@intentius/chant-lexicon-prometheus 0.96.0

package/dist/rules/promql-literal.ts

@@ -0,0 +1,55 @@
+import * as ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { calleeName, literalText, position, propertyName } from "./prom-ast";
+import { checkPromql } from "../../promql";
+
+/**
+ * PROM002: a rule's `expr`, written as a string literal inside a
+ * `RuleGroup`, is not valid PromQL.
+ *
+ * The same parse runs after the build as PROM104, over every rule in the
+ * emitted rule file. This rule reports it in the editor, at the expression,
+ * for the literals it can see; an `expr` built at runtime is left to PROM104.
+ */
+export const promqlLiteralRule: LintRule = {
+  id: "PROM002",
+  severity: "error",
+  category: "correctness",
+  description: "A literal PromQL expression in a RuleGroup does not parse",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+
+    const scan = (node: ts.Node) => {
+      if (ts.isPropertyAssignment(node) && propertyName(node) === "expr") {
+        const text = literalText(node.initializer);
+        if (text !== undefined) {
+          const checked = checkPromql(text);
+          if (!checked.ok) {
+            diagnostics.push({
+              ruleId: "PROM002",
+              severity: "error",
+              message: `expr is not valid PromQL: ${checked.message}`,
+              file: context.filePath,
+              ...position(source, node.initializer),
+            });
+          }
+        }
+      }
+      ts.forEachChild(node, scan);
+    };
+
+    const visit = (node: ts.Node) => {
+      if (ts.isNewExpression(node) && calleeName(node) === "RuleGroup") {
+        const arg = node.arguments?.[0];
+        if (arg) scan(arg);
+        return;
+      }
+      ts.forEachChild(node, visit);
+    };
+
+    visit(source);
+    return diagnostics;
+  },
+};

package/dist/rules/slo-literal.ts

@@ -0,0 +1,81 @@
+import * as ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { calleeName, literalText, position, propertyName } from "./prom-ast";
+import { sliExprProblem } from "../../composites/slo";
+import { durationMs, isValidDuration } from "../../duration";
+
+/** A numeric literal, with an optional leading minus, as a number. */
+function literalNumber(node: ts.Expression): number | undefined {
+  if (ts.isNumericLiteral(node)) return Number(node.text);
+  if (ts.isPrefixUnaryExpression(node) && node.operator === ts.SyntaxKind.MinusToken && ts.isNumericLiteral(node.operand)) {
+    return -Number(node.operand.text);
+  }
+  return undefined;
+}
+
+function objectProps(node: ts.Expression): Map<string, ts.Expression> {
+  const out = new Map<string, ts.Expression>();
+  if (!ts.isObjectLiteralExpression(node)) return out;
+  for (const p of node.properties) {
+    const name = propertyName(p);
+    if (name !== undefined && ts.isPropertyAssignment(p)) out.set(name, p.initializer);
+  }
+  return out;
+}
+
+/**
+ * PROM003: an `Slo` whose literal objective, window or SLI expression can
+ * not build.
+ *
+ * `Slo()` throws on the same problems when the build runs it; this rule
+ * reports them in the editor, at the literal: an objective outside (0, 1),
+ * a window that is not a positive Prometheus duration, and an SLI
+ * expression without `{{window}}` or that is not PromQL once it is filled
+ * in. Values built at runtime are left to the constructor.
+ */
+export const sloLiteralRule: LintRule = {
+  id: "PROM003",
+  severity: "error",
+  category: "correctness",
+  description: "An Slo's literal objective, window or SLI expression is invalid",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+    const report = (node: ts.Node, message: string) =>
+      diagnostics.push({ ruleId: "PROM003", severity: "error", message, file: context.filePath, ...position(source, node) });
+
+    const visit = (node: ts.Node) => {
+      if ((ts.isCallExpression(node) || ts.isNewExpression(node)) && calleeName(node) === "Slo") {
+        const arg = node.arguments?.[0];
+        if (arg) {
+          const props = objectProps(arg);
+          const objective = props.get("objective");
+          const o = objective ? literalNumber(objective) : undefined;
+          if (objective && o !== undefined && !(o > 0 && o < 1)) {
+            report(objective, `Slo objective must be strictly between 0 and 1 (e.g. 0.995 for 99.5%), got ${o}`);
+          }
+          const window = props.get("window");
+          const w = window ? literalText(window) : undefined;
+          if (window && w !== undefined && (!isValidDuration(w) || durationMs(w) === 0)) {
+            report(window, `Slo window must be a positive Prometheus duration (e.g. 28d or 30d), got ${JSON.stringify(w)}`);
+          }
+          const sli = props.get("sli");
+          if (sli) {
+            for (const [key, expr] of objectProps(sli)) {
+              if (key !== "good" && key !== "errors" && key !== "total") continue;
+              const text = literalText(expr);
+              if (text === undefined) continue;
+              const problem = sliExprProblem(text);
+              if (problem) report(expr, `Slo sli.${key} ${problem}`);
+            }
+          }
+        }
+      }
+      ts.forEachChild(node, visit);
+    };
+
+    visit(source);
+    return diagnostics;
+  },
+};

package/dist/rules.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `RuleGroup`: one group of recording and alerting rules.
+ *
+ * A group is the unit Prometheus evaluates together, on one interval, and
+ * the unit both destinations take: an entry under `groups:` in a rule file,
+ * and an entry in a Prometheus Operator `PrometheusRule`'s `spec.groups`. The
+ * same declaration renders to either; `ruleGroupConfig()` is the one
+ * conversion both go through.
+ *
+ * Rules are plain objects in the rule file's own shape, so a composite (the
+ * SLO declaration, say) can build them as data and hand a list to one or
+ * more groups.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import { type AlertingRuleConfig, type RecordingRuleConfig, type RuleConfig, type RuleGroupConfig } from "./model.js";
+export type RecordingRule = RecordingRuleConfig;
+export type AlertingRule = AlertingRuleConfig;
+export type Rule = RuleConfig;
+/** What `new RuleGroup(...)` takes: the group exactly as it appears in a rule file. */
+export type RuleGroupProps = RuleGroupConfig;
+export interface RuleGroupEntity extends Declarable {
+    readonly props: RuleGroupProps;
+    /** The group's `name`. */
+    readonly groupName: string;
+}
+export declare const RULE_GROUP_TYPE = "Prometheus::Rules::RuleGroup";
+/**
+ * A group of recording and alerting rules.
+ *
+ * @example
+ * ```ts
+ * export const api = new RuleGroup({
+ *   name: "api",
+ *   interval: "30s",
+ *   rules: [
+ *     { record: "job:http_requests:rate5m", expr: "sum by (job) (rate(http_requests_total[5m]))" },
+ *     {
+ *       alert: "ApiHighErrorRate",
+ *       expr: 'sum(rate(http_requests_total{code=~"5.."}[5m])) / sum(rate(http_requests_total[5m])) > 0.05',
+ *       for: "10m",
+ *       labels: { severity: "page" },
+ *       annotations: { summary: "API 5xx ratio above 5%" },
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export declare const RuleGroup: new (props: RuleGroupProps) => RuleGroupEntity;
+/** True when `value` is a declared `RuleGroup`. */
+export declare function isRuleGroup(value: unknown): value is RuleGroupEntity;
+/** A rule in canonical key order, `undefined` fields dropped. */
+export declare function ruleConfig(rule: Rule): Rule;
+/**
+ * The plain group a `RuleGroup` (or group props) renders to, in canonical key
+ * order. This is what goes under `groups:` in a rule file and into a
+ * `PrometheusRule`'s `spec.groups`.
+ */
+export declare function ruleGroupConfig(group: RuleGroupEntity | RuleGroupProps): RuleGroupConfig;
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAChD,MAAM,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAC9C,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC;AAE9B,uFAAuF;AACvF,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC;AAE7C,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAO9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,EAGN,KAAK,KAAK,EAAE,cAAc,KAAK,eAAe,CAAC;AAG/D,mDAAmD;AACnD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAEpE;AAgBD,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAgB3C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,GAAG,eAAe,CAUxF"}

package/dist/serializer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Prometheus serializer.
+ *
+ * Emits the two files a Prometheus setup reads:
+ *
+ * - the rule file (`groups:`), from every `RuleGroup` in the build, the file
+ *   `rule_files:` points at and `promtool check rules` reads;
+ * - `alertmanager.yml`, from the `Route`, `Receiver`, `InhibitRule`,
+ *   `TimeInterval` and `AlertmanagerSettings` entities, the file
+ *   `amtool check-config` reads.
+ *
+ * The rule file is the primary output when the build declares any rule
+ * groups, and `alertmanager.yml` is written beside it when the build also
+ * declares Alertmanager entities. A build with only Alertmanager entities
+ * emits `alertmanager.yml` as the primary output. Rules inside a group and
+ * child routes keep the order they are written in, which is the order that
+ * matters to Prometheus and Alertmanager; groups, receivers and time
+ * intervals, whose order means nothing, are sorted by name.
+ *
+ * Neither file has a metadata channel, so there is no ownership marker to
+ * stamp.
+ */
+import type { Serializer } from "@intentius/chant/serializer";
+/** The filename `alertmanager.yml` is written under when it sits beside a rule file. */
+export declare const ALERTMANAGER_FILE = "alertmanager.yml";
+export declare const prometheusSerializer: Serializer;
+//# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAIhF,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AAEpD,eAAO,MAAM,oBAAoB,EAAE,UAuBlC,CAAC"}

package/dist/skill-defs.d.ts

@@ -0,0 +1,3 @@
+/** The prometheus lexicon's AI skills, read from src/skills/. */
+export declare const prometheusSkills: () => import("packages/core/src").SkillDefinition[];
+//# sourceMappingURL=skill-defs.d.ts.map

package/dist/skill-defs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-defs.d.ts","sourceRoot":"","sources":["../src/skill-defs.ts"],"names":[],"mappings":"AAEA,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,qDAuC3B,CAAC"}

package/dist/skills/chant-prometheus-alertmanager.md

@@ -0,0 +1,58 @@
+---
+skill: chant-prometheus-alertmanager
+description: Declare Alertmanager routing (routes, receivers, inhibit rules, time intervals) and keep every alert severity routed
+user-invocable: true
+---
+
+# Alertmanager routing with chant
+
+`Route`, `Receiver`, `InhibitRule`, `TimeInterval` and `AlertmanagerSettings` build `alertmanager.yml`. When the same build root declares `RuleGroup`s, the rule file is the primary output and `alertmanager.yml` is written beside it.
+
+```ts
+import { AlertmanagerSettings, InhibitRule, Receiver, Route, TimeInterval } from "@intentius/chant-lexicon-prometheus";
+
+export const settings = new AlertmanagerSettings({ global: { resolve_timeout: "5m" } });
+
+export const oncall = new Receiver({
+  name: "oncall",
+  pagerduty_configs: [{ routing_key_file: "/etc/alertmanager/secrets/pagerduty-key" }],
+});
+export const team = new Receiver({
+  name: "team-slack",
+  slack_configs: [{ api_url_file: "/etc/alertmanager/secrets/slack-url", channel: "#alerts", send_resolved: true }],
+});
+export const sink = new Receiver({ name: "default", webhook_configs: [{ url: "http://alert-sink.monitoring:8080/" }] });
+
+export const offHours = new TimeInterval({
+  name: "off-hours",
+  time_intervals: [{ weekdays: ["saturday", "sunday"] }, { times: [{ start_time: "18:00", end_time: "24:00" }] }],
+});
+
+export const root = new Route({
+  receiver: sink,
+  group_by: ["alertname", "job"],
+  group_wait: "30s",
+  group_interval: "5m",
+  repeat_interval: "4h",
+  routes: [
+    { matchers: ['severity="page"'], receiver: oncall },
+    { matchers: ['severity="ticket"'], receiver: team, mute_time_intervals: [offHours] },
+  ],
+});
+
+export const pageMutesTicket = new InhibitRule({
+  source_matchers: ['severity="page"'],
+  target_matchers: ['severity="ticket"'],
+  equal: ["alertname", "job"],
+});
+```
+
+## What the checks hold you to
+
+- One root route (the `Route` no other route nests), with a receiver and no matchers (PROM205).
+- Routes name receivers and time intervals that exist (PROM201, PROM204). Reference the entity rather than a string and TypeScript does most of this.
+- Every `severity` an alert in the same build root carries is matched by some route below the root (PROM202). The check only sees one build root (chant #1939): keep the rules and the Alertmanager config in the same one, or it goes quiet.
+- Credentials go in `*_file` fields. Alertmanager does not expand environment variables in its config, and a literal `api_url`, `routing_key` or `auth_password` is flagged (PROM001).
+- Each integration has somewhere to send (PROM209): a webhook `url`, a Slack `api_url` (or `global.slack_api_url`), a PagerDuty key, an email `to`/`smarthost`/`from` (or the global SMTP defaults).
+
+Run `amtoolCheckConfig(alertmanagerYaml(entities))` in a test to have `amtool check-config` confirm it when installed.

package/dist/skills/chant-prometheus-kubernetes.md

@@ -0,0 +1,48 @@
+---
+skill: chant-prometheus-kubernetes
+description: Render the same RuleGroups into a Prometheus Operator PrometheusRule, or into ConfigMaps for a plain Prometheus and Alertmanager on Kubernetes
+user-invocable: true
+---
+
+# Prometheus rules on Kubernetes
+
+A `RuleGroup` from `@intentius/chant-lexicon-prometheus` renders to two places: the rule file, and a Prometheus Operator `PrometheusRule` from `@intentius/chant-lexicon-k8s`.
+
+## Into a PrometheusRule
+
+```ts
+import { PrometheusRule } from "@intentius/chant-lexicon-k8s";
+import { RuleGroup } from "@intentius/chant-lexicon-prometheus";
+
+const api = new RuleGroup({
+  name: "api",
+  rules: [{ alert: "ApiDown", expr: 'up{job="api"} == 0', for: "5m", labels: { severity: "page" }, annotations: { summary: "api is down" } }],
+});
+
+export const apiRules = new PrometheusRule({
+  metadata: { name: "api-rules", labels: { release: "kube-prometheus-stack" } },
+  spec: { groups: [api] },
+});
+```
+
+The k8s serializer writes each `RuleGroup` in `spec.groups` as the same group the rule file would hold. Declare the group with `const` (not exported) when it should only appear inside the CRD; export it too when the build should also write the rule file.
+
+`MonitoredService` takes the groups directly:
+
+```ts
+MonitoredService({ name: "api", image: "api:1.0", ruleGroups: [api] });
+```
+
+Its older `alertRules` prop still works, and both may be set; the groups come after the `alertRules` group.
+
+## Without the operator
+
+For a plain Prometheus or Alertmanager Deployment, put the files in ConfigMaps with `ruleFileYaml(groups)` and `alertmanagerYaml(entities)`:
+
+```ts
+import { ConfigMap } from "@intentius/chant-lexicon-k8s";
+import { ruleFileYaml, alertmanagerYaml } from "@intentius/chant-lexicon-prometheus";
+
+export const rulesCm = new ConfigMap({ metadata: { name: "prometheus-rules" }, data: { "rules.yml": ruleFileYaml([api]) } });
+export const amCm = new ConfigMap({ metadata: { name: "alertmanager" }, data: { "alertmanager.yml": alertmanagerYaml([root, oncall, sink]) } });
+```

package/dist/skills/chant-prometheus.md

@@ -0,0 +1,91 @@
+---
+skill: chant-prometheus
+description: Declare Prometheus recording and alerting rule groups as typed chant entities and build a rule file that passes promtool
+user-invocable: true
+---
+
+# Prometheus rules with chant
+
+The prometheus lexicon (`@intentius/chant-lexicon-prometheus`) types Prometheus rule groups. Each `RuleGroup` is an entity; `chant build` writes the rule file Prometheus loads through `rule_files:`.
+
+## Project setup
+
+```ts
+// chant.config.ts
+export default { lexicons: ["prometheus"] };
+```
+
+## Declaring a group
+
+A group takes the rule file's own keys (`name`, `interval`, `query_offset`, `limit`, `labels`, `rules`). Rules are plain objects: `record` + `expr` for a recording rule, `alert` + `expr` (+ `for`, `keep_firing_for`, `labels`, `annotations`) for an alerting rule.
+
+```ts
+import { RuleGroup } from "@intentius/chant-lexicon-prometheus";
+
+export const api = new RuleGroup({
+  name: "api",
+  interval: "30s",
+  rules: [
+    {
+      record: "job:http_errors:ratio5m",
+      expr: 'sum by (job) (rate(http_requests_total{code=~"5.."}[5m])) / sum by (job) (rate(http_requests_total[5m]))',
+    },
+    {
+      alert: "ApiErrorRatioHigh",
+      expr: "job:http_errors:ratio5m > 0.05",
+      for: "10m",
+      labels: { severity: "page" },
+      annotations: { summary: "{{ $labels.job }} 5xx ratio above 5%", runbook_url: "https://runbooks.example.com/api-errors" },
+    },
+  ],
+});
+```
+
+Build it with `chant build src --lexicon prometheus -o dist/rules.yml`.
+
+## Rules of thumb
+
+- Name recording rules `level:metric:operations` (`job:http_errors:ratio5m`), and alert on the recorded series rather than repeating the expression.
+- Give every alert a `severity` label (PROM106) that an Alertmanager route matches (PROM202), and a `summary` annotation (PROM107).
+- Alerts may share a name when their labels differ, e.g. the same alert at `severity: "page"` and `severity: "ticket"`. Two rules with the same name *and* labels overwrite each other (PROM102).
+- Durations are Prometheus durations: `30s`, `5m`, `1h30m`. Not `1.5h`, not `90 seconds` (PROM103).
+- Every `expr` is parsed with the Prometheus project's PromQL grammar at build time (PROM104) and, for literals, in the editor (PROM002).
+
+## Checking with promtool
+
+```ts
+import { ruleFileYaml, promtoolCheckRules } from "@intentius/chant-lexicon-prometheus";
+
+const result = promtoolCheckRules(ruleFileYaml([api]));
+if (result.ran && !result.ok) throw new Error(result.output);
+```
+
+`ran` is false when `promtool` isn't on PATH (or `$PROMTOOL`), so a test can skip instead of failing.
+
+## Building rules from data
+
+`RuleGroup` takes plain rule objects, so a composite can generate them: map over services or windows, return one or more `RuleGroup`s, and the rule file and a `PrometheusRule` both pick them up. `ruleGroupConfig(group)` gives the plain group as it appears in the file.
+
+## SLOs
+
+`Slo` builds an SLO to one `RuleGroup`: error ratios per window, the error budget left, and the SRE Workbook's multiwindow burn-rate alerts (page at 1h/5m and 6h/30m, ticket at 1d/2h and 3d/6h, factors scaled to the SLO window). It is a composite, called without `new`.
+
+```ts
+import { Slo, sloMetrics } from "@intentius/chant-lexicon-prometheus";
+
+export const checkout = Slo({
+  name: "checkout",
+  objective: 0.999,
+  window: "30d",
+  sli: {
+    good: 'sum(rate(http_requests_total{job="checkout",code!~"5.."}[{{window}}]))',
+    total: 'sum(rate(http_requests_total{job="checkout"}[{{window}}]))',
+  },
+});
+
+sloMetrics(checkout).errorRatio["1h"]; // "slo:sli_error:ratio_rate1h"
+```
+
+- Write the objective as a fraction strictly between 0 and 1, and put `{{window}}` where each SLI expression's range goes (PROM003).
+- Alerts carry `severity` `page` or `ticket`; route both (PROM202).
+- Read series names from `sloMetrics()` in dashboards instead of repeating them.

package/dist/tools.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `promtool check rules` and `amtool check-config`, when they are installed.
+ *
+ * The lexicon's own checks cover structure, references and PromQL syntax.
+ * The upstream tools add what only Prometheus and Alertmanager know (PromQL
+ * types, template parsing in annotations, every receiver field). They are
+ * not bundled and not run by `chant build`, so a build gives the same answer
+ * everywhere; tests, e2e runs and CI jobs call these helpers, which report
+ * `ran: false` when the binary isn't on PATH instead of failing.
+ */
+export interface ToolResult {
+    /** False when the binary isn't installed; `ok` and `output` are then meaningless. */
+    ran: boolean;
+    ok: boolean;
+    /** Combined stdout and stderr. */
+    output: string;
+}
+/** True when `bin` is on PATH (or is a path that runs). */
+export declare function hasTool(bin: string): boolean;
+/** Run `promtool check rules` over rule file YAML. `bin` defaults to `promtool` on PATH. */
+export declare function promtoolCheckRules(yaml: string, bin?: string): ToolResult;
+/**
+ * Run `promtool test rules` over rule file YAML and a unit-test file for it.
+ * The test file's `rule_files:` should name `rules.yml`, which is where the
+ * rule file is written beside it. `bin` defaults to `promtool` on PATH.
+ */
+export declare function promtoolTestRules(rulesYaml: string, testYaml: string, bin?: string): ToolResult;
+/** Run `amtool check-config` over `alertmanager.yml` text. `bin` defaults to `amtool` on PATH. */
+export declare function amtoolCheckConfig(yaml: string, bin?: string): ToolResult;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG5C;AAeD,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAqC,GAAG,UAAU,CAErG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAqC,GAAG,UAAU,CAW3H;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAiC,GAAG,UAAU,CAEhG"}

package/dist/types/index.d.ts

@@ -0,0 +1,3 @@
+// The prometheus lexicon's entity classes and config types are hand-written in
+// src/ and compiled to dist/index.d.ts; this entry re-exports them.
+export * from "../index.js";

package/dist/validate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=validate-cli.d.ts.map

package/dist/validate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-cli.d.ts","sourceRoot":"","sources":["../src/validate-cli.ts"],"names":[],"mappings":""}

package/dist/validate-config.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Rule file and Alertmanager config checks, as plain functions over the
+ * parsed files.
+ *
+ * The post-synth checks in `lint/post-synth/` are thin wrappers around these,
+ * so the same rules run anywhere the files exist: on a build's output, on a
+ * `PrometheusRule`'s groups, or on a file parsed by some other tool.
+ */
+import { type AlertmanagerConfig, type RuleFileConfig } from "./model.js";
+export type PrometheusIssueCode = "PROM101" | "PROM102" | "PROM103" | "PROM104" | "PROM105" | "PROM106" | "PROM107" | "PROM201" | "PROM202" | "PROM203" | "PROM204" | "PROM205" | "PROM206" | "PROM207" | "PROM208" | "PROM209";
+export interface PrometheusIssue {
+    code: PrometheusIssueCode;
+    severity: "error" | "warning";
+    message: string;
+    /** What the issue is about: a group, a rule (`group/rule`), a receiver or a route. */
+    subject?: string;
+}
+/** Check a rule file (PROM101-PROM107). */
+export declare function validateRuleFile(file: RuleFileConfig): PrometheusIssue[];
+/** Every severity value an alert in these rule files carries, with the alerts carrying it. */
+export declare function alertSeverities(files: RuleFileConfig[]): Map<string, string[]>;
+/** Check an `alertmanager.yml` on its own (PROM201, PROM203-PROM209). */
+export declare function validateAlertmanagerConfig(config: AlertmanagerConfig): PrometheusIssue[];
+/**
+ * PROM202: every severity an alert carries is taken by some route below the
+ * root that matches on `severity`. An alert whose severity no route names
+ * falls through to the root route's default receiver.
+ *
+ * Only matchers on `severity` are read, since other labels (team, service)
+ * come from the series and are not known at build time. A route counts when
+ * it, or a route above it, matches on `severity`, and every severity matcher
+ * on its path accepts the value.
+ */
+export declare function validateSeverityRouting(ruleFiles: RuleFileConfig[], config: AlertmanagerConfig): PrometheusIssue[];
+//# sourceMappingURL=validate-config.d.ts.map

package/dist/validate-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-config.d.ts","sourceRoot":"","sources":["../src/validate-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAGL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AAGjB,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAmBD,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,eAAe,EAAE,CAsHxE;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAa9E;AAsBD,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA4HxF;AAYD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6BlH"}

package/dist/validate.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Validate the prometheus lexicon's own artifacts: every class is in the
+ * registry, every entity constructs and serializes, and a sample rule file
+ * and Alertmanager config pass the lexicon's own checks.
+ */
+import type { ValidateResult } from "@intentius/chant/codegen/validate";
+export type { ValidateCheck, ValidateResult } from "@intentius/chant/codegen/validate";
+/** Every entity class the package must keep exporting. */
+export declare const REQUIRED_NAMES: string[];
+export declare function validate(): Promise<ValidateResult>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAOvF,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEvF,0DAA0D;AAC1D,eAAO,MAAM,cAAc,UAA4F,CAAC;AAExH,wBAAsB,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,CA+CxD"}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@intentius/chant-lexicon-prometheus",
+  "version": "0.96.0",
+  "description": "Prometheus lexicon for chant — typed recording and alerting rule groups and Alertmanager routing, serialized to a rule file and alertmanager.yml",
+  "license": "Apache-2.0",
+  "homepage": "https://intentius.io/chant",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/INTENTIUS/chant.git",
+    "directory": "lexicons/prometheus"
+  },
+  "bugs": {
+    "url": "https://github.com/INTENTIUS/chant/issues"
+  },
+  "keywords": [
+    "infrastructure-as-code",
+    "iac",
+    "typescript",
+    "prometheus",
+    "alertmanager",
+    "promql",
+    "observability",
+    "chant"
+  ],
+  "type": "module",
+  "files": [
+    "src/",
+    "dist/"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./src/index.ts"
+    },
+    "./*": {
+      "development": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./src/*.ts"
+    },
+    "./lint/post-synth": {
+      "development": "./src/lint/post-synth/index.ts",
+      "types": "./dist/lint/post-synth/index.d.ts",
+      "default": "./src/lint/post-synth/index.ts"
+    },
+    "./manifest": "./dist/manifest.json",
+    "./meta": "./dist/meta.json",
+    "./types": "./dist/types/index.d.ts"
+  },
+  "scripts": {
+    "generate": "tsx src/codegen/generate-cli.ts",
+    "bundle": "tsx src/package-cli.ts",
+    "validate": "tsx src/validate-cli.ts",
+    "docs": "tsx src/codegen/docs-cli.ts",
+    "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+  },
+  "dependencies": {
+    "@lezer/highlight": "^1.2.4",
+    "@lezer/lr": "^1.4.10",
+    "@prometheus-io/lezer-promql": "0.315.0",
+    "js-yaml": "^4.3.1"
+  },
+  "devDependencies": {
+    "@intentius/chant": "*",
+    "@types/js-yaml": "^4.0.9",
+    "tsc-alias": "^1.8.17",
+    "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@intentius/chant": "^0.96.0",
+    "typescript": "^5.9.3"
+  }
+}