                    }
+                    if (criteriaIncident.id) {
+                        incident.createdIncidentTemplateId = criteriaIncident.id.toString();
+                    }
+                    if (seriesFingerprint) {
+                        incident.seriesFingerprint = seriesFingerprint;
+                    }
+                    if (seriesLabels && Object.keys(seriesLabels).length > 0) {
+                        incident.seriesLabels = seriesLabels;
+                        await SeriesResourceLinker.linkSeriesResourcesToModel({
+                            model: incident,
+                            seriesLabels,
+                            projectId: input.monitor.projectId,
+                            monitorType: input.monitor.monitorType,
+                        });
+                    }
+                    /*
+                     * Deterministic resource link from the monitor's step config
+                     * (resolved once above). Runs for both grouped and ungrouped
+                     * incidents and merges with anything the series-label path
+                     * resolved, so the per-resource Activity tabs always see
+                     * monitor-created incidents.
+                     */
+                    SeriesResourceLinker.attachResolvedResources({
+                        model: incident,
+                        resolved: resourceContext,
                     });
-                }
-                // Add incident member role assignments after incident creation
-                if (criteriaIncident.incidentMemberRoles &&
-                    criteriaIncident.incidentMemberRoles.length > 0) {
-                    for (const roleAssignment of criteriaIncident.incidentMemberRoles) {
-                        try {
-                            const assignment = roleAssignment;
-                            if (assignment.roleId && assignment.userId) {
-                                const incidentMember = new IncidentMember();
-                                incidentMember.incidentId = createdIncident.id;
-                                incidentMember.projectId = input.monitor.projectId;
-                                incidentMember.userId = new ObjectID(assignment.userId.toString());
-                                incidentMember.incidentRoleId = new ObjectID(assignment.roleId.toString());
-                                await IncidentMemberService.create({
-                                    data: incidentMember,
-                                    props: {
-                                        isRoot: true,
-                                    },
-                                });
-                                logger.debug(`${(_11 = input.monitor.id) === null || _11 === void 0 ? void 0 : _11.toString()} - Assigned incident member role ${assignment.roleId.toString()} to user ${assignment.userId.toString()}`, incidentLogAttributes);
+                    incident.onCallDutyPolicies =
+                        ((_8 = criteriaIncident.onCallPolicyIds) === null || _8 === void 0 ? void 0 : _8.map((id) => {
+                            const onCallPolicy = new OnCallDutyPolicy();
+                            onCallPolicy._id = id.toString();
+                            return onCallPolicy;
+                        })) || [];
+                    // Set labels from criteria
+                    incident.labels =
+                        ((_9 = criteriaIncident.labelIds) === null || _9 === void 0 ? void 0 : _9.map((id) => {
+                            const label = new Label();
+                            label._id = id.toString();
+                            return label;
+                        })) || [];
+                    incident.isCreatedAutomatically = true;
+                    // Set status page visibility (defaults to true if not specified)
+                    if (criteriaIncident.showIncidentOnStatusPage !== undefined) {
+                        incident.isVisibleOnStatusPage =
+                            criteriaIncident.showIncidentOnStatusPage;
+                    }
+                    if (criteriaIncident.isPrivate === true) {
+                        incident.isPrivate = true;
+                    }
+                    if (input.props.telemetryQuery) {
+                        incident.telemetryQuery = input.props.telemetryQuery;
+                    }
+                    if (input.dataToProcess &&
+                        input.dataToProcess.probeId) {
+                        incident.createdByProbeId = input.dataToProcess.probeId;
+                    }
+                    if (criteriaIncident.remediationNotes) {
+                        incident.remediationNotes =
+                            MonitorTemplateUtil.processTemplateString({
+                                value: criteriaIncident.remediationNotes,
+                                storageMap,
+                            });
+                    }
+                    const createdIncident = await IncidentService.create({
+                        data: incident,
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                    /*
+                     * Add owner teams and users after incident creation. Owners
+                     * configured on the criteria template are merged (deduped) with the
+                     * owners of the network device this monitor watches, so device
+                     * ownership flows into the incidents its monitor raises.
+                     */
+                    if (networkDeviceOwners === null) {
+                        networkDeviceOwners =
+                            await NetworkDeviceOwnerUserService.getDeviceOwnersForMonitor({
+                                monitor: input.monitor,
+                                monitorStepId: (_10 = input.dataToProcess.monitorStepId) === null || _10 === void 0 ? void 0 : _10.toString(),
+                            });
+                    }
+                    const ownerUserIds = this.mergeOwnerIds(criteriaIncident.ownerUserIds || [], networkDeviceOwners.ownerUserIds);
+                    const ownerTeamIds = this.mergeOwnerIds(criteriaIncident.ownerTeamIds || [], networkDeviceOwners.ownerTeamIds);
+                    if (ownerTeamIds.length || ownerUserIds.length) {
+                        await IncidentService.addOwners(input.monitor.projectId, createdIncident.id, ownerUserIds, ownerTeamIds, true, // notify owners
+                        {
+                            isRoot: true,
+                        });
+                    }
+                    // Add incident member role assignments after incident creation
+                    if (criteriaIncident.incidentMemberRoles &&
+                        criteriaIncident.incidentMemberRoles.length > 0) {
+                        for (const roleAssignment of criteriaIncident.incidentMemberRoles) {
+                            try {
+                                const assignment = roleAssignment;
+                                if (assignment.roleId && assignment.userId) {
+                                    const incidentMember = new IncidentMember();
+                                    incidentMember.incidentId = createdIncident.id;
+                                    incidentMember.projectId = input.monitor.projectId;
+                                    incidentMember.userId = new ObjectID(assignment.userId.toString());
+                                    incidentMember.incidentRoleId = new ObjectID(assignment.roleId.toString());
+                                    await IncidentMemberService.create({
+                                        data: incidentMember,
+                                        props: {
+                                            isRoot: true,
+                                        },
+                                    });
+                                    logger.debug(`${(_11 = input.monitor.id) === null || _11 === void 0 ? void 0 : _11.toString()} - Assigned incident member role ${assignment.roleId.toString()} to user ${assignment.userId.toString()}`, incidentLogAttributes);
+                                }
+                            }
+                            catch (memberError) {
+                                logger.error(`${(_12 = input.monitor.id) === null || _12 === void 0 ? void 0 : _12.toString()} - Failed to assign incident member role: ${memberError}`, incidentLogAttributes);
                             }
-                        }
-                        catch (memberError) {
-                            logger.error(`${(_12 = input.monitor.id) === null || _12 === void 0 ? void 0 : _12.toString()} - Failed to assign incident member role: ${memberError}`, incidentLogAttributes);
                         }
                     }
+                    (_13 = input.evaluationSummary) === null || _13 === void 0 ? void 0 : _13.events.push({
+                        type: "incident-created",
+                        title: `Incident created: ${createdIncident.title || criteriaIncident.title}`,
+                        message: `Incident triggered from criteria "${((_14 = input.criteriaInstance.data) === null || _14 === void 0 ? void 0 : _14.name) || "Unnamed criteria"}".`,
+                        relatedCriteriaId: (_15 = input.criteriaInstance.data) === null || _15 === void 0 ? void 0 : _15.id,
+                        relatedIncidentId: (_16 = createdIncident.id) === null || _16 === void 0 ? void 0 : _16.toString(),
+                        relatedIncidentNumber: createdIncident.incidentNumber,
+                        relatedIncidentNumberWithPrefix: createdIncident.incidentNumberWithPrefix,
+                        at: OneUptimeDate.getCurrentDate(),
+                    });
+                }
+                catch (err) {
+                    /*
+                     * One series must not take the rest of the fleet down with it.
+                     * Everything in this loop happens per host/container/key and
+                     * touches the database; an error thrown from here used to
+                     * propagate out of MonitorResource (which has no catch, only a
+                     * `finally` that releases the lock) and abandon every series
+                     * after the failing one, plus the monitor log for the tick.
+                     */
+                    logger.error(`${(_17 = input.monitor.id) === null || _17 === void 0 ? void 0 : _17.toString()} - Failed to create incident${(seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.fingerprint)
+                        ? ` for series ${seriesMatch.fingerprint}`
+                        : ""}.`);
+                    logger.error(err);
+                    (_18 = input.evaluationSummary) === null || _18 === void 0 ? void 0 : _18.events.push({
+                        type: "incident-skipped",
+                        title: "Incident creation failed",
+                        message: `Could not create an incident${(seriesMatch === null || seriesMatch === void 0 ? void 0 : seriesMatch.fingerprint)
+                            ? ` for series ${seriesMatch.fingerprint}`
+                            : ""}: ${err instanceof Error ? err.message : String(err)}`,
+                        relatedCriteriaId: (_19 = input.criteriaInstance.data) === null || _19 === void 0 ? void 0 : _19.id,
+                        at: OneUptimeDate.getCurrentDate(),
+                    });
+                    continue;
                 }
-                (_13 = input.evaluationSummary) === null || _13 === void 0 ? void 0 : _13.events.push({
-                    type: "incident-created",
-                    title: `Incident created: ${createdIncident.title || criteriaIncident.title}`,
-                    message: `Incident triggered from criteria "${((_14 = input.criteriaInstance.data) === null || _14 === void 0 ? void 0 : _14.name) || "Unnamed criteria"}".`,
-                    relatedCriteriaId: (_15 = input.criteriaInstance.data) === null || _15 === void 0 ? void 0 : _15.id,
-                    relatedIncidentId: (_16 = createdIncident.id) === null || _16 === void 0 ? void 0 : _16.toString(),
-                    relatedIncidentNumber: createdIncident.incidentNumber,
-                    relatedIncidentNumberWithPrefix: createdIncident.incidentNumberWithPrefix,
-                    at: OneUptimeDate.getCurrentDate(),
-                });
             }
         }
     }
@@ -627,8 +677,65 @@ export default class MonitorIncident {
             }
         }
     }
+    /**
+     * Is `openIncident`'s series still breaching the criteria that raised
+     * it?
+     *
+     * Prefers the per-criteria dictionary, which answers the question for
+     * the criteria that actually owns this incident. The single-set
+     * fallback only knows the winning criteria's breaches, so it has to
+     * approximate with `createIncidents` — a criteria that creates no
+     * incidents is a recovery criteria whose "matches" are healthy series,
+     * and counting those as breaches would pin an offline incident open
+     * forever.
+     */
+    static isSeriesStillBreaching(input) {
+        var _a, _b, _c, _d;
+        const owningCriteriaId = ((_a = input.openIncident.createdCriteriaId) === null || _a === void 0 ? void 0 : _a.toString()) || undefined;
+        if (input.breachingSeriesFingerprintsByCriteriaId && owningCriteriaId) {
+            return Boolean((_b = input.breachingSeriesFingerprintsByCriteriaId[owningCriteriaId]) === null || _b === void 0 ? void 0 : _b.has(input.openSeriesFingerprint));
+        }
+        const matchedCriteriaCreatesIncidents = ((_d = (_c = input.criteriaInstance) === null || _c === void 0 ? void 0 : _c.data) === null || _d === void 0 ? void 0 : _d.createIncidents) === true;
+        return (matchedCriteriaCreatesIncidents &&
+            input.breachingSeriesFingerprints.has(input.openSeriesFingerprint));
+    }
+    static wasCriteriaEvaluated(input) {
+        var _a;
+        const owningCriteriaId = ((_a = input.openIncident.createdCriteriaId) === null || _a === void 0 ? void 0 : _a.toString()) || undefined;
+        if (!owningCriteriaId) {
+            return true;
+        }
+        return (input.breachingSeriesFingerprintsByCriteriaId[owningCriteriaId] !==
+            undefined);
+    }
+    /**
+     * Did the criteria that raised this incident opt into auto-resolve for
+     * the template that raised it?
+     *
+     * An incident whose `createdIncidentTemplateId` is missing (legacy or
+     * API-authored criteria whose template carries no id) is matched
+     * against the criteria as a whole. Requiring an exact template id
+     * there meant such an incident could never auto-resolve — and, because
+     * it stayed open, its criteria could never raise a new one either.
+     */
+    static isAutoResolveConfiguredForIncident(input) {
+        var _a, _b;
+        const createdCriteriaId = ((_a = input.openIncident.createdCriteriaId) === null || _a === void 0 ? void 0 : _a.toString()) || undefined;
+        if (!createdCriteriaId) {
+            return false;
+        }
+        const autoResolveTemplates = input.autoResolveCriteriaInstanceIdIncidentIdsDictionary[createdCriteriaId];
+        if (!autoResolveTemplates || autoResolveTemplates.length === 0) {
+            return false;
+        }
+        const createdTemplateId = ((_b = input.openIncident.createdIncidentTemplateId) === null || _b === void 0 ? void 0 : _b.toString()) || undefined;
+        if (!createdTemplateId) {
+            return true;
+        }
+        return autoResolveTemplates.includes(createdTemplateId);
+    }
     static shouldCloseIncident(input) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
         const openSeriesFingerprint = input.openIncident.seriesFingerprint || undefined;
         /*
          * Event-driven (incoming-request / webhook) per-key incidents must
@@ -644,66 +751,78 @@ export default class MonitorIncident {
         if (input.disableSeriesAbsenceResolution && openSeriesFingerprint) {
             return false;
         }
-        /*
-         * Per-series auto-resolve: when the monitor emits a breaching-
-         * series set and this open incident has a fingerprint, resolve
-         * whenever the fingerprint is no longer in the set — regardless
-         * of whether some *other* series is still breaching the same
-         * criteria. This is the whole point of per-host incidents.
-         */
-        if (input.breachingSeriesFingerprints !== undefined &&
-            openSeriesFingerprint) {
+        // Per-series mode: this evaluation knows which series are breaching.
+        if (input.breachingSeriesFingerprints !== undefined) {
             /*
-             * The breaching set is the matched criteria's per-series matches.
-             * Only ONE criteria wins per evaluation tick, so on a recovery
-             * tick the matched criteria is the RECOVERY criteria (e.g.
-             * Min(iot_device_up) >= 1) and its "matches" are healthy series —
-             * NOT breaches. Treating them as breaching would leave the open
-             * offline incident's fingerprint in the set and pin it open
-             * forever once no other series is down. So membership only counts
-             * as still-breaching when the matched criteria actually creates
-             * incidents (an offline/breach criteria); a recovery criteria
-             * (createIncidents=false) contributes no breaches and lets the
-             * per-series incident auto-resolve.
+             * A whole-monitor incident (no fingerprint) on a monitor that now
+             * raises incidents per series. It was raised before the monitor
+             * was grouped, and nothing can ever dedupe against it again —
+             * every incident from here on carries a fingerprint. Left alone it
+             * stays open forever while its replacements come and go. Resolve
+             * it, on the same auto-resolve terms as any other incident from
+             * its criteria.
              */
-            const matchedCriteriaCreatesIncidents = ((_b = (_a = input.criteriaInstance) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.createIncidents) === true;
-            const stillBreaching = matchedCriteriaCreatesIncidents &&
-                input.breachingSeriesFingerprints.has(openSeriesFingerprint);
-            if (stillBreaching) {
-                return false;
+            if (!openSeriesFingerprint) {
+                if (input.disableSeriesAbsenceResolution) {
+                    return false;
+                }
+                return MonitorIncident.isAutoResolveConfiguredForIncident({
+                    openIncident: input.openIncident,
+                    autoResolveCriteriaInstanceIdIncidentIdsDictionary: input.autoResolveCriteriaInstanceIdIncidentIdsDictionary,
+                });
             }
             /*
-             * Series no longer breaching. Only auto-close if the criteria
-             * was configured to auto-resolve in the first place; otherwise
-             * stay open so a human can acknowledge.
+             * Per-series auto-resolve: resolve whenever this fingerprint is no
+             * longer breaching the criteria that raised it — regardless of
+             * whether some *other* series is still breaching. That is the
+             * whole point of per-host incidents.
              */
-            if (!((_c = input.openIncident.createdCriteriaId) === null || _c === void 0 ? void 0 : _c.toString())) {
+            if (MonitorIncident.isSeriesStillBreaching({
+                openIncident: input.openIncident,
+                criteriaInstance: input.criteriaInstance,
+                openSeriesFingerprint,
+                breachingSeriesFingerprints: input.breachingSeriesFingerprints,
+                breachingSeriesFingerprintsByCriteriaId: input.breachingSeriesFingerprintsByCriteriaId,
+            })) {
                 return false;
             }
-            if (!((_d = input.openIncident.createdIncidentTemplateId) === null || _d === void 0 ? void 0 : _d.toString())) {
+            /*
+             * The criteria that raised this incident was not evaluated on this
+             * tick at all (disabled, deleted, or the monitor stops at its
+             * first match). Absence of a breaching set for it is not evidence
+             * of recovery, so leave the incident alone.
+             */
+            if (input.breachingSeriesFingerprintsByCriteriaId &&
+                !MonitorIncident.wasCriteriaEvaluated({
+                    openIncident: input.openIncident,
+                    breachingSeriesFingerprintsByCriteriaId: input.breachingSeriesFingerprintsByCriteriaId,
+                })) {
                 return false;
             }
-            const autoResolveTemplates = input.autoResolveCriteriaInstanceIdIncidentIdsDictionary[input.openIncident.createdCriteriaId.toString()];
-            if (autoResolveTemplates &&
-                autoResolveTemplates.includes(input.openIncident.createdIncidentTemplateId.toString())) {
-                return true;
-            }
-            return false;
+            /*
+             * Series no longer breaching. Only auto-close if the criteria was
+             * configured to auto-resolve in the first place; otherwise stay
+             * open so a human can acknowledge.
+             */
+            return MonitorIncident.isAutoResolveConfiguredForIncident({
+                openIncident: input.openIncident,
+                autoResolveCriteriaInstanceIdIncidentIdsDictionary: input.autoResolveCriteriaInstanceIdIncidentIdsDictionary,
+            });
         }
-        if (((_e = input.openIncident.createdCriteriaId) === null || _e === void 0 ? void 0 : _e.toString()) ===
-            ((_h = (_g = (_f = input.criteriaInstance) === null || _f === void 0 ? void 0 : _f.data) === null || _g === void 0 ? void 0 : _g.id) === null || _h === void 0 ? void 0 : _h.toString())) {
+        if (((_a = input.openIncident.createdCriteriaId) === null || _a === void 0 ? void 0 : _a.toString()) ===
+            ((_d = (_c = (_b = input.criteriaInstance) === null || _b === void 0 ? void 0 : _b.data) === null || _c === void 0 ? void 0 : _c.id) === null || _d === void 0 ? void 0 : _d.toString())) {
             // same incident active. So, do not close.
             return false;
         }
         // If antoher criteria is active then, check if the incident id is present in the map.
-        if (!((_j = input.openIncident.createdCriteriaId) === null || _j === void 0 ? void 0 : _j.toString())) {
+        if (!((_e = input.openIncident.createdCriteriaId) === null || _e === void 0 ? void 0 : _e.toString())) {
             return false;
         }
-        if (!((_k = input.openIncident.createdIncidentTemplateId) === null || _k === void 0 ? void 0 : _k.toString())) {
+        if (!((_f = input.openIncident.createdIncidentTemplateId) === null || _f === void 0 ? void 0 : _f.toString())) {
             return false;
         }
-        if (input.autoResolveCriteriaInstanceIdIncidentIdsDictionary[(_l = input.openIncident.createdCriteriaId) === null || _l === void 0 ? void 0 : _l.toString()]) {
-            if ((_o = input.autoResolveCriteriaInstanceIdIncidentIdsDictionary[(_m = input.openIncident.createdCriteriaId) === null || _m === void 0 ? void 0 : _m.toString()]) === null || _o === void 0 ? void 0 : _o.includes((_p = input.openIncident.createdIncidentTemplateId) === null || _p === void 0 ? void 0 : _p.toString())) {
+        if (input.autoResolveCriteriaInstanceIdIncidentIdsDictionary[(_g = input.openIncident.createdCriteriaId) === null || _g === void 0 ? void 0 : _g.toString()]) {
+            if ((_j = input.autoResolveCriteriaInstanceIdIncidentIdsDictionary[(_h = input.openIncident.createdCriteriaId) === null || _h === void 0 ? void 0 : _h.toString()]) === null || _j === void 0 ? void 0 : _j.includes((_k = input.openIncident.createdIncidentTemplateId) === null || _k === void 0 ? void 0 : _k.toString())) {
                 return true;
             }
         }