@intentius/chant-lexicon-prometheus 0.102.0 → 0.104.1

package/dist/validate-security.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Settings Alertmanager accepts that weaken how it talks to a receiver
+ * (PROM220-PROM222): certificate checks turned off, SMTP credentials sent
+ * without TLS, and credentials sent to an `http://` URL. `amtool
+ * check-config` passes all three.
+ */
+import type { AlertmanagerGlobalConfig, ReceiverConfig } from "./model.js";
+import type { PrometheusIssue } from "./validate-config.js";
+/** PROM220-PROM222 for one receiver. */
+export declare function validateReceiverSecurity(receiver: ReceiverConfig, global: AlertmanagerGlobalConfig): PrometheusIssue[];
+/** PROM220 for `global:`'s own TLS settings, which every receiver without its own inherits. */
+export declare function validateGlobalSecurity(global: AlertmanagerGlobalConfig): PrometheusIssue[];
+//# sourceMappingURL=validate-security.d.ts.map

package/dist/validate-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-security.d.ts","sourceRoot":"","sources":["../src/validate-security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AA4DzD,wCAAwC;AACxC,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CA+DtH;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,eAAe,EAAE,CAO1F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-prometheus",
-  "version": "0.102.0",
+  "version": "0.104.1",
   "description": "Prometheus lexicon for chant — typed recording and alerting rule groups and Alertmanager routing, serialized to a rule file and alertmanager.yml",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -72,7 +72,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.102.0",
+    "@intentius/chant": "^0.104.1",
     "typescript": "^5.9.3"
   }
 }

package/src/collector-metrics.ts

@@ -0,0 +1,262 @@
+/**
+ * The metric names the collector configs in a build emit through their
+ * `spanmetrics`, `servicegraph`, `sum` and `signaltometrics` connectors (the
+ * last two are how the otel GenAI preset counts tokens and derives the
+ * conventions' client metrics), and the PromQL that reads under those
+ * connectors' namespaces without matching one of them (PROM301).
+ *
+ * Grafana's GRAF118 runs `collectorMetricIssues` over panel queries; the
+ * prometheus lexicon runs it over rule files. Names follow the otel lexicon's
+ * `metric-names.ts`, with each config's `prometheus` and
+ * `prometheusremotewrite` exporters' `namespace` and `add_metric_suffixes`.
+ * A component under a renamed type (`span_metrics`, `service_graph`,
+ * `signal_to_metrics`) is read as the built-in it names, through the otel
+ * lexicon's `canonicalTypeOf`.
+ *
+ * Collector configs come from two places. `chant build` gives a lexicon's
+ * checks only that lexicon's output, but every entity in the build, so the
+ * otel lexicon's own config is rebuilt from the build's otel entities with
+ * `buildCollectorConfig`. Any output document shaped like a collector config,
+ * or a Kubernetes ConfigMap holding one, is read as well.
+ */
+
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { buildCollectorConfig } from "@intentius/chant-lexicon-otel/collector";
+import { isOTelComponent } from "@intentius/chant-lexicon-otel/define";
+import { collectorConfigs } from "@intentius/chant-lexicon-otel/lint/post-synth/otel-helpers";
+import {
+  prometheusLabel,
+  prometheusMetricName,
+  serviceGraphNames,
+  spanMetricsNames,
+  SERVICEGRAPH_NAMESPACE,
+  SPANMETRICS_DEFAULT_NAMESPACE,
+  type CollectorMetric,
+  type PrometheusNaming,
+  type SpanMetricsNamingConfig,
+} from "@intentius/chant-lexicon-otel/metric-names";
+import { canonicalTypeOf, type CollectorConfig } from "@intentius/chant-lexicon-otel/model";
+import { parsePromql, selectors } from "./promql-analysis";
+
+type SyntaxNode = NonNullable<ReturnType<typeof parsePromql>>;
+type Obj = Record<string, unknown>;
+
+/** One metric a collector config emits, as Prometheus sees it. */
+export interface EmittedMetric {
+  /** The connector that emits it, e.g. `spanmetrics/genai`. */
+  connector: string;
+  /** The labels a series of it can carry; undefined when the exporter adds every resource attribute. */
+  labels?: Set<string>;
+}
+
+/** What the collector configs in a build emit. */
+export interface CollectorMetrics {
+  /** The name prefixes the connectors own, e.g. `traces_span_metrics_`. */
+  namespaces: string[];
+  /** Every emitted Prometheus name. A histogram is its `_bucket`, `_sum` and `_count` series. */
+  metrics: Map<string, EmittedMetric[]>;
+}
+
+/** Labels the `prometheus` exporter, or the scrape, adds to every series: `job` and `instance` from the resource, and the scope. */
+const ADDED_LABELS = ["job", "instance", "otel_scope_name", "otel_scope_version", "otel_scope_schema_url"];
+
+function asObj(v: unknown): Obj {
+  return v && typeof v === "object" && !Array.isArray(v) ? (v as Obj) : {};
+}
+
+/** A component's type, with a renamed built-in's new name read as the old one (`span_metrics/genai` is `spanmetrics`). */
+function typeOf(kind: "connector" | "exporter", id: string): string {
+  return canonicalTypeOf(kind, id);
+}
+
+function sanitize(name: string): string {
+  return name.replace(/[^A-Za-z0-9_:]/g, "_");
+}
+
+/** The common dotted prefix of a connector's metric names (`genai.tokens` for `genai.tokens.input` and `.output`). */
+function commonPrefix(names: string[]): string | undefined {
+  if (names.length === 0) return undefined;
+  const split = names.map((n) => n.split("."));
+  const out: string[] = [];
+  for (let i = 0; i < split[0].length - 1; i++) {
+    if (split.every((s) => s.length - 1 > i && s[i] === split[0][i])) out.push(split[0][i]);
+    else break;
+  }
+  if (out.length === 0 && names.length === 1 && split[0].length > 1) return split[0].slice(0, -1).join(".");
+  return out.length > 0 ? out.join(".") : undefined;
+}
+
+/** Every collector config in the build: rebuilt from its otel entities, and found in its output. */
+export function buildCollectorConfigs(ctx: PostSynthContext): CollectorConfig[] {
+  const configs = collectorConfigs(ctx).map((f) => f.config);
+  const otel = [...(ctx.entities?.values() ?? [])].filter((e) => e?.lexicon === "otel");
+  if (otel.some(isOTelComponent)) configs.push(buildCollectorConfig(otel).config);
+  return configs;
+}
+
+/** The metrics the collector configs emit; undefined when there are none. */
+export function collectorMetrics(configs: CollectorConfig[]): CollectorMetrics | undefined {
+  if (configs.length === 0) return undefined;
+  const namespaces = new Set<string>();
+  const metrics = new Map<string, EmittedMetric[]>();
+
+  for (const config of configs) {
+    const exporters = Object.entries(asObj(config.exporters)).filter(([id]) => typeOf("exporter", id) === "prometheus" || typeOf("exporter", id) === "prometheusremotewrite");
+    const namings: Array<{ naming: PrometheusNaming; openLabels: boolean }> =
+      exporters.length > 0
+        ? exporters.map(([, c]) => {
+            const e = asObj(c);
+            return {
+              naming: { ...(typeof e.namespace === "string" ? { namespace: e.namespace } : {}), ...(e.add_metric_suffixes === false ? { add_metric_suffixes: false } : {}) },
+              openLabels: asObj(e.resource_to_telemetry_conversion).enabled === true,
+            };
+          })
+        : [{ naming: {}, openLabels: false }];
+
+    for (const { naming, openLabels } of namings) {
+      const prefix = (ns: string) => `${naming.namespace ? `${sanitize(naming.namespace)}_` : ""}${sanitize(ns)}_`;
+      // The two connectors' defaults are theirs in every build that has a collector config.
+      namespaces.add(prefix(SPANMETRICS_DEFAULT_NAMESPACE));
+      namespaces.add(prefix(SERVICEGRAPH_NAMESPACE));
+
+      const add = (connector: string, m: CollectorMetric, extra: string[] = []) => {
+        const labels = openLabels ? undefined : new Set([...m.dimensions.map(prometheusLabel), ...extra.map(prometheusLabel), ...ADDED_LABELS]);
+        // A classic histogram is served as three series whatever add_metric_suffixes says.
+        const series: Array<[string, Set<string> | undefined]> =
+          m.type === "histogram"
+            ? [
+                [`${m.prometheus}_bucket`, labels ? new Set([...labels, "le"]) : undefined],
+                [`${m.prometheus}_sum`, labels],
+                [`${m.prometheus}_count`, labels],
+              ]
+            : [[m.prometheus, labels]];
+        for (const [name, l] of series) {
+          metrics.set(name, [...(metrics.get(name) ?? []), { connector, ...(l ? { labels: l } : {}) }]);
+        }
+      };
+
+      for (const [id, raw] of Object.entries(asObj(config.connectors))) {
+        const c = asObj(raw);
+        switch (typeOf("connector", id)) {
+          case "spanmetrics": {
+            const n = spanMetricsNames(c as SpanMetricsNamingConfig, naming);
+            if (n.namespace !== "") namespaces.add(prefix(n.namespace));
+            for (const m of [n.calls, n.duration, n.events]) if (m) add(id, m);
+            break;
+          }
+          case "servicegraph": {
+            const n = serviceGraphNames(c, naming);
+            for (const m of [n.requests, n.failed, n.serverDuration, n.clientDuration]) add(id, m);
+            break;
+          }
+          case "sum": {
+            const names: string[] = [];
+            for (const signal of ["spans", "spanevents", "metrics", "datapoints", "logs"]) {
+              for (const [name, def] of Object.entries(asObj(c[signal]))) {
+                const attrs = (Array.isArray(asObj(def).attributes) ? (asObj(def).attributes as unknown[]) : []).map((a) => String(asObj(a).key ?? ""));
+                names.push(name);
+                add(id, { name, prometheus: prometheusMetricName(name, "sum", undefined, naming), type: "sum", dimensions: attrs.filter(Boolean) });
+              }
+            }
+            const ns = commonPrefix(names);
+            if (ns) namespaces.add(prefix(ns));
+            break;
+          }
+          case "signaltometrics": {
+            const names: string[] = [];
+            for (const signal of ["spans", "datapoints", "logs", "profiles"]) {
+              for (const def of Array.isArray(c[signal]) ? (c[signal] as unknown[]) : []) {
+                const m = asObj(def);
+                if (typeof m.name !== "string") continue;
+                const type = m.histogram !== undefined || m.exponential_histogram !== undefined ? "histogram" : m.sum !== undefined ? "sum" : undefined;
+                if (!type) continue;
+                const unit = typeof m.unit === "string" ? m.unit : undefined;
+                const attrs = [
+                  ...(Array.isArray(m.attributes) ? (m.attributes as unknown[]) : []),
+                  ...(Array.isArray(m.include_resource_attributes) ? (m.include_resource_attributes as unknown[]) : []),
+                ].map((a) => String(asObj(a).key ?? ""));
+                names.push(m.name);
+                add(id, { name: m.name, prometheus: prometheusMetricName(m.name, type, unit, naming), type, ...(unit ? { unit } : {}), dimensions: attrs.filter(Boolean) });
+              }
+            }
+            const ns = commonPrefix(names);
+            if (ns) namespaces.add(prefix(ns));
+            break;
+          }
+        }
+      }
+    }
+  }
+  return { namespaces: [...namespaces], metrics };
+}
+
+// ── PromQL ──────────────────────────────────────────────────────────
+
+/** Functions that write a label of their own, so an aggregation over them can group by it. */
+const RELABEL = new Set(["label_replace", "label_join"]);
+
+/** Every `by (...)` aggregation in the expression: its labels and the text it aggregates. */
+function byAggregations(top: SyntaxNode, src: string): Array<{ labels: string[]; body: string }> {
+  const out: Array<{ labels: string[]; body: string }> = [];
+  const walk = (n: SyntaxNode) => {
+    if (n.name === "AggregateExpr") {
+      const mod = n.getChild("AggregateModifier");
+      const body = n.getChild("FunctionCallBody");
+      if (mod?.getChild("By") && body) {
+        const labels = (mod.getChild("GroupingLabels")?.getChildren("LabelName") ?? []).map((l) => src.slice(l.from, l.to));
+        out.push({ labels, body: src.slice(body.from + 1, body.to - 1) });
+      }
+    }
+    for (let c = n.firstChild; c; c = c.nextSibling) walk(c);
+  };
+  walk(top);
+  return out;
+}
+
+export interface CollectorMetricIssue {
+  kind: "name" | "label";
+  metric: string;
+  label?: string;
+  message: string;
+}
+
+/**
+ * What a PromQL expression reads under the build's connector namespaces and
+ * the build does not emit: a metric name no connector writes, and a
+ * `by (...)` label none of the aggregated metrics carries. A name outside
+ * every namespace is not read. An aggregation is checked only when every
+ * series under it is an emitted metric and nothing under it adds a label
+ * (`label_replace`, `label_join`). Selectors come from the lexicon's
+ * `promql-analysis.ts`.
+ */
+export function collectorMetricIssues(expr: string, emitted: CollectorMetrics): CollectorMetricIssue[] {
+  const top = parsePromql(expr);
+  if (!top) return [];
+  const issues: CollectorMetricIssue[] = [];
+  const owned = (name: string) => emitted.namespaces.some((p) => name.startsWith(p));
+
+  const seen = new Set<string>();
+  for (const { name } of selectors(expr)) {
+    if (!name || seen.has(name) || !owned(name) || emitted.metrics.has(name)) continue;
+    seen.add(name);
+    const p = emitted.namespaces.filter((x) => name.startsWith(x)).sort((a, b) => b.length - a.length)[0];
+    issues.push({ kind: "name", metric: name, message: `reads ${name}, which no collector config in the build emits under ${p.slice(0, -1)}` });
+  }
+
+  const reported = new Set<string>();
+  for (const { labels, body } of byAggregations(top, expr)) {
+    const read = selectors(body);
+    if (read.length === 0 || read.some((s) => s.within.some((fn) => RELABEL.has(fn)))) continue;
+    const metrics = read.map((s) => (s.name ? emitted.metrics.get(s.name) : undefined));
+    if (!metrics.every((m) => m !== undefined && m.every((e) => e.labels))) continue;
+    const carried = new Set(metrics.flatMap((m) => m!.flatMap((e) => [...e.labels!])));
+    const shown = [...new Set(read.map((s) => s.name!))].join(", ");
+    for (const label of labels) {
+      const key = `${label} ${shown}`;
+      if (carried.has(label) || reported.has(key)) continue;
+      reported.add(key);
+      issues.push({ kind: "label", metric: shown, label, message: `groups ${shown} by ${label}, which is not a dimension the collector config declares for it` });
+    }
+  }
+  return issues;
+}

package/src/composites/composites.test.ts

@@ -184,12 +184,9 @@ describe("the rules an Slo builds", () => {
     expect(sloMetrics(direct).burnRates).toEqual([]);
   });
 
-  test("the same Slo renders inside the rule file promtool accepts", () => {
+  test.skipIf(!hasPromtool)("the same Slo renders inside the rule file promtool accepts", () => {
     const r = promtoolCheckRules(ruleFileYaml([slo.rules]), PROMTOOL);
-    if (!hasPromtool) {
-      expect(r.ran).toBe(false);
-      return;
-    }
+    expect(r.ran).toBe(true);
     expect(r.output).toContain("SUCCESS");
     expect(r.ok).toBe(true);
   });

package/src/import/testdata/alertmanager-integrations.yml

@@ -50,12 +50,16 @@ route:
 receivers:
   - name: chat
     slack_configs:
-      - channel: '#alerts'
+      - api_url: https://slack.com/api/chat.postMessage
+        channel: '#alerts'
         message_text: '{{ .CommonLabels.alertname }}'
         callback_id: alerts
         image_url: https://example.com/graph.png
         thumb_url: https://example.com/thumb.png
         update_message: true
+        http_config:
+          authorization:
+            credentials_file: /etc/alertmanager/secrets/slack-bot-token
         timeout: 10s
         fields:
           - title: Severity

package/src/index.ts

@@ -66,6 +66,7 @@ export { parseMatchers, matcherMatches, matcher, type Matcher, type MatchOp, typ
 export { checkPromql, PROMQL_GRAMMAR, type PromqlCheck } from "./promql";
 export {
   validateRuleFile,
+  validateRunbookUrls,
   validateAlertmanagerConfig,
   validateSeverityRouting,
   alertSeverities,

package/src/init-templates.test.ts

@@ -24,7 +24,9 @@ describe("init templates", () => {
     try {
       expect(result.errors).toEqual([]);
       expect(result.outputs.get("prometheus")).toBeTruthy();
-      expect(runPostSynthChecks(postSynthChecks, result)).toEqual([]);
+      // As `chant build` reports them: through the default (`recommended`) preset.
+      const recommended = new Set(prometheusPlugin.lintPresets!().recommended);
+      expect(runPostSynthChecks(postSynthChecks, result).filter((d) => recommended.has(d.checkId))).toEqual([]);
       const lint = await lintCommand({ path: join(dir, "src"), format: "stylish", fix: false });
       expect(lint.errorCount + lint.warningCount, lint.output).toBe(0);
     } finally {

package/src/lint/audit-catalog.ts

@@ -128,7 +128,109 @@ export const prometheusAuditCatalog: Record<string, RuleMeta> = {
     "Integration or global setting Alertmanager rejects",
     "Set one of each value and its *_file, and use a value Alertmanager allows (e.g. message_type text or markdown, parse_mode Markdown, MarkdownV2 or HTML).",
   ),
+  PROM211: outputRule(
+    "PROM211",
+    "report-only",
+    "best-practice",
+    "Alerting rule has no for, or for: 0s",
+    "Set for to how long the condition must hold before the alert fires, e.g. 5m.",
+  ),
+  PROM212: outputRule(
+    "PROM212",
+    "report-only",
+    "best-practice",
+    "Alerting rule has no runbook_url annotation (opt-in)",
+    "Add a runbook_url annotation linking to what the responder should do.",
+  ),
+  PROM213: outputRule(
+    "PROM213",
+    "merge-worthy",
+    "correctness",
+    "Alert expression has no comparison",
+    "Add the condition the alert fires on, e.g. > 0.05, or use absent() for a missing series.",
+  ),
+  PROM214: outputRule(
+    "PROM214",
+    "merge-worthy",
+    "correctness",
+    "Alert template reads a label the expression aggregates away",
+    "Keep the label in the aggregation's by (...), or stop reading it in the template.",
+  ),
+  PROM215: outputRule(
+    "PROM215",
+    "merge-worthy",
+    "correctness",
+    "rate, irate or increase over a name that is not a counter's",
+    "Read a counter (a name ending in _total, _count, _sum or _bucket), or use delta() or deriv() for a gauge.",
+  ),
+  PROM216: outputRule(
+    "PROM216",
+    "merge-worthy",
+    "correctness",
+    "histogram_quantile over a series without _bucket, or without le",
+    "Pass the histogram's _bucket series, and keep le in the aggregation: sum by (le, ...) (rate(x_bucket[5m])).",
+  ),
+  PROM217: outputRule(
+    "PROM217",
+    "report-only",
+    "best-practice",
+    "Recording rule name is not level:metric:operations",
+    "Name the recorded series level:metric:operations, e.g. job:http_requests:rate5m.",
+  ),
+  PROM218: outputRule(
+    "PROM218",
+    "report-only",
+    "best-practice",
+    "Regex matcher needs no regex, or is anchored",
+    'Use = or != for a plain value, and drop ^ and $ from a regex, which Prometheus anchors already (job=~"api|web").',
+  ),
+  PROM219: outputRule("PROM219", "merge-worthy", "correctness", "Alerting rule sets the alertname label", "Remove the alertname label; rename the rule instead."),
+  PROM220: outputRule(
+    "PROM220",
+    "merge-worthy",
+    "security",
+    "Receiver turns off TLS certificate verification",
+    "Remove insecure_skip_verify, and set ca_file to the CA that signed the endpoint's certificate.",
+  ),
+  PROM221: outputRule(
+    "PROM221",
+    "merge-worthy",
+    "security",
+    "SMTP credentials sent with require_tls false",
+    "Set require_tls (or global.smtp_require_tls) to true, or use force_implicit_tls with an SMTPS port.",
+  ),
+  PROM222: outputRule(
+    "PROM222",
+    "merge-worthy",
+    "security",
+    "Credentials sent to an http:// receiver URL",
+    "Point the integration at an https:// URL.",
+  ),
+  PROM223: outputRule(
+    "PROM223",
+    "merge-worthy",
+    "correctness",
+    "repeat_interval is shorter than group_interval",
+    "Set repeat_interval to a multiple of group_interval, or lower group_interval.",
+  ),
+  PROM224: outputRule(
+    "PROM224",
+    "merge-worthy",
+    "correctness",
+    "Inhibit rule matches one alert as source and target, with no equal",
+    "List the labels source and target must share under equal (e.g. alertname, cluster), or make the matchers exclusive.",
+  ),
+  PROM301: outputRule(
+    "PROM301",
+    "merge-worthy",
+    "correctness",
+    "Rule reads a connector metric no collector in the build emits",
+    "Read the name spanMetricsNames(), serviceGraphNames() or genAiMetrics() gives for the declared connector, and group by its declared dimensions, or add the dimension to the connector.",
+  ),
 };
 
+/** Post-synth checks the `recommended` lint preset leaves out (#3363); see `prometheusPlugin.lintPresets()`. */
+export const OPT_IN_CHECKS: ReadonlySet<string> = new Set(["PROM212"]);
+
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
 applyLineage(prometheusAuditCatalog, prometheusAuditLineage);

package/src/lint/audit-lineage.test.ts

@@ -0,0 +1,74 @@
+import { describe, test, expect } from "vitest";
+import { prometheusAuditCatalog } from "./audit-catalog";
+
+describe("prometheus audit lineage (#2916, #3136)", () => {
+  const credits = (id: string) => (prometheusAuditCatalog[id].lineage ?? []).map((l) => `${l.tool}:${l.rule ?? ""}:${l.relation}`);
+
+  test("credits promtool where rulefmt rejects the same file", () => {
+    for (const id of ["PROM101", "PROM103", "PROM104", "PROM105"]) {
+      expect(credits(id), id).toContain("promtool::equivalent");
+    }
+    expect(credits("PROM002")).toContain("promtool::equivalent");
+  });
+
+  test("credits pint's named checks", () => {
+    expect(credits("PROM002")).toEqual(["promtool::equivalent", "pint:promql/syntax:equivalent"]);
+    expect(credits("PROM102")).toEqual(["pint:rule/duplicate:overlaps"]);
+    expect(credits("PROM103")).toEqual(["promtool::equivalent", "pint:alerts/for:overlaps"]);
+    expect(credits("PROM104")).toEqual(["promtool::equivalent", "pint:promql/syntax:equivalent"]);
+    expect(credits("PROM106")).toEqual(["pint:rule/label:overlaps"]);
+    expect(credits("PROM107")).toEqual(["pint:alerts/annotation:overlaps"]);
+    expect(credits("PROM211")).toEqual(["pint:rule/for:overlaps"]);
+    expect(credits("PROM212")).toEqual(["pint:alerts/annotation:overlaps"]);
+    expect(credits("PROM213")).toEqual(["pint:alerts/comparison:equivalent"]);
+    expect(credits("PROM214")).toEqual(["pint:alerts/template:overlaps"]);
+    expect(credits("PROM215")).toEqual(["pint:promql/rate:overlaps"]);
+    expect(credits("PROM217")).toEqual(["pint:rule/name:overlaps"]);
+    expect(credits("PROM218")).toEqual(["pint:promql/regexp:equivalent"]);
+  });
+
+  test("credits amtool check-config where Alertmanager rejects the same config", () => {
+    for (const id of ["PROM201", "PROM203", "PROM204", "PROM205", "PROM206", "PROM208"]) {
+      expect(credits(id), id).toEqual(["amtool::equivalent"]);
+    }
+    expect(credits("PROM209")).toEqual(["amtool::overlaps"]);
+    expect(credits("PROM210")).toEqual(["amtool::overlaps"]);
+  });
+
+  test("rules no upstream tool checks carry no credit", () => {
+    for (const id of ["PROM001", "PROM003", "PROM202", "PROM207", "PROM216", "PROM219", "PROM220", "PROM221", "PROM222", "PROM223", "PROM224", "PROM301"]) {
+      expect(prometheusAuditCatalog[id].lineage, id).toBeUndefined();
+    }
+  });
+
+  test("every rule is either credited above or deliberately left uncredited", () => {
+    const credited = Object.keys(prometheusAuditCatalog).filter((id) => prometheusAuditCatalog[id].lineage !== undefined);
+    expect(credited.sort()).toEqual(
+      [
+        "PROM002",
+        "PROM101",
+        "PROM102",
+        "PROM103",
+        "PROM104",
+        "PROM105",
+        "PROM106",
+        "PROM107",
+        "PROM201",
+        "PROM203",
+        "PROM204",
+        "PROM205",
+        "PROM206",
+        "PROM208",
+        "PROM209",
+        "PROM210",
+        "PROM211",
+        "PROM212",
+        "PROM213",
+        "PROM214",
+        "PROM215",
+        "PROM217",
+        "PROM218",
+      ].sort(),
+    );
+  });
+});

package/src/lint/audit-lineage.ts

@@ -21,12 +21,33 @@
  *   configurable "this label or annotation must exist" checks that pint ships
  *   with nothing enabled, so they overlap PROM106 and PROM107 and no more.
  *
+ * The PROM211-PROM219 rule-file checks (#3363), against the same list:
+ * - alerts/comparison and promql/regexp are the same checks as PROM213 and
+ *   PROM218, so those are equivalent.
+ * - rule/for enforces a configured minimum `for`, and alerts/annotation a
+ *   configured annotation; with `for` required and runbook_url named they
+ *   are PROM211 and PROM212. alerts/for is not credited: it rejects bad
+ *   values and a redundant `for: 0s`, not a missing `for`.
+ * - alerts/template covers PROM214's dropped label and checks template
+ *   syntax besides. promql/rate reads the metric type from a live
+ *   Prometheus's metadata; PROM215 has only the name to go on. rule/name
+ *   is a configured name regex; PROM217 fixes it to level:metric:operations.
+ *   All three overlap.
+ *
  * Deliberately without a credit from these tools:
  * - PROM001 and PROM003: a literal credential in TypeScript source, and the
  *   Slo objective/window model. Neither tool reads either.
  * - PROM202 (severity not routed) and PROM207 (receiver never routed to):
  *   check-config accepts both, and `amtool config routes test` answers a
  *   different question (where one given label set goes).
+ * - PROM216 (histogram_quantile without _bucket or le) and PROM219
+ *   (alertname set by hand): no pint check reports either, and promtool's
+ *   rulefmt accepts both.
+ * - PROM220-PROM224: check-config accepts insecure_skip_verify, SMTP auth
+ *   without TLS, credentials over http://, a repeat_interval under
+ *   group_interval, and an inhibit rule without equal.
+ * - PROM301: no tool here reads a rule file together with the collector
+ *   config that produces its metrics.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 
@@ -66,4 +87,11 @@ export const prometheusAuditLineage: Record<string, Lineage[]> = {
   PROM208: [amtool("equivalent")],
   PROM209: [amtool("overlaps")],
   PROM210: [amtool("overlaps")],
+  PROM211: [{ tool: "pint", rule: "rule/for", url: `${PINT}/rule/for.md`, relation: "overlaps" }],
+  PROM212: [{ tool: "pint", rule: "alerts/annotation", url: `${PINT}/alerts/annotation.md`, relation: "overlaps" }],
+  PROM213: [{ tool: "pint", rule: "alerts/comparison", url: `${PINT}/alerts/comparison.md`, relation: "equivalent" }],
+  PROM214: [{ tool: "pint", rule: "alerts/template", url: `${PINT}/alerts/template.md`, relation: "overlaps" }],
+  PROM215: [{ tool: "pint", rule: "promql/rate", url: `${PINT}/promql/rate.md`, relation: "overlaps" }],
+  PROM217: [{ tool: "pint", rule: "rule/name", url: `${PINT}/rule/name.md`, relation: "overlaps" }],
+  PROM218: [{ tool: "pint", rule: "promql/regexp", url: `${PINT}/promql/regexp.md`, relation: "equivalent" }],
 };