@intentius/chant-lexicon-prometheus 0.102.0 → 0.104.1

package/dist/okf/rules/PROM219.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM219
+description: An alerting rule sets the alertname label
+id: PROM219
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An alerting rule sets the alertname label

package/dist/okf/rules/PROM220.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM220
+description: A receiver turns off TLS certificate verification
+id: PROM220
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+A receiver turns off TLS certificate verification

package/dist/okf/rules/PROM221.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM221
+description: SMTP credentials sent with require_tls false
+id: PROM221
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+SMTP credentials sent with require_tls false

package/dist/okf/rules/PROM222.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM222
+description: Credentials sent to an http:// receiver URL
+id: PROM222
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+Credentials sent to an http:// receiver URL

package/dist/okf/rules/PROM223.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM223
+description: repeat_interval is shorter than group_interval
+id: PROM223
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+repeat_interval is shorter than group_interval

package/dist/okf/rules/PROM224.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM224
+description: An inhibit rule matches one alert as source and target, with no equal
+id: PROM224
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+An inhibit rule matches one alert as source and target, with no equal

package/dist/okf/rules/PROM301.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: PROM301
+description: A rule reads a connector metric no collector in the build emits
+id: PROM301
+severity: error
+category: post-synth
+lexicon: prometheus
+docs: https://intentius.io/chant/lexicons/prometheus/rules/
+---
+A rule reads a connector metric no collector in the build emits

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA+B9D;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aA6G9B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA+B9D;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAwH9B,CAAC"}

package/dist/promql-analysis.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Reading a parsed PromQL expression: the selectors it reads, the labels its
+ * result keeps, and whether it filters with a comparison. The rule-file
+ * checks PROM211-PROM219 (./validate-config.ts) are built on these.
+ *
+ * The tree is the one `checkPromql` (./promql.ts) parses with
+ * `@prometheus-io/lezer-promql`. Every function here returns nothing for an
+ * expression that does not parse; PROM104 reports that.
+ */
+import { parser } from "@prometheus-io/lezer-promql";
+import type { MatchOp } from "./matchers.js";
+type SyntaxNode = ReturnType<typeof parser.parse>["topNode"];
+/** The expression under the tree's `PromQL` root, or undefined when it does not parse. */
+export declare function parsePromql(expr: string): SyntaxNode | undefined;
+/** The value of a PromQL string literal: double- or single-quoted with escapes, or a raw backtick string. */
+export declare function stringValue(literal: string): string;
+export interface SelectorMatcher {
+    name: string;
+    op: MatchOp;
+    value: string;
+}
+/** One vector selector in an expression. */
+export interface Selector {
+    /** The metric name, from the identifier or a `__name__="..."` matcher; undefined when neither names one. */
+    name?: string;
+    matchers: SelectorMatcher[];
+    /** The selector as written. */
+    text: string;
+    /** The functions it sits inside, innermost first, e.g. `["rate", "sum"]` for `sum(rate(x[5m]))`. */
+    within: string[];
+}
+/** Every vector selector in the expression, with the functions around it. */
+export declare function selectors(expr: string): Selector[];
+/**
+ * Whether the expression filters its result: a comparison without `bool`,
+ * `absent()`/`absent_over_time()`, or `unless`, anywhere a series can pass
+ * through to the result. An expression without one returns every series it
+ * reads, so an alert on it fires for all of them (pint alerts/comparison).
+ * `or` needs a condition on both sides, since either side alone reaches the
+ * result.
+ */
+export declare function hasCondition(expr: string): boolean | undefined;
+/**
+ * The labels an expression's result carries, as far as the expression says:
+ * `{ only }` when it keeps exactly these labels (`sum by (job)`), `{ except }`
+ * when it keeps every label but these (`sum without (instance)`), or
+ * undefined when it keeps whatever the series it reads carry.
+ */
+export type LabelScope = {
+    only: Set<string>;
+} | {
+    except: Set<string>;
+};
+/** The labels the expression's result keeps; see {@link LabelScope}. */
+export declare function resultLabels(expr: string): LabelScope | undefined;
+/** Whether a label survives a scope. An undefined scope keeps every label. */
+export declare function keepsLabel(scope: LabelScope | undefined, label: string): boolean;
+/** One `histogram_quantile` call and what is wrong with its histogram argument. */
+export interface HistogramProblem {
+    call: string;
+    problem: "no-bucket" | "no-le";
+}
+/** `histogram_quantile` calls over a selector with no `_bucket` in its name, or an aggregation that drops `le`. */
+export declare function histogramProblems(expr: string): HistogramProblem[];
+/** `rate`, `irate` or `increase` read straight from a named selector whose name does not end in a counter suffix. */
+export declare function nonCounterRates(expr: string): Array<{
+    fn: string;
+    name: string;
+}>;
+/** A regex matcher that could be an equality matcher, or that carries anchors Prometheus already adds. */
+export interface RegexProblem {
+    matcher: string;
+    problem: "literal" | "anchored";
+}
+/** The `=~` and `!~` matchers in an expression that need no regex, or that are anchored (pint promql/regexp). */
+export declare function regexProblems(expr: string): RegexProblem[];
+/** Whether every selector in the expression is read through a `*_over_time` function, so the expression already spans a window. */
+export declare function readsOnlyOverTime(expr: string): boolean;
+/** Whether the expression is two conditions joined by `and`: the multi-window form, where the short window does what `for` would. */
+export declare function isMultiWindow(expr: string): boolean;
+export {};
+//# sourceMappingURL=promql-analysis.d.ts.map

package/dist/promql-analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promql-analysis.d.ts","sourceRoot":"","sources":["../src/promql-analysis.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;AAE7D,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAWhE;AAMD,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQnD;AAmBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4CAA4C;AAC5C,MAAM,WAAW,QAAQ;IACvB,4GAA4G;IAC5G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAiCD,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAelD;AAkBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAgC9D;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAuBzE,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAiEjE;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGhF;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;CAChC;AAED,mHAAmH;AACnH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAmBlE;AAKD,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAMjF;AAID,0GAA0G;AAC1G,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,GAAG,UAAU,CAAC;CACjC;AAED,iHAAiH;AACjH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAW1D;AAED,mIAAmI;AACnI,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED,qIAAqI;AACrI,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOnD"}

package/dist/rules/literal-credential.ts

@@ -1,5 +1,6 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { SLACK_APP_URL } from "../../validate-integrations";
 import { calleeName, constInitializers, CREDENTIAL_CLASS, literalText, position, propertyName, resolveConst } from "./prom-ast";
 
 /**
@@ -89,6 +90,9 @@ export const literalCredentialRule: LintRule = {
       if (only && integration !== undefined && integration !== only) return;
       const text = literalText(init);
       if (text === undefined || text === "") return;
+      // A Slack bot posts to the public chat.postMessage endpoint with its token
+      // in http_config, and update_message needs exactly that api_url (PROM210).
+      if (key === "api_url" && text === SLACK_APP_URL) return;
       diagnostics.push({
         ruleId: "PROM001",
         severity: "error",

package/dist/rules/prom-helpers.ts

@@ -13,10 +13,12 @@
 import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import type { SerializerResult } from "@intentius/chant/serializer";
 import { loadAll } from "js-yaml";
+import { buildCollectorConfigs, collectorMetricIssues, collectorMetrics } from "../../collector-metrics";
 import { looksLikeAlertmanagerConfig, looksLikeRuleFile, type AlertmanagerConfig, type RuleFileConfig } from "../../model";
 import {
   validateAlertmanagerConfig,
   validateRuleFile,
+  validateRunbookUrls,
   validateSeverityRouting,
   type PrometheusIssue,
   type PrometheusIssueCode,
@@ -62,7 +64,7 @@ function toDiagnostic(issue: PrometheusIssue, source: string): PostSynthDiagnost
   };
 }
 
-/** Diagnostics for one rule-file code (PROM101-PROM107) across every rule file in the output. */
+/** Diagnostics for one rule-file code (PROM101-PROM107, PROM211, PROM213-PROM219) across every rule file in the output. */
 export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) =>
     validateRuleFile(config)
@@ -71,7 +73,7 @@ export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssue
   );
 }
 
-/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210) across every `alertmanager.yml` in the output. */
+/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210, PROM220-PROM224) across every `alertmanager.yml` in the output. */
 export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).alertmanager.flatMap(({ source, config }) =>
     validateAlertmanagerConfig(config)
@@ -80,6 +82,43 @@ export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusI
   );
 }
 
+/** PROM212 across every rule file in the output. Opt-in: the lexicon's `recommended` lint preset leaves it out (see ../../plugin.ts). */
+export function runbookDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) => validateRunbookUrls(config).map((i) => toDiagnostic(i, source)));
+}
+
+/**
+ * PROM301: every rule expression in the output against the metrics the
+ * build's collector configs emit. Silent when the build has none.
+ */
+export function collectorMetricDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const { ruleFiles } = prometheusDocs(ctx);
+  if (ruleFiles.length === 0) return [];
+  const emitted = collectorMetrics(buildCollectorConfigs(ctx));
+  if (!emitted) return [];
+  const out: PostSynthDiagnostic[] = [];
+  for (const { source, config } of ruleFiles) {
+    for (const group of Array.isArray(config?.groups) ? config.groups : []) {
+      for (const rule of Array.isArray(group?.rules) ? group.rules : []) {
+        const r = rule as unknown as Record<string, unknown>;
+        if (typeof r.expr !== "string") continue;
+        const subject = `${group.name}/${typeof r.record === "string" ? r.record : String(r.alert ?? "")}`;
+        for (const issue of collectorMetricIssues(r.expr, emitted)) {
+          const message = `rule ${subject} ${issue.message}`;
+          out.push({
+            checkId: "PROM301",
+            severity: "warning",
+            message: source && source !== "prometheus" ? `${source}: ${message}` : message,
+            entity: subject,
+            lexicon: "prometheus",
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
 /** PROM202: joins every rule file in the output against every Alertmanager config in it. Silent when either is absent. */
 export function routingDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
   const { ruleFiles, alertmanager } = prometheusDocs(ctx);

package/dist/rules/prom211.ts

@@ -0,0 +1,21 @@
+/**
+ * PROM211: An alerting rule has no for, or for: 0s
+ *
+ * The alert fires on the first evaluation that matches, so one bad scrape
+ * pages. Left alone when the expression reads no series (vector(1), a dead
+ * man's switch) or already spans a window: every selector read through a
+ * *_over_time function, or two conditions joined by and (the multi-window
+ * burn-rate form, where the short window does what for would).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom211: PostSynthCheck = {
+  id: "PROM211",
+  description: "An alerting rule has no for, or for: 0s",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM211");
+  },
+};

package/dist/rules/prom212.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM212: An alerting rule has no runbook_url annotation (opt-in)
+ *
+ * Off unless enabled: the lint preset all, or a lint.rules entry for PROM212,
+ * turns it on. See validateRunbookUrls.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { runbookDiagnostics } from "./prom-helpers";
+
+export const prom212: PostSynthCheck = {
+  id: "PROM212",
+  description: "An alerting rule has no runbook_url annotation (opt-in)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return runbookDiagnostics(ctx);
+  },
+};

package/dist/rules/prom213.ts

@@ -0,0 +1,20 @@
+/**
+ * PROM213: An alert expression has no comparison
+ *
+ * Every series the expression returns is an alert, so an expression with no
+ * comparison fires for all of them. absent(), absent_over_time() and unless
+ * count as a condition; a comparison with bool does not. An expression that
+ * reads no series (vector(1), a dead man's switch) is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom213: PostSynthCheck = {
+  id: "PROM213",
+  description: "An alert expression has no comparison",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM213");
+  },
+};

package/dist/rules/prom214.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM214: An alert template reads a label the expression aggregates away
+ *
+ * A $labels.x whose x the expression's by (...) leaves out, or its without
+ * (...) names, renders empty. Labels the rule or its group set are left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom214: PostSynthCheck = {
+  id: "PROM214",
+  description: "An alert template reads a label the expression aggregates away",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM214");
+  },
+};

package/dist/rules/prom215.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM215: rate, irate or increase over a name that is not a counter's
+ *
+ * These functions treat every drop as a counter reset. A name not ending in
+ * _total, _count, _sum or _bucket is read as a gauge.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom215: PostSynthCheck = {
+  id: "PROM215",
+  description: "rate, irate or increase over a name that is not a counter's",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM215");
+  },
+};

package/dist/rules/prom216.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM216: histogram_quantile over a series without _bucket, or without le
+ *
+ * A classic histogram's quantile needs its _bucket series with the le label
+ * kept. A native histogram has no _bucket series, so this check does not apply
+ * to one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom216: PostSynthCheck = {
+  id: "PROM216",
+  description: "histogram_quantile over a series without _bucket, or without le",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM216");
+  },
+};

package/dist/rules/prom217.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM217: A recording rule name is not in level:metric:operations form
+ *
+ * Prometheus's naming convention for recorded series, e.g.
+ * job:http_requests:rate5m.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom217: PostSynthCheck = {
+  id: "PROM217",
+  description: "A recording rule name is not in level:metric:operations form",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM217");
+  },
+};

package/dist/rules/prom218.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM218: A regex matcher needs no regex, or is anchored
+ *
+ * A =~ or !~ with no regex metacharacters is an equality matcher written the
+ * slow way. Prometheus anchors every regex, so a leading ^ or trailing $ does
+ * nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom218: PostSynthCheck = {
+  id: "PROM218",
+  description: "A regex matcher needs no regex, or is anchored",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM218");
+  },
+};

package/dist/rules/prom219.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM219: An alerting rule sets the alertname label
+ *
+ * Prometheus sets alertname to the rule's name after applying the rule's
+ * labels, so the value is overwritten.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom219: PostSynthCheck = {
+  id: "PROM219",
+  description: "An alerting rule sets the alertname label",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM219");
+  },
+};

package/dist/rules/prom220.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM220: A receiver turns off TLS certificate verification
+ *
+ * tls_config.insecure_skip_verify: true on a receiver, or in global, accepts
+ * any certificate the endpoint presents.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom220: PostSynthCheck = {
+  id: "PROM220",
+  description: "A receiver turns off TLS certificate verification",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM220");
+  },
+};

package/dist/rules/prom221.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM221: SMTP credentials sent with require_tls false
+ *
+ * An email receiver with SMTP auth and require_tls false (its own, or
+ * global.smtp_require_tls) can send the credentials in clear text. Implicit
+ * TLS is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom221: PostSynthCheck = {
+  id: "PROM221",
+  description: "SMTP credentials sent with require_tls false",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM221");
+  },
+};

package/dist/rules/prom222.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM222: Credentials sent to an http:// receiver URL
+ *
+ * An integration whose URL is http:// and whose request carries a credential:
+ * user info in the URL, http_config auth, or a key or token field.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom222: PostSynthCheck = {
+  id: "PROM222",
+  description: "Credentials sent to an http:// receiver URL",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM222");
+  },
+};

package/dist/rules/prom223.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM223: repeat_interval is shorter than group_interval
+ *
+ * Alertmanager resends only when it flushes a group, every group_interval, so
+ * a shorter repeat_interval never takes effect. Intervals are inherited down
+ * the routing tree from Alertmanager's defaults.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom223: PostSynthCheck = {
+  id: "PROM223",
+  description: "repeat_interval is shorter than group_interval",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM223");
+  },
+};

package/dist/rules/prom224.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM224: An inhibit rule matches one alert as source and target, with no equal
+ *
+ * With no equal, any alert matching the source mutes every alert matching the
+ * target. When one alert can match both, alerts of that kind mute each other.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom224: PostSynthCheck = {
+  id: "PROM224",
+  description: "An inhibit rule matches one alert as source and target, with no equal",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM224");
+  },
+};

package/dist/rules/prom301.ts

@@ -0,0 +1,23 @@
+/**
+ * PROM301: A rule reads a connector metric no collector in the build emits
+ *
+ * For each selector in a rule whose name falls under a namespace the build's
+ * spanmetrics, servicegraph or GenAI connectors own (spanmetrics' and
+ * servicegraph's defaults included), reports a name no collector config in
+ * the build emits, and a by (...) label that is not a dimension the config
+ * declares for the metrics aggregated. Silent for names outside those
+ * namespaces, and when the build has no collector config. See
+ * ../../collector-metrics.ts.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { collectorMetricDiagnostics } from "./prom-helpers";
+
+export const prom301: PostSynthCheck = {
+  id: "PROM301",
+  description: "A rule reads a connector metric no collector in the build emits",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return collectorMetricDiagnostics(ctx);
+  },
+};

package/dist/validate-config.d.ts

@@ -7,7 +7,7 @@
  * `PrometheusRule`'s groups, or on a file parsed by some other tool.
  */
 import { type AlertmanagerConfig, type RuleFileConfig } from "./model.js";
-export type PrometheusIssueCode = "PROM101" | "PROM102" | "PROM103" | "PROM104" | "PROM105" | "PROM106" | "PROM107" | "PROM201" | "PROM202" | "PROM203" | "PROM204" | "PROM205" | "PROM206" | "PROM207" | "PROM208" | "PROM209" | "PROM210";
+export type PrometheusIssueCode = "PROM101" | "PROM102" | "PROM103" | "PROM104" | "PROM105" | "PROM106" | "PROM107" | "PROM201" | "PROM202" | "PROM203" | "PROM204" | "PROM205" | "PROM206" | "PROM207" | "PROM208" | "PROM209" | "PROM210" | "PROM211" | "PROM212" | "PROM213" | "PROM214" | "PROM215" | "PROM216" | "PROM217" | "PROM218" | "PROM219" | "PROM220" | "PROM221" | "PROM222" | "PROM223" | "PROM224";
 export interface PrometheusIssue {
     code: PrometheusIssueCode;
     severity: "error" | "warning";
@@ -15,11 +15,17 @@ export interface PrometheusIssue {
     /** What the issue is about: a group, a rule (`group/rule`), a receiver or a route. */
     subject?: string;
 }
-/** Check a rule file (PROM101-PROM107). */
+/** Check a rule file (PROM101-PROM107, PROM211 and PROM213-PROM219). PROM212 is opt-in; see {@link validateRunbookUrls}. */
 export declare function validateRuleFile(file: RuleFileConfig): PrometheusIssue[];
+/**
+ * PROM212: alerts without a `runbook_url` annotation. Not part of
+ * {@link validateRuleFile}, because the check is opt-in: the lint preset
+ * `all`, or a `lint.rules` entry for PROM212, turns it on.
+ */
+export declare function validateRunbookUrls(file: RuleFileConfig): PrometheusIssue[];
 /** Every severity value an alert in these rule files carries, with the alerts carrying it. */
 export declare function alertSeverities(files: RuleFileConfig[]): Map<string, string[]>;
-/** Check an `alertmanager.yml` on its own (PROM201, PROM203-PROM210). */
+/** Check an `alertmanager.yml` on its own (PROM201, PROM203-PROM210, PROM220-PROM224). */
 export declare function validateAlertmanagerConfig(config: AlertmanagerConfig): PrometheusIssue[];
 /**
  * PROM202: every severity an alert carries is taken by some route below the

package/dist/validate-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-config.d.ts","sourceRoot":"","sources":["../src/validate-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAGL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AAIjB,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmBD,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,eAAe,EAAE,CAsHxE;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAa9E;AAsBD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAmGxF;AAYD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6BlH"}
+{"version":3,"file":"validate-config.d.ts","sourceRoot":"","sources":["../src/validate-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAGL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AAiBjB,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAwID,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,eAAe,EAAE,CAmIxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,eAAe,EAAE,CAU3E;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAa9E;AAkGD,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAsHxF;AAYD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6BlH"}

package/dist/validate-integrations.d.ts

@@ -30,6 +30,7 @@ import type { AlertmanagerGlobalConfig, ReceiverConfig } from "./model.js";
 import type { PrometheusIssue } from "./validate-config.js";
 /** True when `value` is a Go `time.ParseDuration` duration (`0`, `1.5s`, `1h30m`, `300ms`). */
 export declare function isValidGoDuration(value: unknown): boolean;
+export declare const SLACK_APP_URL = "https://slack.com/api/chat.postMessage";
 /** PROM208-PROM210 findings for every integration of one receiver. */
 export declare function validateReceiverIntegrations(receiver: ReceiverConfig, global: AlertmanagerGlobalConfig): PrometheusIssue[];
 /** PROM208 and PROM210 findings for `global:` (config/config.go `Config.UnmarshalYAML`). */

package/dist/validate-integrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-integrations.d.ts","sourceRoot":"","sources":["../src/validate-integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAoB,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAwBzD,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKzD;AA6RD,sEAAsE;AACtE,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAS1H;AAgBD,4FAA4F;AAC5F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAe1F"}
+{"version":3,"file":"validate-integrations.d.ts","sourceRoot":"","sources":["../src/validate-integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAoB,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAwBzD,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKzD;AAkBD,eAAO,MAAM,aAAa,2CAA2C,CAAC;AA2QtE,sEAAsE;AACtE,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAS1H;AAgBD,4FAA4F;AAC5F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAe1F"}