@intentius/chant-lexicon-prometheus 0.124.30 → 0.124.32

package/dist/export-resources.js

@@ -0,0 +1,163 @@
+/**
+ * Live export for prometheus (#3371): `chant import --from <env>` writes the
+ * environment's rule groups and Alertmanager config as chant TypeScript.
+ *
+ * All I/O is here. What is read goes through the file importer's own parse
+ * (./import/parser.ts) into the same IR, so a group read from a ruler and
+ * the same group in a rule file generate the same source through the same
+ * `PrometheusGenerator`, `Slo` recognition (./import/slo.ts) included.
+ *
+ * - Rule groups, from the environment's ruler (./api/ruler.ts). On Mimir,
+ *   Cortex and Loki only the namespaces the profile declares are read
+ *   (`namespace` and `groupNamespaces`, see ./config.ts); that is the
+ *   ownership boundary, as a stack bounds a CloudFormation export. An ad-hoc
+ *   read with no namespace declared reads every namespace of the tenant and
+ *   says so, and with `owned` reads none. On a plain Prometheus the groups
+ *   come from `/api/v1/rules` and are mapped back to the rule-file shape
+ *   (./api/evaluated.ts), which is lossy, and the export says how.
+ * - The Alertmanager config, from `/api/v2/status` or, on Mimir and
+ *   Cortex, `/api/v1/alerts` (./api/alertmanager.ts). Alertmanager's status
+ *   config is its loaded config marshalled again; unless `verbatim`, what
+ *   that adds is taken out (./import/alertmanager-live.ts). Secrets read
+ *   `<secret>` and are named in a warning.
+ * - `selector.type` is `Prometheus::Rules::RuleGroup` (with `selector.name`
+ *   a group name) or any `Prometheus::Alertmanager::*` type, which selects
+ *   the whole config.
+ *
+ * Neither endpoint being bound is an error; one of them being unbound is a
+ * warning, so a project with only rule groups imports them.
+ */
+import { bindEndpoints } from "./api/bind.js";
+import { EVALUATED_IMPORT_WARNING, evaluatedToRuleGroup } from "./api/evaluated.js";
+import { declaredNamespaces, isUnresolvedTarget, namespaceOfGroup } from "./config.js";
+import { ALERTMANAGER_RESOURCE_TYPE, RULE_FILE_RESOURCE_TYPE, loadPrometheusYaml, parseAlertmanagerDocument, parseRuleFileDocument, } from "./import/parser.js";
+import { maskedSecretPaths, stripAlertmanagerDefaults } from "./import/alertmanager-live.js";
+import { RULE_GROUP_TYPE } from "./rules.js";
+const ALERTMANAGER_TYPE_PREFIX = "Prometheus::Alertmanager::";
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** The groups of the declared namespaces (or, ad hoc, of every namespace), each with where it came from. */
+async function rulerGroups(ruler, owned, warnings) {
+    const declared = declaredNamespaces(ruler.target);
+    if (declared.length === 0) {
+        if (owned) {
+            warnings.push(`no rule groups are imported with --owned: ${ruler.target.source} declares no ruler namespace, and the namespace is the ownership boundary`);
+            return [];
+        }
+        const all = await ruler.listNamespaces();
+        const names = Object.keys(all);
+        if (names.length > 0) {
+            warnings.push(`${ruler.target.source} declares no ruler namespace, so every namespace of the tenant was read (${names.join(", ")}); ` +
+                "set prometheus.profiles.<env>.ruler.namespace to bound what is imported and what an apply may change");
+        }
+        return names.map((namespace) => ({ namespace, raw: all[namespace] }));
+    }
+    const out = [];
+    for (const namespace of declared) {
+        const raw = await ruler.readNamespace(namespace);
+        if (raw === undefined)
+            warnings.push(`ruler namespace "${namespace}" has no rule groups on ${ruler.target.url}`);
+        else
+            out.push({ namespace, raw });
+    }
+    return out;
+}
+async function exportRuleGroups(ruler, options, warnings) {
+    const name = options.selector?.name;
+    const groups = [];
+    const seen = new Map();
+    const keep = (group, from) => {
+        if (name !== undefined && group.name !== name)
+            return;
+        const first = seen.get(group.name);
+        if (first !== undefined) {
+            warnings.push(`rule group "${group.name}" is in both ${first} and ${from}; the one in ${first} is imported, since a rule file holds one group of a name`);
+            return;
+        }
+        seen.set(group.name, from);
+        groups.push(group);
+    };
+    if (ruler.target.kind === "prometheus") {
+        const files = declaredNamespaces(ruler.target);
+        if (files.length === 0 && options.owned) {
+            warnings.push(`no rule groups are imported with --owned: ${ruler.target.source} names no rule file, and a rule file carries no ownership marker`);
+            return [];
+        }
+        const evaluated = (await ruler.evaluated()).filter((g) => files.length === 0 || files.includes(g.file));
+        if (evaluated.length > 0)
+            warnings.push(EVALUATED_IMPORT_WARNING);
+        for (const g of evaluated)
+            keep(evaluatedToRuleGroup(g), `rule file "${g.file}"`);
+        return groups;
+    }
+    for (const { namespace, raw } of await rulerGroups(ruler, options.owned, warnings)) {
+        const parsed = parseRuleFileDocument({ groups: raw });
+        for (const w of parsed.warnings)
+            warnings.push(`ruler namespace "${namespace}": ${w}`);
+        for (const g of parsed.file.groups) {
+            keep(g, `namespace "${namespace}"`);
+            if (seen.get(g.name) === `namespace "${namespace}"` && namespaceOfGroup(ruler.target, g.name) !== namespace) {
+                warnings.push(`rule group "${g.name}" was read from ruler namespace "${namespace}", which a rule file cannot say; ` +
+                    `name it under prometheus.profiles.<env>.ruler.groupNamespaces so it is observed and applied there`);
+            }
+        }
+    }
+    return groups;
+}
+async function exportAlertmanager(am, verbatim, warnings) {
+    const live = await am.readConfig();
+    if (live === undefined) {
+        warnings.push(`${am.target.url} has no Alertmanager config for this tenant`);
+        return undefined;
+    }
+    const loaded = loadPrometheusYaml(live.text);
+    if (!isObject(loaded))
+        throw new Error(`the Alertmanager config read from ${live.address} is not a YAML mapping`);
+    const doc = live.remarshalled && !verbatim ? stripAlertmanagerDefaults(loaded) : loaded;
+    const masked = maskedSecretPaths(doc);
+    if (masked.length > 0) {
+        warnings.push(`Alertmanager masks secrets in ${live.address}; these read "<secret>" and need their real values (a *_file path, say): ${masked.join(", ")}`);
+    }
+    if (live.templateFiles) {
+        warnings.push(`the Alertmanager's notification templates (${Object.keys(live.templateFiles).join(", ")}) are not imported; templates: names files, not their contents`);
+    }
+    const parsed = parseAlertmanagerDocument(doc);
+    warnings.push(...parsed.warnings.map((w) => `alertmanager: ${w}`));
+    return {
+        logicalId: "alertmanager",
+        type: ALERTMANAGER_RESOURCE_TYPE,
+        properties: { config: parsed.config },
+    };
+}
+export async function exportResources(options) {
+    const { ruler, alertmanager } = await bindEndpoints(options);
+    const type = options.selector?.type;
+    const wantRules = type === undefined || type === RULE_GROUP_TYPE || type === RULE_FILE_RESOURCE_TYPE;
+    const wantAlertmanager = (type === undefined || type.startsWith(ALERTMANAGER_TYPE_PREFIX)) && options.selector?.name === undefined;
+    const unbound = [
+        ...(wantRules && isUnresolvedTarget(ruler) ? [`rule groups: ${ruler.detail}`] : []),
+        ...(wantAlertmanager && isUnresolvedTarget(alertmanager) ? [`Alertmanager: ${alertmanager.detail}`] : []),
+    ];
+    const wanted = (wantRules ? 1 : 0) + (wantAlertmanager ? 1 : 0);
+    if (wanted > 0 && unbound.length === wanted)
+        throw new Error(`nothing to read for environment "${options.environment}": ${unbound.join("; ")}`);
+    const warnings = unbound.map((u) => `not imported, ${u}`);
+    const resources = [];
+    if (wantRules && !isUnresolvedTarget(ruler)) {
+        const groups = await exportRuleGroups(ruler, options, warnings);
+        if (groups.length > 0) {
+            resources.push({
+                logicalId: "ruleFile",
+                type: RULE_FILE_RESOURCE_TYPE,
+                properties: { file: { groups } },
+            });
+        }
+    }
+    if (wantAlertmanager && !isUnresolvedTarget(alertmanager)) {
+        const resource = await exportAlertmanager(alertmanager, options.verbatim, warnings);
+        if (resource)
+            resources.push(resource);
+    }
+    return { resources, parameters: [], warnings };
+}

package/dist/import/alertmanager-live.js

@@ -0,0 +1,309 @@
+/**
+ * Alertmanager's `/api/v2/status` config, back to the shape a person writes
+ * (#3371).
+ *
+ * `config.original` is the loaded config marshalled again, not the file
+ * (`Config.String()` in Alertmanager's `config/config.go`). Against
+ * Alertmanager v0.34.1 (`PROMETHEUS_PIN.alertmanager`) that adds three
+ * kinds of thing a file did not say:
+ *
+ * - `global:` with every default of `DefaultGlobalConfig()` written out:
+ *   `resolve_timeout: 5m`, the default `http_config`, `smtp_hello`,
+ *   `smtp_require_tls`, `smtp_tls_config` and the integration API URLs.
+ * - every receiver integration with the settings it inherited from `global:`
+ *   (`http_config`, an email config's `smarthost`, `from` and SMTP auth, a
+ *   Slack config's `api_url`, a PagerDuty config's `url`, and so on), as
+ *   `Config.UnmarshalYAML` copies them in.
+ * - every integration's own defaults (`DefaultEmailConfig`,
+ *   `DefaultSlackConfig`, `DefaultPagerdutyConfig`, ...) and the zero values
+ *   of fields marshalled without `omitempty` (`url_file: ""`,
+ *   `max_alerts: 0`, `continue: false`).
+ *
+ * {@link stripAlertmanagerDefaults} takes those out, so an import writes
+ * what a person would have declared. It drops a value only where it equals
+ * the default or the global it was copied from; a value someone set to the
+ * default is indistinguishable from one they left out, and goes too, which
+ * builds to the same config. `verbatim` skips it. Secrets read `<secret>`
+ * either way (see {@link maskedSecretPaths}).
+ */
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function canonical(v) {
+    if (Array.isArray(v))
+        return v.map(canonical);
+    if (isObject(v))
+        return Object.fromEntries(Object.keys(v).sort().map((k) => [k, canonical(v[k])]));
+    return v;
+}
+function same(a, b) {
+    return JSON.stringify(canonical(a)) === JSON.stringify(canonical(b));
+}
+/** Empty, false, zero or null: what a field marshalled without `omitempty` holds when nobody set it. */
+function isZero(v) {
+    if (v === null || v === undefined || v === "" || v === false || v === 0)
+        return true;
+    if (Array.isArray(v))
+        return v.length === 0;
+    if (isObject(v))
+        return Object.values(v).every(isZero);
+    return false;
+}
+/** `commoncfg.DefaultHTTPClientConfig`, marshalled. */
+const DEFAULT_HTTP_CONFIG = { follow_redirects: true, enable_http2: true };
+function isDefaultHttpConfig(v) {
+    if (!isObject(v))
+        return false;
+    const rest = Object.fromEntries(Object.entries(v).filter(([k]) => !(k in DEFAULT_HTTP_CONFIG)));
+    return Object.entries(DEFAULT_HTTP_CONFIG).every(([k, d]) => v[k] === undefined || v[k] === d) && isZero(rest);
+}
+/** `DefaultGlobalConfig()` at the pin. `http_config` and `smtp_tls_config` are compared by {@link isDefaultHttpConfig} and {@link isZero}. */
+const GLOBAL_DEFAULTS = {
+    resolve_timeout: "5m",
+    smtp_hello: "localhost",
+    smtp_require_tls: true,
+    pagerduty_url: "https://events.pagerduty.com/v2/enqueue",
+    opsgenie_api_url: "https://api.opsgenie.com/",
+    wechat_api_url: "https://qyapi.weixin.qq.com/cgi-bin/",
+    victorops_api_url: "https://alert.victorops.com/integrations/generic/20131114/alert/",
+    telegram_api_url: "https://api.telegram.org",
+    webex_api_url: "https://webexapis.com/v1/messages",
+    rocketchat_api_url: "https://open.rocket.chat/",
+    slack_app_url: "https://slack.com/api/chat.postMessage",
+};
+/** Fields `Config.UnmarshalYAML` copies from `global:` into each integration, integration field to global key. */
+const INHERITED = {
+    email_configs: {
+        tls_config: "smtp_tls_config",
+        smarthost: "smtp_smarthost",
+        from: "smtp_from",
+        hello: "smtp_hello",
+        auth_username: "smtp_auth_username",
+        auth_password: "smtp_auth_password",
+        auth_password_file: "smtp_auth_password_file",
+        auth_secret: "smtp_auth_secret",
+        auth_secret_file: "smtp_auth_secret_file",
+        auth_identity: "smtp_auth_identity",
+        require_tls: "smtp_require_tls",
+        force_implicit_tls: "smtp_force_implicit_tls",
+    },
+    slack_configs: {
+        app_url: "slack_app_url",
+        app_token: "slack_app_token",
+        app_token_file: "slack_app_token_file",
+        api_url: "slack_api_url",
+        api_url_file: "slack_api_url_file",
+    },
+    pagerduty_configs: { url: "pagerduty_url" },
+    opsgenie_configs: { api_url: "opsgenie_api_url", api_key: "opsgenie_api_key", api_key_file: "opsgenie_api_key_file" },
+    wechat_configs: { api_url: "wechat_api_url", api_secret: "wechat_api_secret", api_secret_file: "wechat_api_secret_file", corp_id: "wechat_api_corp_id" },
+    victorops_configs: { api_url: "victorops_api_url", api_key: "victorops_api_key", api_key_file: "victorops_api_key_file" },
+    telegram_configs: { api_url: "telegram_api_url", bot_token: "telegram_bot_token", bot_token_file: "telegram_bot_token_file" },
+    webex_configs: { api_url: "webex_api_url" },
+    rocketchat_configs: {
+        api_url: "rocketchat_api_url",
+        token: "rocketchat_token",
+        token_file: "rocketchat_token_file",
+        token_id: "rocketchat_token_id",
+        token_id_file: "rocketchat_token_id_file",
+    },
+    mattermost_configs: { webhook_url: "mattermost_webhook_url", webhook_url_file: "mattermost_webhook_url_file" },
+    jira_configs: { api_url: "jira_api_url" },
+};
+/** Each integration's `Default<Kind>Config` at the pin, the fields it sets. Kinds not listed keep what they read. */
+const INTEGRATION_DEFAULTS = {
+    webhook_configs: { send_resolved: true },
+    email_configs: { send_resolved: false, html: '{{ template "email.default.html" . }}' },
+    slack_configs: {
+        send_resolved: false,
+        color: '{{ template "slack.default.color" . }}',
+        username: '{{ template "slack.default.username" . }}',
+        title: '{{ template "slack.default.title" . }}',
+        title_link: '{{ template "slack.default.titlelink" . }}',
+        icon_emoji: '{{ template "slack.default.iconemoji" . }}',
+        icon_url: '{{ template "slack.default.iconurl" . }}',
+        pretext: '{{ template "slack.default.pretext" . }}',
+        text: '{{ template "slack.default.text" . }}',
+        fallback: '{{ template "slack.default.fallback" . }}',
+        callback_id: '{{ template "slack.default.callbackid" . }}',
+        footer: '{{ template "slack.default.footer" . }}',
+    },
+    pagerduty_configs: {
+        send_resolved: true,
+        description: '{{ template "pagerduty.default.description" .}}',
+        client: '{{ template "pagerduty.default.client" . }}',
+        client_url: '{{ template "pagerduty.default.clientURL" . }}',
+    },
+    webex_configs: { send_resolved: true, message: '{{ template "webex.default.message" . }}' },
+    rocketchat_configs: {
+        send_resolved: false,
+        color: '{{ if eq .Status "firing" }}red{{ else }}green{{ end }}',
+        emoji: '{{ template "rocketchat.default.emoji" . }}',
+        icon_url: '{{ template "rocketchat.default.iconurl" . }}',
+        text: '{{ template "rocketchat.default.text" . }}',
+        title: '{{ template "rocketchat.default.title" . }}',
+        title_link: '{{ template "rocketchat.default.titlelink" . }}',
+    },
+    wechat_configs: {
+        send_resolved: false,
+        message: '{{ template "wechat.default.message" . }}',
+        to_user: '{{ template "wechat.default.to_user" . }}',
+        to_party: '{{ template "wechat.default.to_party" . }}',
+        to_tag: '{{ template "wechat.default.to_tag" . }}',
+        agent_id: '{{ template "wechat.default.agent_id" . }}',
+    },
+    victorops_configs: {
+        send_resolved: true,
+        message_type: "CRITICAL",
+        state_message: '{{ template "victorops.default.state_message" . }}',
+        entity_display_name: '{{ template "victorops.default.entity_display_name" . }}',
+        monitoring_tool: '{{ template "victorops.default.monitoring_tool" . }}',
+    },
+    pushover_configs: {
+        send_resolved: true,
+        title: '{{ template "pushover.default.title" . }}',
+        message: '{{ template "pushover.default.message" . }}',
+        url: '{{ template "pushover.default.url" . }}',
+        priority: '{{ if eq .Status "firing" }}2{{ else }}0{{ end }}',
+        retry: "1m",
+        expire: "1h",
+    },
+    sns_configs: { send_resolved: true, subject: '{{ template "sns.default.subject" . }}', message: '{{ template "sns.default.message" . }}' },
+};
+/** `DefaultEmailSubject`, which an email config's `headers` gain when they set no Subject. */
+const DEFAULT_EMAIL_SUBJECT = '{{ template "email.default.subject" . }}';
+/** `DefaultPagerdutyDetails`, merged into every PagerDuty config's `details`. */
+const DEFAULT_PAGERDUTY_DETAILS = {
+    firing: "{{ .Alerts.Firing | toJson }}",
+    resolved: "{{ .Alerts.Resolved | toJson }}",
+    num_firing: "{{ .Alerts.Firing | len }}",
+    num_resolved: "{{ .Alerts.Resolved | len }}",
+};
+function stripIntegration(kind, raw, global) {
+    const out = { ...raw };
+    const inherited = INHERITED[kind] ?? {};
+    const defaults = INTEGRATION_DEFAULTS[kind] ?? {};
+    for (const [field, globalKey] of Object.entries(inherited)) {
+        if (field in out && global[globalKey] !== undefined && same(out[field], global[globalKey]))
+            delete out[field];
+        else if (field in out && global[globalKey] === undefined && isZero(out[field]) && field !== "require_tls")
+            delete out[field];
+    }
+    if ("http_config" in out && (global.http_config !== undefined ? same(out.http_config, global.http_config) : isDefaultHttpConfig(out.http_config))) {
+        delete out.http_config;
+    }
+    for (const [field, d] of Object.entries(defaults)) {
+        if (field in out && same(out[field], d))
+            delete out[field];
+    }
+    if (kind === "email_configs" && isObject(out.headers)) {
+        const headers = { ...out.headers };
+        if (headers.Subject === DEFAULT_EMAIL_SUBJECT)
+            delete headers.Subject;
+        if (Object.keys(headers).length === 0)
+            delete out.headers;
+        else
+            out.headers = headers;
+    }
+    if (kind === "pagerduty_configs" && isObject(out.details)) {
+        const details = Object.fromEntries(Object.entries(out.details).filter(([k, v]) => !same(v, DEFAULT_PAGERDUTY_DETAILS[k])));
+        if (Object.keys(details).length === 0)
+            delete out.details;
+        else
+            out.details = details;
+    }
+    // What is left at its zero value was marshalled without omitempty. A field with a known default or a global to
+    // inherit from survived the comparisons above because it differs (`send_resolved: false` on a webhook,
+    // `require_tls: false` under a global `true`), and `send_resolved` of a kind with no known default stays.
+    for (const [k, v] of Object.entries(out)) {
+        if (k === "send_resolved" || k in defaults)
+            continue;
+        if (k in inherited && global[inherited[k]] !== undefined)
+            continue;
+        if (isZero(v))
+            delete out[k];
+    }
+    return out;
+}
+function stripRoute(raw) {
+    if (!isObject(raw))
+        return raw;
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+        if (k === "routes" && Array.isArray(v)) {
+            if (v.length > 0)
+                out.routes = v.map(stripRoute);
+            continue;
+        }
+        if (isZero(v))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+function stripGlobal(raw) {
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+        if (k in GLOBAL_DEFAULTS && same(v, GLOBAL_DEFAULTS[k]))
+            continue;
+        if (k === "http_config" && isDefaultHttpConfig(v))
+            continue;
+        if (k === "smtp_require_tls" && v === false) {
+            out[k] = v;
+            continue;
+        }
+        if (isZero(v))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/** The re-marshalled config with what Alertmanager added taken out (see the module comment). Pure; `doc` is not changed. */
+export function stripAlertmanagerDefaults(doc) {
+    const global = isObject(doc.global) ? doc.global : {};
+    const out = {};
+    for (const [section, value] of Object.entries(doc)) {
+        if (section === "global") {
+            const g = stripGlobal(global);
+            if (Object.keys(g).length > 0)
+                out.global = g;
+        }
+        else if (section === "receivers" && Array.isArray(value)) {
+            out.receivers = value.map((r) => {
+                if (!isObject(r))
+                    return r;
+                const receiver = {};
+                for (const [k, v] of Object.entries(r)) {
+                    if (k.endsWith("_configs") && Array.isArray(v)) {
+                        if (v.length > 0)
+                            receiver[k] = v.map((c) => (isObject(c) ? stripIntegration(k, c, global) : c));
+                    }
+                    else if (k === "name" || !isZero(v))
+                        receiver[k] = v;
+                }
+                return receiver;
+            });
+        }
+        else if (section === "route") {
+            out.route = stripRoute(value);
+        }
+        else if (section === "inhibit_rules" && Array.isArray(value)) {
+            if (value.length > 0)
+                out.inhibit_rules = value.map((r) => (isObject(r) ? Object.fromEntries(Object.entries(r).filter(([, v]) => !isZero(v))) : r));
+        }
+        else if (!isZero(value)) {
+            out[section] = value;
+        }
+    }
+    return out;
+}
+/** The paths that read `<secret>`, the mask Alertmanager writes over every secret it marshals. */
+export function maskedSecretPaths(doc, at = "") {
+    if (doc === "<secret>")
+        return [at];
+    if (Array.isArray(doc))
+        return doc.flatMap((v, i) => maskedSecretPaths(v, `${at}[${i}]`));
+    if (isObject(doc))
+        return Object.entries(doc).flatMap(([k, v]) => maskedSecretPaths(v, at ? `${at}.${k}` : k));
+    return [];
+}

package/dist/import/embedded.js

@@ -0,0 +1,100 @@
+/**
+ * Prometheus and Alertmanager content embedded in another lexicon's
+ * resource, for `chant import`: a k8s `PrometheusRule`'s `spec.groups`, or a
+ * rule file held as text in a ConfigMap (#2962), and an `alertmanager.yml`
+ * held as text in a ConfigMap (#3031).
+ *
+ * The groups are imported exactly as `chant import rules.yml` would import
+ * them, into a directory of its own. `spec.groups` becomes the list of the
+ * declared groups (an `Slo`'s by its `rules` member), which the k8s
+ * serializer renders as the same groups; a rule file becomes
+ * `ruleFileYaml([...])`, the text the prometheus serializer writes.
+ *
+ * An `alertmanager.yml` is imported exactly as `chant import alertmanager.yml`
+ * would import it, and becomes `alertmanagerYaml([...])` over every receiver,
+ * time interval, root route, inhibit rule and settings it declares. The
+ * ConfigMap then holds the config as the serializer writes it: the same
+ * config, with Alertmanager's deprecated spellings rewritten as the
+ * standalone import rewrites them.
+ *
+ * A `prometheus.yml` held as text in a ConfigMap is imported exactly as
+ * `chant import prometheus.yml` would import it, and becomes
+ * `prometheusConfigYaml([...])` over every scrape job and the sections
+ * besides them. The ConfigMap then holds the config as the serializer
+ * writes it: scrape jobs sorted by name, sections in Prometheus's order.
+ */
+import { looksLikeAlertmanagerConfig, looksLikeRuleFile } from "../model.js";
+import { looksLikePrometheusConfig } from "../config-model.js";
+import { parsePrometheusYaml } from "./parser.js";
+import { generateAlertmanager, generatePrometheusConfig, generateRuleFile } from "./generator.js";
+const PACKAGE = "@intentius/chant-lexicon-prometheus";
+export const ruleGroupsImporter = {
+    what: "Prometheus rule groups",
+    matches(content) {
+        if (!looksLikeRuleFile(content.document))
+            return false;
+        return content.select === "groups" || (content.select === undefined && typeof content.text === "string");
+    },
+    import(content) {
+        // JSON is YAML: the document goes through the same parser a rule file does.
+        const source = content.select === undefined ? content.text : JSON.stringify(content.document);
+        const parsed = parsePrometheusYaml(source);
+        if (parsed.kind !== "rules")
+            throw new Error("this is not a Prometheus rule file");
+        const { files, groups } = generateRuleFile(parsed.file);
+        const bindings = groups.map((g) => ({ from: g.path, name: g.name, ...(g.member ? { member: g.member } : {}) }));
+        return {
+            files,
+            value: content.select === undefined
+                ? { bindings, shape: "list", through: { from: PACKAGE, name: "ruleFileYaml" } }
+                : { bindings, shape: "list" },
+            warnings: parsed.warnings,
+        };
+    },
+};
+export const alertmanagerImporter = {
+    what: "an Alertmanager config",
+    matches(content) {
+        return content.select === undefined && typeof content.text === "string" && looksLikeAlertmanagerConfig(content.document);
+    },
+    import(content) {
+        const parsed = parsePrometheusYaml(content.text);
+        if (parsed.kind !== "alertmanager")
+            throw new Error("this is not an alertmanager.yml");
+        const { files, declarations } = generateAlertmanager(parsed.config);
+        if (declarations.length === 0)
+            throw new Error("the import declared nothing");
+        return {
+            files,
+            value: {
+                bindings: declarations.map((d) => ({ from: d.path, name: d.name })),
+                shape: "list",
+                through: { from: PACKAGE, name: "alertmanagerYaml" },
+            },
+            warnings: parsed.warnings,
+        };
+    },
+};
+export const prometheusConfigImporter = {
+    what: "a prometheus.yml",
+    matches(content) {
+        return content.select === undefined && typeof content.text === "string" && looksLikePrometheusConfig(content.document);
+    },
+    import(content) {
+        const parsed = parsePrometheusYaml(content.text);
+        if (parsed.kind !== "prometheus")
+            throw new Error("this is not a prometheus.yml");
+        const { files, declarations } = generatePrometheusConfig(parsed.config);
+        if (declarations.length === 0)
+            throw new Error("the import declared nothing");
+        return {
+            files,
+            value: {
+                bindings: declarations.map((d) => ({ from: d.path, name: d.name })),
+                shape: "list",
+                through: { from: PACKAGE, name: "prometheusConfigYaml" },
+            },
+            warnings: parsed.warnings,
+        };
+    },
+};