@intentius/chant-lexicon-prometheus 0.124.31 → 0.124.32

package/dist/config.js

@@ -0,0 +1,225 @@
+/**
+ * The `prometheus` namespace in `chant.config.ts` (#3371): which ruler and
+ * which Alertmanager each chant environment observes and imports from, and
+ * (#3372) applies to.
+ *
+ * ```ts
+ * import type { ChantConfig } from "@intentius/chant/config";
+ * import "@intentius/chant-lexicon-prometheus";   // brings the `prometheus` key into ChantConfig
+ *
+ * export default {
+ *   lexicons: ["prometheus"],
+ *   prometheus: {
+ *     profiles: {
+ *       prod: {
+ *         ruler: { kind: "mimir", url: "https://mimir.example.com", tenant: "shop", namespace: "shop-rules", token: { env: "MIMIR_TOKEN" } },
+ *         alertmanager: { kind: "mimir", url: "https://mimir.example.com", tenant: "shop", token: { env: "MIMIR_TOKEN" } },
+ *       },
+ *     },
+ *   },
+ * } satisfies ChantConfig;
+ * ```
+ *
+ * A rule file has no namespace and no ownership marker, so the ruler
+ * namespaces a profile names are the boundary: `namespace` is where the
+ * project's groups live, `groupNamespaces` moves single groups to another,
+ * and nothing outside those namespaces is read for import or written by an
+ * apply. On a plain Prometheus the "namespace" is the rule file path
+ * `/api/v1/rules` reports as `file`, and may be left out.
+ *
+ * Credentials are named by their environment variable, never written in the
+ * config. An environment with no profile falls back to environment
+ * variables (see {@link resolveRulerTarget} and
+ * {@link resolveAlertmanagerTarget}).
+ */
+import { z } from "zod";
+const envRef = z.strictObject({ env: z.string() });
+const basicAuth = z.strictObject({ user: envRef, password: envRef });
+/** The rulers chant reads rule groups from. `prometheus` is a plain Prometheus, read over `/api/v1/rules`. */
+export const RULER_KINDS = ["mimir", "cortex", "loki", "prometheus"];
+/** Where an Alertmanager config is read: a plain Alertmanager's `/api/v2/status`, or Mimir's and Cortex's `/api/v1/alerts`. */
+export const ALERTMANAGER_KINDS = ["alertmanager", "mimir", "cortex"];
+export const rulerProfileSchema = z.strictObject({
+    kind: z.enum(RULER_KINDS),
+    /** Base URL: the Mimir, Cortex or Loki endpoint the ruler API is served on, or the Prometheus server. */
+    url: z.string(),
+    /** `X-Scope-OrgID`. */
+    tenant: z.string().optional(),
+    /** The ruler namespace the project's rule groups live in (on a plain Prometheus, the rule file path). */
+    namespace: z.string().optional(),
+    /** Groups that live in another namespace than `namespace`, by group name. */
+    groupNamespaces: z.record(z.string(), z.string()).optional(),
+    /** Mimir's or Cortex's `-http.prometheus-http-prefix`. Defaults to `/prometheus` (to nothing for a plain Prometheus). */
+    prometheusPrefix: z.string().optional(),
+    token: envRef.optional(),
+    basicAuth: basicAuth.optional(),
+});
+export const alertmanagerProfileSchema = z.strictObject({
+    kind: z.enum(ALERTMANAGER_KINDS).optional(),
+    url: z.string(),
+    /** `X-Scope-OrgID`, for Mimir and Cortex. */
+    tenant: z.string().optional(),
+    /** Mimir's or Cortex's `-http.alertmanager-http-prefix`. Defaults to `/alertmanager`. */
+    alertmanagerPrefix: z.string().optional(),
+    token: envRef.optional(),
+    basicAuth: basicAuth.optional(),
+});
+export const prometheusProfileSchema = z.strictObject({
+    ruler: rulerProfileSchema.optional(),
+    alertmanager: alertmanagerProfileSchema.optional(),
+});
+export const prometheusConfigSchema = z.strictObject({
+    /** One ruler and one Alertmanager per chant environment. */
+    profiles: z.record(z.string(), prometheusProfileSchema).optional(),
+});
+export function isUnresolvedTarget(v) {
+    return "reason" in v;
+}
+/**
+ * The namespaces a ruler target declares, deduplicated, in the order they
+ * are named. This is the ownership boundary: import reads only these, and
+ * an apply (#3372) writes and deletes only inside these.
+ */
+export function declaredNamespaces(target) {
+    const out = [];
+    for (const ns of [target.namespace, ...Object.values(target.groupNamespaces)]) {
+        if (ns !== undefined && ns !== "" && !out.includes(ns))
+            out.push(ns);
+    }
+    return out;
+}
+/** The namespace a declared group lives in: its `groupNamespaces` entry, else `namespace`. */
+export function namespaceOfGroup(target, group) {
+    return target.groupNamespaces[group] ?? target.namespace;
+}
+function profileAuth(source, profile, env) {
+    if (profile.token) {
+        const token = env[profile.token.env];
+        if (!token)
+            return { reason: "no-credentials", detail: `${source}.token names ${profile.token.env}, which is not set` };
+        return { token };
+    }
+    if (profile.basicAuth) {
+        const user = env[profile.basicAuth.user.env];
+        const password = env[profile.basicAuth.password.env];
+        if (!user || !password) {
+            const missing = [!user ? profile.basicAuth.user.env : undefined, !password ? profile.basicAuth.password.env : undefined].filter(Boolean).join(" and ");
+            return { reason: "no-credentials", detail: `${source}.basicAuth names ${missing}, which ${missing.includes(" and ") ? "are" : "is"} not set` };
+        }
+        return { user, password };
+    }
+    return undefined;
+}
+function envAuth(env, prefix) {
+    const token = env[`${prefix}_TOKEN`];
+    if (token)
+        return { token };
+    const user = env[`${prefix}_USER`];
+    const password = env[`${prefix}_PASSWORD`];
+    return user && password ? { user, password } : undefined;
+}
+const trim = (url) => url.replace(/\/+$/, "");
+const prefixOf = (p, fallback) => (p === undefined ? fallback : p === "" ? "" : `/${p.replace(/^\/+|\/+$/g, "")}`);
+/**
+ * The ruler an environment reads from. Pure: `config` and `env` are passed in.
+ *
+ * 1. `prometheus.profiles.<environment>.ruler`. A profile that names a
+ *    credential variable which is not set is `no-credentials`.
+ * 2. `PROMETHEUS_RULER_URL`, with `PROMETHEUS_RULER_KIND` (default `mimir`),
+ *    `PROMETHEUS_RULER_TENANT`, `PROMETHEUS_RULER_NAMESPACE` and
+ *    `PROMETHEUS_RULER_TOKEN` (or `_USER` and `_PASSWORD`).
+ * 3. `PROMETHEUS_URL`: a plain Prometheus, read over `/api/v1/rules`.
+ * 4. Otherwise `no-binding`.
+ */
+export function resolveRulerTarget(input) {
+    const env = input.env ?? process.env;
+    const profile = input.environment !== undefined ? input.config?.prometheus?.profiles?.[input.environment]?.ruler : undefined;
+    if (profile) {
+        const source = `prometheus.profiles.${input.environment}.ruler`;
+        const auth = profileAuth(source, profile, env);
+        if (auth && isUnresolvedTarget(auth))
+            return auth;
+        if (profile.kind !== "prometheus" && !profile.namespace) {
+            return { reason: "no-binding", detail: `${source}.namespace is not set, and a ${profile.kind} ruler's groups live in a namespace` };
+        }
+        return {
+            kind: profile.kind,
+            url: trim(profile.url),
+            ...(profile.tenant ? { tenant: profile.tenant } : {}),
+            ...(auth ? { auth } : {}),
+            ...(profile.namespace ? { namespace: profile.namespace } : {}),
+            groupNamespaces: profile.groupNamespaces ?? {},
+            prometheusPrefix: prefixOf(profile.prometheusPrefix, profile.kind === "prometheus" ? "" : "/prometheus"),
+            source,
+        };
+    }
+    const where = input.environment !== undefined ? `prometheus.profiles.${input.environment}.ruler is not declared and ` : "";
+    const rulerUrl = env.PROMETHEUS_RULER_URL;
+    if (rulerUrl) {
+        const kind = (env.PROMETHEUS_RULER_KIND ?? "mimir");
+        if (!RULER_KINDS.includes(kind)) {
+            return { reason: "no-binding", detail: `PROMETHEUS_RULER_KIND is "${kind}", not one of ${RULER_KINDS.join(", ")}` };
+        }
+        const auth = envAuth(env, "PROMETHEUS_RULER");
+        return {
+            kind,
+            url: trim(rulerUrl),
+            ...(env.PROMETHEUS_RULER_TENANT ? { tenant: env.PROMETHEUS_RULER_TENANT } : {}),
+            ...(auth ? { auth } : {}),
+            ...(env.PROMETHEUS_RULER_NAMESPACE ? { namespace: env.PROMETHEUS_RULER_NAMESPACE } : {}),
+            groupNamespaces: {},
+            prometheusPrefix: "/prometheus",
+            source: "env PROMETHEUS_RULER_URL",
+        };
+    }
+    const promUrl = env.PROMETHEUS_URL;
+    if (promUrl) {
+        const auth = envAuth(env, "PROMETHEUS");
+        return { kind: "prometheus", url: trim(promUrl), ...(auth ? { auth } : {}), groupNamespaces: {}, prometheusPrefix: "", source: "env PROMETHEUS_URL" };
+    }
+    return { reason: "no-binding", detail: `${where}neither PROMETHEUS_RULER_URL nor PROMETHEUS_URL is set, so there is no ruler to read` };
+}
+/**
+ * The Alertmanager an environment reads from. Pure.
+ *
+ * 1. `prometheus.profiles.<environment>.alertmanager`.
+ * 2. `ALERTMANAGER_URL`, with `ALERTMANAGER_KIND` (default `alertmanager`),
+ *    `ALERTMANAGER_TENANT` and `ALERTMANAGER_TOKEN` (or `_USER` and `_PASSWORD`).
+ * 3. Otherwise `no-binding`.
+ */
+export function resolveAlertmanagerTarget(input) {
+    const env = input.env ?? process.env;
+    const profile = input.environment !== undefined ? input.config?.prometheus?.profiles?.[input.environment]?.alertmanager : undefined;
+    if (profile) {
+        const source = `prometheus.profiles.${input.environment}.alertmanager`;
+        const auth = profileAuth(source, profile, env);
+        if (auth && isUnresolvedTarget(auth))
+            return auth;
+        return {
+            kind: profile.kind ?? "alertmanager",
+            url: trim(profile.url),
+            ...(profile.tenant ? { tenant: profile.tenant } : {}),
+            ...(auth ? { auth } : {}),
+            alertmanagerPrefix: prefixOf(profile.alertmanagerPrefix, "/alertmanager"),
+            source,
+        };
+    }
+    const url = env.ALERTMANAGER_URL;
+    if (!url) {
+        const where = input.environment !== undefined ? `prometheus.profiles.${input.environment}.alertmanager is not declared and ` : "";
+        return { reason: "no-binding", detail: `${where}ALERTMANAGER_URL is not set, so there is no Alertmanager to read` };
+    }
+    const kind = (env.ALERTMANAGER_KIND ?? "alertmanager");
+    if (!ALERTMANAGER_KINDS.includes(kind)) {
+        return { reason: "no-binding", detail: `ALERTMANAGER_KIND is "${kind}", not one of ${ALERTMANAGER_KINDS.join(", ")}` };
+    }
+    const auth = envAuth(env, "ALERTMANAGER");
+    return {
+        kind,
+        url: trim(url),
+        ...(env.ALERTMANAGER_TENANT ? { tenant: env.ALERTMANAGER_TENANT } : {}),
+        ...(auth ? { auth } : {}),
+        alertmanagerPrefix: "/alertmanager",
+        source: "env ALERTMANAGER_URL",
+    };
+}

package/dist/describe-resources.js

@@ -0,0 +1,299 @@
+/**
+ * `describeResources()` for prometheus (#3371): is each declared rule group
+ * loaded on the environment's ruler and is it healthy, and is each declared
+ * Alertmanager entity in the config the environment's Alertmanager runs.
+ *
+ * Runs on core's observer harness. `bind()` resolves the ruler and the
+ * Alertmanager (./api/bind.ts), each on its own, so a project with only rule
+ * groups is not held up by having no Alertmanager. Verdicts:
+ *
+ * | Entity | Read | Absent when |
+ * |---|---|---|
+ * | `RuleGroup` on Mimir, Cortex, Loki | the config API's `/{namespace}/{group}`, in the namespace the profile gives the group | 404 |
+ * | `RuleGroup` on a plain Prometheus | `/api/v1/rules`, by name (and rule file, when the profile names one) | not listed |
+ * | `Receiver`, `TimeInterval` | the loaded Alertmanager config, by name | no entry of that name |
+ * | `Route` | the loaded routing tree, by receiver and matchers | no route with both |
+ * | `InhibitRule` | the loaded inhibit rules, by matchers and `equal` | no equal rule |
+ * | `AlertmanagerSettings` | the loaded config | no config (Mimir: the tenant has none) |
+ * | `ScrapeConfig`, `PrometheusConfig` | none: `prometheus.yml` is a file on disk | `unsupported-kind` |
+ *
+ * A group's health is from `/api/v1/rules` (./api/evaluated.ts): `health`
+ * (`ok`, `err`, `unknown`), the first rule error, and how many alerts are
+ * firing or pending. A failed health read leaves the group present with
+ * `health: "unknown"` and the reason; presence is the config API's answer.
+ * The Alertmanager's cluster status and version ride on its entities.
+ *
+ * Ownership: a rule group and an Alertmanager config carry no marker
+ * (./serializer.ts), so every verdict is `unknown`, and an `owned: true`
+ * read withholds them as `filtered`. What bounds chant on a ruler is the
+ * namespace: groups are only read in the namespaces the profile declares
+ * (./config.ts).
+ */
+import { createHash } from "node:crypto";
+import { observeEntities, } from "@intentius/chant/observation";
+import { bindEndpoints, classifyPromFailure } from "./api/bind.js";
+import { PromApiError } from "./api/client.js";
+import { groupHealth } from "./api/evaluated.js";
+import { isUnresolvedTarget, namespaceOfGroup } from "./config.js";
+import { INHIBIT_RULE_TYPE, RECEIVER_TYPE, ROUTE_TYPE, SETTINGS_TYPE, TIME_INTERVAL_TYPE } from "./alertmanager.js";
+import { RULE_GROUP_TYPE } from "./rules.js";
+import { PROMETHEUS_CONFIG_TYPE, SCRAPE_CONFIG_TYPE } from "./prometheus-config.js";
+import { loadPrometheusYaml, parseAlertmanagerDocument } from "./import/parser.js";
+import { stripAlertmanagerDefaults } from "./import/alertmanager-live.js";
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** What `unsupported-kind` says about `prometheus.yml` entities. */
+export const PROMETHEUS_CONFIG_NOT_OBSERVED = "prometheus.yml is a file Prometheus reads from disk, not something its API serves for comparison; observe it through the lexicon that deploys it";
+/** A failed read as the harness's per-entity verdict; anything else is rethrown for the harness to record. */
+function unobservedFrom(err) {
+    if (err instanceof PromApiError)
+        return { unobserved: classifyPromFailure(err) };
+    throw err;
+}
+function unbound(u) {
+    return { unobserved: { reason: u.reason, detail: u.detail } };
+}
+const FILTERED_DETAIL = "carries no ownership marker, so an owned-only read cannot show it is chant's";
+// ── rule groups ─────────────────────────────────────────────────────
+async function healthAttributes(ruler, file, name) {
+    try {
+        const groups = await ruler.evaluated();
+        const g = groups.find((x) => x.name === name && (file === undefined || x.file === file));
+        if (!g)
+            return { health: "unknown", healthDetail: `the ruler does not report "${name}" in ${ruler.evaluatedPath} yet` };
+        const h = groupHealth(g);
+        return {
+            health: h.health,
+            ...(h.lastError ? { lastError: h.lastError } : {}),
+            failing: h.failing,
+            firing: h.firing,
+            pending: h.pending,
+        };
+    }
+    catch (err) {
+        return { health: "unknown", healthDetail: classifyPromFailure(err).detail };
+    }
+}
+async function observeRuleGroup(ruler, entity, owned) {
+    const name = typeof entity.props.name === "string" ? entity.props.name : entity.name;
+    if (ruler.target.kind === "prometheus") {
+        const file = namespaceOfGroup(ruler.target, name);
+        let groups;
+        try {
+            groups = await ruler.evaluated();
+        }
+        catch (err) {
+            return unobservedFrom(err);
+        }
+        const queried = ruler.evaluatedPath;
+        const g = groups.find((x) => x.name === name && (file === undefined || x.file === file));
+        if (!g)
+            return { absent: true, queried };
+        if (owned)
+            return { unobserved: { reason: "filtered", detail: `rule group "${name}" is loaded but ${FILTERED_DETAIL}` }, queried };
+        const h = groupHealth(g);
+        return {
+            present: {
+                type: RULE_GROUP_TYPE,
+                physicalId: `${g.file}/${name}`,
+                status: "PRESENT",
+                ownership: "unknown",
+                attributes: {
+                    file: g.file,
+                    rules: g.rules.length,
+                    health: h.health,
+                    ...(h.lastError ? { lastError: h.lastError } : {}),
+                    failing: h.failing,
+                    firing: h.firing,
+                    pending: h.pending,
+                },
+            },
+            queried,
+        };
+    }
+    const namespace = namespaceOfGroup(ruler.target, name);
+    if (namespace === undefined) {
+        return { unobserved: { reason: "no-binding", detail: `${ruler.target.source} names no namespace for rule group "${name}"` } };
+    }
+    const queried = ruler.groupPath(namespace, name);
+    let raw;
+    try {
+        raw = await ruler.readGroup(namespace, name);
+    }
+    catch (err) {
+        return unobservedFrom(err);
+    }
+    if (!raw)
+        return { absent: true, queried };
+    if (owned)
+        return { unobserved: { reason: "filtered", detail: `rule group "${name}" is in namespace "${namespace}" but ${FILTERED_DETAIL}` }, queried };
+    const meta = {
+        type: RULE_GROUP_TYPE,
+        physicalId: `${namespace}/${name}`,
+        status: "PRESENT",
+        ownership: "unknown",
+        attributes: {
+            namespace,
+            rules: Array.isArray(raw.rules) ? raw.rules.length : 0,
+            ...(typeof raw.interval === "string" ? { interval: raw.interval } : {}),
+            ...(await healthAttributes(ruler, namespace, name)),
+        },
+    };
+    return { present: meta, queried };
+}
+async function loadAlertmanager(am) {
+    return am.client.once("observe:config", async () => {
+        const live = await am.readConfig();
+        if (!live)
+            return undefined;
+        const loaded = loadPrometheusYaml(live.text);
+        if (!isObject(loaded))
+            throw new PromApiError(502, "GET", live.address, "the Alertmanager config is not a YAML mapping");
+        const doc = live.remarshalled ? stripAlertmanagerDefaults(loaded) : loaded;
+        const health = (await am.health()) ?? {};
+        return {
+            config: parseAlertmanagerDocument(doc).config,
+            address: live.address,
+            digest: createHash("sha256").update(live.text).digest("hex").slice(0, 16),
+            health: { ...health },
+        };
+    });
+}
+/** `name="value"`, whatever spacing and quoting it was written with. */
+function normalMatcher(m) {
+    const match = /^\s*([^=!~\s]+)\s*(=~|!~|!=|=)\s*(.*?)\s*$/.exec(m);
+    if (!match)
+        return m.trim();
+    let value = match[3];
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            value = value.slice(1, -1);
+        }
+    }
+    return `${match[1]}${match[2]}${JSON.stringify(value)}`;
+}
+function matcherKey(list) {
+    return (Array.isArray(list) ? list.map((m) => normalMatcher(String(m))) : []).sort().join(",");
+}
+function nameOf(ref) {
+    if (typeof ref === "string")
+        return ref;
+    if (isObject(ref) && isObject(ref.props) && typeof ref.props.name === "string")
+        return ref.props.name;
+    return undefined;
+}
+function routeKey(receiver, matchers) {
+    return `${nameOf(receiver) ?? ""}{${matcherKey(matchers)}}`;
+}
+function routesOf(root) {
+    if (!root)
+        return [];
+    const out = [root];
+    for (const child of root.routes ?? [])
+        out.push(...routesOf(child));
+    return out;
+}
+function inhibitKey(r) {
+    const rule = isObject(r) ? r : {};
+    const equal = Array.isArray(rule.equal) ? [...rule.equal].map(String).sort().join(",") : "";
+    return `${matcherKey(rule.source_matchers)}=>${matcherKey(rule.target_matchers)}/${equal}`;
+}
+async function observeAlertmanagerEntity(am, entity, owned) {
+    let loaded;
+    try {
+        loaded = await loadAlertmanager(am);
+    }
+    catch (err) {
+        return unobservedFrom(err);
+    }
+    const queried = am.target.kind === "alertmanager" ? am.statusPath : "/api/v1/alerts";
+    if (!loaded)
+        return { absent: true, queried };
+    const { config, health } = loaded;
+    const props = entity.props;
+    let physicalId;
+    let attributes = {};
+    switch (entity.type) {
+        case RECEIVER_TYPE: {
+            const r = (config.receivers ?? []).find((x) => x.name === props.name);
+            if (r) {
+                physicalId = `receiver/${r.name}`;
+                attributes = { integrations: Object.keys(r).filter((k) => k.endsWith("_configs")).sort() };
+            }
+            break;
+        }
+        case TIME_INTERVAL_TYPE: {
+            const t = (config.time_intervals ?? []).find((x) => x.name === props.name);
+            if (t)
+                physicalId = `time_interval/${t.name}`;
+            break;
+        }
+        case ROUTE_TYPE: {
+            const key = routeKey(props.receiver, props.matchers);
+            const r = routesOf(config.route).find((x) => routeKey(x.receiver, x.matchers) === key);
+            if (r) {
+                physicalId = `route/${key}`;
+                attributes = { receiver: r.receiver ?? "", routes: (r.routes ?? []).length };
+            }
+            break;
+        }
+        case INHIBIT_RULE_TYPE: {
+            const key = inhibitKey(props);
+            const i = (config.inhibit_rules ?? []).findIndex((x) => inhibitKey(x) === key);
+            if (i >= 0)
+                physicalId = `inhibit_rule/${i}`;
+            break;
+        }
+        case SETTINGS_TYPE:
+            physicalId = "alertmanager";
+            attributes = { configDigest: loaded.digest, ...(config.templates ? { templates: config.templates.length } : {}) };
+            break;
+        default:
+            return { unobserved: { reason: "unsupported-kind", detail: `no prometheus reader for ${entity.type}` } };
+    }
+    if (physicalId === undefined)
+        return { absent: true, queried };
+    if (owned)
+        return { unobserved: { reason: "filtered", detail: `${entity.name} is in the loaded Alertmanager config but ${FILTERED_DETAIL}` }, queried };
+    return {
+        present: { type: entity.type, physicalId, status: "PRESENT", ownership: "unknown", attributes: { ...attributes, ...health } },
+        queried,
+    };
+}
+// ── harness ─────────────────────────────────────────────────────────
+const ALERTMANAGER_TYPES = new Set([RECEIVER_TYPE, ROUTE_TYPE, INHIBIT_RULE_TYPE, TIME_INTERVAL_TYPE, SETTINGS_TYPE]);
+function adapter(options) {
+    return {
+        bind: () => bindEndpoints({ ...options }),
+        classifyBindFailure: (err) => classifyPromFailure(err),
+        async read(endpoints, entity) {
+            if (entity.type === RULE_GROUP_TYPE) {
+                return isUnresolvedTarget(endpoints.ruler) ? unbound(endpoints.ruler) : observeRuleGroup(endpoints.ruler, entity, options.owned);
+            }
+            if (ALERTMANAGER_TYPES.has(entity.type)) {
+                return isUnresolvedTarget(endpoints.alertmanager)
+                    ? unbound(endpoints.alertmanager)
+                    : observeAlertmanagerEntity(endpoints.alertmanager, entity, options.owned);
+            }
+            if (entity.type === SCRAPE_CONFIG_TYPE || entity.type === PROMETHEUS_CONFIG_TYPE) {
+                return { unobserved: { reason: "unsupported-kind", detail: PROMETHEUS_CONFIG_NOT_OBSERVED } };
+            }
+            return { unobserved: { reason: "unsupported-kind", detail: `no prometheus reader for ${entity.type}` } };
+        },
+    };
+}
+/** Observe every declared prometheus entity against the environment's ruler and Alertmanager. */
+export async function describeResources(options) {
+    const declared = [];
+    for (const name of options.entityNames) {
+        const entity = options.entities.get(name);
+        if (!entity)
+            continue;
+        declared.push({ name, type: entity.entityType, props: entity.props });
+    }
+    return observeEntities(declared, adapter(options));
+}

package/dist/detect.js

@@ -0,0 +1,12 @@
+/**
+ * Template detection for the prometheus lexicon: a parsed document is ours
+ * when it is shaped like a rule file (`groups:` of named rule lists), an
+ * `alertmanager.yml` (`route:` or `receivers:` at the top level) or a
+ * `prometheus.yml` (`scrape_configs:`, `remote_write:` and the like). Kept free
+ * of the plugin and the TypeScript compiler so it bundles for edge runtimes,
+ * like the other lexicons' `detect` modules.
+ */
+import { looksLikeAlertmanagerConfig, looksLikePrometheusConfig, looksLikeRuleFile } from "./model.js";
+export function detectTemplate(data) {
+    return looksLikeRuleFile(data) || looksLikeAlertmanagerConfig(data) || looksLikePrometheusConfig(data);
+}

package/dist/duration.js

@@ -0,0 +1,54 @@
+/**
+ * Prometheus durations, as `model.ParseDuration` reads them.
+ *
+ * A duration is one or more `<number><unit>` terms, units in descending
+ * order and each at most once: `y`, `w`, `d`, `h`, `m`, `s`, `ms`. `1h30m`
+ * is valid, `30m1h` and `1.5h` are not. `0` on its own is valid. Prometheus
+ * (rule `for`, `interval`, range selectors) and Alertmanager (`group_wait`,
+ * `resolve_timeout`) share this grammar.
+ */
+const DURATION = /^(?:(\d+)y)?(?:(\d+)w)?(?:(\d+)d)?(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?(?:(\d+)ms)?$/;
+const UNIT_MS = [365 * 86400000, 7 * 86400000, 86400000, 3600000, 60000, 1000, 1];
+/** True when `value` is a Prometheus duration string. */
+export function isValidDuration(value) {
+    if (typeof value !== "string" || value === "")
+        return false;
+    if (value === "0")
+        return true;
+    return DURATION.test(value);
+}
+/** A duration in milliseconds, or `undefined` when it isn't a valid duration. */
+export function durationMs(value) {
+    if (value === "0")
+        return 0;
+    if (value === "")
+        return undefined;
+    const m = DURATION.exec(value);
+    if (!m)
+        return undefined;
+    let total = 0;
+    for (let i = 0; i < UNIT_MS.length; i++) {
+        const n = m[i + 1];
+        if (n !== undefined)
+            total += Number(n) * UNIT_MS[i];
+    }
+    return total;
+}
+/** Write a millisecond count as the shortest Prometheus duration, e.g. `5400000` -> `1h30m`. */
+export function formatDuration(ms) {
+    if (!Number.isInteger(ms) || ms < 0)
+        throw new Error(`prometheus: ${ms} is not a whole, non-negative number of milliseconds`);
+    if (ms === 0)
+        return "0s";
+    const units = ["y", "w", "d", "h", "m", "s", "ms"];
+    let rest = ms;
+    let out = "";
+    for (let i = 0; i < UNIT_MS.length; i++) {
+        const n = Math.floor(rest / UNIT_MS[i]);
+        if (n > 0) {
+            out += `${n}${units[i]}`;
+            rest -= n * UNIT_MS[i];
+        }
+    }
+    return out;
+}