@oneuptime/common 13.0.5 → 13.0.6

package/build/dist/Server/Services/ServiceLevelObjectiveMonitorRuleEngineService.js

@@ -8,11 +8,22 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import Monitor from "../../Models/DatabaseModels/Monitor";
+import { ServiceLevelObjectiveFeedEventType } from "../../Models/DatabaseModels/ServiceLevelObjectiveFeed";
+import { Gray500, Green500 } from "../../Types/BrandColors";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
-import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { escapeMarkdownInline } from "../../Utils/Markdown/MarkdownEscape";
+import RuleCriteriaMatcher from "../../Utils/Rules/RuleCriteriaMatcher";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
+import QueryHelper from "../Types/Database/QueryHelper";
 import logger from "../Utils/Logger";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
+import SloLegacyMonitorLabelAdoption from "../Utils/Slo/SloLegacyMonitorLabelAdoption";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import MonitorService from "./MonitorService";
+import ServiceLevelObjectiveFeedService from "./ServiceLevelObjectiveFeedService";
+import ServiceLevelObjectiveMonitorRuleService from "./ServiceLevelObjectiveMonitorRuleService";
 import ServiceLevelObjectiveService from "./ServiceLevelObjectiveService";
 function emptyResult() {
     return { monitorIdsAdded: [], monitorIdsRemoved: [] };
@@ -48,27 +59,66 @@ function isSameSet(a, b) {
     }
     return true;
 }
+/*
+ * The rule kind named in logs - and the model this engine evaluates, which
+ * the rule-criteria runtime coverage contract looks for in this file.
+ */
+const RULE_KIND = "ServiceLevelObjectiveMonitorRule";
 /**
- * Keeps an SLO's monitor list in step with its label rule.
+ * Everything the engine needs to know about one rule to decide membership.
+ * `findBy` hands back partial models, so this is the shape actually selected
+ * rather than the full entity. `criteria: true` is load-bearing: without it a
+ * criteria-backed rule reads as a legacy one whose shadowed "(?!)" name
+ * pattern matches nothing.
+ */
+const RULE_SELECT = {
+    _id: true,
+    projectId: true,
+    serviceLevelObjectiveId: true,
+    isEnabled: true,
+    monitorLabels: { _id: true },
+    monitorNamePattern: true,
+    monitorDescriptionPattern: true,
+    criteria: true,
+};
+/*
+ * Feed items name the monitors a sync attached or detached. A rule written
+ * against a whole estate can move thousands at once, so the sentence names a
+ * handful, the "more information" section lists a bounded page of them, and
+ * the rest are counted rather than enumerated.
+ */
+const MAX_MONITORS_NAMED_IN_FEED_HEADLINE = 5;
+const MAX_MONITORS_LISTED_IN_FEED_DETAILS = 50;
+/**
+ * Keeps an SLO's monitor list in step with its monitor rules.
  *
- * An SLO can name a set of monitor labels ("Auto-Add Monitors With Labels").
- * Every monitor in the project carrying at least one of them belongs to the
- * SLO, and stops belonging to it the moment it carries none. Two entry points
- * drive that, because the membership can be invalidated from either side:
+ * An SLO can carry any number of ServiceLevelObjectiveMonitorRule rows ("every
+ * monitor labelled Production", "every monitor whose name starts with api-").
+ * Membership is a UNION at the SLO level: a monitor belongs to the SLO while
+ * at least one ENABLED rule of that SLO matches it, and stops belonging the
+ * moment none does. Two entry points drive that, because membership can be
+ * invalidated from either side:
  *
- *   - the SLO side (its rule changed) -> syncMonitorsForSlo
- *   - the monitor side (its labels changed) -> syncSlosForMonitor
+ *   - the SLO side (one of its rules was created, edited, disabled or
+ *     deleted) -> syncMonitorsForSlo
+ *   - the monitor side (its labels, name or description changed, or it was
+ *     just created) -> syncSlosForMonitor
  *
  * Both write through ServiceLevelObjective.autoAddedMonitors, which records
- * which attachments the rule owns. Only those are ever detached, so a monitor
- * a human attached by hand survives every rule evaluation — including the one
- * that runs when the rule is deleted.
+ * which attachments the rules own. Only those are ever detached, so a monitor
+ * a human attached by hand survives every rule evaluation - including the one
+ * that runs when the last rule is deleted.
+ *
+ * Membership is kept in sync whatever the SLO's own state: a disabled or
+ * archived SLO is skipped by the evaluation worker, not by this engine, so
+ * re-enabling or unarchiving one starts from the right monitor set instead of
+ * whatever it held when it was switched off.
  */
 export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
     /**
-     * Re-evaluates one SLO's label rule against every monitor in its project.
-     * Use when the SLO's rule changed (created, edited, or cleared) — it is the
-     * authoritative, self-healing path and repairs any drift it finds.
+     * Re-evaluates every enabled rule of one SLO against every monitor in its
+     * project. Use when a rule changed - it is the authoritative, self-healing
+     * path and repairs any drift it finds.
      */
     async syncMonitorsForSlo(data) {
         const slo = await ServiceLevelObjectiveService.findOneById({
@@ -76,9 +126,7 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
             select: {
                 _id: true,
                 projectId: true,
-                monitorLabels: {
-                    _id: true,
-                },
+                name: true,
                 monitors: {
                     _id: true,
                 },
@@ -93,31 +141,35 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
         if (!slo || !slo.id || !slo.projectId) {
             return emptyResult();
         }
-        const ruleLabelIds = toIdSet(slo.monitorLabels);
+        const rules = await this.findEnabledRules({
+            projectId: slo.projectId,
+            serviceLevelObjectiveId: slo.id,
+        });
         /*
-         * No rule (or the rule was just cleared) means nothing matches, which in
-         * turn detaches everything the rule had attached. Deleting the rule
-         * therefore undoes the rule rather than leaving its monitors stranded on
-         * an SLO nobody remembers configuring.
+         * No enabled rule (the last one was just disabled or deleted) means
+         * nothing matches, which in turn detaches everything the rules had
+         * attached. Removing the rules therefore undoes them rather than leaving
+         * their monitors stranded on an SLO nobody remembers configuring.
          */
-        const matchedMonitorIds = ruleLabelIds.size === 0
-            ? new Set()
-            : await this.findMonitorIdsWithAnyLabel({
+        const matchedMonitors = rules.length === 0
+            ? []
+            : await this.findMatchingMonitors({
                 projectId: slo.projectId,
-                labelIds: ruleLabelIds,
+                rules: rules,
             });
         return await this.writeMembership({
             slo: slo,
             attachedMonitorIds: toIdSet(slo.monitors),
             autoAddedMonitorIds: toIdSet(slo.autoAddedMonitors),
-            matchedMonitorIds: matchedMonitorIds,
+            matchedMonitorIds: toIdSet(matchedMonitors),
+            knownMonitors: matchedMonitors,
         });
     }
     /**
-     * Re-evaluates every label rule in the project against a single monitor.
-     * Use when the monitor's labels changed: it touches only this monitor's
-     * membership, so it costs one query per project regardless of how many
-     * monitors the rules match.
+     * Re-evaluates every enabled SLO monitor rule in the project against a
+     * single monitor. Use when the monitor changed: it touches only this
+     * monitor's membership, and costs a fixed handful of queries per project
+     * regardless of how many monitors the rules match.
      */
     async syncSlosForMonitor(data) {
         var _a;
@@ -126,6 +178,8 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
             select: {
                 _id: true,
                 projectId: true,
+                name: true,
+                description: true,
                 labels: {
                     _id: true,
                 },
@@ -141,18 +195,113 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
         if (!projectId) {
             return [];
         }
-        const monitorLabelIds = toIdSet(monitor.labels);
         const monitorId = monitor.id.toString();
+        const rules = await this.findEnabledRules({ projectId: projectId });
+        const rulesBySloId = new Map();
+        for (const rule of rules) {
+            const sloId = ((_a = rule.serviceLevelObjectiveId) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+            if (!sloId) {
+                continue;
+            }
+            const sloRules = rulesBySloId.get(sloId) || [];
+            sloRules.push(rule);
+            rulesBySloId.set(sloId, sloRules);
+        }
+        /*
+         * The SLOs this monitor's membership can change on: every SLO with an
+         * enabled rule, plus every SLO that still records this monitor as
+         * rule-attached. The second group has no enabled rule left (a disable or
+         * delete whose own sync failed), so nothing matches there any more and
+         * the monitor is released - without it, that drift would only ever be
+         * repaired by the next edit to a rule on that SLO.
+         */
+        const candidateSloIds = new Set(rulesBySloId.keys());
+        for (const sloId of await this.findSloIdsHoldingAutoAddedMonitor({
+            projectId: projectId,
+            monitorId: monitor.id,
+        })) {
+            candidateSloIds.add(sloId);
+        }
+        if (candidateSloIds.size === 0) {
+            return [];
+        }
+        const results = [];
+        /*
+         * A candidate with no enabled rule is about to have this monitor released.
+         * Before that, one whose monitors were attached by the deprecated label
+         * list - written by a previous-release pod after the one-shot backfill ran
+         * - is given its rule, and synced with it instead. Without this the first
+         * edit to such a monitor silently took it off the SLO. See
+         * SloLegacyMonitorLabelAdoption for why this can do it without bringing
+         * back a rule a user deleted, and for the other places that adopt.
+         */
+        const sloIdsWithoutEnabledRule = Array.from(candidateSloIds).filter((sloId) => {
+            return !rulesBySloId.has(sloId);
+        });
+        if (sloIdsWithoutEnabledRule.length > 0) {
+            let adoptedSloIds = new Set();
+            try {
+                adoptedSloIds = new Set(await SloLegacyMonitorLabelAdoption.adoptLegacyMonitorLabels({
+                    projectId: projectId,
+                    serviceLevelObjectiveIds: sloIdsWithoutEnabledRule,
+                }));
+            }
+            catch (error) {
+                /*
+                 * Whether these SLOs are label-configured is unknown, and releasing
+                 * the monitor from one that is would lose it. They are left alone
+                 * this time; releasing a genuinely stale attachment can wait for the
+                 * next sync.
+                 */
+                logger.error(`Error adopting legacy SLO monitor labels for monitor ${monitorId}; not releasing it from SLOs without an enabled rule this time: ${error}`, {
+                    projectId: projectId.toString(),
+                    monitorId: monitorId,
+                });
+                for (const sloId of sloIdsWithoutEnabledRule) {
+                    candidateSloIds.delete(sloId);
+                }
+            }
+            for (const sloId of sloIdsWithoutEnabledRule) {
+                if (!adoptedSloIds.has(sloId.toLowerCase())) {
+                    continue;
+                }
+                candidateSloIds.delete(sloId);
+                try {
+                    /*
+                     * A full sync, not just this monitor: the new rule also claims every
+                     * other labelled monitor the previous-release engine would have
+                     * attached since.
+                     */
+                    const result = await this.syncMonitorsForSlo({
+                        serviceLevelObjectiveId: new ObjectID(sloId),
+                    });
+                    if (result.monitorIdsAdded.length > 0 ||
+                        result.monitorIdsRemoved.length > 0) {
+                        results.push(result);
+                    }
+                }
+                catch (error) {
+                    logger.error(`Error syncing SLO ${sloId} after adopting its legacy monitor labels for monitor ${monitorId}: ${error}`, {
+                        projectId: projectId.toString(),
+                        monitorId: monitorId,
+                    });
+                }
+            }
+            if (candidateSloIds.size === 0) {
+                return results;
+            }
+        }
         const slos = await ServiceLevelObjectiveService.findBy({
             query: {
                 projectId: projectId,
+                _id: QueryHelper.any(Array.from(candidateSloIds).map((id) => {
+                    return new ObjectID(id);
+                })),
             },
             select: {
                 _id: true,
                 projectId: true,
-                monitorLabels: {
-                    _id: true,
-                },
+                name: true,
                 monitors: {
                     _id: true,
                 },
@@ -166,38 +315,36 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
                 isRoot: true,
             },
         });
-        const results = [];
         for (const slo of slos) {
-            const ruleLabelIds = toIdSet(slo.monitorLabels);
-            // SLOs without a label rule are curated by hand. Never touch them.
-            if (ruleLabelIds.size === 0) {
+            if (!slo.id) {
                 continue;
             }
-            const attachedMonitorIds = toIdSet(slo.monitors);
-            const autoAddedMonitorIds = toIdSet(slo.autoAddedMonitors);
-            const doesMatch = this.doesLabelSetMatchRule({
-                labelIds: monitorLabelIds,
-                ruleLabelIds: ruleLabelIds,
-            });
-            /*
-             * Only this monitor's membership is in question, so the "matched" set
-             * handed to writeMembership is the SLO's current auto-added set with
-             * this monitor toggled in or out. Every other auto-added monitor is
-             * reported as still matching and is left exactly where it is.
-             */
-            const matchedMonitorIds = new Set(autoAddedMonitorIds);
-            if (doesMatch) {
-                matchedMonitorIds.add(monitorId);
-            }
-            else {
-                matchedMonitorIds.delete(monitorId);
-            }
             try {
+                const sloRules = rulesBySloId.get(slo.id.toString()) || [];
+                const doesMatch = sloRules.some((rule) => {
+                    return this.doesMonitorMatchRule({ monitor: monitor, rule: rule });
+                });
+                const autoAddedMonitorIds = toIdSet(slo.autoAddedMonitors);
+                /*
+                 * Only this monitor's membership is in question, so the "matched" set
+                 * handed to writeMembership is the SLO's current rule-attached set
+                 * with this monitor toggled in or out. Every other rule-attached
+                 * monitor is reported as still matching and is left exactly where it
+                 * is.
+                 */
+                const matchedMonitorIds = new Set(autoAddedMonitorIds);
+                if (doesMatch) {
+                    matchedMonitorIds.add(monitorId);
+                }
+                else {
+                    matchedMonitorIds.delete(monitorId);
+                }
                 const result = await this.writeMembership({
                     slo: slo,
-                    attachedMonitorIds: attachedMonitorIds,
+                    attachedMonitorIds: toIdSet(slo.monitors),
                     autoAddedMonitorIds: autoAddedMonitorIds,
                     matchedMonitorIds: matchedMonitorIds,
+                    knownMonitors: [monitor],
                 });
                 if (result.monitorIdsAdded.length > 0 ||
                     result.monitorIdsRemoved.length > 0) {
@@ -206,10 +353,10 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
             }
             catch (error) {
                 /*
-                 * One SLO failing must not stop the others: the monitor's labels have
-                 * already changed, and half a sync is better than none.
+                 * One SLO failing must not stop the others: the monitor has already
+                 * changed, and half a sync is better than none.
                  */
-                logger.error(`Error syncing SLO ${(_a = slo.id) === null || _a === void 0 ? void 0 : _a.toString()} for monitor ${monitorId}: ${error}`, {
+                logger.error(`Error syncing SLO ${slo.id.toString()} monitor rules for monitor ${monitorId}: ${error}`, {
                     projectId: projectId.toString(),
                     monitorId: monitorId,
                 });
@@ -218,22 +365,139 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
         return results;
     }
     /**
-     * Every monitor in the project carrying at least one of `labelIds`.
+     * Does this monitor satisfy the rule?
+     *
+     * A rule with configurable `criteria` is evaluated filter by filter through
+     * the shared matcher (All / Any, text and label operators). A rule without
+     * it uses its legacy columns, which are ANDed with empty ones skipped - the
+     * way every other monitor rule in the product reads. Either way, a rule
+     * with no criteria at all matches nothing: silently measuring the entire
+     * project is not a reasonable reading of an empty form. Users who genuinely
+     * want that write `.*` as the name pattern.
+     *
+     * Pattern matching goes through RulePatternMatchUtil, the same matcher the
+     * status page and network device rules use, so a pattern means the same
+     * thing everywhere in the product: a case-insensitive regex, or a `*`
+     * wildcard glob (#2940).
      */
-    async findMonitorIdsWithAnyLabel(data) {
-        const labelIds = Array.from(data.labelIds).map((id) => {
-            return new ObjectID(id);
+    doesMonitorMatchRule(data) {
+        return RuleCriteriaMatcher.matchesWithLegacySync({
+            rule: data.rule,
+            legacyFields: [
+                "monitorLabels",
+                "monitorNamePattern",
+                "monitorDescriptionPattern",
+            ],
+            emptyResult: false,
+            matchesLegacyRule: (legacyRule) => {
+                return this.doesMonitorMatchLegacyRule({
+                    monitor: data.monitor,
+                    rule: legacyRule,
+                });
+            },
         });
-        if (labelIds.length === 0) {
-            return new Set();
+    }
+    doesMonitorMatchLegacyRule(data) {
+        const { monitor, rule } = data;
+        const hasLabelCriteria = Boolean(rule.monitorLabels && rule.monitorLabels.length > 0);
+        const hasNameCriteria = Boolean(rule.monitorNamePattern);
+        const hasDescriptionCriteria = Boolean(rule.monitorDescriptionPattern);
+        if (!hasLabelCriteria && !hasNameCriteria && !hasDescriptionCriteria) {
+            return false;
         }
-        const monitors = await MonitorService.findBy({
-            query: {
-                projectId: data.projectId,
-                labels: labelIds,
+        if (hasLabelCriteria) {
+            const ruleLabelIds = toIdSet(rule.monitorLabels);
+            const monitorLabelIds = toIdSet(monitor.labels);
+            let hasAnyLabel = false;
+            for (const labelId of monitorLabelIds) {
+                if (ruleLabelIds.has(labelId)) {
+                    hasAnyLabel = true;
+                    break;
+                }
+            }
+            if (!hasAnyLabel) {
+                return false;
+            }
+        }
+        if (hasNameCriteria) {
+            if (!RulePatternMatchUtil.matches(monitor.name, rule.monitorNamePattern)) {
+                return false;
+            }
+        }
+        if (hasDescriptionCriteria) {
+            if (!RulePatternMatchUtil.matches(monitor.description, rule.monitorDescriptionPattern)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * The enabled rules of a project, or of one SLO in it. Disabled rules are
+     * filtered in the query rather than in memory: they match nothing, so there
+     * is no reason to count them against the per-project read ceiling.
+     */
+    async findEnabledRules(data) {
+        const rules = await ServiceLevelObjectiveMonitorRuleService.findBy({
+            query: data.serviceLevelObjectiveId
+                ? {
+                    projectId: data.projectId,
+                    serviceLevelObjectiveId: data.serviceLevelObjectiveId,
+                    isEnabled: true,
+                }
+                : {
+                    projectId: data.projectId,
+                    isEnabled: true,
+                },
+            select: RULE_SELECT,
+            limit: MAX_RULES_EVALUATED_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
             },
+        });
+        logIfRuleReadWasTruncated({
+            ruleKind: RULE_KIND,
+            projectId: data.projectId,
+            rulesRead: rules.length,
+        });
+        return rules;
+    }
+    /**
+     * Every monitor in the project at least one of `rules` matches.
+     *
+     * When every rule is a legacy rule with a label list, a monitor can only
+     * match if it carries at least one label from the union of those lists, so
+     * that union is pushed into the query - it is the criterion that usually
+     * narrows the project the most. Anything else (a criteria-backed rule, a
+     * pattern-only rule) could match a monitor with no labels at all, so the
+     * project's monitors are read once and matched in memory. Regexes are always
+     * applied in memory: Postgres regex semantics and JavaScript's are not the
+     * same dialect, and the pattern a user typed has to mean one thing.
+     */
+    async findMatchingMonitors(data) {
+        const rules = data.rules.filter((rule) => {
+            return this.hasAnyMatchCriteria(rule);
+        });
+        if (rules.length === 0) {
+            return [];
+        }
+        const labelPrefilter = this.getLabelPrefilter(rules);
+        const monitors = await MonitorService.findBy({
+            query: labelPrefilter
+                ? {
+                    projectId: data.projectId,
+                    labels: labelPrefilter,
+                }
+                : {
+                    projectId: data.projectId,
+                },
             select: {
                 _id: true,
+                name: true,
+                description: true,
+                labels: {
+                    _id: true,
+                },
             },
             limit: LIMIT_PER_PROJECT,
             skip: 0,
@@ -241,27 +505,85 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
                 isRoot: true,
             },
         });
-        return toIdSet(monitors);
+        return monitors.filter((monitor) => {
+            return rules.some((rule) => {
+                return this.doesMonitorMatchRule({ monitor: monitor, rule: rule });
+            });
+        });
     }
-    doesLabelSetMatchRule(data) {
-        if (data.ruleLabelIds.size === 0 || data.labelIds.size === 0) {
-            return false;
+    hasAnyMatchCriteria(rule) {
+        if (rule.criteria !== undefined && rule.criteria !== null) {
+            return true;
         }
-        for (const labelId of data.labelIds) {
-            if (data.ruleLabelIds.has(labelId)) {
-                return true;
+        return Boolean((rule.monitorLabels && rule.monitorLabels.length > 0) ||
+            rule.monitorNamePattern ||
+            rule.monitorDescriptionPattern);
+    }
+    /*
+     * The label ids to push into the monitor query, or null when no safe
+     * pre-filter exists. Safe only when EVERY rule is a legacy rule with labels:
+     * each such rule requires any-of its own labels, so no monitor outside the
+     * union can match any of them. The query may hand back only the matching
+     * label rows, which still leaves every rule its evidence.
+     */
+    getLabelPrefilter(rules) {
+        const labelIds = new Map();
+        for (const rule of rules) {
+            if (rule.criteria !== undefined && rule.criteria !== null) {
+                return null;
+            }
+            const ruleLabels = (rule.monitorLabels || []).filter((label) => {
+                return Boolean(label.id);
+            });
+            if (ruleLabels.length === 0) {
+                return null;
+            }
+            for (const label of ruleLabels) {
+                labelIds.set(label.id.toString(), label.id);
             }
         }
-        return false;
+        return labelIds.size > 0 ? Array.from(labelIds.values()) : null;
+    }
+    /*
+     * The SLOs that record this monitor as rule-attached. Selects ids only: a
+     * relation filter can narrow the joined relation rows it hands back, so the
+     * membership itself is read separately by id.
+     */
+    async findSloIdsHoldingAutoAddedMonitor(data) {
+        const slos = await ServiceLevelObjectiveService.findBy({
+            query: {
+                projectId: data.projectId,
+                autoAddedMonitors: [data.monitorId],
+            },
+            select: {
+                _id: true,
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        return slos
+            .map((slo) => {
+            var _a;
+            return ((_a = slo.id) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+        })
+            .filter((id) => {
+            return id.length > 0;
+        });
     }
     /**
      * Applies a computed match set to one SLO and persists the difference.
      *
-     * `matchedMonitorIds` is the full set of monitors the rule claims. Anything
+     * `matchedMonitorIds` is the full set of monitors the rules claim. Anything
      * in it that is not attached gets attached and recorded as rule-owned;
-     * anything recorded as rule-owned that the rule no longer claims gets
+     * anything recorded as rule-owned that the rules no longer claim gets
      * detached. Attachments that are not rule-owned are invisible to both
      * halves, which is what keeps manual monitors safe.
+     *
+     * `knownMonitors` are monitors the caller already read, so the feed item
+     * can name them without another lookup.
      */
     async writeMembership(data) {
         var _a;
@@ -276,9 +598,9 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
             return !matchedMonitorIds.has(id);
         });
         /*
-         * A monitor the rule still matches but that a human attached by hand stays
-         * manual: it is never promoted into autoAddedMonitors, so dropping the
-         * label later detaches nothing.
+         * A monitor a rule matches but that a human attached by hand stays
+         * manual: it is never promoted into autoAddedMonitors, so the rule
+         * letting go of it later detaches nothing.
          */
         const nextAutoAddedMonitorIds = new Set(Array.from(autoAddedMonitorIds).filter((id) => {
             return matchedMonitorIds.has(id);
@@ -306,6 +628,10 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
          * the compiler infer it for two arrays of Monitor (whose own relations
          * fan out across most of the schema) trips TS2589 "type instantiation is
          * excessively deep". The shape is exactly what the column types say.
+         *
+         * Written as root on purpose: rules are server-side configuration, and
+         * the manual-add guard in ServiceLevelObjectiveService lets root writes
+         * through precisely so this one is never refused.
          */
         const updateData = {
             monitors: toMonitors(nextAttachedMonitorIds),
@@ -318,12 +644,207 @@ export class ServiceLevelObjectiveMonitorRuleEngineServiceClass {
                 isRoot: true,
             },
         });
-        logger.debug(`SLO monitor label rule synced SLO ${slo.id.toString()}: +${monitorIdsAdded.length} / -${monitorIdsRemoved.length} monitors`, { projectId: (_a = slo.projectId) === null || _a === void 0 ? void 0 : _a.toString() });
+        logger.debug(`SLO monitor rules synced SLO ${slo.id.toString()}: +${monitorIdsAdded.length} / -${monitorIdsRemoved.length} monitors`, { projectId: (_a = slo.projectId) === null || _a === void 0 ? void 0 : _a.toString() });
+        /*
+         * Only monitors that were really on the list count as detached. A repair
+         * that drops a stale bookkeeping entry for a monitor no longer attached
+         * changed nothing a reader of the feed could see.
+         */
+        await this.postMembershipFeedItems({
+            slo: slo,
+            monitorIdsAttached: monitorIdsAdded,
+            monitorIdsDetached: monitorIdsRemoved.filter((id) => {
+                return attachedMonitorIds.has(id);
+            }),
+            knownMonitors: data.knownMonitors || [],
+        });
         return {
             monitorIdsAdded: monitorIdsAdded,
             monitorIdsRemoved: monitorIdsRemoved,
         };
     }
+    /*
+     * Tells the SLO's feed which monitors the rules just attached or detached.
+     * Posted without a user: nobody clicked anything, a rule reacted to a
+     * change. Manual attaches from the Monitors page are posted by the SLO
+     * service instead, and this engine writes as root with no user, which is
+     * how the two never double-post.
+     *
+     * Never throws. The membership is already saved; a feed item that could
+     * not be written must not turn a successful sync into a failed one.
+     */
+    async postMembershipFeedItems(data) {
+        const { slo } = data;
+        if (!slo.id ||
+            !slo.projectId ||
+            (data.monitorIdsAttached.length === 0 &&
+                data.monitorIdsDetached.length === 0)) {
+            return;
+        }
+        try {
+            const sloLink = await ServiceLevelObjectiveService.getSloMarkdownLink({
+                projectId: slo.projectId,
+                sloId: slo.id,
+                sloName: slo.name || undefined,
+            });
+            const monitorNameById = await this.getMonitorNamesById({
+                monitorIds: [
+                    ...data.monitorIdsAttached.slice(0, MAX_MONITORS_LISTED_IN_FEED_DETAILS),
+                    ...data.monitorIdsDetached.slice(0, MAX_MONITORS_LISTED_IN_FEED_DETAILS),
+                ],
+                knownMonitors: data.knownMonitors,
+            });
+            if (data.monitorIdsAttached.length > 0) {
+                const count = data.monitorIdsAttached.length;
+                await ServiceLevelObjectiveFeedService.createServiceLevelObjectiveFeedItem({
+                    serviceLevelObjectiveId: slo.id,
+                    projectId: slo.projectId,
+                    serviceLevelObjectiveFeedEventType: ServiceLevelObjectiveFeedEventType.MonitorsAttached,
+                    displayColor: Green500,
+                    feedInfoInMarkdown: count === 1
+                        ? `🔗 Monitor rules attached ${this.describeMonitorNames({
+                            monitorIds: data.monitorIdsAttached,
+                            monitorNameById: monitorNameById,
+                        })} to ${sloLink}. It now counts towards this SLO.`
+                        : `🔗 Monitor rules attached ${count} monitors to ${sloLink}: ${this.describeMonitorNames({
+                            monitorIds: data.monitorIdsAttached,
+                            monitorNameById: monitorNameById,
+                        })}.`,
+                    moreInformationInMarkdown: this.listMonitorsInDetails({
+                        title: "Monitors attached",
+                        monitorIds: data.monitorIdsAttached,
+                        monitorNameById: monitorNameById,
+                    }),
+                });
+            }
+            if (data.monitorIdsDetached.length > 0) {
+                const count = data.monitorIdsDetached.length;
+                await ServiceLevelObjectiveFeedService.createServiceLevelObjectiveFeedItem({
+                    serviceLevelObjectiveId: slo.id,
+                    projectId: slo.projectId,
+                    serviceLevelObjectiveFeedEventType: ServiceLevelObjectiveFeedEventType.MonitorsDetached,
+                    displayColor: Gray500,
+                    feedInfoInMarkdown: count === 1
+                        ? `✂️ Monitor rules detached ${this.describeMonitorNames({
+                            monitorIds: data.monitorIdsDetached,
+                            monitorNameById: monitorNameById,
+                        })} from ${sloLink}. It no longer matches any enabled monitor rule of this SLO.`
+                        : `✂️ Monitor rules detached ${count} monitors from ${sloLink}: ${this.describeMonitorNames({
+                            monitorIds: data.monitorIdsDetached,
+                            monitorNameById: monitorNameById,
+                        })}.`,
+                    moreInformationInMarkdown: this.listMonitorsInDetails({
+                        title: "Monitors detached",
+                        monitorIds: data.monitorIdsDetached,
+                        monitorNameById: monitorNameById,
+                    }),
+                });
+            }
+        }
+        catch (error) {
+            logger.error(`Error posting SLO monitor rule membership feed items for SLO ${slo.id.toString()}: ${error}`, { projectId: slo.projectId.toString() });
+        }
+    }
+    /*
+     * Names for the monitors a feed item mentions. Monitors the caller already
+     * holds are used as they are; the rest (a detached monitor is by definition
+     * no longer among the matches) are read in one bounded query.
+     */
+    async getMonitorNamesById(data) {
+        var _a, _b;
+        const monitorNameById = new Map();
+        for (const monitor of data.knownMonitors) {
+            const id = ((_a = monitor.id) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+            if (id && monitor.name) {
+                monitorNameById.set(id, monitor.name);
+            }
+        }
+        const missingIds = Array.from(new Set(data.monitorIds)).filter((id) => {
+            return !monitorNameById.has(id);
+        });
+        if (missingIds.length === 0) {
+            return monitorNameById;
+        }
+        const monitors = await MonitorService.findBy({
+            query: {
+                _id: QueryHelper.any(missingIds.map((id) => {
+                    return new ObjectID(id);
+                })),
+            },
+            select: {
+                _id: true,
+                name: true,
+            },
+            limit: missingIds.length,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        for (const monitor of monitors) {
+            const id = ((_b = monitor.id) === null || _b === void 0 ? void 0 : _b.toString()) || "";
+            if (id && monitor.name) {
+                monitorNameById.set(id, monitor.name);
+            }
+        }
+        return monitorNameById;
+    }
+    /*
+     * The display names, escaped, sorted so the same set always reads the same
+     * way. A name that could not be resolved still counts - it is shown as
+     * "a monitor" rather than dropped from the sentence.
+     */
+    getSortedMonitorNames(data) {
+        return data.monitorIds
+            .slice(0, MAX_MONITORS_LISTED_IN_FEED_DETAILS)
+            .map((id) => {
+            return data.monitorNameById.get(id) || "";
+        })
+            .sort((a, b) => {
+            if (!a || !b) {
+                return a ? -1 : b ? 1 : 0;
+            }
+            return a.localeCompare(b, undefined, { sensitivity: "base" });
+        })
+            .map((name) => {
+            return name ? `**${escapeMarkdownInline(name)}**` : "a monitor";
+        });
+    }
+    // "**A**", "**A** and **B**", "**A**, **B**, ... and 7 more".
+    describeMonitorNames(data) {
+        const names = this.getSortedMonitorNames(data);
+        const named = names.slice(0, MAX_MONITORS_NAMED_IN_FEED_HEADLINE);
+        const remaining = data.monitorIds.length - named.length;
+        if (remaining > 0) {
+            return `${named.join(", ")} and ${remaining} more`;
+        }
+        if (named.length <= 1) {
+            return named[0] || "a monitor";
+        }
+        return `${named.slice(0, -1).join(", ")} and ${named[named.length - 1]}`;
+    }
+    /*
+     * The full (bounded) list, only when the sentence could not name everyone -
+     * a single monitor, or a handful, is already fully described above.
+     */
+    listMonitorsInDetails(data) {
+        if (data.monitorIds.length <= MAX_MONITORS_NAMED_IN_FEED_HEADLINE) {
+            return undefined;
+        }
+        const names = this.getSortedMonitorNames(data);
+        const notListed = data.monitorIds.length - names.length;
+        const lines = [
+            `**${data.title} (${data.monitorIds.length})**`,
+            "",
+            ...names.map((name) => {
+                return `- ${name}`;
+            }),
+        ];
+        if (notListed > 0) {
+            lines.push(`- …and ${notListed} more not listed here.`);
+        }
+        return lines.join("\n");
+    }
 }
 __decorate([
     CaptureSpan(),
@@ -342,6 +863,12 @@ __decorate([
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
-], ServiceLevelObjectiveMonitorRuleEngineServiceClass.prototype, "findMonitorIdsWithAnyLabel", null);
+], ServiceLevelObjectiveMonitorRuleEngineServiceClass.prototype, "findEnabledRules", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ServiceLevelObjectiveMonitorRuleEngineServiceClass.prototype, "findMatchingMonitors", null);
 export default new ServiceLevelObjectiveMonitorRuleEngineServiceClass();
 //# sourceMappingURL=ServiceLevelObjectiveMonitorRuleEngineService.js.map