@intentius/chant-lexicon-prometheus 0.106.4 → 0.108.0

package/src/export-resources.test.ts

@@ -0,0 +1,253 @@
+/**
+ * Live export (#3371): `chant import --from <env>` against a fake Mimir
+ * ruler, a fake plain Prometheus and fake Alertmanagers
+ * (./api/fake-servers.ts), the ruler and the Alertmanager behind real HTTP
+ * servers on localhost. The last test runs core's `liveImportFromPlugins`
+ * over the plugin, bound by environment variables, and reads the files it
+ * writes.
+ */
+
+import { mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { exportResources, type PrometheusExportOptions } from "./export-resources";
+import { fakeAlertmanager, fakeHttp, fakeRuler, serveFake, type FakeAlertmanagerState, type FakeRulerState } from "./api/fake-servers";
+import { EVALUATED_IMPORT_WARNING } from "./api/evaluated";
+import { PrometheusGenerator } from "./import/generator";
+import { ALERTMANAGER_RESOURCE_TYPE, RULE_FILE_RESOURCE_TYPE, type AlertmanagerResourceProperties, type RuleFileResourceProperties } from "./import/parser";
+import { Slo } from "./composites/slo";
+import { ruleGroupConfig } from "./rules";
+import { prometheusPlugin } from "./plugin";
+import type { RawRuleGroup } from "./api/ruler";
+import type { TemplateIR } from "@intentius/chant/import/parser";
+
+const sloGroup = ruleGroupConfig(
+  Slo({ name: "checkout", objective: 0.99, window: "30d", sli: { errors: "sum(rate(e[{{window}}]))", total: "sum(rate(t[{{window}}]))" } }).rules,
+) as unknown as RawRuleGroup;
+
+const apiGroup: RawRuleGroup = {
+  name: "api",
+  interval: "30s",
+  // Mimir keeps fields a rule file does not have; the importer names them.
+  source_tenants: ["shop", "payments"],
+  rules: [{ alert: "ApiDown", expr: 'up{job="api"} == 0', for: "5m", labels: { severity: "page" } }],
+};
+
+function rulerState(): FakeRulerState {
+  return {
+    kind: "mimir",
+    tenant: "shop",
+    namespaces: {
+      shop: [apiGroup, sloGroup],
+      platform: [{ name: "infra", rules: [{ record: "node:up:sum", expr: 'sum(up{job="node"})' }] }],
+      other: [{ name: "foreign", rules: [{ record: "a:b", expr: "sum(a)" }] }],
+    },
+  };
+}
+
+const original = readFileSync(join(import.meta.dirname, "api", "testdata", "am-status-original.yml"), "utf8");
+
+let ruler = rulerState();
+const rulerCalls: string[] = [];
+let am: FakeAlertmanagerState = { kind: "alertmanager", original };
+let rulerUrl = "";
+let amUrl = "";
+const closers: Array<() => Promise<void>> = [];
+
+beforeAll(async () => {
+  const r = await serveFake((req) => fakeRuler(ruler, rulerCalls)(req));
+  const a = await serveFake((req) => fakeAlertmanager(am)(req));
+  rulerUrl = r.url;
+  amUrl = a.url;
+  closers.push(r.close, a.close);
+});
+afterAll(async () => {
+  for (const c of closers) await c();
+});
+
+function profile(ruler: Record<string, unknown> | undefined = { kind: "mimir", url: rulerUrl, tenant: "shop", namespace: "shop", groupNamespaces: { infra: "platform" } }) {
+  return { prometheus: { profiles: { prod: { ...(ruler ? { ruler } : {}), alertmanager: { url: amUrl } } } } } as PrometheusExportOptions["config"];
+}
+
+function exportProd(opts: Partial<PrometheusExportOptions> = {}) {
+  return exportResources({ environment: "prod", config: profile(), env: {}, ...opts });
+}
+
+const ruleFile = (ir: TemplateIR) => (ir.resources.find((r) => r.type === RULE_FILE_RESOURCE_TYPE)?.properties as unknown as RuleFileResourceProperties | undefined)?.file;
+const amConfig = (ir: TemplateIR) => (ir.resources.find((r) => r.type === ALERTMANAGER_RESOURCE_TYPE)?.properties as unknown as AlertmanagerResourceProperties | undefined)?.config;
+
+describe("rule groups from a Mimir ruler", () => {
+  it("reads the declared namespaces only, and the groups parse as a rule file's would", async () => {
+    ruler = rulerState();
+    am = { kind: "alertmanager", original };
+    rulerCalls.length = 0;
+    const ir = await exportProd();
+    expect(ruleFile(ir)?.groups.map((g) => g.name)).toEqual(["api", "slo-checkout", "infra"]);
+    expect(ruleFile(ir)?.groups[0]).toEqual({ name: "api", interval: "30s", rules: [{ alert: "ApiDown", expr: 'up{job="api"} == 0', for: "5m", labels: { severity: "page" } }] });
+    expect(rulerCalls).toEqual(["GET /prometheus/config/v1/rules/shop", "GET /prometheus/config/v1/rules/platform"]);
+    expect(ir.warnings?.some((w) => w.startsWith('ruler namespace "shop": group "api": "source_tenants" is not a rule group field'))).toBe(true);
+  });
+
+  it("generates RuleGroups, and the group an Slo built as that Slo", async () => {
+    ruler = rulerState();
+    const files = Object.fromEntries(new PrometheusGenerator().generate(await exportProd({ selector: { type: "Prometheus::Rules::RuleGroup" } })).map((f) => [f.path, f.content]));
+    expect(files["slos.ts"]).toContain("const checkout = Slo({");
+    expect(files["rules.ts"]).toContain("new RuleGroup({");
+    expect(files["rules.ts"]).toContain('name: "infra"');
+  });
+
+  it("a selector names one group and leaves the Alertmanager out", async () => {
+    ruler = rulerState();
+    const ir = await exportProd({ selector: { type: "Prometheus::Rules::RuleGroup", name: "infra" } });
+    expect(ruleFile(ir)?.groups.map((g) => g.name)).toEqual(["infra"]);
+    expect(amConfig(ir)).toBeUndefined();
+  });
+
+  it("a declared namespace the ruler does not have is a warning, not an error", async () => {
+    ruler = { ...rulerState(), namespaces: { shop: [apiGroup] } };
+    const ir = await exportProd();
+    expect(ruleFile(ir)?.groups.map((g) => g.name)).toEqual(["api"]);
+    expect(ir.warnings).toContain(`ruler namespace "platform" has no rule groups on ${rulerUrl}`);
+  });
+
+  it("a group read from a namespace the profile does not give it is imported with a warning", async () => {
+    ruler = { ...rulerState(), namespaces: { shop: [apiGroup], platform: [{ name: "infra", rules: [] }, { name: "stray", rules: [] }] } };
+    const ir = await exportProd();
+    expect(ir.warnings?.some((w) => w.startsWith('rule group "stray" was read from ruler namespace "platform"'))).toBe(true);
+    expect(ir.warnings?.some((w) => w.includes('"infra" was read from'))).toBe(false);
+  });
+
+  it("the same group name in two namespaces imports the first, with a warning", async () => {
+    ruler = { ...rulerState(), namespaces: { shop: [apiGroup], platform: [{ ...apiGroup, interval: "1m" }] } };
+    const ir = await exportProd();
+    expect(ruleFile(ir)?.groups).toHaveLength(1);
+    expect(ruleFile(ir)?.groups[0].interval).toBe("30s");
+    expect(ir.warnings?.some((w) => w.startsWith('rule group "api" is in both namespace "shop" and namespace "platform"'))).toBe(true);
+  });
+
+  it("with no namespace declared, an ad-hoc import reads every namespace and says so; with owned it reads none", async () => {
+    ruler = rulerState();
+    const adHoc = { PROMETHEUS_RULER_URL: rulerUrl, PROMETHEUS_RULER_TENANT: "shop" };
+    let ir = await exportResources({ environment: "dev", config: {}, env: adHoc, selector: { type: "Prometheus::Rules::RuleGroup" } });
+    expect(ruleFile(ir)?.groups.map((g) => g.name).sort()).toEqual(["api", "foreign", "infra", "slo-checkout"]);
+    expect(ir.warnings?.some((w) => w.includes("declares no ruler namespace, so every namespace of the tenant was read (shop, platform, other)"))).toBe(true);
+    rulerCalls.length = 0;
+    ir = await exportResources({ environment: "dev", config: {}, env: adHoc, owned: true, selector: { type: "Prometheus::Rules::RuleGroup" } });
+    expect(ir.resources).toEqual([]);
+    expect(rulerCalls).toEqual([]);
+    expect(ir.warnings?.some((w) => w.startsWith("no rule groups are imported with --owned"))).toBe(true);
+  });
+
+  it("a refused tenant fails the export rather than importing nothing", async () => {
+    ruler = rulerState();
+    await expect(exportProd({ config: profile({ kind: "mimir", url: rulerUrl, tenant: "nope", namespace: "shop" }) })).rejects.toThrow(/returned 401/);
+  });
+});
+
+describe("rule groups from a plain Prometheus", () => {
+  const state: FakeRulerState = {
+    kind: "prometheus",
+    namespaces: {},
+    evaluated: [
+      {
+        name: "api",
+        file: "/etc/prometheus/api.yml",
+        interval: 30,
+        rules: [{ type: "alerting", name: "ApiDown", query: 'up{job="api"} == 0', duration: 300, labels: { severity: "page" }, annotations: {}, health: "ok" }],
+      },
+      { name: "node", file: "/etc/prometheus/node.yml", interval: 60, rules: [{ type: "recording", name: "node:up:sum", query: 'sum(up{job="node"})', health: "ok" }] },
+    ],
+  };
+  const options = (ruler: Record<string, unknown>, extra: Partial<PrometheusExportOptions> = {}) =>
+    exportResources({
+      environment: "prod",
+      config: { prometheus: { profiles: { prod: { ruler: { kind: "prometheus", url: "http://prometheus.test", ...ruler } } } } } as PrometheusExportOptions["config"],
+      env: {},
+      http: { ruler: fakeHttp(fakeRuler(state)) },
+      ...extra,
+    });
+
+  it("maps /api/v1/rules back to rule-file groups and says what that loses", async () => {
+    const ir = await options({});
+    expect(ruleFile(ir)?.groups).toEqual([
+      { name: "api", interval: "30s", rules: [{ alert: "ApiDown", expr: 'up{job="api"} == 0', for: "5m", labels: { severity: "page" } }] },
+      { name: "node", interval: "1m", rules: [{ record: "node:up:sum", expr: 'sum(up{job="node"})' }] },
+    ]);
+    expect(ir.warnings).toContain(EVALUATED_IMPORT_WARNING);
+    expect(ir.warnings?.some((w) => w.startsWith("not imported, Alertmanager:"))).toBe(true);
+  });
+
+  it("a named rule file bounds what is read, and owned with none names nothing", async () => {
+    expect(ruleFile(await options({ namespace: "/etc/prometheus/node.yml" }))?.groups.map((g) => g.name)).toEqual(["node"]);
+    const owned = await options({}, { owned: true });
+    expect(owned.resources).toEqual([]);
+  });
+});
+
+describe("the Alertmanager config", () => {
+  it("from /api/v2/status: Alertmanager's defaults are taken out and masked secrets are named", async () => {
+    am = { kind: "alertmanager", original };
+    const ir = await exportProd({ selector: { type: "Prometheus::Alertmanager::Config" } });
+    const config = amConfig(ir);
+    expect(config?.global).toEqual({ smtp_from: "am@example.com", smtp_smarthost: "smtp.example.com:587" });
+    expect(config?.receivers?.map((r) => r.name)).toEqual(["team", "pager"]);
+    expect(config?.route).toMatchObject({ receiver: "team", routes: [{ receiver: "pager", matchers: ['severity="page"'] }] });
+    expect(ruleFile(ir)).toBeUndefined();
+    const secrets = ir.warnings?.find((w) => w.includes('read "<secret>"'));
+    expect(secrets).toContain("receivers[0].webhook_configs[0].url");
+    expect(secrets).toContain("receivers[1].pagerduty_configs[0].routing_key");
+  });
+
+  it("verbatim keeps what Alertmanager wrote", async () => {
+    am = { kind: "alertmanager", original };
+    const config = amConfig(await exportProd({ verbatim: true, selector: { type: "Prometheus::Alertmanager::Route" } }));
+    expect(config?.global).toMatchObject({ resolve_timeout: "5m", smtp_hello: "localhost" });
+  });
+
+  it("from Mimir's /api/v1/alerts: the config as uploaded, with the templates named in a warning", async () => {
+    const uploaded = "route:\n  receiver: team\n  group_wait: 30s\nreceivers:\n  - name: team\n    webhook_configs:\n      - url: http://hooks.example.com/team\n        send_resolved: true\n";
+    const state: FakeAlertmanagerState = { kind: "mimir", tenant: "shop", uploaded: { alertmanager_config: uploaded, template_files: { "team.tmpl": '{{ define "x" }}y{{ end }}' } } };
+    const ir = await exportResources({
+      environment: "prod",
+      config: { prometheus: { profiles: { prod: { alertmanager: { kind: "mimir", url: "http://mimir.test", tenant: "shop" } } } } },
+      env: {},
+      http: { alertmanager: fakeHttp(fakeAlertmanager(state), { "x-scope-orgid": "shop" }) },
+    });
+    // Uploaded as written: send_resolved: true stays, and group_wait is not taken for a default.
+    expect(amConfig(ir)).toEqual({
+      route: { receiver: "team", group_wait: "30s" },
+      receivers: [{ name: "team", webhook_configs: [{ url: "http://hooks.example.com/team", send_resolved: true }] }],
+    });
+    expect(ir.warnings?.some((w) => w.includes("notification templates (team.tmpl) are not imported"))).toBe(true);
+    expect(ir.warnings?.some((w) => w.startsWith("not imported, rule groups:"))).toBe(true);
+  });
+});
+
+it("neither endpoint bound is an error that says why for both", async () => {
+  await expect(exportResources({ environment: "prod", config: {}, env: {} })).rejects.toThrow(/rule groups: .*; Alertmanager: /);
+});
+
+it("chant import --from writes the ruler's groups and the Alertmanager's config as source", async () => {
+  ruler = rulerState();
+  am = { kind: "alertmanager", original };
+  const { liveImportFromPlugins } = await import("@intentius/chant/cli/commands/import");
+  const dir = mkdtempSync(join(tmpdir(), "prom-import-live-"));
+  vi.stubEnv("PROMETHEUS_RULER_URL", rulerUrl);
+  vi.stubEnv("PROMETHEUS_RULER_TENANT", "shop");
+  vi.stubEnv("PROMETHEUS_RULER_NAMESPACE", "shop");
+  vi.stubEnv("ALERTMANAGER_URL", amUrl);
+  try {
+    const result = await liveImportFromPlugins([prometheusPlugin], { environment: "nowhere", lexicon: "prometheus", output: join(dir, "src"), force: true });
+    expect(result.error).toBeUndefined();
+    expect(result.success).toBe(true);
+    const written = readdirSync(join(dir, "src")).sort();
+    expect(written).toEqual(expect.arrayContaining(["rules.ts", "slos.ts", "receivers.ts", "routes.ts"]));
+    expect(readFileSync(join(dir, "src", "slos.ts"), "utf8")).toContain("Slo({");
+    expect(readFileSync(join(dir, "src", "rules.ts"), "utf8")).not.toContain("foreign");
+    expect(result.warnings.some((w) => w.includes('read "<secret>"'))).toBe(true);
+  } finally {
+    vi.unstubAllEnvs();
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/src/export-resources.ts

@@ -0,0 +1,193 @@
+/**
+ * Live export for prometheus (#3371): `chant import --from <env>` writes the
+ * environment's rule groups and Alertmanager config as chant TypeScript.
+ *
+ * All I/O is here. What is read goes through the file importer's own parse
+ * (./import/parser.ts) into the same IR, so a group read from a ruler and
+ * the same group in a rule file generate the same source through the same
+ * `PrometheusGenerator`, `Slo` recognition (./import/slo.ts) included.
+ *
+ * - Rule groups, from the environment's ruler (./api/ruler.ts). On Mimir,
+ *   Cortex and Loki only the namespaces the profile declares are read
+ *   (`namespace` and `groupNamespaces`, see ./config.ts); that is the
+ *   ownership boundary, as a stack bounds a CloudFormation export. An ad-hoc
+ *   read with no namespace declared reads every namespace of the tenant and
+ *   says so, and with `owned` reads none. On a plain Prometheus the groups
+ *   come from `/api/v1/rules` and are mapped back to the rule-file shape
+ *   (./api/evaluated.ts), which is lossy, and the export says how.
+ * - The Alertmanager config, from `/api/v2/status` or, on Mimir and
+ *   Cortex, `/api/v1/alerts` (./api/alertmanager.ts). Alertmanager's status
+ *   config is its loaded config marshalled again; unless `verbatim`, what
+ *   that adds is taken out (./import/alertmanager-live.ts). Secrets read
+ *   `<secret>` and are named in a warning.
+ * - `selector.type` is `Prometheus::Rules::RuleGroup` (with `selector.name`
+ *   a group name) or any `Prometheus::Alertmanager::*` type, which selects
+ *   the whole config.
+ *
+ * Neither endpoint being bound is an error; one of them being unbound is a
+ * warning, so a project with only rule groups imports them.
+ */
+
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import type { ResourceIR } from "@intentius/chant/import/parser";
+import { bindEndpoints, type BindOptions } from "./api/bind";
+import { EVALUATED_IMPORT_WARNING, evaluatedToRuleGroup } from "./api/evaluated";
+import type { RulerApi, RawRuleGroup } from "./api/ruler";
+import type { AlertmanagerApi } from "./api/alertmanager";
+import { declaredNamespaces, isUnresolvedTarget, namespaceOfGroup } from "./config";
+import {
+  ALERTMANAGER_RESOURCE_TYPE,
+  RULE_FILE_RESOURCE_TYPE,
+  loadPrometheusYaml,
+  parseAlertmanagerDocument,
+  parseRuleFileDocument,
+  type AlertmanagerResourceProperties,
+  type RuleFileResourceProperties,
+} from "./import/parser";
+import { maskedSecretPaths, stripAlertmanagerDefaults } from "./import/alertmanager-live";
+import type { RuleGroupConfig } from "./model";
+import { RULE_GROUP_TYPE } from "./rules";
+
+export interface PrometheusExportOptions extends Omit<BindOptions, "environment"> {
+  environment: string;
+  stack?: string;
+  region?: string;
+  selector?: ResourceSelector;
+  owned?: boolean;
+  verbatim?: boolean;
+}
+
+const ALERTMANAGER_TYPE_PREFIX = "Prometheus::Alertmanager::";
+
+function isObject(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/** The groups of the declared namespaces (or, ad hoc, of every namespace), each with where it came from. */
+async function rulerGroups(ruler: RulerApi, owned: boolean | undefined, warnings: string[]): Promise<Array<{ namespace: string; raw: RawRuleGroup[] }>> {
+  const declared = declaredNamespaces(ruler.target);
+  if (declared.length === 0) {
+    if (owned) {
+      warnings.push(`no rule groups are imported with --owned: ${ruler.target.source} declares no ruler namespace, and the namespace is the ownership boundary`);
+      return [];
+    }
+    const all = await ruler.listNamespaces();
+    const names = Object.keys(all);
+    if (names.length > 0) {
+      warnings.push(
+        `${ruler.target.source} declares no ruler namespace, so every namespace of the tenant was read (${names.join(", ")}); ` +
+          "set prometheus.profiles.<env>.ruler.namespace to bound what is imported and what an apply may change",
+      );
+    }
+    return names.map((namespace) => ({ namespace, raw: all[namespace] }));
+  }
+  const out: Array<{ namespace: string; raw: RawRuleGroup[] }> = [];
+  for (const namespace of declared) {
+    const raw = await ruler.readNamespace(namespace);
+    if (raw === undefined) warnings.push(`ruler namespace "${namespace}" has no rule groups on ${ruler.target.url}`);
+    else out.push({ namespace, raw });
+  }
+  return out;
+}
+
+async function exportRuleGroups(ruler: RulerApi, options: PrometheusExportOptions, warnings: string[]): Promise<RuleGroupConfig[]> {
+  const name = options.selector?.name;
+  const groups: RuleGroupConfig[] = [];
+  const seen = new Map<string, string>();
+  const keep = (group: RuleGroupConfig, from: string) => {
+    if (name !== undefined && group.name !== name) return;
+    const first = seen.get(group.name);
+    if (first !== undefined) {
+      warnings.push(`rule group "${group.name}" is in both ${first} and ${from}; the one in ${first} is imported, since a rule file holds one group of a name`);
+      return;
+    }
+    seen.set(group.name, from);
+    groups.push(group);
+  };
+
+  if (ruler.target.kind === "prometheus") {
+    const files = declaredNamespaces(ruler.target);
+    if (files.length === 0 && options.owned) {
+      warnings.push(`no rule groups are imported with --owned: ${ruler.target.source} names no rule file, and a rule file carries no ownership marker`);
+      return [];
+    }
+    const evaluated = (await ruler.evaluated()).filter((g) => files.length === 0 || files.includes(g.file));
+    if (evaluated.length > 0) warnings.push(EVALUATED_IMPORT_WARNING);
+    for (const g of evaluated) keep(evaluatedToRuleGroup(g), `rule file "${g.file}"`);
+    return groups;
+  }
+
+  for (const { namespace, raw } of await rulerGroups(ruler, options.owned, warnings)) {
+    const parsed = parseRuleFileDocument({ groups: raw });
+    for (const w of parsed.warnings) warnings.push(`ruler namespace "${namespace}": ${w}`);
+    for (const g of parsed.file.groups) {
+      keep(g, `namespace "${namespace}"`);
+      if (seen.get(g.name) === `namespace "${namespace}"` && namespaceOfGroup(ruler.target, g.name) !== namespace) {
+        warnings.push(
+          `rule group "${g.name}" was read from ruler namespace "${namespace}", which a rule file cannot say; ` +
+            `name it under prometheus.profiles.<env>.ruler.groupNamespaces so it is observed and applied there`,
+        );
+      }
+    }
+  }
+  return groups;
+}
+
+async function exportAlertmanager(am: AlertmanagerApi, verbatim: boolean | undefined, warnings: string[]): Promise<ResourceIR | undefined> {
+  const live = await am.readConfig();
+  if (live === undefined) {
+    warnings.push(`${am.target.url} has no Alertmanager config for this tenant`);
+    return undefined;
+  }
+  const loaded = loadPrometheusYaml(live.text);
+  if (!isObject(loaded)) throw new Error(`the Alertmanager config read from ${live.address} is not a YAML mapping`);
+  const doc = live.remarshalled && !verbatim ? stripAlertmanagerDefaults(loaded) : loaded;
+  const masked = maskedSecretPaths(doc);
+  if (masked.length > 0) {
+    warnings.push(
+      `Alertmanager masks secrets in ${live.address}; these read "<secret>" and need their real values (a *_file path, say): ${masked.join(", ")}`,
+    );
+  }
+  if (live.templateFiles) {
+    warnings.push(`the Alertmanager's notification templates (${Object.keys(live.templateFiles).join(", ")}) are not imported; templates: names files, not their contents`);
+  }
+  const parsed = parseAlertmanagerDocument(doc);
+  warnings.push(...parsed.warnings.map((w) => `alertmanager: ${w}`));
+  return {
+    logicalId: "alertmanager",
+    type: ALERTMANAGER_RESOURCE_TYPE,
+    properties: { config: parsed.config } satisfies AlertmanagerResourceProperties as unknown as Record<string, unknown>,
+  };
+}
+
+export async function exportResources(options: PrometheusExportOptions): Promise<ExportedTemplate> {
+  const { ruler, alertmanager } = await bindEndpoints(options);
+  const type = options.selector?.type;
+  const wantRules = type === undefined || type === RULE_GROUP_TYPE || type === RULE_FILE_RESOURCE_TYPE;
+  const wantAlertmanager = (type === undefined || type.startsWith(ALERTMANAGER_TYPE_PREFIX)) && options.selector?.name === undefined;
+
+  const unbound = [
+    ...(wantRules && isUnresolvedTarget(ruler) ? [`rule groups: ${ruler.detail}`] : []),
+    ...(wantAlertmanager && isUnresolvedTarget(alertmanager) ? [`Alertmanager: ${alertmanager.detail}`] : []),
+  ];
+  const wanted = (wantRules ? 1 : 0) + (wantAlertmanager ? 1 : 0);
+  if (wanted > 0 && unbound.length === wanted) throw new Error(`nothing to read for environment "${options.environment}": ${unbound.join("; ")}`);
+
+  const warnings: string[] = unbound.map((u) => `not imported, ${u}`);
+  const resources: ResourceIR[] = [];
+  if (wantRules && !isUnresolvedTarget(ruler)) {
+    const groups = await exportRuleGroups(ruler, options, warnings);
+    if (groups.length > 0) {
+      resources.push({
+        logicalId: "ruleFile",
+        type: RULE_FILE_RESOURCE_TYPE,
+        properties: { file: { groups } } satisfies RuleFileResourceProperties as unknown as Record<string, unknown>,
+      });
+    }
+  }
+  if (wantAlertmanager && !isUnresolvedTarget(alertmanager)) {
+    const resource = await exportAlertmanager(alertmanager, options.verbatim, warnings);
+    if (resource) resources.push(resource);
+  }
+  return { resources, parameters: [], warnings };
+}

package/src/import/alertmanager-live.test.ts

@@ -0,0 +1,66 @@
+/**
+ * Alertmanager's re-marshalled `/api/v2/status` config back to the declared
+ * shape (#3371). The fixture is written by hand in the shape
+ * `Config.String()` gives at Alertmanager v0.34.1 (defaults written out,
+ * globals copied into each integration, secrets masked); a stack run
+ * against a real Alertmanager is what confirms it.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { maskedSecretPaths, stripAlertmanagerDefaults } from "./alertmanager-live";
+import { loadPrometheusYaml } from "./parser";
+
+const original = readFileSync(join(import.meta.dirname, "..", "api", "testdata", "am-status-original.yml"), "utf8");
+const doc = loadPrometheusYaml(original) as Record<string, unknown>;
+
+describe("stripAlertmanagerDefaults", () => {
+  const stripped = stripAlertmanagerDefaults(doc);
+
+  test("global keeps only what differs from DefaultGlobalConfig", () => {
+    expect(stripped.global).toEqual({ smtp_from: "am@example.com", smtp_smarthost: "smtp.example.com:587" });
+  });
+
+  test("routes lose continue: false and keep matchers, group_by and time intervals", () => {
+    expect(stripped.route).toEqual({
+      receiver: "team",
+      group_by: ["alertname"],
+      routes: [{ receiver: "pager", matchers: ['severity="page"'], mute_time_intervals: ["weekends"] }],
+    });
+  });
+
+  test("integrations lose inherited globals, their own defaults and zero values, and keep what was set", () => {
+    expect(stripped.receivers).toEqual([
+      { name: "team", webhook_configs: [{ url: "<secret>" }] },
+      {
+        name: "pager",
+        // require_tls: false differs from the global true, so it was set and stays.
+        email_configs: [{ to: "oncall@example.com", require_tls: false }],
+        pagerduty_configs: [{ routing_key: "<secret>", details: { team: "payments" } }],
+      },
+    ]);
+  });
+
+  test("inhibit rules and time intervals are kept, an empty templates list is not", () => {
+    expect(stripped.inhibit_rules).toEqual([{ source_matchers: ['severity="page"'], target_matchers: ['severity="ticket"'], equal: ["alertname"] }]);
+    expect(stripped.time_intervals).toEqual([{ name: "weekends", time_intervals: [{ weekdays: ["saturday", "sunday"] }] }]);
+    expect("templates" in stripped).toBe(false);
+  });
+
+  test("a webhook that turned send_resolved off keeps it", () => {
+    const out = stripAlertmanagerDefaults({ receivers: [{ name: "x", webhook_configs: [{ send_resolved: false, url: "http://x" }] }] });
+    expect(out.receivers).toEqual([{ name: "x", webhook_configs: [{ send_resolved: false, url: "http://x" }] }]);
+  });
+
+  test("the input is not changed", () => {
+    expect((loadPrometheusYaml(original) as Record<string, unknown>).global).toEqual(doc.global);
+  });
+});
+
+test("maskedSecretPaths names every <secret>", () => {
+  expect(maskedSecretPaths(stripAlertmanagerDefaults(doc))).toEqual([
+    "receivers[0].webhook_configs[0].url",
+    "receivers[1].pagerduty_configs[0].routing_key",
+  ]);
+});