@intentius/chant-lexicon-prometheus 0.124.30 → 0.124.32

package/dist/lint/post-synth/prom204.js

@@ -0,0 +1,13 @@
+/**
+ * PROM204: A route names a time interval that is not declared
+ *
+ * mute_time_intervals and active_time_intervals must name entries under time_intervals.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom204 = {
+    id: "PROM204",
+    description: "A route names a time interval that is not declared",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM204");
+    },
+};

package/dist/lint/post-synth/prom205.js

@@ -0,0 +1,13 @@
+/**
+ * PROM205: The root route is missing, has no receiver, or has matchers
+ *
+ * The root route is the default for every alert: it must exist, name a receiver and match everything.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom205 = {
+    id: "PROM205",
+    description: "The root route is missing, has no receiver, or has matchers",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM205");
+    },
+};

package/dist/lint/post-synth/prom206.js

@@ -0,0 +1,13 @@
+/**
+ * PROM206: A route or inhibit rule matcher does not parse
+ *
+ * Matchers are label, operator (=, !=, =~, !~) and value, e.g. severity="page".
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom206 = {
+    id: "PROM206",
+    description: "A route or inhibit rule matcher does not parse",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM206");
+    },
+};

package/dist/lint/post-synth/prom207.js

@@ -0,0 +1,13 @@
+/**
+ * PROM207: A receiver is declared but no route sends to it
+ *
+ * An unused receiver usually means a route names the wrong one.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom207 = {
+    id: "PROM207",
+    description: "A receiver is declared but no route sends to it",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM207");
+    },
+};

package/dist/lint/post-synth/prom208.js

@@ -0,0 +1,13 @@
+/**
+ * PROM208: An Alertmanager duration is not a duration
+ *
+ * group_wait, group_interval, repeat_interval, resolve_timeout and Jira reopen_duration take Prometheus durations (30s, 4h, 1d); the timeout of webhook, Slack, PagerDuty and incident.io, and Pushover retry, expire and ttl take Go durations (10s, 1m30s, 500ms).
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom208 = {
+    id: "PROM208",
+    description: "An Alertmanager duration is not a duration",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM208");
+    },
+};

package/dist/lint/post-synth/prom209.js

@@ -0,0 +1,13 @@
+/**
+ * PROM209: A receiver integration is missing its destination or credential
+ *
+ * Every one of Alertmanager's 18 integrations is checked for the destination, credential and required fields its config validation asks for, with the global defaults it falls back to: e.g. a webhook url, an Opsgenie api_key (or global.opsgenie_api_key), a Telegram chat_id and bot token, a Webex room_id and authorization, an SNS target, a Jira project and issue_type.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom209 = {
+    id: "PROM209",
+    description: "A receiver integration is missing its destination or credential",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM209");
+    },
+};

package/dist/lint/post-synth/prom210.js

@@ -0,0 +1,13 @@
+/**
+ * PROM210: A receiver integration or global setting is one Alertmanager rejects
+ *
+ * Two settings that exclude each other (a value and its *_file, a Slack api_url and app_token, Pushover html and monospace, two SNS targets), or a value outside the allowed set (WeChat message_type, Telegram parse_mode, Jira api_type, an Opsgenie responder type, a VictorOps reserved custom field, a smarthost that is not host:port, a Slack or Mattermost field without title and value).
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom210 = {
+    id: "PROM210",
+    description: "A receiver integration or global setting is one Alertmanager rejects",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM210");
+    },
+};

package/dist/lint/post-synth/prom211.js

@@ -0,0 +1,17 @@
+/**
+ * PROM211: An alerting rule has no for, or for: 0s
+ *
+ * The alert fires on the first evaluation that matches, so one bad scrape
+ * pages. Left alone when the expression reads no series (vector(1), a dead
+ * man's switch) or already spans a window: every selector read through a
+ * *_over_time function, or two conditions joined by and (the multi-window
+ * burn-rate form, where the short window does what for would).
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom211 = {
+    id: "PROM211",
+    description: "An alerting rule has no for, or for: 0s",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM211");
+    },
+};

package/dist/lint/post-synth/prom212.js

@@ -0,0 +1,14 @@
+/**
+ * PROM212: An alerting rule has no runbook_url annotation (opt-in)
+ *
+ * Off unless enabled: the lint preset all, or a lint.rules entry for PROM212,
+ * turns it on. See validateRunbookUrls.
+ */
+import { runbookDiagnostics } from "./prom-helpers.js";
+export const prom212 = {
+    id: "PROM212",
+    description: "An alerting rule has no runbook_url annotation (opt-in)",
+    check(ctx) {
+        return runbookDiagnostics(ctx);
+    },
+};

package/dist/lint/post-synth/prom213.js

@@ -0,0 +1,16 @@
+/**
+ * PROM213: An alert expression has no comparison
+ *
+ * Every series the expression returns is an alert, so an expression with no
+ * comparison fires for all of them. absent(), absent_over_time() and unless
+ * count as a condition; a comparison with bool does not. An expression that
+ * reads no series (vector(1), a dead man's switch) is left alone.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom213 = {
+    id: "PROM213",
+    description: "An alert expression has no comparison",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM213");
+    },
+};

package/dist/lint/post-synth/prom214.js

@@ -0,0 +1,14 @@
+/**
+ * PROM214: An alert template reads a label the expression aggregates away
+ *
+ * A $labels.x whose x the expression's by (...) leaves out, or its without
+ * (...) names, renders empty. Labels the rule or its group set are left alone.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom214 = {
+    id: "PROM214",
+    description: "An alert template reads a label the expression aggregates away",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM214");
+    },
+};

package/dist/lint/post-synth/prom215.js

@@ -0,0 +1,14 @@
+/**
+ * PROM215: rate, irate or increase over a name that is not a counter's
+ *
+ * These functions treat every drop as a counter reset. A name not ending in
+ * _total, _count, _sum or _bucket is read as a gauge.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom215 = {
+    id: "PROM215",
+    description: "rate, irate or increase over a name that is not a counter's",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM215");
+    },
+};

package/dist/lint/post-synth/prom216.js

@@ -0,0 +1,15 @@
+/**
+ * PROM216: histogram_quantile over a series without _bucket, or without le
+ *
+ * A classic histogram's quantile needs its _bucket series with the le label
+ * kept. A native histogram has no _bucket series, so this check does not apply
+ * to one.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom216 = {
+    id: "PROM216",
+    description: "histogram_quantile over a series without _bucket, or without le",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM216");
+    },
+};

package/dist/lint/post-synth/prom217.js

@@ -0,0 +1,14 @@
+/**
+ * PROM217: A recording rule name is not in level:metric:operations form
+ *
+ * Prometheus's naming convention for recorded series, e.g.
+ * job:http_requests:rate5m.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom217 = {
+    id: "PROM217",
+    description: "A recording rule name is not in level:metric:operations form",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM217");
+    },
+};

package/dist/lint/post-synth/prom218.js

@@ -0,0 +1,15 @@
+/**
+ * PROM218: A regex matcher needs no regex, or is anchored
+ *
+ * A =~ or !~ with no regex metacharacters is an equality matcher written the
+ * slow way. Prometheus anchors every regex, so a leading ^ or trailing $ does
+ * nothing.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom218 = {
+    id: "PROM218",
+    description: "A regex matcher needs no regex, or is anchored",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM218");
+    },
+};

package/dist/lint/post-synth/prom219.js

@@ -0,0 +1,14 @@
+/**
+ * PROM219: An alerting rule sets the alertname label
+ *
+ * Prometheus sets alertname to the rule's name after applying the rule's
+ * labels, so the value is overwritten.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom219 = {
+    id: "PROM219",
+    description: "An alerting rule sets the alertname label",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM219");
+    },
+};

package/dist/lint/post-synth/prom220.js

@@ -0,0 +1,14 @@
+/**
+ * PROM220: A receiver turns off TLS certificate verification
+ *
+ * tls_config.insecure_skip_verify: true on a receiver, or in global, accepts
+ * any certificate the endpoint presents.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom220 = {
+    id: "PROM220",
+    description: "A receiver turns off TLS certificate verification",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM220");
+    },
+};

package/dist/lint/post-synth/prom221.js

@@ -0,0 +1,15 @@
+/**
+ * PROM221: SMTP credentials sent with require_tls false
+ *
+ * An email receiver with SMTP auth and require_tls false (its own, or
+ * global.smtp_require_tls) can send the credentials in clear text. Implicit
+ * TLS is left alone.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom221 = {
+    id: "PROM221",
+    description: "SMTP credentials sent with require_tls false",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM221");
+    },
+};

package/dist/lint/post-synth/prom222.js

@@ -0,0 +1,14 @@
+/**
+ * PROM222: Credentials sent to an http:// receiver URL
+ *
+ * An integration whose URL is http:// and whose request carries a credential:
+ * user info in the URL, http_config auth, or a key or token field.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom222 = {
+    id: "PROM222",
+    description: "Credentials sent to an http:// receiver URL",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM222");
+    },
+};

package/dist/lint/post-synth/prom223.js

@@ -0,0 +1,15 @@
+/**
+ * PROM223: repeat_interval is shorter than group_interval
+ *
+ * Alertmanager resends only when it flushes a group, every group_interval, so
+ * a shorter repeat_interval never takes effect. Intervals are inherited down
+ * the routing tree from Alertmanager's defaults.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom223 = {
+    id: "PROM223",
+    description: "repeat_interval is shorter than group_interval",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM223");
+    },
+};

package/dist/lint/post-synth/prom224.js

@@ -0,0 +1,14 @@
+/**
+ * PROM224: An inhibit rule matches one alert as source and target, with no equal
+ *
+ * With no equal, any alert matching the source mutes every alert matching the
+ * target. When one alert can match both, alerts of that kind mute each other.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom224 = {
+    id: "PROM224",
+    description: "An inhibit rule matches one alert as source and target, with no equal",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM224");
+    },
+};

package/dist/lint/post-synth/prom225.js

@@ -0,0 +1,15 @@
+/**
+ * PROM225: A labeldrop or labelkeep relabel step carries a field it does not take
+ *
+ * Both actions match regex against label names, so source_labels, separator,
+ * target_label, modulus and replacement do nothing, and Prometheus rejects the
+ * file at load. Reads every prometheus.yml in the output.
+ */
+import { relabelDiagnostics } from "./prom-helpers.js";
+export const prom225 = {
+    id: "PROM225",
+    description: "A labeldrop or labelkeep relabel step carries a field it does not take",
+    check(ctx) {
+        return relabelDiagnostics(ctx);
+    },
+};

package/dist/lint/post-synth/prom301.js

@@ -0,0 +1,19 @@
+/**
+ * PROM301: A rule reads a connector metric no collector in the build emits
+ *
+ * For each selector in a rule whose name falls under a namespace the build's
+ * spanmetrics, servicegraph or GenAI connectors own (spanmetrics' and
+ * servicegraph's defaults included), reports a name no collector config in
+ * the build emits, and a by (...) label that is not a dimension the config
+ * declares for the metrics aggregated. Silent for names outside those
+ * namespaces, and when the build has no collector config. See
+ * ../../collector-metrics.ts.
+ */
+import { collectorMetricDiagnostics } from "./prom-helpers.js";
+export const prom301 = {
+    id: "PROM301",
+    description: "A rule reads a connector metric no collector in the build emits",
+    check(ctx) {
+        return collectorMetricDiagnostics(ctx);
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,8 @@
+import { literalCredentialRule } from "./literal-credential.js";
+import { promqlLiteralRule } from "./promql-literal.js";
+import { sloLiteralRule } from "./slo-literal.js";
+export { literalCredentialRule, SECRET_FIELDS } from "./literal-credential.js";
+export { promqlLiteralRule } from "./promql-literal.js";
+export { sloLiteralRule } from "./slo-literal.js";
+/** All lint rules provided by this lexicon (imported by plugin.ts's lintRules()). */
+export const rules = [literalCredentialRule, promqlLiteralRule, sloLiteralRule];

package/dist/lint/rules/literal-credential.js

@@ -0,0 +1,127 @@
+import { ts } from "@intentius/chant/lint/typescript";
+import { SLACK_APP_URL } from "../../validate-integrations.js";
+import { calleeName, constInitializers, CREDENTIAL_CLASS, literalText, position, propertyName, resolveConst } from "./prom-ast.js";
+/**
+ * Alertmanager fields that hold a secret, each with a `*_file` sibling that
+ * reads it from a mounted file instead.
+ */
+export const SECRET_FIELDS = new Set([
+    "api_url", // slack_configs only: the incoming-webhook URL is the credential (see SECRET_ONLY_IN)
+    "webhook_url", // discord, msteams, msteamsv2 and mattermost
+    "app_token",
+    "routing_key", // pagerduty (victorops' routing_key names a route, see SECRET_ONLY_IN)
+    "service_key",
+    "api_key",
+    "api_secret",
+    "bot_token",
+    "token",
+    "token_id",
+    "user_key",
+    "alert_source_token",
+    "auth_password",
+    "auth_secret",
+    "smtp_auth_password",
+    "smtp_auth_secret",
+    "slack_api_url",
+    "slack_app_token",
+    "opsgenie_api_key",
+    "wechat_api_secret",
+    "victorops_api_key",
+    "telegram_bot_token",
+    "rocketchat_token",
+    "rocketchat_token_id",
+    "mattermost_webhook_url",
+    "password",
+    "credentials",
+    "bearer_token",
+    "client_secret",
+]);
+/**
+ * Fields that are a secret in one integration and plain elsewhere: `api_url`
+ * is Slack's webhook credential but only an endpoint for the others, and a
+ * VictorOps `routing_key` names a route.
+ */
+const SECRET_ONLY_IN = {
+    api_url: "slack_configs",
+    routing_key: "pagerduty_configs",
+};
+/**
+ * PROM001: a credential written as a literal in a `Receiver` or
+ * `AlertmanagerSettings`.
+ *
+ * A literal there is a secret in the repository and in the emitted
+ * `alertmanager.yml`. Alertmanager does not expand environment variables in
+ * its config, so the fix is the field's `*_file` sibling (`api_url_file`,
+ * `routing_key_file`, `auth_password_file`, `credentials_file`), pointing at
+ * a file mounted from a secret store.
+ */
+export const literalCredentialRule = {
+    id: "PROM001",
+    severity: "error",
+    category: "security",
+    description: "Alertmanager credential declared as a literal instead of read from a *_file",
+    check(context) {
+        const diagnostics = [];
+        const source = context.sourceFile;
+        const consts = constInitializers(source);
+        const scanned = new Set();
+        // A value is followed to the const it names, so a list lifted out of the
+        // constructor (`email_configs: heartbeatEmail`) is scanned where it is used.
+        // `integration` is the `*_configs` list a value sits in, when that is known.
+        const scanValue = (key, value, integration) => {
+            const init = resolveConst(value, consts);
+            const within = key?.endsWith("_configs") ? key : integration;
+            if (ts.isObjectLiteralExpression(init) || ts.isArrayLiteralExpression(init)) {
+                if (scanned.has(init))
+                    return;
+                scanned.add(init);
+                if (ts.isObjectLiteralExpression(init))
+                    scan(init, within);
+                else
+                    for (const el of init.elements)
+                        scanValue(undefined, el, within);
+                return;
+            }
+            if (!key || !SECRET_FIELDS.has(key))
+                return;
+            const only = SECRET_ONLY_IN[key];
+            if (only && integration !== undefined && integration !== only)
+                return;
+            const text = literalText(init);
+            if (text === undefined || text === "")
+                return;
+            // A Slack bot posts to the public chat.postMessage endpoint with its token
+            // in http_config, and update_message needs exactly that api_url (PROM210).
+            if (key === "api_url" && text === SLACK_APP_URL)
+                return;
+            diagnostics.push({
+                ruleId: "PROM001",
+                severity: "error",
+                message: `\`${key}\` is a literal credential; Alertmanager doesn't expand environment variables, so mount the secret and set \`${key}_file\` instead`,
+                file: context.filePath,
+                ...position(source, init),
+            });
+        };
+        const scan = (obj, integration) => {
+            for (const prop of obj.properties) {
+                if (ts.isPropertyAssignment(prop))
+                    scanValue(propertyName(prop), prop.initializer, integration);
+                else if (ts.isShorthandPropertyAssignment(prop))
+                    scanValue(prop.name.text, prop.name, integration);
+                else if (ts.isSpreadAssignment(prop))
+                    scanValue(undefined, prop.expression, integration);
+            }
+        };
+        const visit = (node) => {
+            if (ts.isNewExpression(node) || ts.isCallExpression(node)) {
+                const name = calleeName(node);
+                const arg = node.arguments?.[0];
+                if (name && CREDENTIAL_CLASS.test(name) && arg)
+                    scanValue(undefined, arg);
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/prom-ast.js

@@ -0,0 +1,65 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/** The constructor name of a `new X(...)` or `X(...)` expression, if it is a plain or dotted name. */
+export function calleeName(node) {
+    const callee = node.expression;
+    if (ts.isIdentifier(callee))
+        return callee.text;
+    if (ts.isPropertyAccessExpression(callee))
+        return callee.name.text;
+    return undefined;
+}
+/** The classes whose props hold Alertmanager credentials. */
+export const CREDENTIAL_CLASS = /^(Receiver|AlertmanagerSettings)$/;
+/** A property's key as text, for identifier and string-literal keys. */
+export function propertyName(prop) {
+    if (!ts.isPropertyAssignment(prop))
+        return undefined;
+    if (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name))
+        return prop.name.text;
+    return undefined;
+}
+/** The text of a string literal or substitution-free template, else undefined. */
+export function literalText(node) {
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+        return node.text;
+    return undefined;
+}
+export function position(source, node) {
+    const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+    return { line: line + 1, column: character + 1 };
+}
+/**
+ * Every `const name = <initializer>` in the file, so a rule can follow a
+ * value lifted out of a constructor into a named const (the way COR001 asks
+ * for it, and the way `chant import` writes it) back to its literal.
+ */
+export function constInitializers(source) {
+    const consts = new Map();
+    const collect = (node) => {
+        if (ts.isVariableDeclarationList(node) && node.flags & ts.NodeFlags.Const) {
+            for (const d of node.declarations) {
+                if (ts.isIdentifier(d.name) && d.initializer)
+                    consts.set(d.name.text, d.initializer);
+            }
+        }
+        ts.forEachChild(node, collect);
+    };
+    collect(source);
+    return consts;
+}
+/** `expr` itself, or the initializer of the const it names (followed through `as` and `satisfies`). */
+export function resolveConst(expr, consts) {
+    let cur = expr;
+    for (let hops = 0; hops < 8; hops++) {
+        if (ts.isAsExpression(cur) || ts.isSatisfiesExpression(cur) || ts.isParenthesizedExpression(cur)) {
+            cur = cur.expression;
+            continue;
+        }
+        if (ts.isIdentifier(cur) && consts.has(cur.text)) {
+            cur = consts.get(cur.text);
+            continue;
+        }
+        break;
+    }
+    return cur;
+}

package/dist/lint/rules/promql-literal.js

@@ -0,0 +1,65 @@
+import { ts } from "@intentius/chant/lint/typescript";
+import { calleeName, constInitializers, literalText, position, propertyName, resolveConst } from "./prom-ast.js";
+import { checkPromql } from "../../promql.js";
+/**
+ * PROM002: a rule's `expr`, written as a string literal inside a
+ * `RuleGroup`, is not valid PromQL.
+ *
+ * The same parse runs after the build as PROM104, over every rule in the
+ * emitted rule file. This rule reports it in the editor, at the expression,
+ * for the literals it can see; an `expr` built at runtime is left to PROM104.
+ */
+export const promqlLiteralRule = {
+    id: "PROM002",
+    severity: "error",
+    category: "correctness",
+    description: "A literal PromQL expression in a RuleGroup does not parse",
+    check(context) {
+        const diagnostics = [];
+        const source = context.sourceFile;
+        const consts = constInitializers(source);
+        const scanned = new Set();
+        // Rules lifted into a const (`rules: apiRules`) are followed to it and
+        // checked where the group uses them.
+        const follow = (value) => {
+            const init = resolveConst(value, consts);
+            if (init !== value && !scanned.has(init)) {
+                scanned.add(init);
+                scan(init);
+            }
+        };
+        const scan = (node) => {
+            if (ts.isShorthandPropertyAssignment(node))
+                follow(node.name);
+            if (ts.isPropertyAssignment(node) && ts.isIdentifier(node.initializer))
+                follow(node.initializer);
+            if (ts.isPropertyAssignment(node) && propertyName(node) === "expr") {
+                const text = literalText(node.initializer);
+                if (text !== undefined) {
+                    const checked = checkPromql(text);
+                    if (!checked.ok) {
+                        diagnostics.push({
+                            ruleId: "PROM002",
+                            severity: "error",
+                            message: `expr is not valid PromQL: ${checked.message}`,
+                            file: context.filePath,
+                            ...position(source, node.initializer),
+                        });
+                    }
+                }
+            }
+            ts.forEachChild(node, scan);
+        };
+        const visit = (node) => {
+            if (ts.isNewExpression(node) && calleeName(node) === "RuleGroup") {
+                const arg = node.arguments?.[0];
+                if (arg)
+                    scan(arg);
+                return;
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+        return diagnostics;
+    },
+};