@intentius/chant-lexicon-prometheus 0.106.4 → 0.108.0

package/dist/export-resources.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Live export for prometheus (#3371): `chant import --from <env>` writes the
+ * environment's rule groups and Alertmanager config as chant TypeScript.
+ *
+ * All I/O is here. What is read goes through the file importer's own parse
+ * (./import/parser.ts) into the same IR, so a group read from a ruler and
+ * the same group in a rule file generate the same source through the same
+ * `PrometheusGenerator`, `Slo` recognition (./import/slo.ts) included.
+ *
+ * - Rule groups, from the environment's ruler (./api/ruler.ts). On Mimir,
+ *   Cortex and Loki only the namespaces the profile declares are read
+ *   (`namespace` and `groupNamespaces`, see ./config.ts); that is the
+ *   ownership boundary, as a stack bounds a CloudFormation export. An ad-hoc
+ *   read with no namespace declared reads every namespace of the tenant and
+ *   says so, and with `owned` reads none. On a plain Prometheus the groups
+ *   come from `/api/v1/rules` and are mapped back to the rule-file shape
+ *   (./api/evaluated.ts), which is lossy, and the export says how.
+ * - The Alertmanager config, from `/api/v2/status` or, on Mimir and
+ *   Cortex, `/api/v1/alerts` (./api/alertmanager.ts). Alertmanager's status
+ *   config is its loaded config marshalled again; unless `verbatim`, what
+ *   that adds is taken out (./import/alertmanager-live.ts). Secrets read
+ *   `<secret>` and are named in a warning.
+ * - `selector.type` is `Prometheus::Rules::RuleGroup` (with `selector.name`
+ *   a group name) or any `Prometheus::Alertmanager::*` type, which selects
+ *   the whole config.
+ *
+ * Neither endpoint being bound is an error; one of them being unbound is a
+ * warning, so a project with only rule groups imports them.
+ */
+import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
+import { type BindOptions } from "./api/bind.js";
+export interface PrometheusExportOptions extends Omit<BindOptions, "environment"> {
+    environment: string;
+    stack?: string;
+    region?: string;
+    selector?: ResourceSelector;
+    owned?: boolean;
+    verbatim?: boolean;
+}
+export declare function exportResources(options: PrometheusExportOptions): Promise<ExportedTemplate>;
+//# sourceMappingURL=export-resources.d.ts.map

package/dist/export-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-resources.d.ts","sourceRoot":"","sources":["../src/export-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEnF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAkB7D,MAAM,WAAW,uBAAwB,SAAQ,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAyGD,wBAAsB,eAAe,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8BjG"}

package/dist/import/alertmanager-live.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Alertmanager's `/api/v2/status` config, back to the shape a person writes
+ * (#3371).
+ *
+ * `config.original` is the loaded config marshalled again, not the file
+ * (`Config.String()` in Alertmanager's `config/config.go`). Against
+ * Alertmanager v0.34.1 (`PROMETHEUS_PIN.alertmanager`) that adds three
+ * kinds of thing a file did not say:
+ *
+ * - `global:` with every default of `DefaultGlobalConfig()` written out:
+ *   `resolve_timeout: 5m`, the default `http_config`, `smtp_hello`,
+ *   `smtp_require_tls`, `smtp_tls_config` and the integration API URLs.
+ * - every receiver integration with the settings it inherited from `global:`
+ *   (`http_config`, an email config's `smarthost`, `from` and SMTP auth, a
+ *   Slack config's `api_url`, a PagerDuty config's `url`, and so on), as
+ *   `Config.UnmarshalYAML` copies them in.
+ * - every integration's own defaults (`DefaultEmailConfig`,
+ *   `DefaultSlackConfig`, `DefaultPagerdutyConfig`, ...) and the zero values
+ *   of fields marshalled without `omitempty` (`url_file: ""`,
+ *   `max_alerts: 0`, `continue: false`).
+ *
+ * {@link stripAlertmanagerDefaults} takes those out, so an import writes
+ * what a person would have declared. It drops a value only where it equals
+ * the default or the global it was copied from; a value someone set to the
+ * default is indistinguishable from one they left out, and goes too, which
+ * builds to the same config. `verbatim` skips it. Secrets read `<secret>`
+ * either way (see {@link maskedSecretPaths}).
+ */
+type Json = Record<string, unknown>;
+/** The re-marshalled config with what Alertmanager added taken out (see the module comment). Pure; `doc` is not changed. */
+export declare function stripAlertmanagerDefaults(doc: Json): Json;
+/** The paths that read `<secret>`, the mask Alertmanager writes over every secret it marshals. */
+export declare function maskedSecretPaths(doc: unknown, at?: string): string[];
+export {};
+//# sourceMappingURL=alertmanager-live.d.ts.map

package/dist/import/alertmanager-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alertmanager-live.d.ts","sourceRoot":"","sources":["../../src/import/alertmanager-live.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAiOpC,4HAA4H;AAC5H,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CA2BzD;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,SAAK,GAAG,MAAM,EAAE,CAKjE"}

package/dist/import/parser.d.ts

@@ -53,6 +53,18 @@ export type ParsedPrometheusFile = {
 };
 /** A matcher string Alertmanager parses back to `name op value`. */
 export declare function matcherString(name: string, op: "=" | "=~", value: string): string;
+/** Load YAML the way the parser does: YAML 1.2 core types plus `<<` merge keys. */
+export declare function loadPrometheusYaml(content: string): unknown;
+/** A rule file already loaded (live import builds one from a ruler's groups, ../export-resources.ts). */
+export declare function parseRuleFileDocument(doc: Record<string, unknown>): {
+    file: RuleFileConfig;
+    warnings: string[];
+};
+/** An `alertmanager.yml` already loaded (live import reads one from Alertmanager's API, ../export-resources.ts). */
+export declare function parseAlertmanagerDocument(doc: Record<string, unknown>): {
+    config: AlertmanagerConfig;
+    warnings: string[];
+};
 /** Parse a rule file or `alertmanager.yml`, telling them apart by shape. */
 export declare function parsePrometheusYaml(content: string): ParsedPrometheusFile;
 /** The rule file and `alertmanager.yml` parser `chant import` runs. */

package/dist/import/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAOL,KAAK,kBAAkB,EAKvB,KAAK,cAAc,EAEnB,KAAK,oBAAoB,EAG1B,MAAM,UAAU,CAAC;AAIlB,kDAAkD;AAClD,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAC9D,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,qCAAqC,CAAC;AAE7E,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,yDAAyD;AACzD,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,4BAA4B;AAC5B,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAgH7E,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjF;AA0MD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CAgBzE;AAED,uEAAuE;AACvE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAqBjC;CACF"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAOL,KAAK,kBAAkB,EAKvB,KAAK,cAAc,EAEnB,KAAK,oBAAoB,EAG1B,MAAM,UAAU,CAAC;AAIlB,kDAAkD;AAClD,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAC9D,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,qCAAqC,CAAC;AAE7E,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,yDAAyD;AACzD,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,4BAA4B;AAC5B,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAgH7E,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjF;AA0MD,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,yGAAyG;AACzG,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAGhH;AAED,oHAAoH;AACpH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAG1H;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CAgBzE;AAED,uEAAuE;AACvE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAqBjC;CACF"}

package/dist/index.d.ts

@@ -11,5 +11,10 @@ export { checkPromql, PROMQL_GRAMMAR, type PromqlCheck } from "./promql.js";
 export { validateRuleFile, validateRunbookUrls, validateAlertmanagerConfig, validateSeverityRouting, alertSeverities, type PrometheusIssue, type PrometheusIssueCode, } from "./validate-config.js";
 export { PROMETHEUS_PIN } from "./pin.js";
 export { promtoolCheckRules, promtoolCheckConfig, promtoolTestRules, amtoolCheckConfig, hasTool, type ToolResult } from "./tools.js";
-export { Slo, sloMetrics, sloPropsProblem, sliExprProblem, eventCount, DEFAULT_BURN_RATES, SLO_WINDOW_PLACEHOLDER, type SloProps, type SloSli, type SloAlerting, type SloAlertTier, type BurnRateWindow, type SloMembers, type SloInstance, type SloMetrics, type SloBurnRate, GenAiRules, genAiRuleMetrics, type GenAiRulesProps, type GenAiRulesMembers, type GenAiRulesInstance, type GenAiRuleMetrics, type GenAiPrice, type GenAiAlerting, type GenAiAlertOptions, type GenAiRatioAlert, type GenAiLatencyAlert, type GenAiBudget, type GenAiAlertInfo, type GenAiQuantileSeries, } from "./composites/index.js";
+export { Slo, sloMetrics, sloPropsProblem, sliExprProblem, eventCount, DEFAULT_BURN_RATES, SLO_WINDOW_PLACEHOLDER, type SloProps, type SloSli, type SloAlerting, type SloAlertTier, type BurnRateWindow, type SloMembers, type SloInstance, type SloMetrics, type SloBurnRate, GenAiRules, genAiRuleMetrics, type GenAiRulesProps, type GenAiRulesMembers, type GenAiRulesInstance, type GenAiRuleMetrics, type GenAiPrice, type GenAiAlerting, type GenAiAlertOptions, type GenAiRatioAlert, type GenAiLatencyAlert, type GenAiBudget, type GenAiAlertInfo, type GenAiQuantileSeries, RedAlerts, redAlertRules, RED_ALERT_NAMES, type RedAlertsProps, type RedAlertsMembers, type RedAlertsInstance, type RedAlertOptions, type RedErrorRatioAlert, type RedLatencyAlert, Watchdog, WATCHDOG_URL_FILE, type WatchdogProps, type WatchdogMembers, type WatchdogInstance, AlertRouting, ALERT_ROUTING_LEVELS, type AlertRoutingProps, type AlertRoutingMembers, type AlertRoutingInstance, type AlertRoutingLevel, type AlertRoutingTeam, type AlertRoutingTiming, type AlertRoutingReceiver, } from "./composites/index.js";
+export { prometheusConfigSchema, resolveRulerTarget, resolveAlertmanagerTarget, declaredNamespaces, namespaceOfGroup } from "./config.js";
+export type { PrometheusLexiconConfig, PrometheusProfile, RulerProfile, AlertmanagerProfile, RulerKind, AlertmanagerKind } from "./config.js";
+export { amtoolRoutesTest, alertmanagerSilence, alertmanagerUnsilence, rulesLoadedObserve, ruleAudit } from "./op/builders.js";
+export { RuleAuditOp, type RuleAuditOpConfig, type RuleAuditOpResources } from "./op/audit-op.js";
+export { sloRuleTests, type SloTestInput } from "./op/slo-rule-tests.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGxF,OAAO,EACL,SAAS,EACT,eAAe,EACf,WAAW,EACX,eAAe,EACf,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,KAAK,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,UAAU,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AACrH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AACzE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAGvC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAGlI,OAAO,EACL,GAAG,EACH,UAAU,EACV,eAAe,EACf,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,UAAU,EACV,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGxF,OAAO,EACL,SAAS,EACT,eAAe,EACf,WAAW,EACX,eAAe,EACf,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,KAAK,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,UAAU,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AACrH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AACzE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAGvC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAGlI,OAAO,EACL,GAAG,EACH,UAAU,EACV,eAAe,EACf,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,QAAQ,EACb,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,UAAU,EACV,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,SAAS,EACT,aAAa,EACb,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,QAAQ,EACR,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,YAAY,EACZ,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACvI,YAAY,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAM3I,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC5H,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/integrity.json

@@ -1,14 +1,14 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "2c6be256cd5955acb726931e4eaf531b1f165026a06bf77c1673e476bdb84dfb",
+    "manifest.json": "792b4452301bdc29a6969c248b3510fd9016f60ed5d040cc18a1f102c7161a16",
     "meta.json": "a06b8059e2de2ca6c8131bfbbfe7e143e818f2d2d497d3f45a9bc5c63af6aeeb",
     "types/index.d.ts": "150d72287453a24a40cdeffb8cf3e9dc6e77ab58b342b48d01902dc58fb5f85d",
     "rules/literal-credential.ts": "1ea8b768e9dc4a6d7b133a52923ce2e8cb815584d3eeb1854f77af34d50f8257",
     "rules/prom-ast.ts": "6de6f83cfa81505efeb2c55aa1e9872ead9b09695a400c92bec8fa11059a551f",
     "rules/promql-literal.ts": "c734b6d9f0949ac7529edd6e687f7a5a1e62f37e614492f0e92e7062260e85db",
     "rules/slo-literal.ts": "13f86da17d11939ebbcf64be38b092b602f6c9e95876e1615c00a032638d75b1",
-    "rules/prom-helpers.ts": "1c7aa83f7635096fe3364c959f5c0376e74187529a0ccc8bf0602d47d0ada8dd",
+    "rules/prom-helpers.ts": "eacd3456e331129e356cde2187bbc3c7b5ac54e8836a5dae2dd149d8fa0541f7",
     "rules/prom101.ts": "f153c2b0b5f43b51e15053d732f27321aeb33c76683416b47982a95986704935",
     "rules/prom102.ts": "d40d7d4690ada12efcf50c471739b2254376cbd382c1d8c547bbadca3205a1fa",
     "rules/prom103.ts": "7801469c838023083ef3c196fffc6ab71b05270dba439fc19cb1dc383a6a8f64",
@@ -46,5 +46,5 @@
     "skills/chant-prometheus-alertmanager.md": "4c4a22bea6147653d09d7d3f55f81c4927963d4e2f50b2e430fbb9023e99570b",
     "skills/chant-prometheus-kubernetes.md": "cca016857891f4cabf1feb6f9db83c220a2e6ece200cd89e635851079f8070a8"
   },
-  "composite": "968b2054ad9877915712a06c995193113cd7582e008f76dbc327eac5cc58122a"
+  "composite": "e0c13b36937c568b7e56ff13a6a3e881f07ddc0ecf1c39ff01014c3129adac19"
 }

package/dist/lint/post-synth/prom-helpers.d.ts

@@ -5,9 +5,9 @@
  *
  * Documents are recognized by shape, not by which lexicon emitted them, so a
  * rule file that reaches the output some other way (a hand-written YAML
- * sidecar) is checked too. `PrometheusRule` manifests are not read here;
- * their groups are the same `RuleGroup`s and are checked where they are
- * declared.
+ * sidecar) is checked too. `PrometheusRule` manifests are not read here:
+ * `chant build` hands each lexicon's checks only that lexicon's output, so the
+ * k8s lexicon's WK8606 runs `prometheusRuleDiagnostics` (below) over them.
  */
 import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { type PrometheusConfigFile } from "../../config-model.js";
@@ -44,4 +44,12 @@ export declare function runbookDiagnostics(ctx: PostSynthContext): PostSynthDiag
 export declare function collectorMetricDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[];
 /** PROM202: joins every rule file in the output against every Alertmanager config in it. Silent when either is absent. */
 export declare function routingDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[];
+/**
+ * The rule-file checks (PROM101-PROM107, PROM211, PROM213-PROM219) over the
+ * groups of every `PrometheusRule` in the build, whichever lexicon emitted
+ * it. `spec.groups` is a rule file's `groups`, so `validateRuleFile` reads it
+ * as is. Findings keep their PROM ids and name the PrometheusRule's namespace
+ * and name. PROM212 (runbook URLs) stays opt-in and is not run here.
+ */
+export declare function prometheusRuleDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[];
 //# sourceMappingURL=prom-helpers.d.ts.map

package/dist/lint/post-synth/prom-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prom-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAI9F,OAAO,EAA6B,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1F,OAAO,EAAkD,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IAC7D,YAAY,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC;IACpE,UAAU,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,8JAA8J;AAC9J,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAuB/D;AAYD,2HAA2H;AAC3H,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAM3G;AAED,uIAAuI;AACvI,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAM/G;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAE/E;AAED,yIAAyI;AACzI,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAE/E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA0BvF;AAED,0HAA0H;AAC1H,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAK/E"}
+{"version":3,"file":"prom-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/prom-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAI9F,OAAO,EAA6B,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1F,OAAO,EAAkD,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IAC7D,YAAY,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,CAAC,CAAC;IACpE,UAAU,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,8JAA8J;AAC9J,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAuB/D;AAYD,2HAA2H;AAC3H,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAM3G;AAED,uIAAuI;AACvI,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAM/G;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAE/E;AAED,yIAAyI;AACzI,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAE/E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA0BvF;AAED,0HAA0H;AAC1H,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAK/E;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA0BtF"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "prometheus",
-  "version": "0.106.4",
+  "version": "0.108.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Prometheus",
   "intrinsics": [],

package/dist/op/activities/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * prometheus Op activities (#3369), resolved by the core activity registry
+ * when a project's `chant.config.ts` lists the `prometheus` lexicon. Every
+ * function this module exports is an activity, bound by its export name, so
+ * the helpers behind them stay in their own files.
+ *
+ * - `promtoolCheckRules`, `promtoolTestRules`, `amtoolCheckConfig`: the
+ *   upstream tools over built files, failing the step when the tool is
+ *   missing or rejects the file.
+ * - `amtoolRoutesTest`: labels route to the expected receivers.
+ * - `alertmanagerSilence`, `alertmanagerUnsilence`: a silence around a
+ *   change, recorded so the final and `onFailure` phases can expire it.
+ * - `rulesLoadedObserve`: declared rule groups as the resources of a
+ *   `ConvergeOp({ observe })`.
+ * - `ruleAudit`: the step of `RuleAuditOp`.
+ */
+export { promtoolCheckRules, promtoolTestRules, amtoolCheckConfig, amtoolRoutesTest } from "./promtool.js";
+export type { ToolStepResult, PromtoolCheckRulesArgs, PromtoolTestRulesArgs, AmtoolCheckConfigArgs, AmtoolRoutesTestArgs, AmtoolRoutesTestResult, } from "./promtool.js";
+export { alertmanagerSilence, alertmanagerUnsilence } from "./silence.js";
+export type { AlertmanagerSilenceArgs, AlertmanagerSilenceResult, AlertmanagerUnsilenceArgs, AlertmanagerUnsilenceResult } from "./silence.js";
+export { rulesLoadedObserve } from "./rules-loaded.js";
+export type { RulesLoadedObserveArgs, RulesLoadedObserveResult } from "./rules-loaded.js";
+export { ruleAudit } from "./rule-audit.js";
+export type { RuleAuditArgs, RuleAuditResult, RuleAuditFinding, RuleAuditFindingKind, RuleAuditMode } from "./rule-audit.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxG,YAAY,EACV,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvE,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAC5I,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/op/activities/promtool.d.ts

@@ -0,0 +1,78 @@
+/**
+ * `promtool` and `amtool` as Op steps (#3369), over the functions in
+ * `../../tools.ts`.
+ *
+ * Those functions report `ran: false` when the binary is missing, so tests
+ * and CI can skip them. A step does not: a check that did not run must not
+ * read as a check that passed, so a missing binary fails the step, and so
+ * does a file the tool rejects, with the tool's output as the message.
+ *
+ * Paths are relative to the working directory. `promtoolTestRules` writes
+ * the rule file as `rules.yml` beside each test file, so a test file's
+ * `rule_files:` names `rules.yml`; the tests `sloRuleTests()` generates
+ * from `Slo` declarations do.
+ */
+import { type ExecRunner } from "@intentius/chant-lexicon-otel/op/activities/exec";
+export interface ToolStepResult {
+    /** The files checked. */
+    files: string[];
+    ok: boolean;
+    output: string;
+}
+export interface PromtoolCheckRulesArgs {
+    /** One rule file or several, e.g. `dist/prometheus/rules.yml`. */
+    rules: string | string[];
+    /** The promtool binary. Default `$PROMTOOL`, else `promtool`. */
+    bin?: string;
+}
+export interface PromtoolTestRulesArgs {
+    /** The rule file under test, e.g. `dist/prometheus/rules.yml`. */
+    rules: string;
+    /** Unit-test files, each naming `rules.yml` in `rule_files:`. */
+    tests?: string | string[];
+    /** Unit-test documents given inline, such as the ones `sloRuleTests()` generates. */
+    testYaml?: string | string[];
+    /** The promtool binary. Default `$PROMTOOL`, else `promtool`. */
+    bin?: string;
+}
+export interface AmtoolCheckConfigArgs {
+    /** The Alertmanager config, e.g. `dist/prometheus/alertmanager.yml`. */
+    config: string;
+    /** The amtool binary. Default `$AMTOOL`, else `amtool`. */
+    bin?: string;
+}
+export interface AmtoolRoutesTestArgs {
+    /** The Alertmanager config. */
+    config: string;
+    /** The alert's labels. */
+    labels: Record<string, string>;
+    /** The receiver, or receivers in order, the labels must route to. */
+    expect: string | string[];
+    /** The amtool binary. Default `$AMTOOL`, else `amtool`. */
+    bin?: string;
+    /** Replaces the child process. For tests. */
+    _exec?: ExecRunner;
+}
+export interface AmtoolRoutesTestResult {
+    config: string;
+    labels: Record<string, string>;
+    /** The receivers amtool resolved, in order. */
+    receivers: string[];
+    ok: boolean;
+}
+/** `promtool check rules` over each rule file. */
+export declare function promtoolCheckRules(args: PromtoolCheckRulesArgs): Promise<ToolStepResult>;
+/** `promtool test rules` over the rule file, once per test file or inline test document. */
+export declare function promtoolTestRules(args: PromtoolTestRulesArgs): Promise<ToolStepResult & {
+    tests: number;
+}>;
+/** `amtool check-config` over the Alertmanager config. */
+export declare function amtoolCheckConfig(args: AmtoolCheckConfigArgs): Promise<ToolStepResult>;
+/**
+ * The receivers amtool printed: its last non-empty line, comma-separated
+ * (`oncall` or `oncall,tickets`).
+ */
+export declare function parseRoutesOutput(output: string): string[];
+/** `amtool config routes test`: the labels route to the expected receivers, in order. */
+export declare function amtoolRoutesTest(args: AmtoolRoutesTestArgs): Promise<AmtoolRoutesTestResult>;
+//# sourceMappingURL=promtool.d.ts.map

package/dist/op/activities/promtool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promtool.d.ts","sourceRoot":"","sources":["../../../src/op/activities/promtool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAQhG,MAAM,WAAW,cAAc;IAC7B,yBAAyB;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,EAAE,EAAE,OAAO,CAAC;CACb;AAcD,kDAAkD;AAClD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAO9F;AAED,4FAA4F;AAC5F,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhH;AAED,0DAA0D;AAC1D,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAG5F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAI1D;AAED,yFAAyF;AACzF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAgBlG"}

package/dist/op/activities/rule-audit.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `ruleAudit`: what a live Prometheus says about its rules (#3369), the
+ * activity behind `RuleAuditOp`.
+ *
+ * - groups with health errors: every rule `/api/v1/rules` reports with
+ *   `health: "err"`, with its `lastError`.
+ * - alerts pending or firing past a threshold, from `/api/v1/alerts`: a
+ *   pending alert older than `pendingFor` is one whose `for` never
+ *   completes (a flapping condition), and a firing one older than
+ *   `firingFor` is one nobody is acting on.
+ * - selectors no live target emits: each distinct vector selector in the
+ *   loaded rules' expressions, queried as
+ *   `count(last_over_time(<selector>[<lookback>]))`. An empty answer means
+ *   the rule reads a series nothing writes (a renamed metric, a dropped
+ *   label, a target that is gone). Selectors over series the rules record
+ *   themselves, and over `ALERTS`, are left out. One query per selector, at
+ *   most `selectorBudget` of them; the rest are counted as unchecked.
+ *
+ * `mode` is `report` (return the findings) or `issue` (keep one open issue
+ * current with them).
+ */
+import { type CommandRunner } from "@intentius/chant-lexicon-otel/op/activities/github";
+import { type ApiRuleGroup } from "./rules-loaded.js";
+export type RuleAuditMode = "report" | "issue";
+export interface RuleAuditArgs {
+    /** Prometheus's base URL. Default `$PROMETHEUS_URL`, else `http://localhost:9090`. */
+    url?: string;
+    /** A pending alert older than this is a finding. Default `1h`. */
+    pendingFor?: string;
+    /** A firing alert older than this is a finding. Default `24h`. */
+    firingFor?: string;
+    /** At most this many selector queries. Default 50. */
+    selectorBudget?: number;
+    /** How far back a selector's series may last have been written. Default `1h`. */
+    lookback?: string;
+    mode?: RuleAuditMode;
+    /** The issue's title in `issue` mode. Default `prometheus: rule audit findings`. */
+    issueTitle?: string;
+    _fetch?: typeof fetch;
+    _run?: CommandRunner;
+    _now?: () => Date;
+}
+export type RuleAuditFindingKind = "rule-error" | "pending-too-long" | "firing-too-long" | "selector-no-series";
+export interface RuleAuditFinding {
+    kind: RuleAuditFindingKind;
+    /** The group, the alert, or the selector. */
+    subject: string;
+    detail: string;
+}
+export interface RuleAuditResult {
+    mode: RuleAuditMode;
+    findings: RuleAuditFinding[];
+    /** Selector queries made. */
+    queried: number;
+    /** Selectors left unchecked by the budget. */
+    unchecked: number;
+    summary: string;
+    issueUrl?: string;
+}
+/** The distinct selectors the rules read, without the ones over recorded series and ALERTS. */
+export declare function auditedSelectors(groups: ApiRuleGroup[]): string[];
+export declare function renderRuleAuditSummary(findings: RuleAuditFinding[], queried: number, unchecked: number): string;
+/** Audit a live Prometheus's rules, alerts and selectors. */
+export declare function ruleAudit(args?: RuleAuditArgs): Promise<RuleAuditResult>;
+//# sourceMappingURL=rule-audit.d.ts.map

package/dist/op/activities/rule-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-audit.d.ts","sourceRoot":"","sources":["../../../src/op/activities/rule-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,oDAAoD,CAAC;AAGpH,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,KAAK,CAAC;IACtB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAEhH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgBD,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CAcjE;AAWD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAS/G;AAED,6DAA6D;AAC7D,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+ClF"}

package/dist/op/activities/rules-loaded.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Declared rule groups as resources a `ConvergeOp` observes (#3369).
+ *
+ * `rulesLoadedObserve` reads `GET /api/v1/rules` and returns one resource
+ * per declared group:
+ *
+ * - `drifted` when Prometheus has not loaded the group (the rule file is not
+ *   mounted, did not parse, or the reload has not happened), or when a rule
+ *   in it has `health: "err"`, with the rule's `lastError` as the detail;
+ * - `in-sync` otherwise;
+ * - `unknown`, for every group, when the API cannot be read.
+ *
+ * The declared groups are `groups`, plus the groups of each rule file in
+ * `rules` (read on each tick, so a rebuilt file is what is observed).
+ * Prometheus is `url`, else `$PROMETHEUS_URL`, else `http://localhost:9090`.
+ */
+export interface RulesLoadedObserveArgs {
+    /** Prometheus's base URL. */
+    url?: string;
+    /** Group names that must be loaded. */
+    groups?: string[];
+    /** Rule files whose groups must be loaded, relative to the working directory. */
+    rules?: string | string[];
+    /** Request timeout, ms. Default 10000. */
+    timeoutMs?: number;
+    /** Replaces fetch. For tests. */
+    _fetch?: typeof fetch;
+}
+export interface RulesLoadedObserveResult {
+    resources: {
+        name: string;
+        status: "in-sync" | "drifted" | "unknown";
+        detail: string;
+    }[];
+}
+/** One group as `/api/v1/rules` returns it. */
+export interface ApiRuleGroup {
+    name: string;
+    file?: string;
+    rules: Array<{
+        name: string;
+        type?: string;
+        query?: string;
+        health?: string;
+        lastError?: string;
+        state?: string;
+    }>;
+}
+export declare function prometheusUrl(url?: string): string;
+/** The group names in a rule file's text. */
+export declare function ruleFileGroups(text: string): string[];
+/** The declared groups, in order, without repeats. */
+export declare function declaredGroups(args: Pick<RulesLoadedObserveArgs, "groups" | "rules">, cwd?: string): string[];
+/** `GET /api/v1/rules`'s groups. Throws on anything but a successful answer. */
+export declare function fetchRuleGroups(f: typeof fetch, url: string, timeoutMs?: number): Promise<ApiRuleGroup[]>;
+/** The verdict for one declared group against the loaded groups. */
+export declare function groupVerdict(name: string, loaded: ApiRuleGroup[]): RulesLoadedObserveResult["resources"][number];
+/** Observe the declared rule groups: one resource per group. */
+export declare function rulesLoadedObserve(args: RulesLoadedObserveArgs): Promise<RulesLoadedObserveResult>;
+//# sourceMappingURL=rules-loaded.d.ts.map

package/dist/op/activities/rules-loaded.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-loaded.d.ts","sourceRoot":"","sources":["../../../src/op/activities/rules-loaded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,MAAM,CAAC,EAAE,OAAO,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1F;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpH;AAED,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAGrD;AAED,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,GAAG,SAAgB,GAAG,MAAM,EAAE,CAKpH;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CAAC,CAAC,EAAE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAM/G;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAShH;AAED,gEAAgE;AAChE,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAYxG"}

package/dist/op/activities/silence.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Alertmanager silences as Op steps (#3369): silence the alerts a change is
+ * expected to set off, and expire the silence when the change is done or
+ * has failed.
+ *
+ * `alertmanagerSilence` creates a silence through `POST /api/v2/silences`
+ * and records its id in a file under the working directory
+ * (`.chant/alertmanager-silences/<record>.json`). Step-output references are
+ * not available in an Op's `onFailure` phases, so the record is how a final
+ * phase and an `onFailure` phase alike find the silence:
+ * `alertmanagerUnsilence({ record })` expires every silence the record
+ * holds through `DELETE /api/v2/silence/{id}`, and drops them from it. An
+ * already-expired or unknown silence counts as expired, so the step can
+ * run in both places.
+ *
+ * The Alertmanager is `url`, else `$ALERTMANAGER_URL`, else
+ * `http://localhost:9093`.
+ */
+export interface AlertmanagerSilenceArgs {
+    /** The Alertmanager's base URL. */
+    url?: string;
+    /**
+     * The alerts to silence: matcher strings (`alertname="X"`,
+     * `severity=~"page|ticket"`, or `{a="1", b="2"}`), or a label set matched
+     * by equality.
+     */
+    matchers: string[] | Record<string, string>;
+    /** How long the silence lasts, e.g. `30m`. Expiring it earlier is `alertmanagerUnsilence`'s job. */
+    duration: string;
+    comment?: string;
+    /** Default `chant`, with the Op's name when run in one. */
+    createdBy?: string;
+    /** The record the id is kept in. Default `silence`. */
+    record?: string;
+    /** Where records live, relative to the working directory. Default `.chant/alertmanager-silences`. */
+    recordDir?: string;
+    /** Replaces fetch. For tests. */
+    _fetch?: typeof fetch;
+    /** Replaces the clock. For tests. */
+    _now?: () => Date;
+}
+export interface AlertmanagerSilenceResult {
+    silenceId: string;
+    url: string;
+    startsAt: string;
+    endsAt: string;
+    /** The record file the id was written to. */
+    record: string;
+}
+export interface AlertmanagerUnsilenceArgs {
+    url?: string;
+    /** Expire this silence only, in place of the record's. */
+    silenceId?: string;
+    /** The record to expire. Default `silence`. */
+    record?: string;
+    recordDir?: string;
+    _fetch?: typeof fetch;
+}
+export interface AlertmanagerUnsilenceResult {
+    expired: string[];
+    /** Silences that could not be expired, kept in the record for the next try. */
+    failed: {
+        silenceId: string;
+        detail: string;
+    }[];
+}
+export declare function alertmanagerUrl(url?: string): string;
+/** The API matchers for `matchers`. */
+export declare function apiMatchers(matchers: string[] | Record<string, string>): Array<{
+    name: string;
+    value: string;
+    isRegex: boolean;
+    isEqual: boolean;
+}>;
+export declare function recordPath(record?: string, recordDir?: string, cwd?: string): string;
+/** Create a silence and record its id. */
+export declare function alertmanagerSilence(args: AlertmanagerSilenceArgs): Promise<AlertmanagerSilenceResult>;
+/** Expire the recorded silences (or `silenceId`), and drop the expired ones from the record. */
+export declare function alertmanagerUnsilence(args?: AlertmanagerUnsilenceArgs): Promise<AlertmanagerUnsilenceResult>;
+//# sourceMappingURL=silence.d.ts.map

package/dist/op/activities/silence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"silence.d.ts","sourceRoot":"","sources":["../../../src/op/activities/silence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,MAAM,WAAW,uBAAuB;IACtC,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,MAAM,CAAC,EAAE,OAAO,KAAK,CAAC;IACtB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+EAA+E;IAC/E,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AASD,wBAAgB,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,uCAAuC;AACvC,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAYnJ;AAED,wBAAgB,UAAU,CAAC,MAAM,SAAY,EAAE,SAAS,SAAiC,EAAE,GAAG,SAAgB,GAAG,MAAM,CAGtH;AAgBD,0CAA0C;AAC1C,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAwB3G;AAED,gGAAgG;AAChG,wBAAsB,qBAAqB,CAAC,IAAI,GAAE,yBAA8B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA2BtH"}