@intentius/chant-lexicon-prometheus 0.101.0 → 0.104.0

package/dist/rules/prom211.ts

@@ -0,0 +1,21 @@
+/**
+ * PROM211: An alerting rule has no for, or for: 0s
+ *
+ * The alert fires on the first evaluation that matches, so one bad scrape
+ * pages. Left alone when the expression reads no series (vector(1), a dead
+ * man's switch) or already spans a window: every selector read through a
+ * *_over_time function, or two conditions joined by and (the multi-window
+ * burn-rate form, where the short window does what for would).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom211: PostSynthCheck = {
+  id: "PROM211",
+  description: "An alerting rule has no for, or for: 0s",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM211");
+  },
+};

package/dist/rules/prom212.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM212: An alerting rule has no runbook_url annotation (opt-in)
+ *
+ * Off unless enabled: the lint preset all, or a lint.rules entry for PROM212,
+ * turns it on. See validateRunbookUrls.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { runbookDiagnostics } from "./prom-helpers";
+
+export const prom212: PostSynthCheck = {
+  id: "PROM212",
+  description: "An alerting rule has no runbook_url annotation (opt-in)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return runbookDiagnostics(ctx);
+  },
+};

package/dist/rules/prom213.ts

@@ -0,0 +1,20 @@
+/**
+ * PROM213: An alert expression has no comparison
+ *
+ * Every series the expression returns is an alert, so an expression with no
+ * comparison fires for all of them. absent(), absent_over_time() and unless
+ * count as a condition; a comparison with bool does not. An expression that
+ * reads no series (vector(1), a dead man's switch) is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom213: PostSynthCheck = {
+  id: "PROM213",
+  description: "An alert expression has no comparison",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM213");
+  },
+};

package/dist/rules/prom214.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM214: An alert template reads a label the expression aggregates away
+ *
+ * A $labels.x whose x the expression's by (...) leaves out, or its without
+ * (...) names, renders empty. Labels the rule or its group set are left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom214: PostSynthCheck = {
+  id: "PROM214",
+  description: "An alert template reads a label the expression aggregates away",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM214");
+  },
+};

package/dist/rules/prom215.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM215: rate, irate or increase over a name that is not a counter's
+ *
+ * These functions treat every drop as a counter reset. A name not ending in
+ * _total, _count, _sum or _bucket is read as a gauge.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom215: PostSynthCheck = {
+  id: "PROM215",
+  description: "rate, irate or increase over a name that is not a counter's",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM215");
+  },
+};

package/dist/rules/prom216.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM216: histogram_quantile over a series without _bucket, or without le
+ *
+ * A classic histogram's quantile needs its _bucket series with the le label
+ * kept. A native histogram has no _bucket series, so this check does not apply
+ * to one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom216: PostSynthCheck = {
+  id: "PROM216",
+  description: "histogram_quantile over a series without _bucket, or without le",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM216");
+  },
+};

package/dist/rules/prom217.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM217: A recording rule name is not in level:metric:operations form
+ *
+ * Prometheus's naming convention for recorded series, e.g.
+ * job:http_requests:rate5m.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom217: PostSynthCheck = {
+  id: "PROM217",
+  description: "A recording rule name is not in level:metric:operations form",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM217");
+  },
+};

package/dist/rules/prom218.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM218: A regex matcher needs no regex, or is anchored
+ *
+ * A =~ or !~ with no regex metacharacters is an equality matcher written the
+ * slow way. Prometheus anchors every regex, so a leading ^ or trailing $ does
+ * nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom218: PostSynthCheck = {
+  id: "PROM218",
+  description: "A regex matcher needs no regex, or is anchored",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM218");
+  },
+};

package/dist/rules/prom219.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM219: An alerting rule sets the alertname label
+ *
+ * Prometheus sets alertname to the rule's name after applying the rule's
+ * labels, so the value is overwritten.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom219: PostSynthCheck = {
+  id: "PROM219",
+  description: "An alerting rule sets the alertname label",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM219");
+  },
+};

package/dist/rules/prom220.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM220: A receiver turns off TLS certificate verification
+ *
+ * tls_config.insecure_skip_verify: true on a receiver, or in global, accepts
+ * any certificate the endpoint presents.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom220: PostSynthCheck = {
+  id: "PROM220",
+  description: "A receiver turns off TLS certificate verification",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM220");
+  },
+};

package/dist/rules/prom221.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM221: SMTP credentials sent with require_tls false
+ *
+ * An email receiver with SMTP auth and require_tls false (its own, or
+ * global.smtp_require_tls) can send the credentials in clear text. Implicit
+ * TLS is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom221: PostSynthCheck = {
+  id: "PROM221",
+  description: "SMTP credentials sent with require_tls false",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM221");
+  },
+};

package/dist/rules/prom222.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM222: Credentials sent to an http:// receiver URL
+ *
+ * An integration whose URL is http:// and whose request carries a credential:
+ * user info in the URL, http_config auth, or a key or token field.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom222: PostSynthCheck = {
+  id: "PROM222",
+  description: "Credentials sent to an http:// receiver URL",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM222");
+  },
+};

package/dist/rules/prom223.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM223: repeat_interval is shorter than group_interval
+ *
+ * Alertmanager resends only when it flushes a group, every group_interval, so
+ * a shorter repeat_interval never takes effect. Intervals are inherited down
+ * the routing tree from Alertmanager's defaults.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom223: PostSynthCheck = {
+  id: "PROM223",
+  description: "repeat_interval is shorter than group_interval",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM223");
+  },
+};

package/dist/rules/prom224.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM224: An inhibit rule matches one alert as source and target, with no equal
+ *
+ * With no equal, any alert matching the source mutes every alert matching the
+ * target. When one alert can match both, alerts of that kind mute each other.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom224: PostSynthCheck = {
+  id: "PROM224",
+  description: "An inhibit rule matches one alert as source and target, with no equal",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM224");
+  },
+};

package/dist/rules/prom301.ts

@@ -0,0 +1,23 @@
+/**
+ * PROM301: A rule reads a connector metric no collector in the build emits
+ *
+ * For each selector in a rule whose name falls under a namespace the build's
+ * spanmetrics, servicegraph or GenAI connectors own (spanmetrics' and
+ * servicegraph's defaults included), reports a name no collector config in
+ * the build emits, and a by (...) label that is not a dimension the config
+ * declares for the metrics aggregated. Silent for names outside those
+ * namespaces, and when the build has no collector config. See
+ * ../../collector-metrics.ts.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { collectorMetricDiagnostics } from "./prom-helpers";
+
+export const prom301: PostSynthCheck = {
+  id: "PROM301",
+  description: "A rule reads a connector metric no collector in the build emits",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return collectorMetricDiagnostics(ctx);
+  },
+};

package/dist/skill-defs.d.ts

@@ -1,3 +1,3 @@
 /** The prometheus lexicon's AI skills, read from src/skills/. */
-export declare const prometheusSkills: () => import("packages/core/src").SkillDefinition[];
+export declare const prometheusSkills: () => import("@intentius/chant").SkillDefinition[];
 //# sourceMappingURL=skill-defs.d.ts.map

package/dist/skill-defs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-defs.d.ts","sourceRoot":"","sources":["../src/skill-defs.ts"],"names":[],"mappings":"AAEA,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,qDAuC3B,CAAC"}
+{"version":3,"file":"skill-defs.d.ts","sourceRoot":"","sources":["../src/skill-defs.ts"],"names":[],"mappings":"AAEA,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,oDAuC3B,CAAC"}

package/dist/skills/chant-prometheus-alertmanager.md

@@ -57,6 +57,8 @@ Import it rather than retyping it: `chant import alertmanager.yml --output src`
 - Routes name receivers and time intervals that exist (PROM201, PROM204). Reference the entity rather than a string and TypeScript does most of this.
 - Every `severity` an alert in the same build root carries is matched by some route below the root (PROM202). The check only sees one build root (chant #1939): keep the rules and the Alertmanager config in the same one, or it goes quiet.
 - Credentials go in `*_file` fields. Alertmanager does not expand environment variables in its config, and a literal `api_url`, `routing_key` or `auth_password` is flagged (PROM001).
-- Each integration has somewhere to send (PROM209): a webhook `url`, a Slack `api_url` (or `global.slack_api_url`), a PagerDuty key, an email `to`/`smarthost`/`from` (or the global SMTP defaults).
+- Each integration has its destination, credential and required fields, or the `global` default it falls back to (PROM209): a webhook `url`, a Slack `api_url` or app token, an Opsgenie `api_key`, a Telegram `chat_id` and bot token, a Webex `room_id` and `http_config.authorization`, one SNS target, a Jira `project` and `issue_type`, an email `to`/`smarthost`/`from`, and so on.
+- No setting Alertmanager rejects (PROM210): a value and its `*_file` both set, a Slack `api_url` with an app token, `update_message` without `api_url: https://slack.com/api/chat.postMessage`, a WeChat `message_type` other than `text`/`markdown`, a Telegram `parse_mode` other than `Markdown`/`MarkdownV2`/`HTML`.
+- Durations parse (PROM208). Route timers and `resolve_timeout` take `1d`; the integration `timeout`s and Pushover `retry`/`expire`/`ttl` are Go durations and take `24h`, not `1d`.
 
 Run `amtoolCheckConfig(alertmanagerYaml(entities))` in a test to have `amtool check-config` confirm it when installed.

package/dist/validate-config.d.ts

@@ -7,7 +7,7 @@
  * `PrometheusRule`'s groups, or on a file parsed by some other tool.
  */
 import { type AlertmanagerConfig, type RuleFileConfig } from "./model.js";
-export type PrometheusIssueCode = "PROM101" | "PROM102" | "PROM103" | "PROM104" | "PROM105" | "PROM106" | "PROM107" | "PROM201" | "PROM202" | "PROM203" | "PROM204" | "PROM205" | "PROM206" | "PROM207" | "PROM208" | "PROM209";
+export type PrometheusIssueCode = "PROM101" | "PROM102" | "PROM103" | "PROM104" | "PROM105" | "PROM106" | "PROM107" | "PROM201" | "PROM202" | "PROM203" | "PROM204" | "PROM205" | "PROM206" | "PROM207" | "PROM208" | "PROM209" | "PROM210" | "PROM211" | "PROM212" | "PROM213" | "PROM214" | "PROM215" | "PROM216" | "PROM217" | "PROM218" | "PROM219" | "PROM220" | "PROM221" | "PROM222" | "PROM223" | "PROM224";
 export interface PrometheusIssue {
     code: PrometheusIssueCode;
     severity: "error" | "warning";
@@ -15,11 +15,17 @@ export interface PrometheusIssue {
     /** What the issue is about: a group, a rule (`group/rule`), a receiver or a route. */
     subject?: string;
 }
-/** Check a rule file (PROM101-PROM107). */
+/** Check a rule file (PROM101-PROM107, PROM211 and PROM213-PROM219). PROM212 is opt-in; see {@link validateRunbookUrls}. */
 export declare function validateRuleFile(file: RuleFileConfig): PrometheusIssue[];
+/**
+ * PROM212: alerts without a `runbook_url` annotation. Not part of
+ * {@link validateRuleFile}, because the check is opt-in: the lint preset
+ * `all`, or a `lint.rules` entry for PROM212, turns it on.
+ */
+export declare function validateRunbookUrls(file: RuleFileConfig): PrometheusIssue[];
 /** Every severity value an alert in these rule files carries, with the alerts carrying it. */
 export declare function alertSeverities(files: RuleFileConfig[]): Map<string, string[]>;
-/** Check an `alertmanager.yml` on its own (PROM201, PROM203-PROM209). */
+/** Check an `alertmanager.yml` on its own (PROM201, PROM203-PROM210, PROM220-PROM224). */
 export declare function validateAlertmanagerConfig(config: AlertmanagerConfig): PrometheusIssue[];
 /**
  * PROM202: every severity an alert carries is taken by some route below the

package/dist/validate-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-config.d.ts","sourceRoot":"","sources":["../src/validate-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAGL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AAGjB,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmBD,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,eAAe,EAAE,CAsHxE;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAa9E;AAsBD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA4HxF;AAYD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6BlH"}
+{"version":3,"file":"validate-config.d.ts","sourceRoot":"","sources":["../src/validate-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAGL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AAiBjB,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAwID,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,eAAe,EAAE,CAmIxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,eAAe,EAAE,CAU3E;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAa9E;AAkGD,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAsHxF;AAYD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6BlH"}

package/dist/validate-integrations.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Receiver integration and `global:` checks for `alertmanager.yml`
+ * (PROM208-PROM210), one case per validation Alertmanager v0.34.1 makes when
+ * it loads the file (see ./pin.ts). Sources, under
+ * github.com/prometheus/alertmanager at that tag:
+ *
+ * - `config/notifiers.go`: the `UnmarshalYAML` of the Email, Slack (and its
+ *   fields, actions and confirmations), WeChat, VictorOps, Pushover, SNS,
+ *   Rocket.Chat and Webex configs.
+ * - `notify/<name>/config.go`: the `UnmarshalYAML` of the Discord,
+ *   incident.io, Jira, Mattermost (and its fields), MS Teams, MS Teams v2,
+ *   Opsgenie, PagerDuty, Telegram and webhook configs.
+ * - `config/config.go`: `Config.UnmarshalYAML`, which fills each
+ *   integration from its `global:` default and then rejects what is still
+ *   missing, and the `global:` "at most one of" checks; `HostPort` for
+ *   `smarthost`.
+ *
+ * Durations come in two grammars. `model.Duration` fields (`resolve_timeout`,
+ * the route timers, Jira `reopen_duration`) use Prometheus's, see
+ * ./duration.ts. `time.Duration` fields (the `timeout` of webhook, Slack,
+ * PagerDuty and incident.io, and Pushover's `retry`, `expire` and `ttl`)
+ * use Go's `time.ParseDuration`: `1.5s` and `300ms` are valid, `1d` is not.
+ *
+ * Alertmanager stops at the first error; these checks report every one.
+ * PROM209 is something missing (a destination, credential or required
+ * field), PROM210 a setting Alertmanager rejects (two settings that exclude
+ * each other, or a value outside the allowed set), PROM208 a duration.
+ */
+import type { AlertmanagerGlobalConfig, ReceiverConfig } from "./model.js";
+import type { PrometheusIssue } from "./validate-config.js";
+/** True when `value` is a Go `time.ParseDuration` duration (`0`, `1.5s`, `1h30m`, `300ms`). */
+export declare function isValidGoDuration(value: unknown): boolean;
+export declare const SLACK_APP_URL = "https://slack.com/api/chat.postMessage";
+/** PROM208-PROM210 findings for every integration of one receiver. */
+export declare function validateReceiverIntegrations(receiver: ReceiverConfig, global: AlertmanagerGlobalConfig): PrometheusIssue[];
+/** PROM208 and PROM210 findings for `global:` (config/config.go `Config.UnmarshalYAML`). */
+export declare function validateGlobalSettings(global: AlertmanagerGlobalConfig): PrometheusIssue[];
+//# sourceMappingURL=validate-integrations.d.ts.map

package/dist/validate-integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-integrations.d.ts","sourceRoot":"","sources":["../src/validate-integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAoB,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAwBzD,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKzD;AAkBD,eAAO,MAAM,aAAa,2CAA2C,CAAC;AA2QtE,sEAAsE;AACtE,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAS1H;AAgBD,4FAA4F;AAC5F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAe1F"}

package/dist/validate-security.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Settings Alertmanager accepts that weaken how it talks to a receiver
+ * (PROM220-PROM222): certificate checks turned off, SMTP credentials sent
+ * without TLS, and credentials sent to an `http://` URL. `amtool
+ * check-config` passes all three.
+ */
+import type { AlertmanagerGlobalConfig, ReceiverConfig } from "./model.js";
+import type { PrometheusIssue } from "./validate-config.js";
+/** PROM220-PROM222 for one receiver. */
+export declare function validateReceiverSecurity(receiver: ReceiverConfig, global: AlertmanagerGlobalConfig): PrometheusIssue[];
+/** PROM220 for `global:`'s own TLS settings, which every receiver without its own inherits. */
+export declare function validateGlobalSecurity(global: AlertmanagerGlobalConfig): PrometheusIssue[];
+//# sourceMappingURL=validate-security.d.ts.map

package/dist/validate-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-security.d.ts","sourceRoot":"","sources":["../src/validate-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AA4DzD,wCAAwC;AACxC,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CA+DtH;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAO1F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-prometheus",
-  "version": "0.101.0",
+  "version": "0.104.0",
   "description": "Prometheus lexicon for chant — typed recording and alerting rule groups and Alertmanager routing, serialized to a rule file and alertmanager.yml",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -56,7 +56,7 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
   },
   "dependencies": {
     "@intentius/chant-lexicon-otel": "*",
@@ -72,7 +72,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.101.0",
+    "@intentius/chant": "^0.104.0",
     "typescript": "^5.9.3"
   }
 }