@intentius/chant-lexicon-prometheus 0.101.0 → 0.104.0

package/dist/lint/post-synth/prom216.d.ts

@@ -0,0 +1,10 @@
+/**
+ * PROM216: histogram_quantile over a series without _bucket, or without le
+ *
+ * A classic histogram's quantile needs its _bucket series with the le label
+ * kept. A native histogram has no _bucket series, so this check does not apply
+ * to one.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom216: PostSynthCheck;
+//# sourceMappingURL=prom216.d.ts.map

package/dist/lint/post-synth/prom216.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom216.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom216.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom217.d.ts

@@ -0,0 +1,9 @@
+/**
+ * PROM217: A recording rule name is not in level:metric:operations form
+ *
+ * Prometheus's naming convention for recorded series, e.g.
+ * job:http_requests:rate5m.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom217: PostSynthCheck;
+//# sourceMappingURL=prom217.d.ts.map

package/dist/lint/post-synth/prom217.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom217.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom217.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom218.d.ts

@@ -0,0 +1,10 @@
+/**
+ * PROM218: A regex matcher needs no regex, or is anchored
+ *
+ * A =~ or !~ with no regex metacharacters is an equality matcher written the
+ * slow way. Prometheus anchors every regex, so a leading ^ or trailing $ does
+ * nothing.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom218: PostSynthCheck;
+//# sourceMappingURL=prom218.d.ts.map

package/dist/lint/post-synth/prom218.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom218.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom218.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom219.d.ts

@@ -0,0 +1,9 @@
+/**
+ * PROM219: An alerting rule sets the alertname label
+ *
+ * Prometheus sets alertname to the rule's name after applying the rule's
+ * labels, so the value is overwritten.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom219: PostSynthCheck;
+//# sourceMappingURL=prom219.d.ts.map

package/dist/lint/post-synth/prom219.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom219.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom219.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom220.d.ts

@@ -0,0 +1,9 @@
+/**
+ * PROM220: A receiver turns off TLS certificate verification
+ *
+ * tls_config.insecure_skip_verify: true on a receiver, or in global, accepts
+ * any certificate the endpoint presents.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom220: PostSynthCheck;
+//# sourceMappingURL=prom220.d.ts.map

package/dist/lint/post-synth/prom220.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom220.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom220.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom221.d.ts

@@ -0,0 +1,10 @@
+/**
+ * PROM221: SMTP credentials sent with require_tls false
+ *
+ * An email receiver with SMTP auth and require_tls false (its own, or
+ * global.smtp_require_tls) can send the credentials in clear text. Implicit
+ * TLS is left alone.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom221: PostSynthCheck;
+//# sourceMappingURL=prom221.d.ts.map

package/dist/lint/post-synth/prom221.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom221.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom221.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom222.d.ts

@@ -0,0 +1,9 @@
+/**
+ * PROM222: Credentials sent to an http:// receiver URL
+ *
+ * An integration whose URL is http:// and whose request carries a credential:
+ * user info in the URL, http_config auth, or a key or token field.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom222: PostSynthCheck;
+//# sourceMappingURL=prom222.d.ts.map

package/dist/lint/post-synth/prom222.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom222.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom222.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom223.d.ts

@@ -0,0 +1,10 @@
+/**
+ * PROM223: repeat_interval is shorter than group_interval
+ *
+ * Alertmanager resends only when it flushes a group, every group_interval, so
+ * a shorter repeat_interval never takes effect. Intervals are inherited down
+ * the routing tree from Alertmanager's defaults.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom223: PostSynthCheck;
+//# sourceMappingURL=prom223.d.ts.map

package/dist/lint/post-synth/prom223.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom223.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom223.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom224.d.ts

@@ -0,0 +1,9 @@
+/**
+ * PROM224: An inhibit rule matches one alert as source and target, with no equal
+ *
+ * With no equal, any alert matching the source mutes every alert matching the
+ * target. When one alert can match both, alerts of that kind mute each other.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom224: PostSynthCheck;
+//# sourceMappingURL=prom224.d.ts.map

package/dist/lint/post-synth/prom224.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom224.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom224.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/post-synth/prom301.d.ts

@@ -0,0 +1,14 @@
+/**
+ * PROM301: A rule reads a connector metric no collector in the build emits
+ *
+ * For each selector in a rule whose name falls under a namespace the build's
+ * spanmetrics, servicegraph or GenAI connectors own (spanmetrics' and
+ * servicegraph's defaults included), reports a name no collector config in
+ * the build emits, and a by (...) label that is not a dimension the config
+ * declares for the metrics aggregated. Silent for names outside those
+ * namespaces, and when the build has no collector config. See
+ * ../../collector-metrics.ts.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const prom301: PostSynthCheck;
+//# sourceMappingURL=prom301.d.ts.map

package/dist/lint/post-synth/prom301.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prom301.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom301.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAOrB,CAAC"}

package/dist/lint/rules/literal-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"literal-credential.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/literal-credential.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF;;;GAGG;AACH,eAAO,MAAM,aAAa,aA8BxB,CAAC;AAYH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,QA4DnC,CAAC"}
+{"version":3,"file":"literal-credential.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/literal-credential.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAIxF;;;GAGG;AACH,eAAO,MAAM,aAAa,aA8BxB,CAAC;AAYH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,QA+DnC,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "prometheus",
-  "version": "0.101.0",
+  "version": "0.104.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Prometheus",
   "intrinsics": [],

package/dist/okf/index.md

@@ -32,3 +32,19 @@ okf_version: '0.2'
 * [PROM207](/rules/PROM207.md) - A receiver is declared but no route sends to it
 * [PROM208](/rules/PROM208.md) - An Alertmanager duration is not a duration
 * [PROM209](/rules/PROM209.md) - A receiver integration is missing its destination or credential
+* [PROM210](/rules/PROM210.md) - A receiver integration or global setting is one Alertmanager rejects
+* [PROM211](/rules/PROM211.md) - An alerting rule has no for, or for: 0s
+* [PROM212](/rules/PROM212.md) - An alerting rule has no runbook_url annotation (opt-in)
+* [PROM213](/rules/PROM213.md) - An alert expression has no comparison
+* [PROM214](/rules/PROM214.md) - An alert template reads a label the expression aggregates away
+* [PROM215](/rules/PROM215.md) - rate, irate or increase over a name that is not a counter's
+* [PROM216](/rules/PROM216.md) - histogram_quantile over a series without _bucket, or without le
+* [PROM217](/rules/PROM217.md) - A recording rule name is not in level:metric:operations form
+* [PROM218](/rules/PROM218.md) - A regex matcher needs no regex, or is anchored
+* [PROM219](/rules/PROM219.md) - An alerting rule sets the alertname label
+* [PROM220](/rules/PROM220.md) - A receiver turns off TLS certificate verification
+* [PROM221](/rules/PROM221.md) - SMTP credentials sent with require_tls false
+* [PROM222](/rules/PROM222.md) - Credentials sent to an http:// receiver URL
+* [PROM223](/rules/PROM223.md) - repeat_interval is shorter than group_interval
+* [PROM224](/rules/PROM224.md) - An inhibit rule matches one alert as source and target, with no equal
+* [PROM301](/rules/PROM301.md) - A rule reads a connector metric no collector in the build emits

package/dist/okf/rules/PROM210.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM210
+description: A receiver integration or global setting is one Alertmanager rejects
+id: PROM210
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+A receiver integration or global setting is one Alertmanager rejects

package/dist/okf/rules/PROM211.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM211
+description: 'An alerting rule has no for, or for: 0s'
+id: PROM211
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An alerting rule has no for, or for: 0s

package/dist/okf/rules/PROM212.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM212
+description: An alerting rule has no runbook_url annotation (opt-in)
+id: PROM212
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An alerting rule has no runbook_url annotation (opt-in)

package/dist/okf/rules/PROM213.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM213
+description: An alert expression has no comparison
+id: PROM213
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An alert expression has no comparison

package/dist/okf/rules/PROM214.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM214
+description: An alert template reads a label the expression aggregates away
+id: PROM214
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An alert template reads a label the expression aggregates away

package/dist/okf/rules/PROM215.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM215
+description: rate, irate or increase over a name that is not a counter's
+id: PROM215
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+rate, irate or increase over a name that is not a counter's

package/dist/okf/rules/PROM216.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM216
+description: histogram_quantile over a series without _bucket, or without le
+id: PROM216
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+histogram_quantile over a series without _bucket, or without le

package/dist/okf/rules/PROM217.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM217
+description: A recording rule name is not in level:metric:operations form
+id: PROM217
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+A recording rule name is not in level:metric:operations form

package/dist/okf/rules/PROM218.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM218
+description: A regex matcher needs no regex, or is anchored
+id: PROM218
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+A regex matcher needs no regex, or is anchored

package/dist/okf/rules/PROM219.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM219
+description: An alerting rule sets the alertname label
+id: PROM219
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An alerting rule sets the alertname label

package/dist/okf/rules/PROM220.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM220
+description: A receiver turns off TLS certificate verification
+id: PROM220
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+A receiver turns off TLS certificate verification

package/dist/okf/rules/PROM221.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM221
+description: SMTP credentials sent with require_tls false
+id: PROM221
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+SMTP credentials sent with require_tls false

package/dist/okf/rules/PROM222.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM222
+description: Credentials sent to an http:// receiver URL
+id: PROM222
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+Credentials sent to an http:// receiver URL

package/dist/okf/rules/PROM223.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM223
+description: repeat_interval is shorter than group_interval
+id: PROM223
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+repeat_interval is shorter than group_interval

package/dist/okf/rules/PROM224.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM224
+description: An inhibit rule matches one alert as source and target, with no equal
+id: PROM224
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An inhibit rule matches one alert as source and target, with no equal

package/dist/okf/rules/PROM301.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM301
+description: A rule reads a connector metric no collector in the build emits
+id: PROM301
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+A rule reads a connector metric no collector in the build emits

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA+B9D;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aA6G9B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA+B9D;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAwH9B,CAAC"}

package/dist/promql-analysis.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Reading a parsed PromQL expression: the selectors it reads, the labels its
+ * result keeps, and whether it filters with a comparison. The rule-file
+ * checks PROM211-PROM219 (./validate-config.ts) are built on these.
+ *
+ * The tree is the one `checkPromql` (./promql.ts) parses with
+ * `@prometheus-io/lezer-promql`. Every function here returns nothing for an
+ * expression that does not parse; PROM104 reports that.
+ */
+import { parser } from "@prometheus-io/lezer-promql";
+import type { MatchOp } from "./matchers.js";
+type SyntaxNode = ReturnType<typeof parser.parse>["topNode"];
+/** The expression under the tree's `PromQL` root, or undefined when it does not parse. */
+export declare function parsePromql(expr: string): SyntaxNode | undefined;
+/** The value of a PromQL string literal: double- or single-quoted with escapes, or a raw backtick string. */
+export declare function stringValue(literal: string): string;
+export interface SelectorMatcher {
+    name: string;
+    op: MatchOp;
+    value: string;
+}
+/** One vector selector in an expression. */
+export interface Selector {
+    /** The metric name, from the identifier or a `__name__="..."` matcher; undefined when neither names one. */
+    name?: string;
+    matchers: SelectorMatcher[];
+    /** The selector as written. */
+    text: string;
+    /** The functions it sits inside, innermost first, e.g. `["rate", "sum"]` for `sum(rate(x[5m]))`. */
+    within: string[];
+}
+/** Every vector selector in the expression, with the functions around it. */
+export declare function selectors(expr: string): Selector[];
+/**
+ * Whether the expression filters its result: a comparison without `bool`,
+ * `absent()`/`absent_over_time()`, or `unless`, anywhere a series can pass
+ * through to the result. An expression without one returns every series it
+ * reads, so an alert on it fires for all of them (pint alerts/comparison).
+ * `or` needs a condition on both sides, since either side alone reaches the
+ * result.
+ */
+export declare function hasCondition(expr: string): boolean | undefined;
+/**
+ * The labels an expression's result carries, as far as the expression says:
+ * `{ only }` when it keeps exactly these labels (`sum by (job)`), `{ except }`
+ * when it keeps every label but these (`sum without (instance)`), or
+ * undefined when it keeps whatever the series it reads carry.
+ */
+export type LabelScope = {
+    only: Set<string>;
+} | {
+    except: Set<string>;
+};
+/** The labels the expression's result keeps; see {@link LabelScope}. */
+export declare function resultLabels(expr: string): LabelScope | undefined;
+/** Whether a label survives a scope. An undefined scope keeps every label. */
+export declare function keepsLabel(scope: LabelScope | undefined, label: string): boolean;
+/** One `histogram_quantile` call and what is wrong with its histogram argument. */
+export interface HistogramProblem {
+    call: string;
+    problem: "no-bucket" | "no-le";
+}
+/** `histogram_quantile` calls over a selector with no `_bucket` in its name, or an aggregation that drops `le`. */
+export declare function histogramProblems(expr: string): HistogramProblem[];
+/** `rate`, `irate` or `increase` read straight from a named selector whose name does not end in a counter suffix. */
+export declare function nonCounterRates(expr: string): Array<{
+    fn: string;
+    name: string;
+}>;
+/** A regex matcher that could be an equality matcher, or that carries anchors Prometheus already adds. */
+export interface RegexProblem {
+    matcher: string;
+    problem: "literal" | "anchored";
+}
+/** The `=~` and `!~` matchers in an expression that need no regex, or that are anchored (pint promql/regexp). */
+export declare function regexProblems(expr: string): RegexProblem[];
+/** Whether every selector in the expression is read through a `*_over_time` function, so the expression already spans a window. */
+export declare function readsOnlyOverTime(expr: string): boolean;
+/** Whether the expression is two conditions joined by `and`: the multi-window form, where the short window does what `for` would. */
+export declare function isMultiWindow(expr: string): boolean;
+export {};
+//# sourceMappingURL=promql-analysis.d.ts.map

package/dist/promql-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promql-analysis.d.ts","sourceRoot":"","sources":["../src/promql-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;AAE7D,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAWhE;AAMD,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQnD;AAmBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4CAA4C;AAC5C,MAAM,WAAW,QAAQ;IACvB,4GAA4G;IAC5G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAiCD,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAelD;AAkBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAgC9D;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAuBzE,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAiEjE;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGhF;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;CAChC;AAED,mHAAmH;AACnH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAmBlE;AAKD,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAMjF;AAID,0GAA0G;AAC1G,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,GAAG,UAAU,CAAC;CACjC;AAED,iHAAiH;AACjH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAW1D;AAED,mIAAmI;AACnI,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED,qIAAqI;AACrI,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOnD"}

package/dist/rule-eval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule-eval.d.ts","sourceRoot":"","sources":["../src/rule-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAA8D,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAI3G,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC5C,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AACD,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AACD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAkCD,8DAA8D;AAC9D,qBAAa,aAAa;IAKZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;gBAErC,MAAM,EAAE,eAAe,EAAE;IAEtD,wEAAwE;IACxE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI;IAU/C,yFAAyF;IACzF,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE;IA8B9B,yFAAyF;IACzF,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE;IAK/C,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,MAAM;IAId,iCAAiC;IACjC,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,IAAI;IA0CZ,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,MAAM;CA2Hf"}
+{"version":3,"file":"rule-eval.d.ts","sourceRoot":"","sources":["../src/rule-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAA8D,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAI3G,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC5C,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AACD,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AACD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAkCD,8DAA8D;AAC9D,qBAAa,aAAa;IAKZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAElE,YAA6B,MAAM,EAAE,eAAe,EAAE,EAAI;IAE1D,wEAAwE;IACxE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAQ9C;IAED,yFAAyF;IACzF,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CA4B7B;IAED,yFAAyF;IACzF,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CAG9C;IAED,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,MAAM;IAId,iCAAiC;IACjC,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,IAAI;IA0CZ,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,MAAM;CA2Hf"}

package/dist/rules/literal-credential.ts

@@ -1,5 +1,6 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { SLACK_APP_URL } from "../../validate-integrations";
 import { calleeName, constInitializers, CREDENTIAL_CLASS, literalText, position, propertyName, resolveConst } from "./prom-ast";
 
 /**
@@ -89,6 +90,9 @@ export const literalCredentialRule: LintRule = {
       if (only && integration !== undefined && integration !== only) return;
       const text = literalText(init);
       if (text === undefined || text === "") return;
+      // A Slack bot posts to the public chat.postMessage endpoint with its token
+      // in http_config, and update_message needs exactly that api_url (PROM210).
+      if (key === "api_url" && text === SLACK_APP_URL) return;
       diagnostics.push({
         ruleId: "PROM001",
         severity: "error",

package/dist/rules/prom-helpers.ts

@@ -13,10 +13,12 @@
 import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import type { SerializerResult } from "@intentius/chant/serializer";
 import { loadAll } from "js-yaml";
+import { buildCollectorConfigs, collectorMetricIssues, collectorMetrics } from "../../collector-metrics";
 import { looksLikeAlertmanagerConfig, looksLikeRuleFile, type AlertmanagerConfig, type RuleFileConfig } from "../../model";
 import {
   validateAlertmanagerConfig,
   validateRuleFile,
+  validateRunbookUrls,
   validateSeverityRouting,
   type PrometheusIssue,
   type PrometheusIssueCode,
@@ -62,7 +64,7 @@ function toDiagnostic(issue: PrometheusIssue, source: string): PostSynthDiagnost
   };
 }
 
-/** Diagnostics for one rule-file code (PROM101-PROM107) across every rule file in the output. */
+/** Diagnostics for one rule-file code (PROM101-PROM107, PROM211, PROM213-PROM219) across every rule file in the output. */
 export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) =>
     validateRuleFile(config)
@@ -71,7 +73,7 @@ export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssue
   );
 }
 
-/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM209) across every `alertmanager.yml` in the output. */
+/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210, PROM220-PROM224) across every `alertmanager.yml` in the output. */
 export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).alertmanager.flatMap(({ source, config }) =>
     validateAlertmanagerConfig(config)
@@ -80,6 +82,43 @@ export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusI
   );
 }
 
+/** PROM212 across every rule file in the output. Opt-in: the lexicon's `recommended` lint preset leaves it out (see ../../plugin.ts). */
+export function runbookDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) => validateRunbookUrls(config).map((i) => toDiagnostic(i, source)));
+}
+
+/**
+ * PROM301: every rule expression in the output against the metrics the
+ * build's collector configs emit. Silent when the build has none.
+ */
+export function collectorMetricDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const { ruleFiles } = prometheusDocs(ctx);
+  if (ruleFiles.length === 0) return [];
+  const emitted = collectorMetrics(buildCollectorConfigs(ctx));
+  if (!emitted) return [];
+  const out: PostSynthDiagnostic[] = [];
+  for (const { source, config } of ruleFiles) {
+    for (const group of Array.isArray(config?.groups) ? config.groups : []) {
+      for (const rule of Array.isArray(group?.rules) ? group.rules : []) {
+        const r = rule as unknown as Record<string, unknown>;
+        if (typeof r.expr !== "string") continue;
+        const subject = `${group.name}/${typeof r.record === "string" ? r.record : String(r.alert ?? "")}`;
+        for (const issue of collectorMetricIssues(r.expr, emitted)) {
+          const message = `rule ${subject} ${issue.message}`;
+          out.push({
+            checkId: "PROM301",
+            severity: "warning",
+            message: source && source !== "prometheus" ? `${source}: ${message}` : message,
+            entity: subject,
+            lexicon: "prometheus",
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
 /** PROM202: joins every rule file in the output against every Alertmanager config in it. Silent when either is absent. */
 export function routingDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
   const { ruleFiles, alertmanager } = prometheusDocs(ctx);

package/dist/rules/prom208.ts

@@ -1,7 +1,7 @@
 /**
  * PROM208: An Alertmanager duration is not a duration
  *
- * group_wait, group_interval, repeat_interval, resolve_timeout and webhook timeout take durations such as 30s or 4h.
+ * group_wait, group_interval, repeat_interval, resolve_timeout and Jira reopen_duration take Prometheus durations (30s, 4h, 1d); the timeout of webhook, Slack, PagerDuty and incident.io, and Pushover retry, expire and ttl take Go durations (10s, 1m30s, 500ms).
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";

package/dist/rules/prom209.ts

@@ -1,7 +1,7 @@
 /**
  * PROM209: A receiver integration is missing its destination or credential
  *
- * A webhook needs url or url_file, Slack an api_url (or the global one), PagerDuty a routing_key or service_key, and email a to address, a smarthost and a from address (or their global defaults).
+ * Every one of Alertmanager's 18 integrations is checked for the destination, credential and required fields its config validation asks for, with the global defaults it falls back to: e.g. a webhook url, an Opsgenie api_key (or global.opsgenie_api_key), a Telegram chat_id and bot token, a Webex room_id and authorization, an SNS target, a Jira project and issue_type.
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";

package/dist/rules/prom210.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM210: A receiver integration or global setting is one Alertmanager rejects
+ *
+ * Two settings that exclude each other (a value and its *_file, a Slack api_url and app_token, Pushover html and monospace, two SNS targets), or a value outside the allowed set (WeChat message_type, Telegram parse_mode, Jira api_type, an Opsgenie responder type, a VictorOps reserved custom field, a smarthost that is not host:port, a Slack or Mattermost field without title and value).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom210: PostSynthCheck = {
+  id: "PROM210",
+  description: "A receiver integration or global setting is one Alertmanager rejects",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM210");
+  },
+};