@intentius/chant-lexicon-prometheus 0.101.0 → 0.104.0

package/src/lint/post-synth/prom211.ts

@@ -0,0 +1,21 @@
+/**
+ * PROM211: An alerting rule has no for, or for: 0s
+ *
+ * The alert fires on the first evaluation that matches, so one bad scrape
+ * pages. Left alone when the expression reads no series (vector(1), a dead
+ * man's switch) or already spans a window: every selector read through a
+ * *_over_time function, or two conditions joined by and (the multi-window
+ * burn-rate form, where the short window does what for would).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom211: PostSynthCheck = {
+  id: "PROM211",
+  description: "An alerting rule has no for, or for: 0s",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM211");
+  },
+};

package/src/lint/post-synth/prom212.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM212: An alerting rule has no runbook_url annotation (opt-in)
+ *
+ * Off unless enabled: the lint preset all, or a lint.rules entry for PROM212,
+ * turns it on. See validateRunbookUrls.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { runbookDiagnostics } from "./prom-helpers";
+
+export const prom212: PostSynthCheck = {
+  id: "PROM212",
+  description: "An alerting rule has no runbook_url annotation (opt-in)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return runbookDiagnostics(ctx);
+  },
+};

package/src/lint/post-synth/prom213.ts

@@ -0,0 +1,20 @@
+/**
+ * PROM213: An alert expression has no comparison
+ *
+ * Every series the expression returns is an alert, so an expression with no
+ * comparison fires for all of them. absent(), absent_over_time() and unless
+ * count as a condition; a comparison with bool does not. An expression that
+ * reads no series (vector(1), a dead man's switch) is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom213: PostSynthCheck = {
+  id: "PROM213",
+  description: "An alert expression has no comparison",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM213");
+  },
+};

package/src/lint/post-synth/prom214.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM214: An alert template reads a label the expression aggregates away
+ *
+ * A $labels.x whose x the expression's by (...) leaves out, or its without
+ * (...) names, renders empty. Labels the rule or its group set are left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom214: PostSynthCheck = {
+  id: "PROM214",
+  description: "An alert template reads a label the expression aggregates away",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM214");
+  },
+};

package/src/lint/post-synth/prom215.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM215: rate, irate or increase over a name that is not a counter's
+ *
+ * These functions treat every drop as a counter reset. A name not ending in
+ * _total, _count, _sum or _bucket is read as a gauge.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom215: PostSynthCheck = {
+  id: "PROM215",
+  description: "rate, irate or increase over a name that is not a counter's",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM215");
+  },
+};

package/src/lint/post-synth/prom216.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM216: histogram_quantile over a series without _bucket, or without le
+ *
+ * A classic histogram's quantile needs its _bucket series with the le label
+ * kept. A native histogram has no _bucket series, so this check does not apply
+ * to one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom216: PostSynthCheck = {
+  id: "PROM216",
+  description: "histogram_quantile over a series without _bucket, or without le",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM216");
+  },
+};

package/src/lint/post-synth/prom217.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM217: A recording rule name is not in level:metric:operations form
+ *
+ * Prometheus's naming convention for recorded series, e.g.
+ * job:http_requests:rate5m.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom217: PostSynthCheck = {
+  id: "PROM217",
+  description: "A recording rule name is not in level:metric:operations form",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM217");
+  },
+};

package/src/lint/post-synth/prom218.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM218: A regex matcher needs no regex, or is anchored
+ *
+ * A =~ or !~ with no regex metacharacters is an equality matcher written the
+ * slow way. Prometheus anchors every regex, so a leading ^ or trailing $ does
+ * nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom218: PostSynthCheck = {
+  id: "PROM218",
+  description: "A regex matcher needs no regex, or is anchored",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM218");
+  },
+};

package/src/lint/post-synth/prom219.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM219: An alerting rule sets the alertname label
+ *
+ * Prometheus sets alertname to the rule's name after applying the rule's
+ * labels, so the value is overwritten.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom219: PostSynthCheck = {
+  id: "PROM219",
+  description: "An alerting rule sets the alertname label",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM219");
+  },
+};

package/src/lint/post-synth/prom220.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM220: A receiver turns off TLS certificate verification
+ *
+ * tls_config.insecure_skip_verify: true on a receiver, or in global, accepts
+ * any certificate the endpoint presents.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom220: PostSynthCheck = {
+  id: "PROM220",
+  description: "A receiver turns off TLS certificate verification",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM220");
+  },
+};

package/src/lint/post-synth/prom221.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM221: SMTP credentials sent with require_tls false
+ *
+ * An email receiver with SMTP auth and require_tls false (its own, or
+ * global.smtp_require_tls) can send the credentials in clear text. Implicit
+ * TLS is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom221: PostSynthCheck = {
+  id: "PROM221",
+  description: "SMTP credentials sent with require_tls false",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM221");
+  },
+};

package/src/lint/post-synth/prom222.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM222: Credentials sent to an http:// receiver URL
+ *
+ * An integration whose URL is http:// and whose request carries a credential:
+ * user info in the URL, http_config auth, or a key or token field.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom222: PostSynthCheck = {
+  id: "PROM222",
+  description: "Credentials sent to an http:// receiver URL",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM222");
+  },
+};

package/src/lint/post-synth/prom223.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM223: repeat_interval is shorter than group_interval
+ *
+ * Alertmanager resends only when it flushes a group, every group_interval, so
+ * a shorter repeat_interval never takes effect. Intervals are inherited down
+ * the routing tree from Alertmanager's defaults.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom223: PostSynthCheck = {
+  id: "PROM223",
+  description: "repeat_interval is shorter than group_interval",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM223");
+  },
+};

package/src/lint/post-synth/prom224.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM224: An inhibit rule matches one alert as source and target, with no equal
+ *
+ * With no equal, any alert matching the source mutes every alert matching the
+ * target. When one alert can match both, alerts of that kind mute each other.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom224: PostSynthCheck = {
+  id: "PROM224",
+  description: "An inhibit rule matches one alert as source and target, with no equal",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM224");
+  },
+};

package/src/lint/post-synth/prom301.test.ts

@@ -0,0 +1,157 @@
+/**
+ * PROM301 (#3364): rule selectors under a connector namespace against what
+ * the build's collector configs emit.
+ */
+import { describe, expect, test } from "vitest";
+import type { Declarable } from "@intentius/chant/declarable";
+import { makePostSynthCtx, makePostSynthCtxFromFiles } from "@intentius/chant-test-utils";
+import { PrometheusExporter, ServiceGraphConnector, SpanMetricsConnector } from "@intentius/chant-lexicon-otel/components/index";
+import { genAiMetrics, genAiPipeline, type GenAiMetricsOptions } from "@intentius/chant-lexicon-otel/genai";
+import { collectorYaml } from "@intentius/chant-lexicon-otel/collector";
+import { prom301 } from "./prom301";
+import { emitYaml } from "../../build";
+import { ruleGroupConfig } from "../../rules";
+import { GenAiRules, type GenAiAlerting, type GenAiPrice } from "../../composites/genai";
+import { Slo } from "../../composites/slo";
+import type { RuleGroupConfig } from "../../model";
+
+const entities = (...list: Declarable[]) => new Map(list.map((e, i) => [`e${i}`, e] as [string, Declarable]));
+
+/** A rule file of one recording rule per expression. */
+function rules(...exprs: string[]): string {
+  return JSON.stringify({ groups: [{ name: "g", rules: exprs.map((expr, i) => ({ record: `job:r${i}:rate5m`, expr })) }] });
+}
+
+/** PROM301's messages for a rule file, with the collector declared as otel entities in the same build. */
+function found(text: string, ...collector: Declarable[]): string[] {
+  return prom301.check(makePostSynthCtx("prometheus", text, entities(...collector))).map((d) => d.message);
+}
+
+describe("PROM301", () => {
+  test("a rule reading traces_span_metrics_calls_total with no spanmetrics connector of that namespace is reported", () => {
+    const msgs = found(rules("sum by (service_name) (rate(traces_span_metrics_calls_total[5m]))"), new SpanMetricsConnector({ namespace: "shop" }));
+    expect(msgs).toEqual(["rule g/job:r0:rate5m reads traces_span_metrics_calls_total, which no collector config in the build emits under traces_span_metrics"]);
+  });
+
+  test("the names a declared connector emits pass, a misspelt one under its namespace does not", () => {
+    const shop = new SpanMetricsConnector({ namespace: "shop", histogram: { unit: "s" } });
+    expect(found(rules("sum by (service_name) (rate(shop_calls_total[5m]))", "histogram_quantile(0.9, sum by (le) (rate(shop_duration_seconds_bucket[5m])))"), shop)).toEqual([]);
+    expect(found(rules("sum(rate(shop_call_total[5m]))"), shop)).toEqual([
+      "rule g/job:r0:rate5m reads shop_call_total, which no collector config in the build emits under shop",
+    ]);
+    // A duration histogram in ms, read as seconds.
+    expect(found(rules("sum(rate(traces_span_metrics_duration_seconds_count[5m]))"), new SpanMetricsConnector({}))).toHaveLength(1);
+  });
+
+  test("a by (...) label that is not a declared dimension", () => {
+    const spans = new SpanMetricsConnector({ dimensions: [{ name: "http.route" }] });
+    expect(found(rules("sum by (service_name, http_route, job) (rate(traces_span_metrics_calls_total[5m]))"), spans)).toEqual([]);
+    expect(found(rules("sum by (http_method) (rate(traces_span_metrics_calls_total[5m]))"), spans)).toEqual([
+      "rule g/job:r0:rate5m groups traces_span_metrics_calls_total by http_method, which is not a dimension the collector config declares for it",
+    ]);
+    // le belongs to the _bucket series only.
+    expect(found(rules("sum by (le) (rate(traces_span_metrics_duration_milliseconds_count[5m]))"), spans)).toHaveLength(1);
+    // label_replace writes a label of its own, so the aggregation over it is not checked.
+    expect(found(rules('sum by (route) (label_replace(rate(traces_span_metrics_calls_total[5m]), "route", "$1", "http_route", "(.*)"))'), spans)).toEqual([]);
+  });
+
+  test("an exporter that copies every resource attribute leaves the labels open", () => {
+    const spans = new SpanMetricsConnector({});
+    const exporter = new PrometheusExporter({ endpoint: "0.0.0.0:8889", resource_to_telemetry_conversion: { enabled: true } });
+    expect(found(rules("sum by (k8s_namespace_name) (rate(traces_span_metrics_calls_total[5m]))"), spans, exporter)).toEqual([]);
+  });
+
+  test("the exporter's namespace moves every name", () => {
+    const spans = new SpanMetricsConnector({});
+    const exporter = new PrometheusExporter({ endpoint: "0.0.0.0:8889", namespace: "otel" });
+    expect(found(rules("sum(rate(otel_traces_span_metrics_calls_total[5m]))"), spans, exporter)).toEqual([]);
+    expect(found(rules("sum(rate(otel_traces_span_metrics_call_total[5m]))"), spans, exporter)).toHaveLength(1);
+  });
+
+  test("servicegraph names and labels", () => {
+    const graph = new ServiceGraphConnector({ dimensions: ["http.method"] });
+    expect(found(rules("sum by (client, server, client_http_method) (rate(traces_service_graph_request_total[5m]))"), graph)).toEqual([]);
+    expect(found(rules("sum by (client) (rate(traces_service_graph_request_duration_seconds_count[5m]))"), graph)).toHaveLength(1);
+    expect(found(rules("sum by (peer) (rate(traces_service_graph_request_failed_total[5m]))"), graph)).toHaveLength(1);
+  });
+
+  test("silent for names outside every namespace, and with no collector config in the build", () => {
+    expect(found(rules("sum by (job) (rate(http_requests_total[5m]))"), new SpanMetricsConnector({}))).toEqual([]);
+    expect(found(rules("sum by (nope) (rate(traces_span_metrics_calls_totl[5m]))"))).toEqual([]);
+  });
+
+  test("reads a collector config from the output too, as in a ConfigMap or a multi-lexicon context", () => {
+    const yaml = collectorYaml(genAiPipeline({ namespace: "shop" }));
+    const ctx = makePostSynthCtxFromFiles("prometheus", { "collector.yaml": yaml }, rules("sum(rate(traces_span_metrics_calls_total[5m]))"));
+    expect(prom301.check(ctx)).toHaveLength(1);
+  });
+});
+
+describe("PROM301 reads renamed connector types as the built-ins they name", () => {
+  const config = (connectors: string) => `receivers:
+  otlp: {}
+exporters:
+  prometheus:
+    endpoint: 0.0.0.0:8889
+connectors:
+${connectors}
+service:
+  pipelines:
+    traces:
+      receivers: [otlp]
+      exporters: [debug]
+`;
+  const ctx = (yaml: string, text: string) => makePostSynthCtxFromFiles("prometheus", { "collector.yaml": yaml }, text);
+
+  test("span_metrics, service_graph and signal_to_metrics", () => {
+    const yaml = config(`  span_metrics/shop:
+    namespace: shop
+  service_graph: {}
+  signal_to_metrics/genai_client:
+    spans:
+      - name: gen_ai.client.operation.duration
+        unit: s
+        attributes: [{ key: gen_ai.operation.name }]
+        histogram: { buckets: [1] }
+`);
+    const read = rules(
+      "sum by (service_name) (rate(shop_calls_total[5m]))",
+      "sum by (client) (rate(traces_service_graph_request_total[5m]))",
+      "sum by (gen_ai_operation_name, le) (rate(gen_ai_client_operation_duration_seconds_bucket[5m]))",
+    );
+    expect(prom301.check(ctx(yaml, read))).toEqual([]);
+    expect(prom301.check(ctx(yaml, rules("sum(rate(shop_call_total[5m]))", "sum(rate(gen_ai_client_operation_seconds_count[5m]))"))).map((d) => d.entity)).toEqual([
+      "g/job:r0:rate5m",
+      "g/job:r1:rate5m",
+    ]);
+  });
+});
+
+describe("PROM301 on the lexicon's own rules", () => {
+  const groupYaml = (group: RuleGroupConfig) => emitYaml({ groups: [group] });
+  const prices: GenAiPrice[] = [{ provider: "anthropic", model: "m1", inputPerMTok: 3, outputPerMTok: 15, currency: "USD", source: "https://example.com", asOf: "2026-09-29" }];
+  const alerts: GenAiAlerting = { errorRatio: true, latency: true, toolErrorRatio: true, budgets: [{ amount: 5, currency: "USD", per: "hour" }] };
+
+  test.each([
+    ["spans", {}],
+    ["derived client metrics", { clientMetrics: "derive" }],
+    ["provider dimensions and a namespace", { providerDimensions: true, namespace: "ai" }],
+  ] as Array<[string, GenAiMetricsOptions]>)("GenAiRules over genAiPipeline with %s, with and without its alerts", (_label, options) => {
+    const collector = genAiPipeline({ ...options, metricExporters: [new PrometheusExporter({ endpoint: "0.0.0.0:8889" })] });
+    const genAi = genAiMetrics(options);
+    for (const props of [{ genAi, prices }, { genAi, prices, alerts }]) {
+      expect(found(groupYaml(ruleGroupConfig(GenAiRules(props).rules)), ...collector)).toEqual([]);
+    }
+  });
+
+  test("Slo over the default spanmetrics connector", () => {
+    const calls = "traces_span_metrics_calls_total";
+    const slo = Slo({
+      name: "checkout",
+      objective: 0.999,
+      window: "30d",
+      sli: { errors: `sum(rate(${calls}{span_name="checkout",status_code="STATUS_CODE_ERROR"}[{{window}}]))`, total: `sum(rate(${calls}{span_name="checkout"}[{{window}}]))` },
+    });
+    expect(found(groupYaml(ruleGroupConfig(slo.rules)), new SpanMetricsConnector({}))).toEqual([]);
+  });
+});

package/src/lint/post-synth/prom301.ts

@@ -0,0 +1,23 @@
+/**
+ * PROM301: A rule reads a connector metric no collector in the build emits
+ *
+ * For each selector in a rule whose name falls under a namespace the build's
+ * spanmetrics, servicegraph or GenAI connectors own (spanmetrics' and
+ * servicegraph's defaults included), reports a name no collector config in
+ * the build emits, and a by (...) label that is not a dimension the config
+ * declares for the metrics aggregated. Silent for names outside those
+ * namespaces, and when the build has no collector config. See
+ * ../../collector-metrics.ts.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { collectorMetricDiagnostics } from "./prom-helpers";
+
+export const prom301: PostSynthCheck = {
+  id: "PROM301",
+  description: "A rule reads a connector metric no collector in the build emits",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return collectorMetricDiagnostics(ctx);
+  },
+};

package/src/lint/rules/literal-credential.ts

@@ -1,5 +1,6 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { SLACK_APP_URL } from "../../validate-integrations";
 import { calleeName, constInitializers, CREDENTIAL_CLASS, literalText, position, propertyName, resolveConst } from "./prom-ast";
 
 /**
@@ -89,6 +90,9 @@ export const literalCredentialRule: LintRule = {
       if (only && integration !== undefined && integration !== only) return;
       const text = literalText(init);
       if (text === undefined || text === "") return;
+      // A Slack bot posts to the public chat.postMessage endpoint with its token
+      // in http_config, and update_message needs exactly that api_url (PROM210).
+      if (key === "api_url" && text === SLACK_APP_URL) return;
       diagnostics.push({
         ruleId: "PROM001",
         severity: "error",

package/src/lint/rules/rules.test.ts

@@ -45,6 +45,22 @@ describe("PROM001 literal credential", () => {
     expect(diags).toEqual([]);
   });
 
+  test("accepts Slack's bot endpoint as api_url, which update_message needs", () => {
+    const diags = literalCredentialRule.check(
+      ctx(`
+        new Receiver({
+          name: "chat",
+          slack_configs: [{
+            api_url: "https://slack.com/api/chat.postMessage",
+            update_message: true,
+            http_config: { authorization: { credentials_file: "/etc/slack-bot-token" } },
+          }],
+        });
+      `),
+    );
+    expect(diags).toEqual([]);
+  });
+
   test("follows values lifted into named consts, shorthand props and spreads", () => {
     const diags = literalCredentialRule.check(
       ctx(`

package/src/plugin.test.ts

@@ -37,6 +37,22 @@ describe("prometheus plugin", () => {
       "PROM207",
       "PROM208",
       "PROM209",
+      "PROM210",
+      "PROM211",
+      "PROM212",
+      "PROM213",
+      "PROM214",
+      "PROM215",
+      "PROM216",
+      "PROM217",
+      "PROM218",
+      "PROM219",
+      "PROM220",
+      "PROM221",
+      "PROM222",
+      "PROM223",
+      "PROM224",
+      "PROM301",
     ]);
   });
 
@@ -45,6 +61,13 @@ describe("prometheus plugin", () => {
     expect(Object.keys(prometheusAuditCatalog).sort()).toEqual([...ids].sort());
   });
 
+  it("leaves PROM212 out of the recommended preset, and has it in all (#3363)", () => {
+    const presets = prometheusPlugin.lintPresets!();
+    expect(presets.all).toContain("PROM212");
+    expect(presets.recommended).not.toContain("PROM212");
+    expect(presets.all.filter((id) => !presets.recommended.includes(id))).toEqual(["PROM212"]);
+  });
+
   it("detects a rule file and an alertmanager.yml, and nothing else", () => {
     expect(prometheusPlugin.detectTemplate!({ groups: [{ name: "a", rules: [] }] })).toBe(true);
     expect(prometheusPlugin.detectTemplate!({ route: { receiver: "x" }, receivers: [{ name: "x" }] })).toBe(true);

package/src/plugin.ts

@@ -5,13 +5,13 @@ import { createDiffTool } from "@intentius/chant/lexicon-plugin-helpers";
 import { prometheusSerializer } from "./serializer";
 import { rules } from "./lint/rules";
 import { postSynthChecks } from "./lint/post-synth";
-import { prometheusAuditCatalog } from "./lint/audit-catalog";
+import { OPT_IN_CHECKS, prometheusAuditCatalog } from "./lint/audit-catalog";
 import { completions } from "./lsp/completions";
 import { hover } from "./lsp/hover";
 import { detectTemplate } from "./detect";
 import { PrometheusParser } from "./import/parser";
 import { PrometheusGenerator } from "./import/generator";
-import { ruleGroupsImporter } from "./import/embedded";
+import { alertmanagerImporter, ruleGroupsImporter } from "./import/embedded";
 import { DEFAULT_TEMPLATE, RULES_TEMPLATE, SLO_STYLE_TEMPLATE, SLO_TEMPLATE } from "./init-templates";
 import { prometheusSkills } from "./skill-defs";
 import { CATALOG } from "./catalog";
@@ -89,6 +89,17 @@ export const prometheusPlugin: LexiconPlugin = {
     return prometheusAuditCatalog;
   },
 
+  /**
+   * `recommended` (what `chant build` reports by default) is every check but
+   * the opt-in ones; `all` adds them. A project turns one on with
+   * `lint.presets: { prometheus: "all" }`, or by naming it in `lint.rules`
+   * (`{ PROM212: "warning" }`), which keeps a check whatever the preset.
+   */
+  lintPresets() {
+    const all = Object.keys(prometheusAuditCatalog);
+    return { recommended: all.filter((id) => !OPT_IN_CHECKS.has(id)), all };
+  },
+
   skills: prometheusSkills,
 
   composites() {
@@ -122,7 +133,7 @@ export const prometheusPlugin: LexiconPlugin = {
   },
 
   embeddedImporters() {
-    return [ruleGroupsImporter];
+    return [ruleGroupsImporter, alertmanagerImporter];
   },
 
   // `chant init --lexicon prometheus [--template rules|slo-style|slo]`; see ./init-templates.ts.