@intentius/chant-lexicon-prometheus 0.100.0 → 0.102.0

package/src/composites/index.ts

@@ -21,3 +21,18 @@ export type {
   SloMetrics,
   SloBurnRate,
 } from "./slo";
+export { GenAiRules, genAiRuleMetrics } from "./genai";
+export type {
+  GenAiRulesProps,
+  GenAiRulesMembers,
+  GenAiRulesInstance,
+  GenAiRuleMetrics,
+  GenAiPrice,
+  GenAiAlerting,
+  GenAiAlertOptions,
+  GenAiRatioAlert,
+  GenAiLatencyAlert,
+  GenAiBudget,
+  GenAiAlertInfo,
+  GenAiQuantileSeries,
+} from "./genai";

package/src/composites/slo-burn.test.ts

@@ -259,8 +259,32 @@ describe.skipIf(!hasPromtool)("each pair fires at its burn rate and not below it
 
 describe("rule-eval", () => {
   test("throws on PromQL it does not implement instead of guessing", () => {
-    const ev = new RuleEvaluator([{ name: "g", rules: [{ record: "x", expr: "histogram_quantile(0.9, rate(a[5m]))" }] }]);
+    const ev = new RuleEvaluator([{ name: "g", rules: [{ record: "x", expr: "max_over_time(a[5m])" }] }]);
     expect(() => ev.step(0)).toThrow(/not supported|needs a range/);
+    const left = new RuleEvaluator([{ name: "g", rules: [{ record: "x", expr: "a / ignoring (t) group_left (u) b" }] }]);
+    expect(() => left.step(0)).toThrow(/group_left with labels is not supported/);
+  });
+
+  test("histogram_quantile interpolates inside the bucket the rank falls in", () => {
+    const ev = new RuleEvaluator([]);
+    for (const [le, n] of [["0.5", 20], ["1", 60], ["2", 100], ["+Inf", 100]] as const) ev.add({ __name__: "d_bucket", job: "a", le }, 0, n);
+    for (const [le, n] of [["1", 0], ["+Inf", 10]] as const) ev.add({ __name__: "d_bucket", job: "b", le }, 0, n);
+    const at = (q: number) => Object.fromEntries(ev.query(`histogram_quantile(${q}, d_bucket)`, 0).map((e) => [e.labels.job, e.value]));
+    // a: rank 50 is 30 of the 40 in (0.5, 1]; rank 95 is 35 of the 40 in (1, 2].
+    expect(at(0.5).a).toBeCloseTo(0.875, 9);
+    expect(at(0.95).a).toBeCloseTo(1.875, 9);
+    // b: every observation is above the highest finite bound, which is what Prometheus returns.
+    expect(at(0.5).b).toBe(1);
+  });
+
+  test("group_left matches many series on the left to one on the right", () => {
+    const ev = new RuleEvaluator([]);
+    ev.add({ __name__: "errs", m: "x", t: "timeout" }, 0, 2);
+    ev.add({ __name__: "errs", m: "x", t: "refused" }, 0, 3);
+    ev.add({ __name__: "reqs", m: "x" }, 0, 10);
+    const r = ev.query("errs / ignoring (t) group_left reqs", 0);
+    expect(r.map((e) => [e.labels.t, e.value]).sort()).toEqual([["refused", 0.3], ["timeout", 0.2]]);
+    expect(() => ev.query("errs / ignoring (t) reqs", 0)).toThrow(/needs group_left/);
   });
 
   test("evaluates sums, ratios and set operators the way Prometheus does", () => {

package/src/import/embedded.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "vitest";
 import { embeddedDocument, type EmbeddedContent } from "@intentius/chant/import/embedded";
 import { prometheusPlugin } from "../plugin";
-import { ruleGroupsImporter } from "./embedded";
+import { alertmanagerImporter, ruleGroupsImporter } from "./embedded";
 
 const GROUPS = [
   { name: "api", rules: [{ alert: "ApiDown", expr: "up{job=\"api\"} == 0", for: "5m" }] },
@@ -25,8 +25,8 @@ const site = (over: Partial<EmbeddedContent>): EmbeddedContent => ({
 });
 
 describe("rule groups embedded in another lexicon's resource (#2962)", () => {
-  test("the plugin registers the importer", () => {
-    expect(prometheusPlugin.embeddedImporters?.()).toEqual([ruleGroupsImporter]);
+  test("the plugin registers the importers", () => {
+    expect(prometheusPlugin.embeddedImporters?.()).toEqual([ruleGroupsImporter, alertmanagerImporter]);
   });
 
   test("matches a PrometheusRule's groups and a rule file held as text; not an alertmanager.yml", () => {
@@ -54,3 +54,52 @@ describe("rule groups embedded in another lexicon's resource (#2962)", () => {
     expect(out.value.bindings).toEqual([{ from: "rules.ts", name: "api" }]);
   });
 });
+
+const ALERTMANAGER = `route:
+  receiver: team
+  routes:
+    - matchers: [severity="critical"]
+      receiver: pager
+      mute_time_intervals: [nights]
+receivers:
+  - name: team
+  - name: pager
+time_intervals:
+  - name: nights
+    time_intervals:
+      - times: [{ start_time: "22:00", end_time: "24:00" }]
+inhibit_rules:
+  - source_matchers: [severity="critical"]
+    target_matchers: [severity="warning"]
+templates: [/etc/alertmanager/*.tmpl]
+`;
+
+describe("an alertmanager.yml embedded in another lexicon's resource (#3031)", () => {
+  const configMap = (text: string) =>
+    site({ hostType: "K8s::Core::ConfigMap", location: 'ConfigMap am data["alertmanager.yml"]', text, document: embeddedDocument(text) });
+
+  test("matches an alertmanager.yml held as text; not a rule file, nor a selected member", () => {
+    expect(alertmanagerImporter.matches(configMap(ALERTMANAGER))).toBe(true);
+    expect(alertmanagerImporter.matches(configMap(RULE_FILE))).toBe(false);
+    expect(alertmanagerImporter.matches(site({ document: { groups: GROUPS }, select: "groups" }))).toBe(false);
+    expect(ruleGroupsImporter.matches(configMap(ALERTMANAGER))).toBe(false);
+  });
+
+  test("becomes alertmanagerYaml over every declaration the standalone import writes", () => {
+    const out = alertmanagerImporter.import(configMap(ALERTMANAGER));
+    expect(out.files.map((f) => f.path)).toEqual(["receivers.ts", "time-intervals.ts", "routes.ts", "inhibit-rules.ts", "settings.ts"]);
+    expect(out.value).toEqual({
+      bindings: [
+        { from: "receivers.ts", name: "team" },
+        { from: "receivers.ts", name: "pager" },
+        { from: "time-intervals.ts", name: "nights" },
+        { from: "routes.ts", name: "root" },
+        { from: "inhibit-rules.ts", name: "inhibitRule1" },
+        { from: "settings.ts", name: "settings" },
+      ],
+      shape: "list",
+      through: { from: "@intentius/chant-lexicon-prometheus", name: "alertmanagerYaml" },
+    });
+    expect(out.warnings).toEqual([]);
+  });
+});

package/src/import/embedded.ts

@@ -1,19 +1,27 @@
 /**
- * Rule groups embedded in another lexicon's resource, for `chant import`
- * (#2962): a k8s `PrometheusRule`'s `spec.groups`, or a rule file held as
- * text in a ConfigMap.
+ * Prometheus and Alertmanager content embedded in another lexicon's
+ * resource, for `chant import`: a k8s `PrometheusRule`'s `spec.groups`, or a
+ * rule file held as text in a ConfigMap (#2962), and an `alertmanager.yml`
+ * held as text in a ConfigMap (#3031).
  *
  * The groups are imported exactly as `chant import rules.yml` would import
  * them, into a directory of its own. `spec.groups` becomes the list of the
  * declared groups (an `Slo`'s by its `rules` member), which the k8s
  * serializer renders as the same groups; a rule file becomes
  * `ruleFileYaml([...])`, the text the prometheus serializer writes.
+ *
+ * An `alertmanager.yml` is imported exactly as `chant import alertmanager.yml`
+ * would import it, and becomes `alertmanagerYaml([...])` over every receiver,
+ * time interval, root route, inhibit rule and settings it declares. The
+ * ConfigMap then holds the config as the serializer writes it: the same
+ * config, with Alertmanager's deprecated spellings rewritten as the
+ * standalone import rewrites them.
  */
 
 import type { EmbeddedContentImporter, EmbeddedImport } from "@intentius/chant/import/embedded";
-import { looksLikeRuleFile } from "../model";
+import { looksLikeAlertmanagerConfig, looksLikeRuleFile } from "../model";
 import { parsePrometheusYaml } from "./parser";
-import { generateRuleFile } from "./generator";
+import { generateAlertmanager, generateRuleFile } from "./generator";
 
 const PACKAGE = "@intentius/chant-lexicon-prometheus";
 
@@ -42,3 +50,27 @@ export const ruleGroupsImporter: EmbeddedContentImporter = {
     };
   },
 };
+
+export const alertmanagerImporter: EmbeddedContentImporter = {
+  what: "an Alertmanager config",
+
+  matches(content) {
+    return content.select === undefined && typeof content.text === "string" && looksLikeAlertmanagerConfig(content.document);
+  },
+
+  import(content): EmbeddedImport {
+    const parsed = parsePrometheusYaml(content.text!);
+    if (parsed.kind !== "alertmanager") throw new Error("this is not an alertmanager.yml");
+    const { files, declarations } = generateAlertmanager(parsed.config);
+    if (declarations.length === 0) throw new Error("the import declared nothing");
+    return {
+      files,
+      value: {
+        bindings: declarations.map((d) => ({ from: d.path, name: d.name })),
+        shape: "list",
+        through: { from: PACKAGE, name: "alertmanagerYaml" },
+      },
+      warnings: parsed.warnings,
+    };
+  },
+};

package/src/import/generator.ts

@@ -381,6 +381,21 @@ function untypedComment(what: string, keys: string[]): string[] {
 
 /** Generate the TypeScript declaring one `alertmanager.yml`. */
 export function generateAlertmanagerFiles(config: AlertmanagerConfig): GeneratedFile[] {
+  return generateAlertmanager(config).files;
+}
+
+/** A declaration an `alertmanager.yml` import exports: its module and variable. */
+export interface AlertmanagerDeclaration {
+  readonly path: string;
+  readonly name: string;
+}
+
+/**
+ * Generate the TypeScript declaring one `alertmanager.yml`, and list every
+ * declaration it exports, module by module (#3031: a ConfigMap holding the
+ * file becomes `alertmanagerYaml([...])` over them).
+ */
+export function generateAlertmanager(config: AlertmanagerConfig): { files: GeneratedFile[]; declarations: AlertmanagerDeclaration[] } {
   const names = new Names([...LEXICON_NAMES, "global", "tracing"]);
   const modules: Module[] = [];
   const receiverVars = new Map<string, { v: string; mod: Module }>();
@@ -558,7 +573,10 @@ export function generateAlertmanagerFiles(config: AlertmanagerConfig): Generated
     mod.exports.push(v);
   }
 
-  return modules.map((m) => ({ path: m.path, content: m.render() }));
+  return {
+    files: modules.map((m) => ({ path: m.path, content: m.render() })),
+    declarations: modules.flatMap((m) => m.exports.map((name) => ({ path: m.path, name }))),
+  };
 }
 
 /** The rule file and `alertmanager.yml` TypeScript generator `chant import` runs. */

package/src/index.ts

@@ -94,4 +94,18 @@ export {
   type SloInstance,
   type SloMetrics,
   type SloBurnRate,
+  GenAiRules,
+  genAiRuleMetrics,
+  type GenAiRulesProps,
+  type GenAiRulesMembers,
+  type GenAiRulesInstance,
+  type GenAiRuleMetrics,
+  type GenAiPrice,
+  type GenAiAlerting,
+  type GenAiAlertOptions,
+  type GenAiRatioAlert,
+  type GenAiLatencyAlert,
+  type GenAiBudget,
+  type GenAiAlertInfo,
+  type GenAiQuantileSeries,
 } from "./composites";

package/src/init-templates.test.ts

@@ -1,29 +1,55 @@
 import { describe, expect, test } from "vitest";
 import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "fs";
-import { tmpdir } from "os";
 import { join } from "path";
+import { load } from "js-yaml";
 import { build } from "@intentius/chant/build";
 import { lintCommand } from "@intentius/chant/cli/commands/lint";
-import { initTemplates } from "./init-templates";
-import { prometheusSerializer } from "./serializer";
-import { postSynthChecks } from "./lint/post-synth";
 import { runPostSynthChecks } from "@intentius/chant/lint/post-synth";
+import { prometheusPlugin } from "./plugin";
+import { TEMPLATE_NAMES } from "./init-templates";
+import { postSynthChecks } from "./lint/post-synth";
+
+async function built(name: string | undefined) {
+  const dir = mkdtempSync(join(import.meta.dirname, "..", ".init-template-"));
+  mkdirSync(join(dir, "src"));
+  for (const [file, text] of Object.entries(prometheusPlugin.initTemplates!(name).src)) writeFileSync(join(dir, "src", file), text);
+  return { dir, result: await build(join(dir, "src"), [prometheusPlugin.serializer]) };
+}
 
+// Every template builds, passes every PROM check with nothing to report, and
+// lints clean.
 describe("init templates", () => {
-  test.each([undefined, "rules", "slo-style"])("%s builds, lints clean and passes every check", async (name) => {
-    const dir = mkdtempSync(join(import.meta.dirname, "..", ".init-template-"));
+  test.each([undefined, ...TEMPLATE_NAMES])("%s builds, lints clean and passes every check", async (name) => {
+    const { dir, result } = await built(name);
     try {
-      mkdirSync(join(dir, "src"));
-      for (const [file, text] of Object.entries(initTemplates(name).src)) writeFileSync(join(dir, "src", file), text);
-      const result = await build(join(dir, "src"), [prometheusSerializer]);
       expect(result.errors).toEqual([]);
       expect(result.outputs.get("prometheus")).toBeTruthy();
-      const diags = runPostSynthChecks(postSynthChecks, result);
-      expect(diags).toEqual([]);
+      expect(runPostSynthChecks(postSynthChecks, result)).toEqual([]);
       const lint = await lintCommand({ path: join(dir, "src"), format: "stylish", fix: false });
       expect(lint.errorCount + lint.warningCount, lint.output).toBe(0);
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+
+  test("the slo template builds the SLO's rules and routes both severities its alerts carry", async () => {
+    const { dir, result } = await built("slo");
+    try {
+      const out = result.outputs.get("prometheus") as { primary: string; files: Record<string, string> };
+      const rules = load(out.primary) as { groups: Array<{ name: string; rules: Array<{ alert?: string; labels?: Record<string, string> }> }> };
+      expect(rules.groups.map((g) => g.name)).toEqual(["slo-checkout"]);
+      const severities = new Set(rules.groups[0].rules.filter((r) => r.alert).map((r) => r.labels?.severity));
+      expect([...severities].sort()).toEqual(["page", "ticket"]);
+      const am = load(out.files["alertmanager.yml"]) as { route: { routes: Array<{ matchers: string[] }> }; inhibit_rules: unknown[] };
+      expect(am.route.routes.flatMap((r) => r.matchers)).toEqual(['severity="page"', 'severity="ticket"']);
+      expect(am.inhibit_rules).toEqual([{ source_matchers: ['severity="page"'], target_matchers: ['severity="ticket"'], equal: ["slo"] }]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("an unknown template name falls back to the default", () => {
+    expect(prometheusPlugin.initTemplates!("no-such-template")).toBe(prometheusPlugin.initTemplates!());
+    for (const name of TEMPLATE_NAMES) expect(prometheusPlugin.initTemplates!(name)).not.toBe(prometheusPlugin.initTemplates!());
+  });
 });

package/src/init-templates.ts

@@ -6,7 +6,11 @@
  * - `rules`: rule groups only, for a setup whose Alertmanager config lives
  *   elsewhere.
  * - `slo-style`: a recording rule per window and alerts on two severities,
- *   the shape SLO burn-rate rules take.
+ *   the shape SLO burn-rate rules take, written out as plain rules.
+ * - `slo`: an SLO declared with the `Slo` composite, which builds its error
+ *   ratios, error budget and multiwindow burn-rate alerts, and the
+ *   Alertmanager routing for the page and ticket severities those alerts
+ *   carry, with a page muting the same SLO's ticket.
  */
 import type { InitTemplateSet } from "@intentius/chant/lexicon";
 
@@ -69,8 +73,73 @@ const burnAlerts = new RuleGroup({ name: "burn-alerts", rules: alerting });
 export { errorRatios, burnAlerts };
 `;
 
-export function initTemplates(template?: string): InitTemplateSet {
-  if (template === "rules") return { src: { "rules.ts": RULES } };
-  if (template === "slo-style") return { src: { "rules.ts": SLO_STYLE } };
-  return { src: { "rules.ts": RULES, "alertmanager.ts": ALERTMANAGER } };
-}
+// ── slo ────────────────────────────────────────────────────────────────
+
+const SLO_DECLARATION = `/**
+ * The SLO: 99.9% of checkout requests answer without a 5xx over 30 days.
+ * \`Slo\` builds one rule group: the error ratio over every window its alerts
+ * read, the error budget left, and burn-rate alerts that page on a fast burn
+ * (severity "page") and open a ticket on a slow one (severity "ticket").
+ * \`sloMetrics(checkout)\` returns the recorded series names, for a dashboard
+ * or another rule to read.
+ */
+import { Slo } from "@intentius/chant-lexicon-prometheus";
+
+const sli = {
+  errors: 'sum(rate(http_requests_total{job="checkout",code=~"5.."}[{{window}}]))',
+  total: 'sum(rate(http_requests_total{job="checkout"}[{{window}}]))',
+};
+const team = { team: "payments" };
+
+const checkout = Slo({
+  name: "checkout",
+  objective: 0.999,
+  window: "30d",
+  description: "Checkout requests answer without a 5xx.",
+  sli,
+  labels: team,
+});
+
+export { checkout };
+`;
+
+const SLO_ALERTMANAGER = `/**
+ * Routing for the SLO's alerts, in the same build root so PROM202 checks that
+ * both severities they carry have a route.
+ */
+import { InhibitRule, Receiver, Route, type RouteProps, type WebhookConfig } from "@intentius/chant-lexicon-prometheus";
+
+const pager: WebhookConfig[] = [{ url: "http://pager-bridge:8080/alerts" }];
+const oncall = new Receiver({ name: "oncall", webhook_configs: pager });
+
+const ticketing: WebhookConfig[] = [{ url: "http://ticket-bridge:8080/alerts" }];
+const tickets = new Receiver({ name: "tickets", webhook_configs: ticketing });
+
+const fallback = new Receiver({ name: "default" });
+
+const bySlo = ["alertname", "slo"];
+const children: RouteProps[] = [
+  { matchers: ['severity="page"'], receiver: oncall },
+  { matchers: ['severity="ticket"'], receiver: tickets },
+];
+const root = new Route({ receiver: fallback, group_by: bySlo, routes: children });
+
+// A page for an SLO mutes its ticket: the fast burn already has someone on it.
+const pageSource = ['severity="page"'];
+const ticketTarget = ['severity="ticket"'];
+const sameSlo = ["slo"];
+const pageMutesTicket = new InhibitRule({ source_matchers: pageSource, target_matchers: ticketTarget, equal: sameSlo });
+
+export { oncall, tickets, fallback, root, pageMutesTicket };
+`;
+
+export const DEFAULT_TEMPLATE: InitTemplateSet = { src: { "rules.ts": RULES, "alertmanager.ts": ALERTMANAGER } };
+
+export const RULES_TEMPLATE: InitTemplateSet = { src: { "rules.ts": RULES } };
+
+export const SLO_STYLE_TEMPLATE: InitTemplateSet = { src: { "rules.ts": SLO_STYLE } };
+
+export const SLO_TEMPLATE: InitTemplateSet = { src: { "slo.ts": SLO_DECLARATION, "alertmanager.ts": SLO_ALERTMANAGER } };
+
+/** The template names `chant init --lexicon prometheus --template <name>` takes, besides the default. */
+export const TEMPLATE_NAMES = ["rules", "slo-style", "slo"] as const;

package/src/lint/audit-catalog.ts

@@ -9,7 +9,8 @@
  * listed for a reader who meets them in a lint report.
  */
 
-import { auditRule, type RuleMeta } from "@intentius/chant/audit/catalog";
+import { applyLineage, auditRule, type RuleMeta } from "@intentius/chant/audit/catalog";
+import { prometheusAuditLineage } from "./audit-lineage";
 
 function sourceRule(id: string, category: RuleMeta["category"], title: string, remediation: string): RuleMeta {
   return { id, tier: "merge-worthy", fixKind: "guidance", category, title, remediation, yamlBased: false };
@@ -118,6 +119,16 @@ export const prometheusAuditCatalog: Record<string, RuleMeta> = {
     "merge-worthy",
     "correctness",
     "Receiver integration missing its destination or credential",
-    "Set the integration's url, api_url, routing_key or to/smarthost/from (or their *_file and global equivalents).",
+    "Set the integration's destination and credential (url, webhook_url, api_key, routing_key, chat_id, room_id, to/smarthost/from, ...), through its *_file or global equivalent where there is one.",
+  ),
+  PROM210: outputRule(
+    "PROM210",
+    "merge-worthy",
+    "correctness",
+    "Integration or global setting Alertmanager rejects",
+    "Set one of each value and its *_file, and use a value Alertmanager allows (e.g. message_type text or markdown, parse_mode Markdown, MarkdownV2 or HTML).",
   ),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(prometheusAuditCatalog, prometheusAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,69 @@
+/**
+ * Prior art for the prometheus lexicon's audit rules: the tools whose checks
+ * cover the same condition, credited per rule. See
+ * packages/core/src/audit/prior-art.ts for the registry, the relation
+ * vocabulary, and why this is credit rather than authority. Kept by hand.
+ *
+ * Mapped against each tool's own check list (#2916):
+ *
+ * - promtool check rules parses a rule file with Prometheus's rulefmt
+ *   package (model/rulefmt/rulefmt.go): repeated group names, record/alert
+ *   exclusivity, annotations/for/keep_firing_for on recording rules, durations,
+ *   and PromQL syntax. It has no per-rule ids, so those credits omit `rule`.
+ * - amtool check-config loads an Alertmanager config with the same code the
+ *   server uses (config/config.go): undefined receivers and time intervals,
+ *   non-unique names, a root route that is missing, has no receiver or has
+ *   matchers, matcher syntax, durations, missing integration destinations and
+ *   credentials, and "at most one of X and X_file". No per-rule ids either.
+ * - pint (cloudflare/pint, docs/checks/) is a rule linter with named checks.
+ *   promql/syntax, rule/duplicate, rule/label, alerts/annotation and
+ *   alerts/for map onto chant rules. rule/label and alerts/annotation are
+ *   configurable "this label or annotation must exist" checks that pint ships
+ *   with nothing enabled, so they overlap PROM106 and PROM107 and no more.
+ *
+ * Deliberately without a credit from these tools:
+ * - PROM001 and PROM003: a literal credential in TypeScript source, and the
+ *   Slo objective/window model. Neither tool reads either.
+ * - PROM202 (severity not routed) and PROM207 (receiver never routed to):
+ *   check-config accepts both, and `amtool config routes test` answers a
+ *   different question (where one given label set goes).
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+const RULEFMT = "https://github.com/prometheus/prometheus/blob/main/model/rulefmt/rulefmt.go";
+const AM_CONFIG = "https://github.com/prometheus/alertmanager/blob/main/config/config.go";
+const PINT = "https://github.com/cloudflare/pint/blob/main/docs/checks";
+
+const amtool = (relation: Lineage["relation"]): Lineage => ({
+  tool: "amtool",
+  url: AM_CONFIG,
+  relation,
+});
+
+export const prometheusAuditLineage: Record<string, Lineage[]> = {
+  PROM002: [
+    { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+    { tool: "pint", rule: "promql/syntax", url: `${PINT}/promql/syntax.md`, relation: "equivalent" },
+  ],
+  PROM101: [{ tool: "promtool", url: RULEFMT, relation: "equivalent" }],
+  PROM102: [{ tool: "pint", rule: "rule/duplicate", url: `${PINT}/rule/duplicate.md`, relation: "overlaps" }],
+  PROM103: [
+    { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+    { tool: "pint", rule: "alerts/for", url: `${PINT}/alerts/for.md`, relation: "overlaps" },
+  ],
+  PROM104: [
+    { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+    { tool: "pint", rule: "promql/syntax", url: `${PINT}/promql/syntax.md`, relation: "equivalent" },
+  ],
+  PROM105: [{ tool: "promtool", url: RULEFMT, relation: "equivalent" }],
+  PROM106: [{ tool: "pint", rule: "rule/label", url: `${PINT}/rule/label.md`, relation: "overlaps" }],
+  PROM107: [{ tool: "pint", rule: "alerts/annotation", url: `${PINT}/alerts/annotation.md`, relation: "overlaps" }],
+  PROM201: [amtool("equivalent")],
+  PROM203: [amtool("equivalent")],
+  PROM204: [amtool("equivalent")],
+  PROM205: [amtool("equivalent")],
+  PROM206: [amtool("equivalent")],
+  PROM208: [amtool("equivalent")],
+  PROM209: [amtool("overlaps")],
+  PROM210: [amtool("overlaps")],
+};

package/src/lint/post-synth/index.ts

@@ -16,6 +16,7 @@ import { prom206 } from "./prom206";
 import { prom207 } from "./prom207";
 import { prom208 } from "./prom208";
 import { prom209 } from "./prom209";
+import { prom210 } from "./prom210";
 
 export const postSynthChecks: PostSynthCheck[] = [
   prom101,
@@ -34,4 +35,5 @@ export const postSynthChecks: PostSynthCheck[] = [
   prom207,
   prom208,
   prom209,
+  prom210,
 ];

package/src/lint/post-synth/post-synth.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, test } from "vitest";
 import { makePostSynthCtx, makePostSynthCtxFromFiles } from "@intentius/chant-test-utils";
 import { postSynthChecks } from "./index";
+import { RECEIVER_INTEGRATION_TYPES } from "../../integrations";
+import { INTEGRATION_CASES, SLACK_APP_URL, amWith } from "../../testdata/integration-cases";
 import { prom101 } from "./prom101";
 import { prom102 } from "./prom102";
 import { prom103 } from "./prom103";
@@ -17,6 +19,7 @@ import { prom206 } from "./prom206";
 import { prom207 } from "./prom207";
 import { prom208 } from "./prom208";
 import { prom209 } from "./prom209";
+import { prom210 } from "./prom210";
 
 const RULES = `groups:
   - name: api
@@ -245,6 +248,37 @@ receivers:
   });
 });
 
+const integrationCodes = (text: string) =>
+  [prom208, prom209, prom210].flatMap((c) => c.check(amOnly(text))).map((d) => d.checkId).sort();
+
+describe("PROM208-PROM210 on every Alertmanager integration", () => {
+  test.each(INTEGRATION_CASES)("%s", (_label, key, entry, global, codes) => {
+    expect(integrationCodes(amWith(key, entry, global))).toEqual(codes);
+  });
+
+  test("every integration has a passing and a failing case", () => {
+    for (const key of Object.keys(RECEIVER_INTEGRATION_TYPES)) {
+      const cases = INTEGRATION_CASES.filter((c) => c[1] === key);
+      expect(cases.some((c) => c[4].length === 0), `${key} passing`).toBe(true);
+      expect(cases.some((c) => c[4].length > 0), `${key} failing`).toBe(true);
+    }
+  });
+
+  test("findings name the receiver and the entry", () => {
+    const [d] = prom209.check(amOnly(amWith("opsgenie_configs", {})));
+    expect(d).toMatchObject({ checkId: "PROM209", severity: "error", entity: "r" });
+    expect(d.message).toContain('receiver "r" opsgenie_configs[0] has no api_key');
+  });
+
+  test("PROM210 and PROM208 in global", () => {
+    const am = (global: Record<string, unknown>) => JSON.stringify({ global, route: { receiver: "r" }, receivers: [{ name: "r" }] });
+    expect(integrationCodes(am({ slack_app_token_file: "/t", slack_api_url: "https://hooks.slack.com/x" }))).toEqual(["PROM210"]);
+    expect(integrationCodes(am({ slack_app_token_file: "/t", slack_api_url: SLACK_APP_URL }))).toEqual([]);
+    expect(integrationCodes(am({ smtp_auth_password: "x", smtp_auth_password_file: "/p", smtp_smarthost: "smtp" }))).toEqual(["PROM210", "PROM210"]);
+    expect(integrationCodes(am({ resolve_timeout: "1.5m" }))).toEqual(["PROM208"]);
+  });
+});
+
 describe("documents from other lexicons", () => {
   test("a k8s manifest and a collector config are not read as ours", () => {
     const ctx = makePostSynthCtx(

package/src/lint/post-synth/prom-helpers.ts

@@ -71,7 +71,7 @@ export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssue
   );
 }
 
-/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM209) across every `alertmanager.yml` in the output. */
+/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210) across every `alertmanager.yml` in the output. */
 export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).alertmanager.flatMap(({ source, config }) =>
     validateAlertmanagerConfig(config)

package/src/lint/post-synth/prom208.ts

@@ -1,7 +1,7 @@
 /**
  * PROM208: An Alertmanager duration is not a duration
  *
- * group_wait, group_interval, repeat_interval, resolve_timeout and webhook timeout take durations such as 30s or 4h.
+ * group_wait, group_interval, repeat_interval, resolve_timeout and Jira reopen_duration take Prometheus durations (30s, 4h, 1d); the timeout of webhook, Slack, PagerDuty and incident.io, and Pushover retry, expire and ttl take Go durations (10s, 1m30s, 500ms).
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";

package/src/lint/post-synth/prom209.ts

@@ -1,7 +1,7 @@
 /**
  * PROM209: A receiver integration is missing its destination or credential
  *
- * A webhook needs url or url_file, Slack an api_url (or the global one), PagerDuty a routing_key or service_key, and email a to address, a smarthost and a from address (or their global defaults).
+ * Every one of Alertmanager's 18 integrations is checked for the destination, credential and required fields its config validation asks for, with the global defaults it falls back to: e.g. a webhook url, an Opsgenie api_key (or global.opsgenie_api_key), a Telegram chat_id and bot token, a Webex room_id and authorization, an SNS target, a Jira project and issue_type.
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";

package/src/lint/post-synth/prom210.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM210: A receiver integration or global setting is one Alertmanager rejects
+ *
+ * Two settings that exclude each other (a value and its *_file, a Slack api_url and app_token, Pushover html and monospace, two SNS targets), or a value outside the allowed set (WeChat message_type, Telegram parse_mode, Jira api_type, an Opsgenie responder type, a VictorOps reserved custom field, a smarthost that is not host:port, a Slack or Mattermost field without title and value).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom210: PostSynthCheck = {
+  id: "PROM210",
+  description: "A receiver integration or global setting is one Alertmanager rejects",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM210");
+  },
+};

package/src/plugin.test.ts

@@ -37,6 +37,7 @@ describe("prometheus plugin", () => {
       "PROM207",
       "PROM208",
       "PROM209",
+      "PROM210",
     ]);
   });