@oneuptime/common 14.0.0 → 14.0.1

package/build/dist/Server/Utils/Monitor/MonitorCriteriaEvaluator.js

@@ -27,6 +27,7 @@ import MonitorCriteriaMessageBuilder from "./MonitorCriteriaMessageBuilder";
 import MonitorCriteriaDataExtractor from "./MonitorCriteriaDataExtractor";
 import MonitorCriteriaMessageFormatter from "./MonitorCriteriaMessageFormatter";
 import AffectedResourceList from "./AffectedResourceList";
+import RootCauseList from "./RootCauseList";
 import MonitorCriteriaInstance from "../../../Types/Monitor/MonitorCriteriaInstance";
 import MonitorStep from "../../../Types/Monitor/MonitorStep";
 import FilterCondition from "../../../Types/Filter/FilterCondition";
@@ -1114,9 +1115,7 @@ ${contextBlock}
                 samples: breachingSamples,
                 totalSamples: ctx.totalSamplesInWindow,
                 unit: ctx.unit,
-                metricName: ctx.metricName,
                 unitHeuristicMetricName: unitHeuristicMetricName,
-                alias: ctx.alias,
                 components: ctx.components || [],
             })}`);
         }
@@ -1152,24 +1151,41 @@ ${contextBlock}
         return sections.join("\n");
     }
     /**
-     * Build the **Breaching Samples** markdown section — a table of
-     * timestamps, values, and any group-by attributes. Caps the row count
-     * so a 30-minute window at 1-second granularity doesn't dump thousands
-     * of lines onto the root-cause page; the caller can always drill in
-     * via the metric explorer link.
+     * Build the **Breaching Samples** markdown section — a numbered list of
+     * the samples that breached, oldest first. Caps the list so a 30-minute
+     * window at 1-second granularity doesn't dump thousands of lines onto
+     * the root-cause page; the caller can always drill in via the metric
+     * explorer link.
+     *
+     *     1. `2026-08-14T10:30:00.000Z` — **1.07 GB**
+     *        - `a`: 537 MB
+     *        - `b`: 1.5 sec
+     *        - `k8s.pod.name`: `web-1`
+     *
+     * It used to be a table — Timestamp | Metric | Alias | Value, a column
+     * per formula component and one per attribute key — which grew wider
+     * with every attribute and read badly in the email card, in Slack and on
+     * the dashboard (see RootCauseList). Its Metric and Alias columns
+     * repeated the same two values on every row, the ones the Metric
+     * Details list directly above already states, so the list leaves them
+     * out; and a component or attribute a sample has no value for is left
+     * out rather than printed as "-".
      *
      * Timestamps are emitted as inline code wrapping ISO 8601 strings so
      * the client-side markdown viewer can localize them to the viewer's
      * timezone (without losing the canonical instant).
      */
     static formatBreachingSamplesSection(input) {
-        const MAX_ROWS = 20;
+        const MAX_SAMPLES_SHOWN = 20;
         // Sort chronologically and de-duplicate any accidental repeats
         const sorted = [...input.samples].sort((a, b) => {
             return (new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
         });
-        const displayedSamples = sorted.slice(0, MAX_ROWS);
-        // Collect attribute keys that appear on any displayed sample
+        const displayedSamples = sorted.slice(0, MAX_SAMPLES_SHOWN);
+        /*
+         * Collect attribute keys that appear on any displayed sample, so every
+         * item lists the attributes it has in the same order.
+         */
         const attrKeySet = new Set();
         for (const s of displayedSamples) {
             for (const k of Object.keys(s.attributes || {})) {
@@ -1177,94 +1193,64 @@ ${contextBlock}
             }
         }
         const attrKeys = Array.from(attrKeySet);
-        /*
-         * Escape pipe characters that could appear in the metric display
-         * name (formulas like "a | b" are unlikely but possible) so they
-         * don't break GitHub-flavored-markdown tables.
-         */
-        const escapeCell = (value) => {
-            return value.replace(/\|/g, "\\|");
-        };
-        /*
-         * Column layout:
-         *   Timestamp | Metric | Alias | Value | <component_1> | ... | <attr_1> | ...
-         *
-         * The component columns let the reader see what each variable of a
-         * formula resolved to at the breach time — e.g. "when c = a + b
-         * breached 100, a was 55, b was 46". They are omitted for plain
-         * metric criteria.
-         */
-        const headerCells = [
-            "Timestamp",
-            "Metric",
-            "Alias",
-            "Value",
-        ];
-        /*
-         * The component columns carry no unit in their header any more. Each
-         * cell now names the unit it actually landed on, and auto-scaling
-         * means neighbouring rows can land on different ones — a header that
-         * read "a (By)" over cells reading "900 KB" and "1.2 MB" states a
-         * unit that neither row uses. The configured unit is not lost: the
-         * Components bullet list above the table still records it.
-         */
-        for (const component of input.components) {
-            headerCells.push(component.alias);
-        }
-        headerCells.push(...attrKeys);
-        const headerRow = `| ${headerCells.join(" | ")} |`;
-        const dividerRow = `| ${headerCells
-            .map(() => {
-            return "---";
-        })
-            .join(" | ")} |`;
-        const metricCell = `\`${escapeCell(input.metricName)}\``;
-        const aliasCell = input.alias
-            ? `\`${escapeCell(input.alias)}\``
-            : "-";
-        const dataRows = displayedSamples.map((s) => {
-            const timestampIso = new Date(s.timestamp).toISOString();
-            const cells = [
-                `\`${timestampIso}\``,
-                metricCell,
-                aliasCell,
-                MetricValueFormatter.format({
-                    value: s.value,
-                    unit: input.unit,
-                    metricName: input.unitHeuristicMetricName,
-                }),
-            ];
+        const items = displayedSamples.map((s) => {
+            const details = [];
+            /*
+             * What each variable of a formula resolved to at the breach time —
+             * e.g. "when c = a + b breached 100, a was 55, b was 46". Absent
+             * for plain metric criteria.
+             */
             for (const component of input.components) {
                 const match = (s.componentValues || []).find((cv) => {
                     return cv.alias === component.alias;
                 });
-                if (match && typeof match.value === "number") {
-                    /*
-                     * Each component keeps its OWN unit. Component values are
-                     * indexed off the per-query series and never go through the
-                     * sample→threshold-unit conversion the main Value column
-                     * does, so they are in the component's legendUnit — mixing
-                     * units across the row is deliberate, and is why every cell
-                     * has to say which one it is in.
-                     */
-                    cells.push(MetricValueFormatter.format({
+                if (!match || typeof match.value !== "number") {
+                    continue;
+                }
+                /*
+                 * Each component keeps its OWN unit. Component values are
+                 * indexed off the per-query series and never go through the
+                 * sample→threshold-unit conversion the sample's value does, so
+                 * they are in the component's legendUnit — which is why each
+                 * one names the unit it is in. Its configured unit is in the
+                 * Components list of the Metric Details above.
+                 */
+                details.push({
+                    label: RootCauseList.code(component.alias),
+                    value: MetricValueFormatter.format({
                         value: match.value,
                         unit: component.unit,
                         metricName: MonitorCriteriaEvaluator.metricNameForUnitHeuristics({
                             metricName: component.name,
                             isFormula: component.isFormula,
                         }),
-                    }));
-                }
-                else {
-                    cells.push("-");
-                }
+                    }),
+                });
             }
+            /*
+             * The attributes identify the series the sample came from. Keys
+             * and values are telemetry, so both go in code spans:
+             * RootCauseList.code keeps whatever they contain inside the span.
+             */
             for (const k of attrKeys) {
                 const v = s.attributes[k];
-                cells.push(v === undefined || v === null ? "-" : String(v));
+                if (v === undefined || v === null) {
+                    continue;
+                }
+                details.push({
+                    label: RootCauseList.code(k),
+                    value: RootCauseList.code(String(v)),
+                });
             }
-            return `| ${cells.join(" | ")} |`;
+            return {
+                title: RootCauseList.code(new Date(s.timestamp).toISOString()),
+                value: `**${MetricValueFormatter.format({
+                    value: s.value,
+                    unit: input.unit,
+                    metricName: input.unitHeuristicMetricName,
+                })}**`,
+                details: details,
+            };
         });
         const lines = [
             `**Breaching Samples**`,
@@ -1273,12 +1259,14 @@ ${contextBlock}
                 totalSamples: input.totalSamples,
             }),
             "",
-            headerRow,
-            dividerRow,
-            ...dataRows,
+            RootCauseList.render(items),
         ];
         if (sorted.length > displayedSamples.length) {
-            lines.push(`\n_Showing the first ${displayedSamples.length} of ${sorted.length} breaching samples._`);
+            /*
+             * The blank line matters: without it the note is a lazy
+             * continuation of the last item, not a paragraph of its own.
+             */
+            lines.push("", `_Showing the first ${displayedSamples.length} of ${sorted.length} breaching samples._`);
         }
         return lines.join("\n");
     }
@@ -1582,15 +1570,34 @@ ${contextBlock}
         sections.push(`**Kubernetes Cluster Details**\n${clusterDetails.join("\n")}`);
         // Affected resources
         if (breakdown.affectedResources && breakdown.affectedResources.length > 0) {
-            // Sort by metric value descending (worst first) and filter out zero-value resources
-            const sortedResources = [
-                ...breakdown.affectedResources,
-            ]
+            /*
+             * Keep the rows that satisfy the criteria that just matched, worst
+             * first — NOT simply the non-zero rows. k8s-node-not-ready fires on
+             * `k8s.node.condition_ready = 0`, so the zero rows are the NotReady
+             * nodes; the old hardcoded `> 0` dropped exactly those and named a
+             * healthy node in the analysis below.
+             */
+            const breach = MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+                criteriaInstance: input.criteriaInstance,
+                floorEqualityFiresOnFall: true,
+            });
+            const sortedResources = breakdown.affectedResources
+                .map((r) => {
+                var _a;
+                /*
+                 * A fall criteria breached on the resource's lowest sample
+                 * in the window, not its highest.
+                 */
+                return breach.worstIsLowest
+                    ? Object.assign(Object.assign({}, r), { metricValue: (_a = r.lowestMetricValue) !== null && _a !== void 0 ? _a : r.metricValue }) : r;
+            })
                 .filter((r) => {
-                return r.metricValue > 0;
+                return breach.matches(r.metricValue);
             })
                 .sort((a, b) => {
-                return b.metricValue - a.metricValue;
+                return breach.worstIsLowest
+                    ? a.metricValue - b.metricValue
+                    : b.metricValue - a.metricValue;
             });
             if (sortedResources.length === 0) {
                 return sections.join("\n");
@@ -2318,31 +2325,49 @@ ${contextBlock}
         return sections.length > 0 ? sections.join("\n") : null;
     }
     /*
-     * Which rows of the Ceph affected-resources list actually BREACHED.
+     * Which rows of an affected-resources list actually BREACHED.
      *
      * The blanket `metricValue > 0` below is right for every count- or
      * level-style criteria ("> 0 active health checks", "> 85 % used"), but
-     * it is exactly backwards for the availability signals: the OSD Down /
-     * OSD Out / Quorum Degraded criteria fire on `< 1` over ceph_osd_up /
-     * ceph_osd_in / ceph_mon_quorum_status, so the ZERO rows are the down
-     * daemons. Dropping them rendered a list of the HEALTHY daemons under
-     * an incident that tells the reader to "check the root cause for the
-     * affected ceph_daemon label".
+     * it is exactly backwards for the availability signals: the Ceph OSD
+     * Down / OSD Out / Quorum Degraded criteria fire on `< 1` over
+     * ceph_osd_up / ceph_osd_in / ceph_mon_quorum_status, so the ZERO rows
+     * are the down daemons. Dropping them rendered a list of the HEALTHY
+     * daemons under an incident that tells the reader to "check the root
+     * cause for the affected ceph_daemon label".
      *
      * Invert only for a criteria that fires when the metric FALLS.
      * Everything else — every `> 0` health check, PG count, latency and
-     * capacity ratio, and every `= 0` recovery criteria — keeps the
-     * existing `> 0`, worst-highest-first list byte for byte.
+     * capacity ratio, and (by default) every `= 0` recovery criteria —
+     * keeps the existing `> 0`, worst-highest-first list byte for byte.
+     *
+     * `floorEqualityFiresOnFall` additionally counts a FIRING `= 0` (or
+     * below) as a fall. Kubernetes needs it: k8s-node-not-ready and
+     * k8s-etcd-no-leader fire on `= 0` over k8s.node.condition_ready /
+     * etcd_server_has_leader, and zero is the floor of those metrics, so
+     * the only way to reach it is down. It is gated on the criteria opening
+     * an incident or alert because the same `= 0` is also how the restart,
+     * failed-pod and unavailable-replica templates express RECOVERY, and
+     * that all-clear must not become a list of healthy zero rows. Ceph
+     * leaves it off: all of its `= 0` criteria are recoveries.
      */
-    static getCephBreachPredicate(criteriaInstance) {
-        var _a;
-        const metricFilters = (((_a = criteriaInstance === null || criteriaInstance === void 0 ? void 0 : criteriaInstance.data) === null || _a === void 0 ? void 0 : _a.filters) || []).filter((f) => {
+    static getAffectedResourceBreachPredicate(input) {
+        var _a, _b, _c, _d, _e, _f;
+        const metricFilters = (((_b = (_a = input.criteriaInstance) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.filters) || []).filter((f) => {
             return f.checkOn === CheckOn.MetricValue && typeof f.value === "number";
         });
+        const opensIncidentOrAlert = ((_d = (_c = input.criteriaInstance) === null || _c === void 0 ? void 0 : _c.data) === null || _d === void 0 ? void 0 : _d.createIncidents) === true ||
+            ((_f = (_e = input.criteriaInstance) === null || _e === void 0 ? void 0 : _e.data) === null || _f === void 0 ? void 0 : _f.createAlerts) === true;
         const firesWhenMetricFalls = metricFilters.length > 0 &&
             metricFilters.every((f) => {
-                return (f.filterType === FilterType.LessThan ||
-                    f.filterType === FilterType.LessThanOrEqualTo);
+                if (f.filterType === FilterType.LessThan ||
+                    f.filterType === FilterType.LessThanOrEqualTo) {
+                    return true;
+                }
+                return (input.floorEqualityFiresOnFall === true &&
+                    opensIncidentOrAlert &&
+                    f.filterType === FilterType.EqualTo &&
+                    f.value <= 0);
             });
         if (!firesWhenMetricFalls) {
             return {
@@ -2356,6 +2381,9 @@ ${contextBlock}
             matches: (value) => {
                 return metricFilters.some((f) => {
                     const threshold = f.value;
+                    if (f.filterType === FilterType.EqualTo) {
+                        return value === threshold;
+                    }
                     return f.filterType === FilterType.LessThan
                         ? value < threshold
                         : value <= threshold;
@@ -2472,7 +2500,9 @@ ${contextBlock}
              * ceph_osd_in / ceph_mon_quorum_status the criteria is `< 1`, so
              * the zero rows are the whole point of the incident.
              */
-            const breach = MonitorCriteriaEvaluator.getCephBreachPredicate(input.criteriaInstance);
+            const breach = MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+                criteriaInstance: input.criteriaInstance,
+            });
             const sortedResources = [
                 ...breakdown.affectedResources,
             ]