@intentius/chant-lexicon-prometheus 0.124.31 → 0.124.32

package/dist/init-templates.js

@@ -0,0 +1,119 @@
+const RULES = `import { RuleGroup, type Rule } from "@intentius/chant-lexicon-prometheus";
+
+const rules: Rule[] = [
+  {
+    record: "job:http_errors:ratio5m",
+    expr: 'sum by (job) (rate(http_requests_total{code=~"5.."}[5m])) / sum by (job) (rate(http_requests_total[5m]))',
+  },
+  {
+    alert: "HttpErrorRatioHigh",
+    expr: "job:http_errors:ratio5m > 0.05",
+    for: "10m",
+    labels: { severity: "page" },
+    annotations: { summary: "{{ $labels.job }} is failing over 5% of requests" },
+  },
+];
+
+const api = new RuleGroup({ name: "api", interval: "30s", rules });
+
+export { api };
+`;
+const ALERTMANAGER = `import { Receiver, Route, type RouteProps, type WebhookConfig } from "@intentius/chant-lexicon-prometheus";
+
+const hook: WebhookConfig[] = [{ url: "http://alert-sink:8080/" }];
+const oncall = new Receiver({ name: "oncall", webhook_configs: hook });
+const fallback = new Receiver({ name: "default" });
+
+const children: RouteProps[] = [{ matchers: ['severity="page"'], receiver: oncall }];
+const byAlert = ["alertname", "job"];
+const root = new Route({ receiver: fallback, group_by: byAlert, routes: children });
+
+export { oncall, fallback, root };
+`;
+const SLO_STYLE = `import { RuleGroup, type Rule } from "@intentius/chant-lexicon-prometheus";
+
+// Error ratio over two windows, and an alert that needs both to agree.
+const windows = ["5m", "1h"];
+
+const recording: Rule[] = windows.map((w) => ({
+  record: \`job:http_errors:ratio\${w}\`,
+  expr: \`sum by (job) (rate(http_requests_total{code=~"5.."}[\${w}])) / sum by (job) (rate(http_requests_total[\${w}]))\`,
+}));
+
+const alerting: Rule[] = [
+  {
+    alert: "ErrorBudgetBurn",
+    expr: "job:http_errors:ratio1h > (14.4 * 0.001) and job:http_errors:ratio5m > (14.4 * 0.001)",
+    labels: { severity: "page" },
+    annotations: { summary: "{{ $labels.job }} is burning its error budget 14.4x too fast" },
+  },
+];
+
+const errorRatios = new RuleGroup({ name: "error-ratios", rules: recording });
+const burnAlerts = new RuleGroup({ name: "burn-alerts", rules: alerting });
+
+export { errorRatios, burnAlerts };
+`;
+// ── slo ────────────────────────────────────────────────────────────────
+const SLO_DECLARATION = `/**
+ * The SLO: 99.9% of checkout requests answer without a 5xx over 30 days.
+ * \`Slo\` builds one rule group: the error ratio over every window its alerts
+ * read, the error budget left, and burn-rate alerts that page on a fast burn
+ * (severity "page") and open a ticket on a slow one (severity "ticket").
+ * \`sloMetrics(checkout)\` returns the recorded series names, for a dashboard
+ * or another rule to read.
+ */
+import { Slo } from "@intentius/chant-lexicon-prometheus";
+
+const sli = {
+  errors: 'sum(rate(http_requests_total{job="checkout",code=~"5.."}[{{window}}]))',
+  total: 'sum(rate(http_requests_total{job="checkout"}[{{window}}]))',
+};
+const team = { team: "payments" };
+
+const checkout = Slo({
+  name: "checkout",
+  objective: 0.999,
+  window: "30d",
+  description: "Checkout requests answer without a 5xx.",
+  sli,
+  labels: team,
+});
+
+export { checkout };
+`;
+const SLO_ALERTMANAGER = `/**
+ * Routing for the SLO's alerts, in the same build root so PROM202 checks that
+ * both severities they carry have a route.
+ */
+import { InhibitRule, Receiver, Route, type RouteProps, type WebhookConfig } from "@intentius/chant-lexicon-prometheus";
+
+const pager: WebhookConfig[] = [{ url: "http://pager-bridge:8080/alerts" }];
+const oncall = new Receiver({ name: "oncall", webhook_configs: pager });
+
+const ticketing: WebhookConfig[] = [{ url: "http://ticket-bridge:8080/alerts" }];
+const tickets = new Receiver({ name: "tickets", webhook_configs: ticketing });
+
+const fallback = new Receiver({ name: "default" });
+
+const bySlo = ["alertname", "slo"];
+const children: RouteProps[] = [
+  { matchers: ['severity="page"'], receiver: oncall },
+  { matchers: ['severity="ticket"'], receiver: tickets },
+];
+const root = new Route({ receiver: fallback, group_by: bySlo, routes: children });
+
+// A page for an SLO mutes its ticket: the fast burn already has someone on it.
+const pageSource = ['severity="page"'];
+const ticketTarget = ['severity="ticket"'];
+const sameSlo = ["slo"];
+const pageMutesTicket = new InhibitRule({ source_matchers: pageSource, target_matchers: ticketTarget, equal: sameSlo });
+
+export { oncall, tickets, fallback, root, pageMutesTicket };
+`;
+export const DEFAULT_TEMPLATE = { src: { "rules.ts": RULES, "alertmanager.ts": ALERTMANAGER } };
+export const RULES_TEMPLATE = { src: { "rules.ts": RULES } };
+export const SLO_STYLE_TEMPLATE = { src: { "rules.ts": SLO_STYLE } };
+export const SLO_TEMPLATE = { src: { "slo.ts": SLO_DECLARATION, "alertmanager.ts": SLO_ALERTMANAGER } };
+/** The template names `chant init --lexicon prometheus --template <name>` takes, besides the default. */
+export const TEMPLATE_NAMES = ["rules", "slo-style", "slo"];

package/dist/integrations.js

@@ -0,0 +1,33 @@
+/**
+ * Alertmanager's receiver integrations and the HTTP client settings they
+ * share, typed against the Go structs of the pinned release (see ./pin.ts):
+ * `alertmanager/config` (`notifiers.go`), `alertmanager/notify/<name>`
+ * (`config.go`), `prometheus/common/config` (`http_config.go`,
+ * `headers.go`) and `prometheus/sigv4`.
+ *
+ * Field names are the YAML keys. Durations are strings (`30s`), secrets and
+ * URLs are strings, and every credential with a `*_file` sibling is best
+ * set through that sibling: Alertmanager does not expand environment
+ * variables in its config, and PROM001 flags a literal.
+ */
+/** Every receiver integration: its key under a receiver, and the name of the type of one entry. */
+export const RECEIVER_INTEGRATION_TYPES = Object.freeze({
+    discord_configs: "DiscordConfig",
+    email_configs: "EmailConfig",
+    incidentio_configs: "IncidentioConfig",
+    pagerduty_configs: "PagerDutyConfig",
+    slack_configs: "SlackConfig",
+    webhook_configs: "WebhookConfig",
+    opsgenie_configs: "OpsGenieConfig",
+    wechat_configs: "WechatConfig",
+    pushover_configs: "PushoverConfig",
+    victorops_configs: "VictorOpsConfig",
+    sns_configs: "SNSConfig",
+    telegram_configs: "TelegramConfig",
+    webex_configs: "WebexConfig",
+    msteams_configs: "MSTeamsConfig",
+    msteamsv2_configs: "MSTeamsV2Config",
+    jira_configs: "JiraConfig",
+    rocketchat_configs: "RocketchatConfig",
+    mattermost_configs: "MattermostConfig",
+});

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "eaf8af81d5e6bd5b3f3c1d1b4126b1ea9353afdcd0484884b694c03bcf93d89d",
+    "manifest.json": "d1b1198c7e2f8c8ca3bbe32b633db8bd0b2bb4639a15cab401cee30e69840144",
     "meta.json": "a06b8059e2de2ca6c8131bfbbfe7e143e818f2d2d497d3f45a9bc5c63af6aeeb",
     "types/index.d.ts": "150d72287453a24a40cdeffb8cf3e9dc6e77ab58b342b48d01902dc58fb5f85d",
     "rules/literal-credential.ts": "df0dc02b93f2da87d9b03ceca906206b40b3b7600b24cb733f6388d81f92aecb",
@@ -46,5 +46,5 @@
     "skills/chant-prometheus-alertmanager.md": "4c4a22bea6147653d09d7d3f55f81c4927963d4e2f50b2e430fbb9023e99570b",
     "skills/chant-prometheus-kubernetes.md": "cca016857891f4cabf1feb6f9db83c220a2e6ece200cd89e635851079f8070a8"
   },
-  "composite": "f01924c8cc592c72321c90c55a4724bddeb025de1f819f64be70e3d9b5a17c1b"
+  "composite": "6c19a6c597d0d2ca495664e8f9e04858b445f7f186546df2aeec314a6ca734ec"
 }

package/dist/lint/audit-catalog.js

@@ -0,0 +1,60 @@
+/**
+ * The prometheus lexicon's chant audit catalog, contributed via
+ * `prometheusPlugin.auditCatalog()` (#687, #1346).
+ *
+ * Every post-synth check reads the emitted rule file or `alertmanager.yml`
+ * (or any output document shaped like one), so they are all `yamlBased` and
+ * fire on an audit of standalone files too. The three source-level lint rules
+ * read TypeScript, so they are constructed with `yamlBased: false`; they are
+ * listed for a reader who meets them in a lint report.
+ */
+import { applyLineage, auditRule } from "@intentius/chant/audit/catalog";
+import { prometheusAuditLineage } from "./audit-lineage.js";
+function sourceRule(id, category, title, remediation) {
+    return { id, tier: "merge-worthy", fixKind: "guidance", category, title, remediation, yamlBased: false };
+}
+function outputRule(id, tier, category, title, remediation) {
+    return auditRule(id, tier, "guidance", title, remediation, { category });
+}
+export const prometheusAuditCatalog = {
+    PROM001: sourceRule("PROM001", "security", "Alertmanager credential declared as a literal", "Mount the secret as a file and set the field's *_file sibling (api_url_file, routing_key_file, auth_password_file, credentials_file) instead."),
+    PROM002: sourceRule("PROM002", "correctness", "Literal PromQL expression in a RuleGroup does not parse", "Fix the expression at the offset the message names."),
+    PROM003: sourceRule("PROM003", "correctness", "Slo objective, window or SLI expression is invalid", "Set objective strictly between 0 and 1, window to a Prometheus duration such as 28d, and write each SLI expression as PromQL with {{window}} where the range goes."),
+    PROM101: outputRule("PROM101", "merge-worthy", "correctness", "Rule group name repeated in a rule file", "Give every group in the rule file its own name."),
+    PROM102: outputRule("PROM102", "report-only", "correctness", "Two rules share a name and label set", "Rename one rule, or give the two different labels (for alerts, usually a different severity)."),
+    PROM103: outputRule("PROM103", "merge-worthy", "correctness", "Rule or group duration is not a Prometheus duration", "Write durations as <number><unit> terms in descending order, e.g. 30s, 5m, 1h30m."),
+    PROM104: outputRule("PROM104", "merge-worthy", "correctness", "Rule expression is not valid PromQL", "Fix the expression at the offset the message names."),
+    PROM105: outputRule("PROM105", "merge-worthy", "correctness", "Rule or group is malformed", "Set exactly one of record or alert with a non-empty name; keep for, keep_firing_for and annotations to alerting rules."),
+    PROM106: outputRule("PROM106", "report-only", "best-practice", "Alerting rule has no severity label", "Add a severity label (on the rule or the group) that an Alertmanager route matches."),
+    PROM107: outputRule("PROM107", "report-only", "best-practice", "Alerting rule has no summary or description", "Add a summary annotation saying what is wrong, and a description or runbook_url saying what to do."),
+    PROM201: outputRule("PROM201", "merge-worthy", "correctness", "Route sends to an undeclared receiver", "Declare the receiver, or reference the declared Receiver entity instead of a name string."),
+    PROM202: outputRule("PROM202", "merge-worthy", "correctness", "Alert severity not routed by any route", "Add a route matching the severity (e.g. severity=\"page\") below the root, or change the alert's severity to one that is routed."),
+    PROM203: outputRule("PROM203", "merge-worthy", "correctness", "Receiver or time interval name repeated", "Give every receiver and every time interval its own name."),
+    PROM204: outputRule("PROM204", "merge-worthy", "correctness", "Route names an undeclared time interval", "Declare the TimeInterval, or reference the declared entity instead of a name string."),
+    PROM205: outputRule("PROM205", "merge-worthy", "correctness", "Root route missing, without a receiver, or with matchers", "Declare exactly one root Route with a receiver and no matchers, and nest every other route under it."),
+    PROM206: outputRule("PROM206", "merge-worthy", "correctness", "Matcher does not parse", 'Write matchers as label, operator and quoted value, e.g. severity="page" or team=~"db|infra".'),
+    PROM207: outputRule("PROM207", "report-only", "best-practice", "Receiver declared but never routed to", "Route to the receiver, or remove it."),
+    PROM208: outputRule("PROM208", "merge-worthy", "correctness", "Alertmanager duration is not a duration", "Write durations as <number><unit> terms in descending order, e.g. 30s, 5m, 4h."),
+    PROM209: outputRule("PROM209", "merge-worthy", "correctness", "Receiver integration missing its destination or credential", "Set the integration's destination and credential (url, webhook_url, api_key, routing_key, chat_id, room_id, to/smarthost/from, ...), through its *_file or global equivalent where there is one."),
+    PROM210: outputRule("PROM210", "merge-worthy", "correctness", "Integration or global setting Alertmanager rejects", "Set one of each value and its *_file, and use a value Alertmanager allows (e.g. message_type text or markdown, parse_mode Markdown, MarkdownV2 or HTML)."),
+    PROM211: outputRule("PROM211", "report-only", "best-practice", "Alerting rule has no for, or for: 0s", "Set for to how long the condition must hold before the alert fires, e.g. 5m."),
+    PROM212: outputRule("PROM212", "report-only", "best-practice", "Alerting rule has no runbook_url annotation (opt-in)", "Add a runbook_url annotation linking to what the responder should do."),
+    PROM213: outputRule("PROM213", "merge-worthy", "correctness", "Alert expression has no comparison", "Add the condition the alert fires on, e.g. > 0.05, or use absent() for a missing series."),
+    PROM214: outputRule("PROM214", "merge-worthy", "correctness", "Alert template reads a label the expression aggregates away", "Keep the label in the aggregation's by (...), or stop reading it in the template."),
+    PROM215: outputRule("PROM215", "merge-worthy", "correctness", "rate, irate or increase over a name that is not a counter's", "Read a counter (a name ending in _total, _count, _sum or _bucket), or use delta() or deriv() for a gauge."),
+    PROM216: outputRule("PROM216", "merge-worthy", "correctness", "histogram_quantile over a series without _bucket, or without le", "Pass the histogram's _bucket series, and keep le in the aggregation: sum by (le, ...) (rate(x_bucket[5m]))."),
+    PROM217: outputRule("PROM217", "report-only", "best-practice", "Recording rule name is not level:metric:operations", "Name the recorded series level:metric:operations, e.g. job:http_requests:rate5m."),
+    PROM218: outputRule("PROM218", "report-only", "best-practice", "Regex matcher needs no regex, or is anchored", 'Use = or != for a plain value, and drop ^ and $ from a regex, which Prometheus anchors already (job=~"api|web").'),
+    PROM219: outputRule("PROM219", "merge-worthy", "correctness", "Alerting rule sets the alertname label", "Remove the alertname label; rename the rule instead."),
+    PROM220: outputRule("PROM220", "merge-worthy", "security", "Receiver turns off TLS certificate verification", "Remove insecure_skip_verify, and set ca_file to the CA that signed the endpoint's certificate."),
+    PROM221: outputRule("PROM221", "merge-worthy", "security", "SMTP credentials sent with require_tls false", "Set require_tls (or global.smtp_require_tls) to true, or use force_implicit_tls with an SMTPS port."),
+    PROM222: outputRule("PROM222", "merge-worthy", "security", "Credentials sent to an http:// receiver URL", "Point the integration at an https:// URL."),
+    PROM223: outputRule("PROM223", "merge-worthy", "correctness", "repeat_interval is shorter than group_interval", "Set repeat_interval to a multiple of group_interval, or lower group_interval."),
+    PROM224: outputRule("PROM224", "merge-worthy", "correctness", "Inhibit rule matches one alert as source and target, with no equal", "List the labels source and target must share under equal (e.g. alertname, cluster), or make the matchers exclusive."),
+    PROM225: outputRule("PROM225", "merge-worthy", "correctness", "labeldrop or labelkeep relabel step carries a field it does not take", "Remove source_labels, separator, target_label, modulus and replacement from the step; keep only regex (and action)."),
+    PROM301: outputRule("PROM301", "merge-worthy", "correctness", "Rule reads a connector metric no collector in the build emits", "Read the name spanMetricsNames(), serviceGraphNames() or genAiMetrics() gives for the declared connector, and group by its declared dimensions, or add the dimension to the connector."),
+};
+/** Post-synth checks the `recommended` lint preset leaves out (#3363); see `prometheusPlugin.lintPresets()`. */
+export const OPT_IN_CHECKS = new Set(["PROM212"]);
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(prometheusAuditCatalog, prometheusAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,42 @@
+const RULEFMT = "https://github.com/prometheus/prometheus/blob/main/model/rulefmt/rulefmt.go";
+const AM_CONFIG = "https://github.com/prometheus/alertmanager/blob/main/config/config.go";
+const PINT = "https://github.com/cloudflare/pint/blob/main/docs/checks";
+const amtool = (relation) => ({
+    tool: "amtool",
+    url: AM_CONFIG,
+    relation,
+});
+export const prometheusAuditLineage = {
+    PROM002: [
+        { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+        { tool: "pint", rule: "promql/syntax", url: `${PINT}/promql/syntax.md`, relation: "equivalent" },
+    ],
+    PROM101: [{ tool: "promtool", url: RULEFMT, relation: "equivalent" }],
+    PROM102: [{ tool: "pint", rule: "rule/duplicate", url: `${PINT}/rule/duplicate.md`, relation: "overlaps" }],
+    PROM103: [
+        { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+        { tool: "pint", rule: "alerts/for", url: `${PINT}/alerts/for.md`, relation: "overlaps" },
+    ],
+    PROM104: [
+        { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+        { tool: "pint", rule: "promql/syntax", url: `${PINT}/promql/syntax.md`, relation: "equivalent" },
+    ],
+    PROM105: [{ tool: "promtool", url: RULEFMT, relation: "equivalent" }],
+    PROM106: [{ tool: "pint", rule: "rule/label", url: `${PINT}/rule/label.md`, relation: "overlaps" }],
+    PROM107: [{ tool: "pint", rule: "alerts/annotation", url: `${PINT}/alerts/annotation.md`, relation: "overlaps" }],
+    PROM201: [amtool("equivalent")],
+    PROM203: [amtool("equivalent")],
+    PROM204: [amtool("equivalent")],
+    PROM205: [amtool("equivalent")],
+    PROM206: [amtool("equivalent")],
+    PROM208: [amtool("equivalent")],
+    PROM209: [amtool("overlaps")],
+    PROM210: [amtool("overlaps")],
+    PROM211: [{ tool: "pint", rule: "rule/for", url: `${PINT}/rule/for.md`, relation: "overlaps" }],
+    PROM212: [{ tool: "pint", rule: "alerts/annotation", url: `${PINT}/alerts/annotation.md`, relation: "overlaps" }],
+    PROM213: [{ tool: "pint", rule: "alerts/comparison", url: `${PINT}/alerts/comparison.md`, relation: "equivalent" }],
+    PROM214: [{ tool: "pint", rule: "alerts/template", url: `${PINT}/alerts/template.md`, relation: "overlaps" }],
+    PROM215: [{ tool: "pint", rule: "promql/rate", url: `${PINT}/promql/rate.md`, relation: "overlaps" }],
+    PROM217: [{ tool: "pint", rule: "rule/name", url: `${PINT}/rule/name.md`, relation: "overlaps" }],
+    PROM218: [{ tool: "pint", rule: "promql/regexp", url: `${PINT}/promql/regexp.md`, relation: "equivalent" }],
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,68 @@
+import { prom101 } from "./prom101.js";
+import { prom102 } from "./prom102.js";
+import { prom103 } from "./prom103.js";
+import { prom104 } from "./prom104.js";
+import { prom105 } from "./prom105.js";
+import { prom106 } from "./prom106.js";
+import { prom107 } from "./prom107.js";
+import { prom201 } from "./prom201.js";
+import { prom202 } from "./prom202.js";
+import { prom203 } from "./prom203.js";
+import { prom204 } from "./prom204.js";
+import { prom205 } from "./prom205.js";
+import { prom206 } from "./prom206.js";
+import { prom207 } from "./prom207.js";
+import { prom208 } from "./prom208.js";
+import { prom209 } from "./prom209.js";
+import { prom210 } from "./prom210.js";
+import { prom211 } from "./prom211.js";
+import { prom212 } from "./prom212.js";
+import { prom213 } from "./prom213.js";
+import { prom214 } from "./prom214.js";
+import { prom215 } from "./prom215.js";
+import { prom216 } from "./prom216.js";
+import { prom217 } from "./prom217.js";
+import { prom218 } from "./prom218.js";
+import { prom219 } from "./prom219.js";
+import { prom220 } from "./prom220.js";
+import { prom221 } from "./prom221.js";
+import { prom222 } from "./prom222.js";
+import { prom223 } from "./prom223.js";
+import { prom224 } from "./prom224.js";
+import { prom225 } from "./prom225.js";
+import { prom301 } from "./prom301.js";
+export const postSynthChecks = [
+    prom101,
+    prom102,
+    prom103,
+    prom104,
+    prom105,
+    prom106,
+    prom107,
+    prom201,
+    prom202,
+    prom203,
+    prom204,
+    prom205,
+    prom206,
+    prom207,
+    prom208,
+    prom209,
+    prom210,
+    prom211,
+    prom212,
+    prom213,
+    prom214,
+    prom215,
+    prom216,
+    prom217,
+    prom218,
+    prom219,
+    prom220,
+    prom221,
+    prom222,
+    prom223,
+    prom224,
+    prom225,
+    prom301,
+];

package/dist/lint/post-synth/prom-helpers.js

@@ -0,0 +1,157 @@
+/**
+ * Shared plumbing for the prometheus post-synth checks: find the rule files
+ * and `alertmanager.yml` documents in a build's output, and run the
+ * plain-function checks over them.
+ *
+ * Documents are recognized by shape, not by which lexicon emitted them, so a
+ * rule file that reaches the output some other way (a hand-written YAML
+ * sidecar) is checked too. `PrometheusRule` manifests are not read here:
+ * `chant build` hands each lexicon's checks only that lexicon's output, so the
+ * k8s lexicon's WK8606 runs `prometheusRuleDiagnostics` (below) over them.
+ */
+import { loadAll } from "js-yaml";
+import { buildCollectorConfigs, collectorMetricIssues, collectorMetrics } from "../../collector-metrics.js";
+import { looksLikePrometheusConfig } from "../../config-model.js";
+import { validateRelabelFields } from "../../validate-relabel.js";
+import { looksLikeAlertmanagerConfig, looksLikeRuleFile } from "../../model.js";
+import { validateAlertmanagerConfig, validateRuleFile, validateRunbookUrls, validateSeverityRouting, } from "../../validate-config.js";
+/** Every rule file and Alertmanager config in the output. Parsed with js-yaml rather than `ctx.docs`, which keeps block scalars and flow lists as strings. */
+export function prometheusDocs(ctx) {
+    const found = { ruleFiles: [], alertmanager: [], prometheus: [] };
+    for (const [lexicon, output] of ctx.outputs) {
+        const texts = typeof output === "string"
+            ? [[lexicon, output]]
+            : [[lexicon, output.primary], ...Object.entries(output.files ?? {})];
+        for (const [source, text] of texts) {
+            if (!text)
+                continue;
+            let docs;
+            try {
+                docs = loadAll(text);
+            }
+            catch {
+                continue; // not YAML, or not ours
+            }
+            for (const doc of docs) {
+                if (looksLikeRuleFile(doc))
+                    found.ruleFiles.push({ source, config: doc });
+                else if (looksLikeAlertmanagerConfig(doc))
+                    found.alertmanager.push({ source, config: doc });
+                else if (looksLikePrometheusConfig(doc))
+                    found.prometheus.push({ source, config: doc });
+            }
+        }
+    }
+    return found;
+}
+function toDiagnostic(issue, source) {
+    return {
+        checkId: issue.code,
+        severity: issue.severity,
+        message: source && source !== "prometheus" ? `${source}: ${issue.message}` : issue.message,
+        ...(issue.subject ? { entity: issue.subject } : {}),
+        lexicon: "prometheus",
+    };
+}
+/** Diagnostics for one rule-file code (PROM101-PROM107, PROM211, PROM213-PROM219) across every rule file in the output. */
+export function ruleFileDiagnostics(ctx, code) {
+    return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) => validateRuleFile(config)
+        .filter((i) => i.code === code)
+        .map((i) => toDiagnostic(i, source)));
+}
+/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210, PROM220-PROM224) across every `alertmanager.yml` in the output. */
+export function alertmanagerDiagnostics(ctx, code) {
+    return prometheusDocs(ctx).alertmanager.flatMap(({ source, config }) => validateAlertmanagerConfig(config)
+        .filter((i) => i.code === code)
+        .map((i) => toDiagnostic(i, source)));
+}
+/** PROM225 across every `prometheus.yml` in the output. */
+export function relabelDiagnostics(ctx) {
+    return prometheusDocs(ctx).prometheus.flatMap(({ source, config }) => validateRelabelFields(config).map((i) => toDiagnostic(i, source)));
+}
+/** PROM212 across every rule file in the output. Opt-in: the lexicon's `recommended` lint preset leaves it out (see ../../plugin.ts). */
+export function runbookDiagnostics(ctx) {
+    return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) => validateRunbookUrls(config).map((i) => toDiagnostic(i, source)));
+}
+/**
+ * PROM301: every rule expression in the output against the metrics the
+ * build's collector configs emit. Silent when the build has none.
+ */
+export function collectorMetricDiagnostics(ctx) {
+    const { ruleFiles } = prometheusDocs(ctx);
+    if (ruleFiles.length === 0)
+        return [];
+    const emitted = collectorMetrics(buildCollectorConfigs(ctx));
+    if (!emitted)
+        return [];
+    const out = [];
+    for (const { source, config } of ruleFiles) {
+        for (const group of Array.isArray(config?.groups) ? config.groups : []) {
+            for (const rule of Array.isArray(group?.rules) ? group.rules : []) {
+                const r = rule;
+                if (typeof r.expr !== "string")
+                    continue;
+                const subject = `${group.name}/${typeof r.record === "string" ? r.record : String(r.alert ?? "")}`;
+                for (const issue of collectorMetricIssues(r.expr, emitted)) {
+                    const message = `rule ${subject} ${issue.message}`;
+                    out.push({
+                        checkId: "PROM301",
+                        severity: "warning",
+                        message: source && source !== "prometheus" ? `${source}: ${message}` : message,
+                        entity: subject,
+                        lexicon: "prometheus",
+                    });
+                }
+            }
+        }
+    }
+    return out;
+}
+/** PROM202: joins every rule file in the output against every Alertmanager config in it. Silent when either is absent. */
+export function routingDiagnostics(ctx) {
+    const { ruleFiles, alertmanager } = prometheusDocs(ctx);
+    if (ruleFiles.length === 0)
+        return [];
+    const files = ruleFiles.map((r) => r.config);
+    return alertmanager.flatMap(({ source, config }) => validateSeverityRouting(files, config).map((i) => toDiagnostic(i, source)));
+}
+/**
+ * The rule-file checks (PROM101-PROM107, PROM211, PROM213-PROM219) over the
+ * groups of every `PrometheusRule` in the build, whichever lexicon emitted
+ * it. `spec.groups` is a rule file's `groups`, so `validateRuleFile` reads it
+ * as is. Findings keep their PROM ids and name the PrometheusRule's namespace
+ * and name. PROM212 (runbook URLs) stays opt-in and is not run here.
+ */
+export function prometheusRuleDiagnostics(ctx) {
+    const out = [];
+    for (const output of ctx.outputs.values()) {
+        const text = typeof output === "string" ? output : output.primary;
+        if (!text)
+            continue;
+        let docs;
+        try {
+            docs = loadAll(text);
+        }
+        catch {
+            continue;
+        }
+        for (const raw of docs) {
+            const doc = raw;
+            if (!doc || typeof doc !== "object" || doc.kind !== "PrometheusRule")
+                continue;
+            if (typeof doc.apiVersion !== "string" || !doc.apiVersion.startsWith("monitoring.coreos.com/"))
+                continue;
+            const groups = doc.spec?.groups;
+            if (!Array.isArray(groups))
+                continue;
+            const name = String(doc.metadata?.name ?? "");
+            const source = `PrometheusRule ${doc.metadata?.namespace ? `${doc.metadata.namespace}/` : ""}${name}`;
+            for (const issue of validateRuleFile({ groups })) {
+                if (issue.code === "PROM212")
+                    continue;
+                out.push({ ...toDiagnostic(issue, source), ...(issue.subject ? {} : { entity: name }) });
+            }
+        }
+    }
+    return out;
+}

package/dist/lint/post-synth/prom101.js

@@ -0,0 +1,13 @@
+/**
+ * PROM101: Two rule groups in one rule file share a name
+ *
+ * Prometheus refuses to load a rule file whose group names repeat.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom101 = {
+    id: "PROM101",
+    description: "Two rule groups in one rule file share a name",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM101");
+    },
+};

package/dist/lint/post-synth/prom102.js

@@ -0,0 +1,13 @@
+/**
+ * PROM102: Two rules share a name and label set
+ *
+ * Two recording rules (or two alerts) with the same name and labels produce the same series and overwrite each other. This follows promtool's duplicate-rules lint: alerts that share a name and differ by a label, such as severity, are fine.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom102 = {
+    id: "PROM102",
+    description: "Two rules share a name and label set",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM102");
+    },
+};

package/dist/lint/post-synth/prom103.js

@@ -0,0 +1,13 @@
+/**
+ * PROM103: A rule or group duration is not a Prometheus duration
+ *
+ * for, keep_firing_for, interval and query_offset take durations such as 30s, 5m or 1h30m. Prometheus refuses the rule file otherwise.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom103 = {
+    id: "PROM103",
+    description: "A rule or group duration is not a Prometheus duration",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM103");
+    },
+};

package/dist/lint/post-synth/prom104.js

@@ -0,0 +1,13 @@
+/**
+ * PROM104: A rule expression is not valid PromQL
+ *
+ * Every expr is parsed with the PromQL grammar the Prometheus project publishes. A syntax error fails the rule file at load time.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom104 = {
+    id: "PROM104",
+    description: "A rule expression is not valid PromQL",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM104");
+    },
+};

package/dist/lint/post-synth/prom105.js

@@ -0,0 +1,13 @@
+/**
+ * PROM105: A rule or group is malformed
+ *
+ * A rule sets exactly one of record and alert, has a non-empty name, and a recording rule takes no for, keep_firing_for or annotations. A group has a name.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom105 = {
+    id: "PROM105",
+    description: "A rule or group is malformed",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM105");
+    },
+};

package/dist/lint/post-synth/prom106.js

@@ -0,0 +1,13 @@
+/**
+ * PROM106: An alerting rule has no severity label
+ *
+ * Alertmanager routes on labels, and severity is the one every route in this lexicon's examples and checks keys on. Without it the alert can only be routed by name.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom106 = {
+    id: "PROM106",
+    description: "An alerting rule has no severity label",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM106");
+    },
+};

package/dist/lint/post-synth/prom107.js

@@ -0,0 +1,13 @@
+/**
+ * PROM107: An alerting rule has no summary or description annotation
+ *
+ * A notification carries only the alert's labels unless an annotation says what is wrong.
+ */
+import { ruleFileDiagnostics } from "./prom-helpers.js";
+export const prom107 = {
+    id: "PROM107",
+    description: "An alerting rule has no summary or description annotation",
+    check(ctx) {
+        return ruleFileDiagnostics(ctx, "PROM107");
+    },
+};

package/dist/lint/post-synth/prom201.js

@@ -0,0 +1,13 @@
+/**
+ * PROM201: A route sends to a receiver that is not declared
+ *
+ * Alertmanager refuses a config whose routes name an undefined receiver.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom201 = {
+    id: "PROM201",
+    description: "A route sends to a receiver that is not declared",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM201");
+    },
+};

package/dist/lint/post-synth/prom202.js

@@ -0,0 +1,13 @@
+/**
+ * PROM202: An alert severity is not routed by any route
+ *
+ * Joins the rule files and the Alertmanager config in one build root. An alert whose severity no route below the root matches falls through to the root's default receiver. Silent when the rules and the Alertmanager config are built in different build roots (chant #1939).
+ */
+import { routingDiagnostics } from "./prom-helpers.js";
+export const prom202 = {
+    id: "PROM202",
+    description: "An alert severity is not routed by any route",
+    check(ctx) {
+        return routingDiagnostics(ctx);
+    },
+};

package/dist/lint/post-synth/prom203.js

@@ -0,0 +1,13 @@
+/**
+ * PROM203: Two receivers or two time intervals share a name
+ *
+ * Alertmanager refuses a config with repeated receiver or time interval names.
+ */
+import { alertmanagerDiagnostics } from "./prom-helpers.js";
+export const prom203 = {
+    id: "PROM203",
+    description: "Two receivers or two time intervals share a name",
+    check(ctx) {
+        return alertmanagerDiagnostics(ctx, "PROM203");
+    },
+};