@intentius/chant-lexicon-prometheus 0.96.0

package/dist/pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../src/pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;EAGzB,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,10 @@
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+/**
+ * Prometheus lexicon plugin.
+ *
+ * Typed recording and alerting rule groups, serialized to a Prometheus rule
+ * file, and Alertmanager routes, receivers, inhibit rules and time
+ * intervals, serialized to `alertmanager.yml`.
+ */
+export declare const prometheusPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA4B9D;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aA6F9B,CAAC"}

package/dist/promql.d.ts

@@ -0,0 +1,25 @@
+/**
+ * PromQL syntax checking, with the grammar the Prometheus project publishes
+ * (`@prometheus-io/lezer-promql`, the parser behind the Prometheus web UI's
+ * editor).
+ *
+ * This is a syntax check: unbalanced brackets, a bad duration in a range
+ * selector, an unknown function, two selectors with no operator between
+ * them. It does not type-check (`rate` over an instant vector parses), which
+ * `promtool check rules` does when it is available (see `tools.ts`).
+ */
+/** The grammar package and the exact version this lexicon checks PromQL with. */
+export declare const PROMQL_GRAMMAR: Readonly<{
+    source: "@prometheus-io/lezer-promql";
+    version: "0.315.0";
+}>;
+export type PromqlCheck = {
+    ok: true;
+} | {
+    ok: false;
+    position: number;
+    message: string;
+};
+/** Check one PromQL expression's syntax. */
+export declare function checkPromql(expr: string): PromqlCheck;
+//# sourceMappingURL=promql.d.ts.map

package/dist/promql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promql.d.ts","sourceRoot":"","sources":["../src/promql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;EAA+E,CAAC;AAE3G,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAU1F,4CAA4C;AAC5C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAkBrD"}

package/dist/rule-eval.d.ts

@@ -0,0 +1,67 @@
+/**
+ * A small rule-file evaluator, for tests over synthetic series.
+ *
+ * It evaluates recording and alerting rules the way Prometheus does, one
+ * evaluation step at a time: each group's rules in order, recording rule
+ * results written back as series the later rules (and later steps) read.
+ * The PromQL it understands is the subset the lexicon's generated rules use:
+ * number literals, vector and range selectors with `=`, `!=`, `=~` and `!~`
+ * matchers, `rate`, `increase`, `avg_over_time`, `sum_over_time`,
+ * `count_over_time`, `vector`, `sum` (with `by` or `without`), the
+ * arithmetic and comparison operators and `and`, `or` and `unless` (with
+ * `on` or `ignoring`). Anything else throws, so a test never passes by
+ * silently evaluating something it does not understand.
+ *
+ * `rate` is the increase between the first and last sample in the range
+ * over the time between them, without Prometheus's extrapolation to the
+ * range's edges. For two counters sampled together that changes neither's
+ * ratio, which is what an SLI is. `promtool test rules`, when installed,
+ * checks the same rules with Prometheus's own engine.
+ *
+ * Not exported from the package root; tests import it by path.
+ */
+import { type RuleGroupConfig } from "./model.js";
+export type Labels = Record<string, string>;
+export interface Sample {
+    t: number;
+    v: number;
+}
+export interface Series {
+    labels: Labels;
+    samples: Sample[];
+}
+export interface VectorElement {
+    labels: Labels;
+    value: number;
+}
+/** One firing alert at one evaluation. */
+export interface FiringAlert {
+    labels: Labels;
+    value: number;
+}
+/** An in-memory series store with rule evaluation over it. */
+export declare class RuleEvaluator {
+    private readonly groups;
+    private readonly series;
+    /** When each active alert started, per alerting rule. */
+    private readonly pending;
+    constructor(groups: RuleGroupConfig[]);
+    /** Append one sample; samples of a series must arrive in time order. */
+    add(labels: Labels, t: number, v: number): void;
+    /** Evaluate every group at time `t` (milliseconds); returns the alerts firing at `t`. */
+    step(t: number): FiringAlert[];
+    /** The latest value of each series matching `selector` at `t`, e.g. `slo:x{slo="a"}`. */
+    query(expr: string, t: number): VectorElement[];
+    private eval;
+    private text;
+    private matchers;
+    private select;
+    /** Samples in (t - range, t]. */
+    private window;
+    private node;
+    private args;
+    private call;
+    private aggregate;
+    private binary;
+}
+//# sourceMappingURL=rule-eval.d.ts.map

package/dist/rule-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-eval.d.ts","sourceRoot":"","sources":["../src/rule-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAA8D,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAI3G,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC5C,MAAM,WAAW,MAAM;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AACD,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AACD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAiCD,8DAA8D;AAC9D,qBAAa,aAAa;IAKZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;gBAErC,MAAM,EAAE,eAAe,EAAE;IAEtD,wEAAwE;IACxE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI;IAU/C,yFAAyF;IACzF,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE;IA8B9B,yFAAyF;IACzF,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE;IAK/C,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,MAAM;IAId,iCAAiC;IACjC,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,IAAI;IAuCZ,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,MAAM;CA0Gf"}

package/dist/rules/literal-credential.ts

@@ -0,0 +1,84 @@
+import * as ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import { calleeName, CREDENTIAL_CLASS, literalText, position, propertyName } from "./prom-ast";
+
+/**
+ * Alertmanager fields that hold a secret, each with a `*_file` sibling that
+ * reads it from a mounted file instead.
+ */
+export const SECRET_FIELDS = new Set([
+  "api_url", // slack_configs: the incoming-webhook URL is the credential
+  "slack_api_url",
+  "routing_key",
+  "service_key",
+  "auth_password",
+  "auth_secret",
+  "smtp_auth_password",
+  "smtp_auth_secret",
+  "password",
+  "credentials",
+  "bearer_token",
+  "client_secret",
+]);
+
+/**
+ * PROM001: a credential written as a literal in a `Receiver` or
+ * `AlertmanagerSettings`.
+ *
+ * A literal there is a secret in the repository and in the emitted
+ * `alertmanager.yml`. Alertmanager does not expand environment variables in
+ * its config, so the fix is the field's `*_file` sibling (`api_url_file`,
+ * `routing_key_file`, `auth_password_file`, `credentials_file`), pointing at
+ * a file mounted from a secret store.
+ */
+export const literalCredentialRule: LintRule = {
+  id: "PROM001",
+  severity: "error",
+  category: "security",
+  description: "Alertmanager credential declared as a literal instead of read from a *_file",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+
+    const scanValue = (key: string | undefined, init: ts.Expression) => {
+      if (ts.isObjectLiteralExpression(init)) {
+        scan(init);
+        return;
+      }
+      if (ts.isArrayLiteralExpression(init)) {
+        for (const el of init.elements) if (ts.isObjectLiteralExpression(el)) scan(el);
+        return;
+      }
+      if (!key || !SECRET_FIELDS.has(key)) return;
+      const text = literalText(init);
+      if (text === undefined || text === "") return;
+      diagnostics.push({
+        ruleId: "PROM001",
+        severity: "error",
+        message: `\`${key}\` is a literal credential; Alertmanager doesn't expand environment variables, so mount the secret and set \`${key}_file\` instead`,
+        file: context.filePath,
+        ...position(source, init),
+      });
+    };
+
+    const scan = (obj: ts.ObjectLiteralExpression) => {
+      for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop)) continue;
+        scanValue(propertyName(prop), prop.initializer);
+      }
+    };
+
+    const visit = (node: ts.Node) => {
+      if (ts.isNewExpression(node) || ts.isCallExpression(node)) {
+        const name = calleeName(node);
+        const arg = node.arguments?.[0];
+        if (name && CREDENTIAL_CLASS.test(name) && arg && ts.isObjectLiteralExpression(arg)) scan(arg);
+      }
+      ts.forEachChild(node, visit);
+    };
+
+    visit(source);
+    return diagnostics;
+  },
+};

package/dist/rules/prom-ast.ts

@@ -0,0 +1,30 @@
+import * as ts from "typescript";
+
+/** The constructor name of a `new X(...)` or `X(...)` expression, if it is a plain or dotted name. */
+export function calleeName(node: ts.CallExpression | ts.NewExpression): string | undefined {
+  const callee = node.expression;
+  if (ts.isIdentifier(callee)) return callee.text;
+  if (ts.isPropertyAccessExpression(callee)) return callee.name.text;
+  return undefined;
+}
+
+/** The classes whose props hold Alertmanager credentials. */
+export const CREDENTIAL_CLASS = /^(Receiver|AlertmanagerSettings)$/;
+
+/** A property's key as text, for identifier and string-literal keys. */
+export function propertyName(prop: ts.ObjectLiteralElementLike): string | undefined {
+  if (!ts.isPropertyAssignment(prop)) return undefined;
+  if (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) return prop.name.text;
+  return undefined;
+}
+
+/** The text of a string literal or substitution-free template, else undefined. */
+export function literalText(node: ts.Expression): string | undefined {
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
+  return undefined;
+}
+
+export function position(source: ts.SourceFile, node: ts.Node): { line: number; column: number } {
+  const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+  return { line: line + 1, column: character + 1 };
+}

package/dist/rules/prom-helpers.ts

@@ -0,0 +1,89 @@
+/**
+ * Shared plumbing for the prometheus post-synth checks: find the rule files
+ * and `alertmanager.yml` documents in a build's output, and run the
+ * plain-function checks over them.
+ *
+ * Documents are recognized by shape, not by which lexicon emitted them, so a
+ * rule file that reaches the output some other way (a hand-written YAML
+ * sidecar) is checked too. `PrometheusRule` manifests are not read here;
+ * their groups are the same `RuleGroup`s and are checked where they are
+ * declared.
+ */
+
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { loadAll } from "js-yaml";
+import { looksLikeAlertmanagerConfig, looksLikeRuleFile, type AlertmanagerConfig, type RuleFileConfig } from "../../model";
+import {
+  validateAlertmanagerConfig,
+  validateRuleFile,
+  validateSeverityRouting,
+  type PrometheusIssue,
+  type PrometheusIssueCode,
+} from "../../validate-config";
+
+export interface FoundDocs {
+  ruleFiles: Array<{ source: string; config: RuleFileConfig }>;
+  alertmanager: Array<{ source: string; config: AlertmanagerConfig }>;
+}
+
+/** Every rule file and Alertmanager config in the output. Parsed with js-yaml rather than `ctx.docs`, which keeps block scalars and flow lists as strings. */
+export function prometheusDocs(ctx: PostSynthContext): FoundDocs {
+  const found: FoundDocs = { ruleFiles: [], alertmanager: [] };
+  for (const [lexicon, output] of ctx.outputs) {
+    const texts: Array<[string, string]> =
+      typeof output === "string"
+        ? [[lexicon, output]]
+        : [[lexicon, (output as SerializerResult).primary], ...Object.entries((output as SerializerResult).files ?? {})];
+    for (const [source, text] of texts) {
+      if (!text) continue;
+      let docs: unknown[];
+      try {
+        docs = loadAll(text);
+      } catch {
+        continue; // not YAML, or not ours
+      }
+      for (const doc of docs) {
+        if (looksLikeRuleFile(doc)) found.ruleFiles.push({ source, config: doc });
+        else if (looksLikeAlertmanagerConfig(doc)) found.alertmanager.push({ source, config: doc });
+      }
+    }
+  }
+  return found;
+}
+
+function toDiagnostic(issue: PrometheusIssue, source: string): PostSynthDiagnostic {
+  return {
+    checkId: issue.code,
+    severity: issue.severity,
+    message: source && source !== "prometheus" ? `${source}: ${issue.message}` : issue.message,
+    ...(issue.subject ? { entity: issue.subject } : {}),
+    lexicon: "prometheus",
+  };
+}
+
+/** Diagnostics for one rule-file code (PROM101-PROM107) across every rule file in the output. */
+export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
+  return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) =>
+    validateRuleFile(config)
+      .filter((i) => i.code === code)
+      .map((i) => toDiagnostic(i, source)),
+  );
+}
+
+/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM209) across every `alertmanager.yml` in the output. */
+export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
+  return prometheusDocs(ctx).alertmanager.flatMap(({ source, config }) =>
+    validateAlertmanagerConfig(config)
+      .filter((i) => i.code === code)
+      .map((i) => toDiagnostic(i, source)),
+  );
+}
+
+/** PROM202: joins every rule file in the output against every Alertmanager config in it. Silent when either is absent. */
+export function routingDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const { ruleFiles, alertmanager } = prometheusDocs(ctx);
+  if (ruleFiles.length === 0) return [];
+  const files = ruleFiles.map((r) => r.config);
+  return alertmanager.flatMap(({ source, config }) => validateSeverityRouting(files, config).map((i) => toDiagnostic(i, source)));
+}

package/dist/rules/prom101.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM101: Two rule groups in one rule file share a name
+ *
+ * Prometheus refuses to load a rule file whose group names repeat.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom101: PostSynthCheck = {
+  id: "PROM101",
+  description: "Two rule groups in one rule file share a name",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM101");
+  },
+};

package/dist/rules/prom102.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM102: Two rules share a name and label set
+ *
+ * Two recording rules (or two alerts) with the same name and labels produce the same series and overwrite each other. This follows promtool's duplicate-rules lint: alerts that share a name and differ by a label, such as severity, are fine.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom102: PostSynthCheck = {
+  id: "PROM102",
+  description: "Two rules share a name and label set",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM102");
+  },
+};

package/dist/rules/prom103.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM103: A rule or group duration is not a Prometheus duration
+ *
+ * for, keep_firing_for, interval and query_offset take durations such as 30s, 5m or 1h30m. Prometheus refuses the rule file otherwise.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom103: PostSynthCheck = {
+  id: "PROM103",
+  description: "A rule or group duration is not a Prometheus duration",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM103");
+  },
+};

package/dist/rules/prom104.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM104: A rule expression is not valid PromQL
+ *
+ * Every expr is parsed with the PromQL grammar the Prometheus project publishes. A syntax error fails the rule file at load time.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom104: PostSynthCheck = {
+  id: "PROM104",
+  description: "A rule expression is not valid PromQL",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM104");
+  },
+};

package/dist/rules/prom105.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM105: A rule or group is malformed
+ *
+ * A rule sets exactly one of record and alert, has a non-empty name, and a recording rule takes no for, keep_firing_for or annotations. A group has a name.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom105: PostSynthCheck = {
+  id: "PROM105",
+  description: "A rule or group is malformed",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM105");
+  },
+};

package/dist/rules/prom106.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM106: An alerting rule has no severity label
+ *
+ * Alertmanager routes on labels, and severity is the one every route in this lexicon's examples and checks keys on. Without it the alert can only be routed by name.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom106: PostSynthCheck = {
+  id: "PROM106",
+  description: "An alerting rule has no severity label",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM106");
+  },
+};

package/dist/rules/prom107.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM107: An alerting rule has no summary or description annotation
+ *
+ * A notification carries only the alert's labels unless an annotation says what is wrong.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom107: PostSynthCheck = {
+  id: "PROM107",
+  description: "An alerting rule has no summary or description annotation",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM107");
+  },
+};

package/dist/rules/prom201.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM201: A route sends to a receiver that is not declared
+ *
+ * Alertmanager refuses a config whose routes name an undefined receiver.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom201: PostSynthCheck = {
+  id: "PROM201",
+  description: "A route sends to a receiver that is not declared",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM201");
+  },
+};

package/dist/rules/prom202.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM202: An alert severity is not routed by any route
+ *
+ * Joins the rule files and the Alertmanager config in one build root. An alert whose severity no route below the root matches falls through to the root's default receiver. Silent when the rules and the Alertmanager config are built in different build roots (chant #1939).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { routingDiagnostics } from "./prom-helpers";
+
+export const prom202: PostSynthCheck = {
+  id: "PROM202",
+  description: "An alert severity is not routed by any route",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return routingDiagnostics(ctx);
+  },
+};

package/dist/rules/prom203.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM203: Two receivers or two time intervals share a name
+ *
+ * Alertmanager refuses a config with repeated receiver or time interval names.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom203: PostSynthCheck = {
+  id: "PROM203",
+  description: "Two receivers or two time intervals share a name",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM203");
+  },
+};

package/dist/rules/prom204.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM204: A route names a time interval that is not declared
+ *
+ * mute_time_intervals and active_time_intervals must name entries under time_intervals.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom204: PostSynthCheck = {
+  id: "PROM204",
+  description: "A route names a time interval that is not declared",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM204");
+  },
+};

package/dist/rules/prom205.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM205: The root route is missing, has no receiver, or has matchers
+ *
+ * The root route is the default for every alert: it must exist, name a receiver and match everything.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom205: PostSynthCheck = {
+  id: "PROM205",
+  description: "The root route is missing, has no receiver, or has matchers",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM205");
+  },
+};

package/dist/rules/prom206.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM206: A route or inhibit rule matcher does not parse
+ *
+ * Matchers are label, operator (=, !=, =~, !~) and value, e.g. severity="page".
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom206: PostSynthCheck = {
+  id: "PROM206",
+  description: "A route or inhibit rule matcher does not parse",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM206");
+  },
+};

package/dist/rules/prom207.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM207: A receiver is declared but no route sends to it
+ *
+ * An unused receiver usually means a route names the wrong one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom207: PostSynthCheck = {
+  id: "PROM207",
+  description: "A receiver is declared but no route sends to it",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM207");
+  },
+};

package/dist/rules/prom208.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM208: An Alertmanager duration is not a duration
+ *
+ * group_wait, group_interval, repeat_interval, resolve_timeout and webhook timeout take durations such as 30s or 4h.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom208: PostSynthCheck = {
+  id: "PROM208",
+  description: "An Alertmanager duration is not a duration",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM208");
+  },
+};

package/dist/rules/prom209.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM209: A receiver integration is missing its destination or credential
+ *
+ * A webhook needs url or url_file, Slack an api_url (or the global one), PagerDuty a routing_key or service_key, and email a to address, a smarthost and a from address (or their global defaults).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom209: PostSynthCheck = {
+  id: "PROM209",
+  description: "A receiver integration is missing its destination or credential",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM209");
+  },
+};