@intentius/chant-lexicon-prometheus 0.106.4 → 0.108.0

package/dist/composites/alert-routing.d.ts

@@ -0,0 +1,104 @@
+/**
+ * `AlertRouting`: an Alertmanager routing tree by team and severity, the
+ * inhibit rules between severity levels, and the receivers.
+ *
+ * The root route sends to `receiver` (default: a `default` receiver with no
+ * integrations, which drops what reaches it). Below it, in order:
+ *
+ * 1. `routes`: child routes of your own, first, such as `Watchdog`'s.
+ * 2. One route per team, matched on the team label (`team` by default),
+ *    sending to the team's receiver; a team can send a severity level to
+ *    another receiver of its own (a pager for `critical`).
+ * 3. One route per severity level, for every alert no team route took.
+ *
+ * The default levels are the severities the lexicon's composites write:
+ * `critical` (with `Slo`'s `page`), `warning` (with `Slo`'s `ticket`, and
+ * `GenAiRules`' and `RedAlerts`' default `warning`) and `info`. Each level
+ * sends to the root receiver unless it names one, so a project routes
+ * `critical` to a pager and leaves the rest, and PROM202 finds every
+ * severity routed.
+ *
+ * While an alert of one level fires, the same alert at every lower level is
+ * held back (an inhibit rule per pair). "The same alert" is equal values of
+ * `inhibitEqual`, by default `alertname` and the labels the lexicon's
+ * composites tell their alerts apart by (`slo`, `service_name`) plus the team
+ * label: one SLO's page holds back that SLO's ticket, not another's.
+ */
+import { type CompositeInstance } from "@intentius/chant/composite";
+import { type InhibitRuleEntity, type ReceiverEntity, type ReceiverProps, type RouteEntity, type RouteProps } from "../alertmanager.js";
+/** A receiver: declared, as props for the composite to declare, or by name for one declared elsewhere. */
+export type AlertRoutingReceiver = ReceiverEntity | ReceiverProps | string;
+/** Route timing, as Alertmanager names it. */
+export interface AlertRoutingTiming {
+    /** How long to wait before the first notification of a new group. */
+    groupWait?: string;
+    /** How long to wait before notifying about new alerts in a group already notified. */
+    groupInterval?: string;
+    /** How long to wait before sending a notification again. */
+    repeatInterval?: string;
+}
+/** One severity level: the `severity` values in it, and where they go. */
+export interface AlertRoutingLevel extends AlertRoutingTiming {
+    /** The level's name, used in member and inhibit rule names, e.g. `critical`. */
+    name: string;
+    /** The `severity` values at this level, e.g. `["critical", "page"]`. */
+    severities: string[];
+    /** Where the level goes (default: the root receiver). */
+    receiver?: AlertRoutingReceiver;
+}
+/** A team's routes: the alerts carrying its team label value. */
+export interface AlertRoutingTeam extends AlertRoutingTiming {
+    /** The team label's value. */
+    team: string;
+    /** Where the team's alerts go. */
+    receiver: AlertRoutingReceiver;
+    /** Another receiver for some levels, by level name, e.g. `{ critical: pager }`. */
+    levels?: Record<string, AlertRoutingReceiver>;
+}
+export interface AlertRoutingProps extends AlertRoutingTiming {
+    /** The root route's receiver, for what no child route takes (default: a `default` receiver with no integrations). */
+    receiver?: AlertRoutingReceiver;
+    /** Severity levels, most severe first (default `critical`, `warning`, `info`; see `ALERT_ROUTING_LEVELS`). */
+    levels?: AlertRoutingLevel[];
+    /** Team routes, tried before the severity levels (default: none). */
+    teams?: AlertRoutingTeam[];
+    /** The label team routes match on (default `team`). */
+    teamLabel?: string;
+    /** Child routes of your own, tried first, e.g. `[watchdog.route]`. */
+    routes?: Array<RouteEntity | RouteProps>;
+    /** Labels alerts are grouped by into one notification (default `["alertname"]`). */
+    groupBy?: string[];
+    /** Inhibit lower levels while a higher one fires (default: on). */
+    inhibit?: boolean;
+    /** The labels that must match for one alert to hold back another (default `alertname`, `slo`, `service_name` and the team label). */
+    inhibitEqual?: string[];
+}
+export type AlertRoutingMembers = {
+    /** The root route. */
+    route: RouteEntity;
+} & {
+    /** Receivers this composite declares (`receiver_<name>`) and inhibit rules (`inhibit_<higher>_<lower>`). */
+    [member: string]: RouteEntity | ReceiverEntity | InhibitRuleEntity;
+};
+export type AlertRoutingInstance = CompositeInstance<AlertRoutingMembers> & AlertRoutingMembers;
+/** The default levels: the severities `Slo`, `GenAiRules` and `RedAlerts` write, most severe first. */
+export declare const ALERT_ROUTING_LEVELS: readonly AlertRoutingLevel[];
+/**
+ * A routing tree by team and severity, with inhibit rules between levels.
+ *
+ * @example
+ * ```ts
+ * import { AlertRouting, Watchdog } from "@intentius/chant-lexicon-prometheus";
+ *
+ * const pager = { name: "pager", pagerduty_configs: [{ routing_key_file: "/etc/alertmanager/secrets/pagerduty" }] };
+ * const chat = { name: "chat", slack_configs: [{ api_url_file: "/etc/alertmanager/secrets/slack", channel: "#alerts" }] };
+ * export const watchdog = Watchdog({});
+ * export const routing = AlertRouting({
+ *   receiver: chat,
+ *   levels: [{ name: "critical", severities: ["critical", "page"], receiver: pager }, { name: "warning", severities: ["warning", "ticket"] }],
+ *   routes: [watchdog.route],
+ * });
+ * ```
+ */
+export declare const AlertRouting: import("@intentius/chant").CompositeDefinition<AlertRoutingProps, AlertRoutingMembers>;
+//# sourceMappingURL=alert-routing.d.ts.map

package/dist/composites/alert-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-routing.d.ts","sourceRoot":"","sources":["../../src/composites/alert-routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAGzB,0GAA0G;AAC1G,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,aAAa,GAAG,MAAM,CAAC;AAE3E,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,qHAAqH;IACrH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,8GAA8G;IAC9G,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,qEAAqE;IACrE,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,MAAM,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC;IACzC,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qIAAqI;IACrI,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,sBAAsB;IACtB,KAAK,EAAE,WAAW,CAAC;CACpB,GAAG;IACF,4GAA4G;IAC5G,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,cAAc,GAAG,iBAAiB,CAAC;CACpE,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;AAEhG,uGAAuG;AACvG,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAI3D,CAAC;AA8BH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,wFAwHP,CAAC"}

package/dist/composites/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/composites/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAiI5C,CAAC"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/composites/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAuV5C,CAAC"}

package/dist/composites/index.d.ts

@@ -5,4 +5,10 @@ export { Slo, sloMetrics, sloPropsProblem, sliExprProblem, eventCount, DEFAULT_B
 export type { SloProps, SloSli, SloAlerting, SloAlertTier, BurnRateWindow, SloMembers, SloInstance, SloMetrics, SloBurnRate, } from "./slo.js";
 export { GenAiRules, genAiRuleMetrics } from "./genai.js";
 export type { GenAiRulesProps, GenAiRulesMembers, GenAiRulesInstance, GenAiRuleMetrics, GenAiPrice, GenAiAlerting, GenAiAlertOptions, GenAiRatioAlert, GenAiLatencyAlert, GenAiBudget, GenAiAlertInfo, GenAiQuantileSeries, } from "./genai.js";
+export { RedAlerts, redAlertRules, RED_ALERT_NAMES } from "./red-alerts.js";
+export type { RedAlertsProps, RedAlertsMembers, RedAlertsInstance, RedAlertOptions, RedErrorRatioAlert, RedLatencyAlert } from "./red-alerts.js";
+export { Watchdog, WATCHDOG_URL_FILE } from "./watchdog.js";
+export type { WatchdogProps, WatchdogMembers, WatchdogInstance } from "./watchdog.js";
+export { AlertRouting, ALERT_ROUTING_LEVELS } from "./alert-routing.js";
+export type { AlertRoutingProps, AlertRoutingMembers, AlertRoutingInstance, AlertRoutingLevel, AlertRoutingTeam, AlertRoutingTiming, AlertRoutingReceiver, } from "./alert-routing.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,GAAG,EACH,UAAU,EACV,eAAe,EACf,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,OAAO,CAAC;AACf,YAAY,EACV,QAAQ,EACR,MAAM,EACN,WAAW,EACX,YAAY,EACZ,cAAc,EACd,UAAU,EACV,WAAW,EACX,UAAU,EACV,WAAW,GACZ,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACvD,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,mBAAmB,GACpB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,GAAG,EACH,UAAU,EACV,eAAe,EACf,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,OAAO,CAAC;AACf,YAAY,EACV,QAAQ,EACR,MAAM,EACN,WAAW,EACX,YAAY,EACZ,cAAc,EACd,UAAU,EACV,WAAW,EACX,UAAU,EACV,WAAW,GACZ,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACvD,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACzE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9I,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACrE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}

package/dist/composites/red-alerts.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `RedAlerts`: error-ratio and latency alerts per service over the span
+ * metrics a `spanmetrics` connector emits.
+ *
+ * The names come from the connector's declaration through the otel lexicon's
+ * `spanMetricsNames()`, and the expressions from its
+ * `spanMetricsRedQueries()`, the same builder the grafana lexicon's
+ * `RedDashboard` runs its panels on. The alert and the panel a responder
+ * opens read one expression, with `rateWindow` in place of Grafana's
+ * `$__rate_interval`.
+ *
+ * Both alerts count server and consumer spans only by default, like the
+ * dashboard: a service's outgoing calls and internal spans don't dilute its
+ * error ratio. Both are on by default; the latency alert needs the
+ * connector's duration histogram and is left out without one unless asked
+ * for.
+ */
+import { type CompositeInstance } from "@intentius/chant/composite";
+import { type PrometheusNaming, type SpanMetricsKind, type SpanMetricsNames } from "@intentius/chant-lexicon-otel/metric-names";
+import type { OTelComponent } from "@intentius/chant-lexicon-otel/define";
+import type { SpanMetricsConnectorConfig } from "@intentius/chant-lexicon-otel/components/connectors";
+import type { PrometheusExporterConfig } from "@intentius/chant-lexicon-otel/components/exporters";
+import { type AlertingRule, type RuleGroupEntity } from "../rules.js";
+import type { LabelSet } from "../model.js";
+/** The fields both alerts take. */
+export interface RedAlertOptions {
+    /** How long the condition must hold (default `10m`). */
+    for?: string;
+    /** The `severity` label, which Alertmanager routes on (default `warning`). */
+    severity?: string;
+    /** More labels on the alert. */
+    labels?: LabelSet;
+    /** More annotations on the alert, e.g. `runbook_url`. */
+    annotations?: LabelSet;
+}
+export interface RedErrorRatioAlert extends RedAlertOptions {
+    /** The share of counted spans ending in error the alert fires above, between 0 and 1 (default 0.05). */
+    threshold?: number;
+}
+export interface RedLatencyAlert extends RedAlertOptions {
+    /** The duration quantile compared (default 0.95). */
+    quantile?: number;
+    /** The duration, in seconds, the quantile fires above (default 1). Converted to the histogram's unit. */
+    thresholdSeconds?: number;
+}
+export interface RedAlertsProps {
+    /** The `spanmetrics` connector the metrics come from (the otel lexicon's `RedMetrics` has it as `spanMetrics`), or the names `spanMetricsNames()` returned for it. */
+    spanMetrics: OTelComponent<"connector", "spanmetrics", SpanMetricsConnectorConfig> | SpanMetricsNames;
+    /** The `prometheus` exporter that serves them, when its `namespace` or `add_metric_suffixes` changes the names. */
+    exporter?: OTelComponent<"exporter", "prometheus", PrometheusExporterConfig> | PrometheusNaming;
+    /** Error ratio per service (default: on, above 0.05). `false` leaves it out. */
+    errorRatio?: boolean | RedErrorRatioAlert;
+    /** A duration quantile per service (default: on, p95 above 1s, when the connector has a histogram). `false` leaves it out. */
+    latency?: boolean | RedLatencyAlert;
+    /** The span kinds counted (default server and consumer spans); `[]` counts every kind. */
+    spanKinds?: SpanMetricsKind[];
+    /** The range every `rate` reads (default `5m`). */
+    rateWindow?: string;
+    /** Spans per second a service must see for its alerts to fire, so a handful of calls can't page (default: no floor). */
+    minRate?: number;
+    /** More Prometheus labels the alerts are split by besides the service, e.g. `deployment_environment`. They must be connector dimensions. */
+    groupBy?: string[];
+    /** The rule group's name (default `red`). */
+    name?: string;
+    /** Labels added to every rule, e.g. `team`. */
+    labels?: LabelSet;
+    /** Evaluation interval of the group (default: Prometheus's `evaluation_interval`). */
+    interval?: string;
+}
+export type RedAlertsMembers = {
+    /** The alerting rules. */
+    rules: RuleGroupEntity;
+};
+/** What `RedAlerts(...)` returns: its rule group, as `rules`. */
+export type RedAlertsInstance = CompositeInstance<RedAlertsMembers> & RedAlertsMembers;
+/** The alert names `RedAlerts` writes. */
+export declare const RED_ALERT_NAMES: Readonly<{
+    errorRatio: "ServiceErrorRatioHigh";
+    latency: "ServiceLatencyHigh";
+}>;
+/** The alerting rules `RedAlerts` builds, without the group: for a group of your own. */
+export declare function redAlertRules(props: RedAlertsProps): AlertingRule[];
+/**
+ * Error-ratio and latency alerts per service, from a `spanmetrics` connector.
+ *
+ * @example
+ * ```ts
+ * import { RedMetrics } from "@intentius/chant-lexicon-otel";
+ * import { RedAlerts } from "@intentius/chant-lexicon-prometheus";
+ *
+ * export const red = RedMetrics({ spanMetrics: { namespace: "shop", histogram: { unit: "s" } } });
+ * export const redAlerts = RedAlerts({ spanMetrics: red.spanMetrics, exporter: red.exporter, latency: { thresholdSeconds: 0.5 } });
+ * ```
+ */
+export declare const RedAlerts: import("@intentius/chant").CompositeDefinition<RedAlertsProps, RedAlertsMembers>;
+//# sourceMappingURL=red-alerts.d.ts.map

package/dist/composites/red-alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"red-alerts.d.ts","sourceRoot":"","sources":["../../src/composites/red-alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAC;AACtG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGzC,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,yDAAyD;IACzD,WAAW,CAAC,EAAE,QAAQ,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,wGAAwG;IACxG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yGAAyG;IACzG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,sKAAsK;IACtK,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,aAAa,EAAE,0BAA0B,CAAC,GAAG,gBAAgB,CAAC;IACtG,mHAAmH;IACnH,QAAQ,CAAC,EAAE,aAAa,CAAC,UAAU,EAAE,YAAY,EAAE,wBAAwB,CAAC,GAAG,gBAAgB,CAAC;IAChG,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAC1C,8HAA8H;IAC9H,OAAO,CAAC,EAAE,OAAO,GAAG,eAAe,CAAC;IACpC,0FAA0F;IAC1F,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9B,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wHAAwH;IACxH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4IAA4I;IAC5I,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,0BAA0B;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;AAKvF,0CAA0C;AAC1C,eAAO,MAAM,eAAe;;;EAAwF,CAAC;AAsBrH,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,EAAE,CAqEnE;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,kFAYP,CAAC"}

package/dist/composites/watchdog.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `Watchdog`: an alert that always fires, routed to a heartbeat receiver.
+ *
+ * The alert's expression is `vector(1)`, so it fires from the first rule
+ * evaluation for as long as Prometheus evaluates rules and Alertmanager
+ * delivers notifications. The route sends it to a heartbeat service
+ * (healthchecks.io, Dead Man's Snitch, a PagerDuty or Opsgenie heartbeat),
+ * which raises its own alarm when the notifications stop: the whole alerting
+ * path, not just Prometheus, is down.
+ *
+ * The route is a child route, matched on the alert's name and severity. Put
+ * it first under the root route: `AlertRouting({ routes: [watchdog.route] })`,
+ * or the `routes` of a root `Route` of your own. Left unnested it is a second
+ * root, and the build warns.
+ *
+ * By default the receiver is a webhook that reads its URL from a file
+ * (`url_file`), since a heartbeat URL is a credential; mount the file into
+ * Alertmanager.
+ */
+import { type CompositeInstance } from "@intentius/chant/composite";
+import { type ReceiverEntity, type ReceiverProps, type RouteEntity } from "../alertmanager.js";
+import { type RuleGroupEntity } from "../rules.js";
+import type { LabelSet } from "../model.js";
+export interface WatchdogProps {
+    /**
+     * Where the heartbeat goes: a declared `Receiver`, a receiver's props
+     * (the composite declares it), or the name of one declared elsewhere.
+     * Default: a `heartbeat` receiver with one webhook reading `urlFile`.
+     */
+    receiver?: ReceiverEntity | ReceiverProps | string;
+    /** The file the default receiver's webhook reads its URL from (default `/etc/alertmanager/secrets/heartbeat-url`). */
+    urlFile?: string;
+    /** The alert's name (default `Watchdog`). */
+    alert?: string;
+    /** The alert's `severity` label (default `none`): no severity route takes it. */
+    severity?: string;
+    /** How often the heartbeat is sent again while the alert fires (default `1m`). Keep it under the heartbeat service's period. */
+    repeatInterval?: string;
+    /** The rule group's name (default `watchdog`). */
+    group?: string;
+    /** More labels on the alert. */
+    labels?: LabelSet;
+    /** More annotations on the alert. */
+    annotations?: LabelSet;
+}
+export type WatchdogMembers = {
+    /** The always-firing alert. */
+    rules: RuleGroupEntity;
+    /** The child route that sends it to the heartbeat receiver. */
+    route: RouteEntity;
+    /** The heartbeat receiver, when this composite declares it. */
+    receiver?: ReceiverEntity;
+};
+export type WatchdogInstance = CompositeInstance<WatchdogMembers> & WatchdogMembers;
+/** The default heartbeat URL file. */
+export declare const WATCHDOG_URL_FILE = "/etc/alertmanager/secrets/heartbeat-url";
+/**
+ * An always-firing alert and the route that sends it to a heartbeat receiver.
+ *
+ * @example
+ * ```ts
+ * import { AlertRouting, Watchdog } from "@intentius/chant-lexicon-prometheus";
+ *
+ * export const watchdog = Watchdog({ urlFile: "/etc/alertmanager/secrets/healthchecks-url" });
+ * export const routing = AlertRouting({ routes: [watchdog.route] });
+ * ```
+ */
+export declare const Watchdog: import("@intentius/chant").CompositeDefinition<WatchdogProps, WatchdogMembers>;
+//# sourceMappingURL=watchdog.d.ts.map

package/dist/composites/watchdog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watchdog.d.ts","sourceRoot":"","sources":["../../src/composites/watchdog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAA+B,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzH,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,GAAG,aAAa,GAAG,MAAM,CAAC;IACnD,sHAAsH;IACtH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gIAAgI;IAChI,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,qCAAqC;IACrC,WAAW,CAAC,EAAE,QAAQ,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,+BAA+B;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,+DAA+D;IAC/D,KAAK,EAAE,WAAW,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;AAKpF,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,4CAA4C,CAAC;AAM3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,gFA4DP,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,273 @@
+/**
+ * The `prometheus` namespace in `chant.config.ts` (#3371): which ruler and
+ * which Alertmanager each chant environment observes and imports from, and
+ * (#3372) applies to.
+ *
+ * ```ts
+ * import type { ChantConfig } from "@intentius/chant/config";
+ * import "@intentius/chant-lexicon-prometheus";   // brings the `prometheus` key into ChantConfig
+ *
+ * export default {
+ *   lexicons: ["prometheus"],
+ *   prometheus: {
+ *     profiles: {
+ *       prod: {
+ *         ruler: { kind: "mimir", url: "https://mimir.example.com", tenant: "shop", namespace: "shop-rules", token: { env: "MIMIR_TOKEN" } },
+ *         alertmanager: { kind: "mimir", url: "https://mimir.example.com", tenant: "shop", token: { env: "MIMIR_TOKEN" } },
+ *       },
+ *     },
+ *   },
+ * } satisfies ChantConfig;
+ * ```
+ *
+ * A rule file has no namespace and no ownership marker, so the ruler
+ * namespaces a profile names are the boundary: `namespace` is where the
+ * project's groups live, `groupNamespaces` moves single groups to another,
+ * and nothing outside those namespaces is read for import or written by an
+ * apply. On a plain Prometheus the "namespace" is the rule file path
+ * `/api/v1/rules` reports as `file`, and may be left out.
+ *
+ * Credentials are named by their environment variable, never written in the
+ * config. An environment with no profile falls back to environment
+ * variables (see {@link resolveRulerTarget} and
+ * {@link resolveAlertmanagerTarget}).
+ */
+import { z } from "zod";
+import type { ChantConfig } from "@intentius/chant/config";
+import type { PromTarget } from "./api/client.js";
+/** The rulers chant reads rule groups from. `prometheus` is a plain Prometheus, read over `/api/v1/rules`. */
+export declare const RULER_KINDS: readonly ["mimir", "cortex", "loki", "prometheus"];
+export type RulerKind = (typeof RULER_KINDS)[number];
+/** Where an Alertmanager config is read: a plain Alertmanager's `/api/v2/status`, or Mimir's and Cortex's `/api/v1/alerts`. */
+export declare const ALERTMANAGER_KINDS: readonly ["alertmanager", "mimir", "cortex"];
+export type AlertmanagerKind = (typeof ALERTMANAGER_KINDS)[number];
+export declare const rulerProfileSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        cortex: "cortex";
+        loki: "loki";
+        mimir: "mimir";
+        prometheus: "prometheus";
+    }>;
+    /** Base URL: the Mimir, Cortex or Loki endpoint the ruler API is served on, or the Prometheus server. */
+    url: z.ZodString;
+    /** `X-Scope-OrgID`. */
+    tenant: z.ZodOptional<z.ZodString>;
+    /** The ruler namespace the project's rule groups live in (on a plain Prometheus, the rule file path). */
+    namespace: z.ZodOptional<z.ZodString>;
+    /** Groups that live in another namespace than `namespace`, by group name. */
+    groupNamespaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Mimir's or Cortex's `-http.prometheus-http-prefix`. Defaults to `/prometheus` (to nothing for a plain Prometheus). */
+    prometheusPrefix: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodObject<{
+        env: z.ZodString;
+    }, z.core.$strict>>;
+    basicAuth: z.ZodOptional<z.ZodObject<{
+        user: z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>;
+        password: z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const alertmanagerProfileSchema: z.ZodObject<{
+    kind: z.ZodOptional<z.ZodEnum<{
+        alertmanager: "alertmanager";
+        cortex: "cortex";
+        mimir: "mimir";
+    }>>;
+    url: z.ZodString;
+    /** `X-Scope-OrgID`, for Mimir and Cortex. */
+    tenant: z.ZodOptional<z.ZodString>;
+    /** Mimir's or Cortex's `-http.alertmanager-http-prefix`. Defaults to `/alertmanager`. */
+    alertmanagerPrefix: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodObject<{
+        env: z.ZodString;
+    }, z.core.$strict>>;
+    basicAuth: z.ZodOptional<z.ZodObject<{
+        user: z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>;
+        password: z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const prometheusProfileSchema: z.ZodObject<{
+    ruler: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<{
+            cortex: "cortex";
+            loki: "loki";
+            mimir: "mimir";
+            prometheus: "prometheus";
+        }>;
+        /** Base URL: the Mimir, Cortex or Loki endpoint the ruler API is served on, or the Prometheus server. */
+        url: z.ZodString;
+        /** `X-Scope-OrgID`. */
+        tenant: z.ZodOptional<z.ZodString>;
+        /** The ruler namespace the project's rule groups live in (on a plain Prometheus, the rule file path). */
+        namespace: z.ZodOptional<z.ZodString>;
+        /** Groups that live in another namespace than `namespace`, by group name. */
+        groupNamespaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Mimir's or Cortex's `-http.prometheus-http-prefix`. Defaults to `/prometheus` (to nothing for a plain Prometheus). */
+        prometheusPrefix: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>>;
+        basicAuth: z.ZodOptional<z.ZodObject<{
+            user: z.ZodObject<{
+                env: z.ZodString;
+            }, z.core.$strict>;
+            password: z.ZodObject<{
+                env: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    alertmanager: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodOptional<z.ZodEnum<{
+            alertmanager: "alertmanager";
+            cortex: "cortex";
+            mimir: "mimir";
+        }>>;
+        url: z.ZodString;
+        /** `X-Scope-OrgID`, for Mimir and Cortex. */
+        tenant: z.ZodOptional<z.ZodString>;
+        /** Mimir's or Cortex's `-http.alertmanager-http-prefix`. Defaults to `/alertmanager`. */
+        alertmanagerPrefix: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodObject<{
+            env: z.ZodString;
+        }, z.core.$strict>>;
+        basicAuth: z.ZodOptional<z.ZodObject<{
+            user: z.ZodObject<{
+                env: z.ZodString;
+            }, z.core.$strict>;
+            password: z.ZodObject<{
+                env: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const prometheusConfigSchema: z.ZodObject<{
+    /** One ruler and one Alertmanager per chant environment. */
+    profiles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        ruler: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                cortex: "cortex";
+                loki: "loki";
+                mimir: "mimir";
+                prometheus: "prometheus";
+            }>;
+            /** Base URL: the Mimir, Cortex or Loki endpoint the ruler API is served on, or the Prometheus server. */
+            url: z.ZodString;
+            /** `X-Scope-OrgID`. */
+            tenant: z.ZodOptional<z.ZodString>;
+            /** The ruler namespace the project's rule groups live in (on a plain Prometheus, the rule file path). */
+            namespace: z.ZodOptional<z.ZodString>;
+            /** Groups that live in another namespace than `namespace`, by group name. */
+            groupNamespaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** Mimir's or Cortex's `-http.prometheus-http-prefix`. Defaults to `/prometheus` (to nothing for a plain Prometheus). */
+            prometheusPrefix: z.ZodOptional<z.ZodString>;
+            token: z.ZodOptional<z.ZodObject<{
+                env: z.ZodString;
+            }, z.core.$strict>>;
+            basicAuth: z.ZodOptional<z.ZodObject<{
+                user: z.ZodObject<{
+                    env: z.ZodString;
+                }, z.core.$strict>;
+                password: z.ZodObject<{
+                    env: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        alertmanager: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodOptional<z.ZodEnum<{
+                alertmanager: "alertmanager";
+                cortex: "cortex";
+                mimir: "mimir";
+            }>>;
+            url: z.ZodString;
+            /** `X-Scope-OrgID`, for Mimir and Cortex. */
+            tenant: z.ZodOptional<z.ZodString>;
+            /** Mimir's or Cortex's `-http.alertmanager-http-prefix`. Defaults to `/alertmanager`. */
+            alertmanagerPrefix: z.ZodOptional<z.ZodString>;
+            token: z.ZodOptional<z.ZodObject<{
+                env: z.ZodString;
+            }, z.core.$strict>>;
+            basicAuth: z.ZodOptional<z.ZodObject<{
+                user: z.ZodObject<{
+                    env: z.ZodString;
+                }, z.core.$strict>;
+                password: z.ZodObject<{
+                    env: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type RulerProfile = z.infer<typeof rulerProfileSchema>;
+export type AlertmanagerProfile = z.infer<typeof alertmanagerProfileSchema>;
+export type PrometheusProfile = z.infer<typeof prometheusProfileSchema>;
+export type PrometheusLexiconConfig = z.infer<typeof prometheusConfigSchema>;
+declare module "@intentius/chant/config" {
+    interface ChantConfig {
+        prometheus?: PrometheusLexiconConfig;
+    }
+}
+/** Compile-time proof that the augmentation reaches `ChantConfig`. */
+export type PrometheusConfigNamespace = NonNullable<ChantConfig["prometheus"]>;
+/** Why no target could be resolved, in the observation vocabulary. */
+export interface UnresolvedTarget {
+    readonly reason: "no-binding" | "no-credentials";
+    readonly detail: string;
+}
+export declare function isUnresolvedTarget(v: object): v is UnresolvedTarget;
+/** A resolved ruler. */
+export interface RulerTarget extends PromTarget {
+    readonly kind: RulerKind;
+    /** Where the project's groups live; absent only for an ad-hoc read with no namespace named. */
+    readonly namespace?: string;
+    readonly groupNamespaces: Readonly<Record<string, string>>;
+    readonly prometheusPrefix: string;
+}
+/** A resolved Alertmanager. */
+export interface AlertmanagerTarget extends PromTarget {
+    readonly kind: AlertmanagerKind;
+    readonly alertmanagerPrefix: string;
+}
+/**
+ * The namespaces a ruler target declares, deduplicated, in the order they
+ * are named. This is the ownership boundary: import reads only these, and
+ * an apply (#3372) writes and deletes only inside these.
+ */
+export declare function declaredNamespaces(target: Pick<RulerTarget, "namespace" | "groupNamespaces">): string[];
+/** The namespace a declared group lives in: its `groupNamespaces` entry, else `namespace`. */
+export declare function namespaceOfGroup(target: Pick<RulerTarget, "namespace" | "groupNamespaces">, group: string): string | undefined;
+type Env = Record<string, string | undefined>;
+interface ResolveInput {
+    environment?: string;
+    config?: Pick<ChantConfig, "prometheus">;
+    env?: Env;
+}
+/**
+ * The ruler an environment reads from. Pure: `config` and `env` are passed in.
+ *
+ * 1. `prometheus.profiles.<environment>.ruler`. A profile that names a
+ *    credential variable which is not set is `no-credentials`.
+ * 2. `PROMETHEUS_RULER_URL`, with `PROMETHEUS_RULER_KIND` (default `mimir`),
+ *    `PROMETHEUS_RULER_TENANT`, `PROMETHEUS_RULER_NAMESPACE` and
+ *    `PROMETHEUS_RULER_TOKEN` (or `_USER` and `_PASSWORD`).
+ * 3. `PROMETHEUS_URL`: a plain Prometheus, read over `/api/v1/rules`.
+ * 4. Otherwise `no-binding`.
+ */
+export declare function resolveRulerTarget(input: ResolveInput): RulerTarget | UnresolvedTarget;
+/**
+ * The Alertmanager an environment reads from. Pure.
+ *
+ * 1. `prometheus.profiles.<environment>.alertmanager`.
+ * 2. `ALERTMANAGER_URL`, with `ALERTMANAGER_KIND` (default `alertmanager`),
+ *    `ALERTMANAGER_TENANT` and `ALERTMANAGER_TOKEN` (or `_USER` and `_PASSWORD`).
+ * 3. Otherwise `no-binding`.
+ */
+export declare function resolveAlertmanagerTarget(input: ResolveInput): AlertmanagerTarget | UnresolvedTarget;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,cAAc,CAAC;AAKzD,8GAA8G;AAC9G,eAAO,MAAM,WAAW,YAAI,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAU,CAAC;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,+HAA+H;AAC/H,eAAO,MAAM,kBAAkB,YAAI,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAC/E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,eAAO,MAAM,kBAAkB;;;;;;;IAE7B,yGAAyG;;IAEzG,uBAAuB;;IAEvB,yGAAyG;;IAEzG,6EAA6E;;IAE7E,yHAAyH;;;;;;;;;;;;;kBAIzH,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;IAGpC,6CAA6C;;IAE7C,yFAAyF;;;;;;;;;;;;;kBAIzF,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;QAzBlC,yGAAyG;;QAEzG,uBAAuB;;QAEvB,yGAAyG;;QAEzG,6EAA6E;;QAE7E,yHAAyH;;;;;;;;;;;;;;;;;;;;;QASzH,6CAA6C;;QAE7C,yFAAyF;;;;;;;;;;;;;;kBASzF,CAAC;AAEH,eAAO,MAAM,sBAAsB;IACjC,4DAA4D;;;;;;;;;YA/B5D,yGAAyG;;YAEzG,uBAAuB;;YAEvB,yGAAyG;;YAEzG,6EAA6E;;YAE7E,yHAAyH;;;;;;;;;;;;;;;;;;;;;YASzH,6CAA6C;;YAE7C,yFAAyF;;;;;;;;;;;;;;;kBAczF,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE7E,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,UAAU,CAAC,EAAE,uBAAuB,CAAC;KACtC;CACF;AAED,sEAAsE;AACtE,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/E,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAEnE;AAED,wBAAwB;AACxB,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,+BAA+B;AAC/B,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,iBAAiB,CAAC,GAAG,MAAM,EAAE,CAMvG;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9H;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAmC9C,UAAU,YAAY;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,CA+CtF;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,YAAY,GAAG,kBAAkB,GAAG,gBAAgB,CAkCpG"}

package/dist/describe-resources.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `describeResources()` for prometheus (#3371): is each declared rule group
+ * loaded on the environment's ruler and is it healthy, and is each declared
+ * Alertmanager entity in the config the environment's Alertmanager runs.
+ *
+ * Runs on core's observer harness. `bind()` resolves the ruler and the
+ * Alertmanager (./api/bind.ts), each on its own, so a project with only rule
+ * groups is not held up by having no Alertmanager. Verdicts:
+ *
+ * | Entity | Read | Absent when |
+ * |---|---|---|
+ * | `RuleGroup` on Mimir, Cortex, Loki | the config API's `/{namespace}/{group}`, in the namespace the profile gives the group | 404 |
+ * | `RuleGroup` on a plain Prometheus | `/api/v1/rules`, by name (and rule file, when the profile names one) | not listed |
+ * | `Receiver`, `TimeInterval` | the loaded Alertmanager config, by name | no entry of that name |
+ * | `Route` | the loaded routing tree, by receiver and matchers | no route with both |
+ * | `InhibitRule` | the loaded inhibit rules, by matchers and `equal` | no equal rule |
+ * | `AlertmanagerSettings` | the loaded config | no config (Mimir: the tenant has none) |
+ * | `ScrapeConfig`, `PrometheusConfig` | none: `prometheus.yml` is a file on disk | `unsupported-kind` |
+ *
+ * A group's health is from `/api/v1/rules` (./api/evaluated.ts): `health`
+ * (`ok`, `err`, `unknown`), the first rule error, and how many alerts are
+ * firing or pending. A failed health read leaves the group present with
+ * `health: "unknown"` and the reason; presence is the config API's answer.
+ * The Alertmanager's cluster status and version ride on its entities.
+ *
+ * Ownership: a rule group and an Alertmanager config carry no marker
+ * (./serializer.ts), so every verdict is `unknown`, and an `owned: true`
+ * read withholds them as `filtered`. What bounds chant on a ruler is the
+ * namespace: groups are only read in the namespaces the profile declares
+ * (./config.ts).
+ */
+import { type DescribeResourcesResult } from "@intentius/chant/observation";
+import { type BindOptions } from "./api/bind.js";
+export interface PrometheusObserveOptions extends Omit<BindOptions, "environment"> {
+    environment: string;
+    buildOutput?: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    owned?: boolean;
+}
+/** What `unsupported-kind` says about `prometheus.yml` entities. */
+export declare const PROMETHEUS_CONFIG_NOT_OBSERVED = "prometheus.yml is a file Prometheus reads from disk, not something its API serves for comparison; observe it through the lexicon that deploys it";
+/** Observe every declared prometheus entity against the environment's ruler and Alertmanager. */
+export declare function describeResources(options: PrometheusObserveOptions): Promise<DescribeResourcesResult>;
+//# sourceMappingURL=describe-resources.d.ts.map

package/dist/describe-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,EAGL,KAAK,uBAAuB,EAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAsC,KAAK,WAAW,EAAuB,MAAM,YAAY,CAAC;AAavG,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAQD,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,qJACyG,CAAC;AAwPrJ,iGAAiG;AACjG,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAQ3G"}