@intentius/chant-lexicon-prometheus 0.96.0

package/src/lint/post-synth/prom104.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM104: A rule expression is not valid PromQL
+ *
+ * Every expr is parsed with the PromQL grammar the Prometheus project publishes. A syntax error fails the rule file at load time.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom104: PostSynthCheck = {
+  id: "PROM104",
+  description: "A rule expression is not valid PromQL",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM104");
+  },
+};

package/src/lint/post-synth/prom105.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM105: A rule or group is malformed
+ *
+ * A rule sets exactly one of record and alert, has a non-empty name, and a recording rule takes no for, keep_firing_for or annotations. A group has a name.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom105: PostSynthCheck = {
+  id: "PROM105",
+  description: "A rule or group is malformed",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM105");
+  },
+};

package/src/lint/post-synth/prom106.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM106: An alerting rule has no severity label
+ *
+ * Alertmanager routes on labels, and severity is the one every route in this lexicon's examples and checks keys on. Without it the alert can only be routed by name.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom106: PostSynthCheck = {
+  id: "PROM106",
+  description: "An alerting rule has no severity label",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM106");
+  },
+};

package/src/lint/post-synth/prom107.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM107: An alerting rule has no summary or description annotation
+ *
+ * A notification carries only the alert's labels unless an annotation says what is wrong.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom107: PostSynthCheck = {
+  id: "PROM107",
+  description: "An alerting rule has no summary or description annotation",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM107");
+  },
+};

package/src/lint/post-synth/prom201.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM201: A route sends to a receiver that is not declared
+ *
+ * Alertmanager refuses a config whose routes name an undefined receiver.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom201: PostSynthCheck = {
+  id: "PROM201",
+  description: "A route sends to a receiver that is not declared",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM201");
+  },
+};

package/src/lint/post-synth/prom202.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM202: An alert severity is not routed by any route
+ *
+ * Joins the rule files and the Alertmanager config in one build root. An alert whose severity no route below the root matches falls through to the root's default receiver. Silent when the rules and the Alertmanager config are built in different build roots (chant #1939).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { routingDiagnostics } from "./prom-helpers";
+
+export const prom202: PostSynthCheck = {
+  id: "PROM202",
+  description: "An alert severity is not routed by any route",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return routingDiagnostics(ctx);
+  },
+};

package/src/lint/post-synth/prom203.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM203: Two receivers or two time intervals share a name
+ *
+ * Alertmanager refuses a config with repeated receiver or time interval names.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom203: PostSynthCheck = {
+  id: "PROM203",
+  description: "Two receivers or two time intervals share a name",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM203");
+  },
+};

package/src/lint/post-synth/prom204.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM204: A route names a time interval that is not declared
+ *
+ * mute_time_intervals and active_time_intervals must name entries under time_intervals.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom204: PostSynthCheck = {
+  id: "PROM204",
+  description: "A route names a time interval that is not declared",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM204");
+  },
+};

package/src/lint/post-synth/prom205.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM205: The root route is missing, has no receiver, or has matchers
+ *
+ * The root route is the default for every alert: it must exist, name a receiver and match everything.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom205: PostSynthCheck = {
+  id: "PROM205",
+  description: "The root route is missing, has no receiver, or has matchers",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM205");
+  },
+};

package/src/lint/post-synth/prom206.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM206: A route or inhibit rule matcher does not parse
+ *
+ * Matchers are label, operator (=, !=, =~, !~) and value, e.g. severity="page".
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom206: PostSynthCheck = {
+  id: "PROM206",
+  description: "A route or inhibit rule matcher does not parse",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM206");
+  },
+};

package/src/lint/post-synth/prom207.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM207: A receiver is declared but no route sends to it
+ *
+ * An unused receiver usually means a route names the wrong one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom207: PostSynthCheck = {
+  id: "PROM207",
+  description: "A receiver is declared but no route sends to it",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM207");
+  },
+};

package/src/lint/post-synth/prom208.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM208: An Alertmanager duration is not a duration
+ *
+ * group_wait, group_interval, repeat_interval, resolve_timeout and webhook timeout take durations such as 30s or 4h.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom208: PostSynthCheck = {
+  id: "PROM208",
+  description: "An Alertmanager duration is not a duration",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM208");
+  },
+};

package/src/lint/post-synth/prom209.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM209: A receiver integration is missing its destination or credential
+ *
+ * A webhook needs url or url_file, Slack an api_url (or the global one), PagerDuty a routing_key or service_key, and email a to address, a smarthost and a from address (or their global defaults).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom209: PostSynthCheck = {
+  id: "PROM209",
+  description: "A receiver integration is missing its destination or credential",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM209");
+  },
+};

package/src/lint/rules/index.ts

@@ -0,0 +1,11 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+import { literalCredentialRule } from "./literal-credential";
+import { promqlLiteralRule } from "./promql-literal";
+import { sloLiteralRule } from "./slo-literal";
+
+export { literalCredentialRule, SECRET_FIELDS } from "./literal-credential";
+export { promqlLiteralRule } from "./promql-literal";
+export { sloLiteralRule } from "./slo-literal";
+
+/** All lint rules provided by this lexicon (imported by plugin.ts's lintRules()). */
+export const rules: LintRule[] = [literalCredentialRule, promqlLiteralRule, sloLiteralRule];

package/src/lint/rules/literal-credential.ts

@@ -0,0 +1,84 @@
+import * as ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { calleeName, CREDENTIAL_CLASS, literalText, position, propertyName } from "./prom-ast";
+
+/**
+ * Alertmanager fields that hold a secret, each with a `*_file` sibling that
+ * reads it from a mounted file instead.
+ */
+export const SECRET_FIELDS = new Set([
+  "api_url", // slack_configs: the incoming-webhook URL is the credential
+  "slack_api_url",
+  "routing_key",
+  "service_key",
+  "auth_password",
+  "auth_secret",
+  "smtp_auth_password",
+  "smtp_auth_secret",
+  "password",
+  "credentials",
+  "bearer_token",
+  "client_secret",
+]);
+
+/**
+ * PROM001: a credential written as a literal in a `Receiver` or
+ * `AlertmanagerSettings`.
+ *
+ * A literal there is a secret in the repository and in the emitted
+ * `alertmanager.yml`. Alertmanager does not expand environment variables in
+ * its config, so the fix is the field's `*_file` sibling (`api_url_file`,
+ * `routing_key_file`, `auth_password_file`, `credentials_file`), pointing at
+ * a file mounted from a secret store.
+ */
+export const literalCredentialRule: LintRule = {
+  id: "PROM001",
+  severity: "error",
+  category: "security",
+  description: "Alertmanager credential declared as a literal instead of read from a *_file",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+
+    const scanValue = (key: string | undefined, init: ts.Expression) => {
+      if (ts.isObjectLiteralExpression(init)) {
+        scan(init);
+        return;
+      }
+      if (ts.isArrayLiteralExpression(init)) {
+        for (const el of init.elements) if (ts.isObjectLiteralExpression(el)) scan(el);
+        return;
+      }
+      if (!key || !SECRET_FIELDS.has(key)) return;
+      const text = literalText(init);
+      if (text === undefined || text === "") return;
+      diagnostics.push({
+        ruleId: "PROM001",
+        severity: "error",
+        message: `\`${key}\` is a literal credential; Alertmanager doesn't expand environment variables, so mount the secret and set \`${key}_file\` instead`,
+        file: context.filePath,
+        ...position(source, init),
+      });
+    };
+
+    const scan = (obj: ts.ObjectLiteralExpression) => {
+      for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop)) continue;
+        scanValue(propertyName(prop), prop.initializer);
+      }
+    };
+
+    const visit = (node: ts.Node) => {
+      if (ts.isNewExpression(node) || ts.isCallExpression(node)) {
+        const name = calleeName(node);
+        const arg = node.arguments?.[0];
+        if (name && CREDENTIAL_CLASS.test(name) && arg && ts.isObjectLiteralExpression(arg)) scan(arg);
+      }
+      ts.forEachChild(node, visit);
+    };
+
+    visit(source);
+    return diagnostics;
+  },
+};

package/src/lint/rules/prom-ast.ts

@@ -0,0 +1,30 @@
+import * as ts from "typescript";
+
+/** The constructor name of a `new X(...)` or `X(...)` expression, if it is a plain or dotted name. */
+export function calleeName(node: ts.CallExpression | ts.NewExpression): string | undefined {
+  const callee = node.expression;
+  if (ts.isIdentifier(callee)) return callee.text;
+  if (ts.isPropertyAccessExpression(callee)) return callee.name.text;
+  return undefined;
+}
+
+/** The classes whose props hold Alertmanager credentials. */
+export const CREDENTIAL_CLASS = /^(Receiver|AlertmanagerSettings)$/;
+
+/** A property's key as text, for identifier and string-literal keys. */
+export function propertyName(prop: ts.ObjectLiteralElementLike): string | undefined {
+  if (!ts.isPropertyAssignment(prop)) return undefined;
+  if (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) return prop.name.text;
+  return undefined;
+}
+
+/** The text of a string literal or substitution-free template, else undefined. */
+export function literalText(node: ts.Expression): string | undefined {
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
+  return undefined;
+}
+
+export function position(source: ts.SourceFile, node: ts.Node): { line: number; column: number } {
+  const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+  return { line: line + 1, column: character + 1 };
+}

package/src/lint/rules/promql-literal.ts

@@ -0,0 +1,55 @@
+import * as ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { calleeName, literalText, position, propertyName } from "./prom-ast";
+import { checkPromql } from "../../promql";
+
+/**
+ * PROM002: a rule's `expr`, written as a string literal inside a
+ * `RuleGroup`, is not valid PromQL.
+ *
+ * The same parse runs after the build as PROM104, over every rule in the
+ * emitted rule file. This rule reports it in the editor, at the expression,
+ * for the literals it can see; an `expr` built at runtime is left to PROM104.
+ */
+export const promqlLiteralRule: LintRule = {
+  id: "PROM002",
+  severity: "error",
+  category: "correctness",
+  description: "A literal PromQL expression in a RuleGroup does not parse",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+
+    const scan = (node: ts.Node) => {
+      if (ts.isPropertyAssignment(node) && propertyName(node) === "expr") {
+        const text = literalText(node.initializer);
+        if (text !== undefined) {
+          const checked = checkPromql(text);
+          if (!checked.ok) {
+            diagnostics.push({
+              ruleId: "PROM002",
+              severity: "error",
+              message: `expr is not valid PromQL: ${checked.message}`,
+              file: context.filePath,
+              ...position(source, node.initializer),
+            });
+          }
+        }
+      }
+      ts.forEachChild(node, scan);
+    };
+
+    const visit = (node: ts.Node) => {
+      if (ts.isNewExpression(node) && calleeName(node) === "RuleGroup") {
+        const arg = node.arguments?.[0];
+        if (arg) scan(arg);
+        return;
+      }
+      ts.forEachChild(node, visit);
+    };
+
+    visit(source);
+    return diagnostics;
+  },
+};

package/src/lint/rules/rules.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, test } from "vitest";
+import * as ts from "typescript";
+import type { LintContext } from "@intentius/chant/lint/rule";
+import { literalCredentialRule } from "./literal-credential";
+import { promqlLiteralRule } from "./promql-literal";
+import { sloLiteralRule } from "./slo-literal";
+
+function ctx(code: string): LintContext {
+  const sourceFile = ts.createSourceFile("alerts.ts", code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath: "alerts.ts" };
+}
+
+describe("PROM001 literal credential", () => {
+  test("flags literal secrets in a Receiver, at any depth", () => {
+    const diags = literalCredentialRule.check(
+      ctx(`
+        new Receiver({
+          name: "oncall",
+          slack_configs: [{ api_url: "https://hooks.slack.com/services/T/B/X", channel: "#a" }],
+          pagerduty_configs: [{ routing_key: "abc123" }],
+          webhook_configs: [{ url: "http://hook", http_config: { authorization: { credentials: "tok" } } }],
+        });
+      `),
+    );
+    expect(diags.map((d) => d.ruleId)).toEqual(["PROM001", "PROM001", "PROM001"]);
+    expect(diags[0].message).toContain("api_url_file");
+    expect(diags[0].line).toBe(4);
+  });
+
+  test("flags the global SMTP password in AlertmanagerSettings", () => {
+    const diags = literalCredentialRule.check(ctx(`new AlertmanagerSettings({ global: { smtp_auth_password: "hunter2" } });`));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("smtp_auth_password_file");
+  });
+
+  test("accepts *_file fields, non-literals, webhook urls and other classes", () => {
+    const diags = literalCredentialRule.check(
+      ctx(`
+        const key = process.env.KEY!;
+        new Receiver({ name: "a", pagerduty_configs: [{ routing_key_file: "/etc/pd" }, { routing_key: key }] });
+        new Receiver({ name: "b", webhook_configs: [{ url: "http://sink:8080/" }] });
+        new Something({ routing_key: "literal" });
+      `),
+    );
+    expect(diags).toEqual([]);
+  });
+});
+
+describe("PROM002 PromQL literal", () => {
+  test("flags a literal expr that does not parse", () => {
+    const diags = promqlLiteralRule.check(
+      ctx(`
+        new RuleGroup({ name: "g", rules: [
+          { record: "a:b", expr: "sum(rate(x[5m])" },
+          { alert: "A", expr: \`up == 0\` },
+        ] });
+      `),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("PROM002");
+    expect(diags[0].line).toBe(3);
+  });
+
+  test("ignores built expressions and exprs outside a RuleGroup", () => {
+    const diags = promqlLiteralRule.check(
+      ctx(`
+        const w = "5m";
+        new RuleGroup({ name: "g", rules: [{ record: "a:b", expr: \`rate(x[\${w}])\` }] });
+        const notARule = { expr: "(((" };
+      `),
+    );
+    expect(diags).toEqual([]);
+  });
+});
+
+describe("PROM003 Slo literal", () => {
+  test("flags an objective outside (0, 1), a bad window and a broken SLI, at the literal", () => {
+    const diags = sloLiteralRule.check(
+      ctx(`
+        export const a = Slo({
+          name: "a",
+          objective: 99.5,
+          window: "4 weeks",
+          sli: { good: "sum(rate(ok_total[5m]))", total: "sum(rate(all_total[{{window}}])" },
+        });
+        export const b = Slo({ name: "b", objective: -1, window: "0", sli: { errors: "sum(rate(e[{{window}}]))", total: "sum(rate(t[{{window}}]))" } });
+      `),
+    );
+    expect(diags.map((d) => [d.ruleId, d.line])).toEqual([
+      ["PROM003", 4],
+      ["PROM003", 5],
+      ["PROM003", 6],
+      ["PROM003", 6],
+      ["PROM003", 8],
+      ["PROM003", 8],
+    ]);
+    expect(diags[0].message).toContain("strictly between 0 and 1");
+    expect(diags[1].message).toContain("positive Prometheus duration");
+    expect(diags[2].message).toContain("{{window}}");
+    expect(diags[3].message).toContain("not valid PromQL");
+  });
+
+  test("accepts a valid Slo, values built at runtime, and other callees", () => {
+    const diags = sloLiteralRule.check(
+      ctx(`
+        const objective = 1.5;
+        Slo({ name: "a", objective: 0.999, window: "30d", sli: { good: \`sum(rate(ok[{{window}}]))\`, total: "sum(rate(all[{{window}}]))" } });
+        Slo({ name: "b", objective, window: process.env.W!, sli: { good: expr, total: expr } });
+        Other({ objective: 5, window: "nope" });
+      `),
+    );
+    expect(diags).toEqual([]);
+  });
+});

package/src/lint/rules/slo-literal.ts

@@ -0,0 +1,81 @@
+import * as ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { calleeName, literalText, position, propertyName } from "./prom-ast";
+import { sliExprProblem } from "../../composites/slo";
+import { durationMs, isValidDuration } from "../../duration";
+
+/** A numeric literal, with an optional leading minus, as a number. */
+function literalNumber(node: ts.Expression): number | undefined {
+  if (ts.isNumericLiteral(node)) return Number(node.text);
+  if (ts.isPrefixUnaryExpression(node) && node.operator === ts.SyntaxKind.MinusToken && ts.isNumericLiteral(node.operand)) {
+    return -Number(node.operand.text);
+  }
+  return undefined;
+}
+
+function objectProps(node: ts.Expression): Map<string, ts.Expression> {
+  const out = new Map<string, ts.Expression>();
+  if (!ts.isObjectLiteralExpression(node)) return out;
+  for (const p of node.properties) {
+    const name = propertyName(p);
+    if (name !== undefined && ts.isPropertyAssignment(p)) out.set(name, p.initializer);
+  }
+  return out;
+}
+
+/**
+ * PROM003: an `Slo` whose literal objective, window or SLI expression can
+ * not build.
+ *
+ * `Slo()` throws on the same problems when the build runs it; this rule
+ * reports them in the editor, at the literal: an objective outside (0, 1),
+ * a window that is not a positive Prometheus duration, and an SLI
+ * expression without `{{window}}` or that is not PromQL once it is filled
+ * in. Values built at runtime are left to the constructor.
+ */
+export const sloLiteralRule: LintRule = {
+  id: "PROM003",
+  severity: "error",
+  category: "correctness",
+  description: "An Slo's literal objective, window or SLI expression is invalid",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+    const report = (node: ts.Node, message: string) =>
+      diagnostics.push({ ruleId: "PROM003", severity: "error", message, file: context.filePath, ...position(source, node) });
+
+    const visit = (node: ts.Node) => {
+      if ((ts.isCallExpression(node) || ts.isNewExpression(node)) && calleeName(node) === "Slo") {
+        const arg = node.arguments?.[0];
+        if (arg) {
+          const props = objectProps(arg);
+          const objective = props.get("objective");
+          const o = objective ? literalNumber(objective) : undefined;
+          if (objective && o !== undefined && !(o > 0 && o < 1)) {
+            report(objective, `Slo objective must be strictly between 0 and 1 (e.g. 0.995 for 99.5%), got ${o}`);
+          }
+          const window = props.get("window");
+          const w = window ? literalText(window) : undefined;
+          if (window && w !== undefined && (!isValidDuration(w) || durationMs(w) === 0)) {
+            report(window, `Slo window must be a positive Prometheus duration (e.g. 28d or 30d), got ${JSON.stringify(w)}`);
+          }
+          const sli = props.get("sli");
+          if (sli) {
+            for (const [key, expr] of objectProps(sli)) {
+              if (key !== "good" && key !== "errors" && key !== "total") continue;
+              const text = literalText(expr);
+              if (text === undefined) continue;
+              const problem = sliExprProblem(text);
+              if (problem) report(expr, `Slo sli.${key} ${problem}`);
+            }
+          }
+        }
+      }
+      ts.forEachChild(node, visit);
+    };
+
+    visit(source);
+    return diagnostics;
+  },
+};

package/src/lsp/completions.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import { completions } from "./completions";
+
+describe("prometheus LSP completions", () => {
+  it("offers the entity classes after new", () => {
+    const content = 'import { RuleGroup } from "@intentius/chant-lexicon-prometheus";\nconst g = new R';
+    const items = completions({
+      uri: "file:///rules.ts",
+      content,
+      position: { line: 1, character: content.split("\n")[1].length },
+      wordAtCursor: "R",
+      linePrefix: "const g = new R",
+    });
+    const labels = items.map((i) => i.label);
+    expect(labels).toContain("RuleGroup");
+    expect(labels).toContain("Route");
+    expect(labels).toContain("Receiver");
+  });
+
+  it("returns an array for an empty context", () => {
+    expect(Array.isArray(completions({} as never))).toBe(true);
+  });
+});

package/src/lsp/completions.ts

@@ -0,0 +1,15 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+import { LexiconIndex, lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+import { lexiconRegistry } from "../catalog";
+
+let cachedIndex: LexiconIndex | null = null;
+
+function getIndex(): LexiconIndex {
+  cachedIndex ??= new LexiconIndex(lexiconRegistry());
+  return cachedIndex;
+}
+
+/** Completions for the prometheus entity classes: RuleGroup and the Alertmanager kinds. */
+export function completions(ctx: CompletionContext): CompletionItem[] {
+  return lexiconCompletions(ctx, getIndex(), "Prometheus entity");
+}