@homeflare/alchemy 0.34.0 → 0.35.0

package/dist/grafana/index.js

@@ -1,17 +1,77 @@
-// src/grafana/datasource.ts
+// src/grafana/alert-rule-group.ts
+import { isResolved as isResolved2 } from "alchemy/Diff";
 import { Resource } from "alchemy";
 import * as Provider from "alchemy/Provider";
 import * as grafana from "@distilled.cloud/grafana";
+import * as Effect5 from "effect/Effect";
+
+// src/grafana/alert-rule-group-drop-warning.ts
+import * as Effect from "effect/Effect";
+var warnOnDroppedRules = (folderUid, group, declaredUids, liveRules) => Effect.gen(function* () {
+  const dropped = (liveRules ?? []).filter((rule) => typeof rule.uid === "string").filter((rule) => !declaredUids.has(rule.uid));
+  if (dropped.length === 0)
+    return;
+  const names = dropped.map((rule) => `${typeof rule.title === "string" ? rule.title : "(untitled)"} (${rule.uid})`).join(", ");
+  yield* Effect.logWarning(`Grafana.AlertRuleGroup ${folderUid}/${group}: this update REMOVES ${dropped.length} ` + `rule(s) not in the declaration: ${names}. Whole-group replacement is by design — add ` + `them to the declaration to keep them, or give them their own group.`);
+});
+
+// src/grafana/alert-rule-group-model.ts
+var RULE_VOLATILE_FIELDS = ["id", "updated", "provenance"];
+var normalizeRule = (rule, folderUid, group) => {
+  const out = {};
+  for (const [key, value] of Object.entries(rule)) {
+    if (key === "folderUID" || key === "ruleGroup" || key === "orgID")
+      continue;
+    if (RULE_VOLATILE_FIELDS.includes(key))
+      continue;
+    out[key] = value;
+  }
+  out.folderUID = folderUid;
+  out.ruleGroup = group;
+  out.orgID = 1;
+  return out;
+};
+var toWireRule = (rule, folderUid, group) => ({
+  ...rule,
+  folderUID: folderUid,
+  orgID: 1,
+  ruleGroup: group
+});
+
+// src/grafana/alerting-provenance.ts
 import * as Effect3 from "effect/Effect";
 
+// src/grafana/provisioned.ts
+import * as Data from "effect/Data";
+import * as Effect2 from "effect/Effect";
+
+class GrafanaProvisionedObjectError extends Data.TaggedError("GrafanaProvisionedObjectError") {
+}
+var refuseIfProvisioned = (kind, uid, owner) => {
+  const ownerClause = owner === undefined || owner === "" ? `(this Grafana instance did not report an owning file)` : `by ${owner}`;
+  return Effect2.fail(new GrafanaProvisionedObjectError({
+    message: `${kind} '${uid}' is file-provisioned ${ownerClause} and read-only through the classic ` + `write API this family calls. Edit the provisioning file instead — declaring this ` + `object read-only (a declaration matching what is live) is safe and will never reach ` + `this refusal.`
+  }));
+};
+
+// src/grafana/alerting-provenance.ts
+var WRITABLE_PROVENANCES = new Set(["", "api"]);
+var isForeignProvenance = (provenance) => provenance === undefined || !WRITABLE_PROVENANCES.has(provenance);
+var refuseIfForeignProvenance = (kind, id, provenance) => {
+  const reason = provenance === undefined ? `did not report a provenance at all — this family cannot tell whether it is safe to own` : `has provenance '${provenance}', not '(none)' or 'api'`;
+  return Effect3.fail(new GrafanaProvisionedObjectError({
+    message: `${kind} '${id}' ${reason} — something other than this API may own it (file ` + `provisioning, the Prometheus-rules importer, or similar), and writing here could take ` + `over or corrupt an object this family does not actually control. Edit it at its actual ` + `source instead — declaring this object read-only (a declaration matching what is live) ` + `is safe and will never reach this refusal.`
+  }));
+};
+
 // src/grafana/resource.ts
 import { isResolved } from "alchemy/Diff";
-import * as Effect from "effect/Effect";
+import * as Effect4 from "effect/Effect";
 var grafanaOperations = (spec) => {
-  const read = (props) => spec.fetchLive(props).pipe(Effect.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
+  const read = (props) => spec.fetchLive(props).pipe(Effect4.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
   return {
     read,
-    diff: (news, output) => Effect.gen(function* () {
+    diff: (news, output) => Effect4.gen(function* () {
       if (output === undefined || !isResolved(news))
         return;
       const live = yield* read(news);
@@ -21,7 +81,7 @@ var grafanaOperations = (spec) => {
         return { action: "noop" };
       return spec.update === undefined ? { action: "replace" } : { action: "update" };
     }),
-    reconcile: (news) => Effect.gen(function* () {
+    reconcile: (news) => Effect4.gen(function* () {
       const before = yield* spec.fetchLive(news);
       if (before === undefined) {
         yield* spec.create(news);
@@ -33,11 +93,11 @@ var grafanaOperations = (spec) => {
       }
       const after = yield* read(news);
       if (after === undefined) {
-        return yield* Effect.die(new Error("grafanaOperations: the write returned no error but the object is still absent. " + "Read back rather than trusting the response status."));
+        return yield* Effect4.die(new Error("grafanaOperations: the write returned no error but the object is still absent. " + "Read back rather than trusting the response status."));
       }
       return after;
     }),
-    destroy: (olds) => Effect.gen(function* () {
+    destroy: (olds) => Effect4.gen(function* () {
       const live = yield* spec.fetchLive(olds);
       if (live === undefined)
         return;
@@ -48,7 +108,7 @@ var grafanaOperations = (spec) => {
 var grafanaHandlers = (spec) => {
   const ops = grafanaOperations(spec);
   return {
-    list: () => Effect.succeed([]),
+    list: () => Effect4.succeed([]),
     read: ({ olds }) => ops.read(olds),
     diff: ({ news, output }) => ops.diff(news, output),
     reconcile: ({ news }) => ops.reconcile(news),
@@ -56,20 +116,100 @@ var grafanaHandlers = (spec) => {
   };
 };
 
+// src/grafana/subset-match.ts
+var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var declaredContentMatches = (declared, live) => {
+  if (declared == null)
+    return true;
+  if (Array.isArray(declared)) {
+    return Array.isArray(live) && declared.length === live.length && declared.every((item, index) => declaredContentMatches(item, live[index]));
+  }
+  if (isPlainObject(declared)) {
+    return isPlainObject(live) && Object.entries(declared).every(([key, value]) => declaredContentMatches(value, live[key]));
+  }
+  return declared === live;
+};
+
+// src/grafana/alert-rule-group.ts
+var GrafanaAlertRuleGroup = Resource("Grafana.AlertRuleGroup", {
+  defaultRemovalPolicy: "retain"
+});
+var findForeignRule = (rules) => (rules ?? []).find((rule) => isForeignProvenance(rule.provenance));
+var body = (props) => ({
+  folderUid: props.folderUid,
+  interval: props.interval,
+  rules: props.rules.map((rule) => toWireRule(rule, props.folderUid, props.group)),
+  title: props.group
+});
+var refuseForForeignRule = (props, foreign) => refuseIfForeignProvenance("Grafana.AlertRuleGroup", `${props.folderUid}/${props.group}`, foreign.provenance);
+var declaredUids = (props) => new Set(props.rules.map((rule) => rule.uid));
+var spec = {
+  attributes: (live, props) => ({
+    folderUid: live.folderUid ?? props.folderUid,
+    group: props.group,
+    interval: live.interval ?? 0,
+    rules: (live.rules ?? []).map((rule) => normalizeRule(rule, props.folderUid, props.group))
+  }),
+  create: (props) => grafana.routePutAlertRuleGroup({
+    FolderUID: props.folderUid,
+    Group: props.group,
+    ...body(props)
+  }),
+  destroy: (props, live) => Effect5.gen(function* () {
+    const foreign = findForeignRule(live.rules);
+    if (foreign !== undefined)
+      return yield* refuseForForeignRule(props, foreign);
+    yield* grafana.routeDeleteAlertRuleGroup({ FolderUID: props.folderUid, Group: props.group });
+  }),
+  fetchLive: (props) => grafana.routeGetAlertRuleGroup({ FolderUID: props.folderUid, Group: props.group }).pipe(Effect5.catchTag("NotFound", () => Effect5.succeed(undefined))),
+  matches: (attributes, props) => attributes.interval === props.interval && declaredContentMatches(props.rules.map((rule) => normalizeRule(rule, props.folderUid, props.group)), attributes.rules),
+  update: (props, live) => Effect5.gen(function* () {
+    const foreign = findForeignRule(live.rules);
+    if (foreign !== undefined)
+      return yield* refuseForForeignRule(props, foreign);
+    yield* warnOnDroppedRules(props.folderUid, props.group, declaredUids(props), live.rules);
+    yield* grafana.routePutAlertRuleGroup({
+      FolderUID: props.folderUid,
+      Group: props.group,
+      ...body(props)
+    });
+  })
+};
+var diff = ({
+  news,
+  output
+}) => Effect5.gen(function* () {
+  if (output === undefined || !isResolved2(news))
+    return;
+  const live = yield* spec.fetchLive(news);
+  if (live === undefined)
+    return { action: "update" };
+  yield* warnOnDroppedRules(news.folderUid, news.group, declaredUids(news), live.rules);
+  const mapped = spec.attributes(live, news);
+  return mapped !== undefined && spec.matches(mapped, news) ? { action: "noop" } : { action: "update" };
+});
+var handlers = { ...grafanaHandlers(spec), diff };
+var GrafanaAlertRuleGroupProvider = () => Provider.effect(GrafanaAlertRuleGroup, Effect5.succeed(GrafanaAlertRuleGroup.Provider.of(handlers)));
+// src/grafana/datasource.ts
+import { Resource as Resource2 } from "alchemy";
+import * as Provider2 from "alchemy/Provider";
+import * as grafana2 from "@distilled.cloud/grafana";
+import * as Effect7 from "effect/Effect";
+
 // src/grafana/secret-refs.ts
-import * as Data from "effect/Data";
-import * as Effect2 from "effect/Effect";
+import * as Data2 from "effect/Data";
+import * as Effect6 from "effect/Effect";
 
-class GrafanaSecretRefUnsetError extends Data.TaggedError("GrafanaSecretRefUnsetError") {
+class GrafanaSecretRefUnsetError extends Data2.TaggedError("GrafanaSecretRefUnsetError") {
 }
-var resolveSecretRefs = (refs, describeField) => Effect2.gen(function* () {
+var resolveSecretRefs = (refs, describeField) => Effect6.gen(function* () {
   if (refs === undefined)
     return;
   const out = {};
   for (const [field, envVar] of Object.entries(refs)) {
     const raw = process.env[envVar];
     if (raw === undefined || raw.trim() === "") {
-      return yield* Effect2.fail(new GrafanaSecretRefUnsetError({
+      return yield* Effect6.fail(new GrafanaSecretRefUnsetError({
         message: `${envVar} is unset. Export the value of ${describeField(field)} there — ` + "never as an Alchemy prop."
       }));
     }
@@ -79,7 +219,7 @@ var resolveSecretRefs = (refs, describeField) => Effect2.gen(function* () {
 });
 
 // src/grafana/datasource.ts
-var GrafanaDatasource = Resource("Grafana.Datasource");
+var GrafanaDatasource = Resource2("Grafana.Datasource");
 var resolveSecureJsonData = (refs) => resolveSecretRefs(refs, (field) => `secureJsonData.${field}`);
 var fields = (props) => ({
   name: props.name,
@@ -94,7 +234,7 @@ var fields = (props) => ({
   ...props.user === undefined ? {} : { user: props.user },
   ...props.withCredentials === undefined ? {} : { withCredentials: props.withCredentials }
 });
-var spec = {
+var spec2 = {
   attributes: (live) => ({
     access: live.access ?? "",
     id: live.id ?? 0,
@@ -107,42 +247,28 @@ var spec = {
     url: live.url ?? "",
     version: live.version ?? 0
   }),
-  create: (props) => Effect3.flatMap(resolveSecureJsonData(props.secureJsonDataRefs), (secureJsonData) => grafana.addDataSource({
+  create: (props) => Effect7.flatMap(resolveSecureJsonData(props.secureJsonDataRefs), (secureJsonData) => grafana2.addDataSource({
     ...fields(props),
     ...secureJsonData === undefined ? {} : { secureJsonData },
     uid: props.uid
   })),
-  destroy: (props) => grafana.deleteDataSourceByUID({ uid: props.uid }),
-  fetchLive: (props) => grafana.getDataSourceByUID({ uid: props.uid }).pipe(Effect3.catchTag("NotFound", () => Effect3.succeed(undefined))),
+  destroy: (props) => grafana2.deleteDataSourceByUID({ uid: props.uid }),
+  fetchLive: (props) => grafana2.getDataSourceByUID({ uid: props.uid }).pipe(Effect7.catchTag("NotFound", () => Effect7.succeed(undefined))),
   matches: (attributes, props) => (props.name === undefined || attributes.name === props.name) && (props.type === undefined || attributes.type === props.type) && (props.url === undefined || attributes.url === props.url) && (props.access === undefined || attributes.access === props.access) && (props.isDefault === undefined || attributes.isDefault === props.isDefault),
-  update: (props, live) => Effect3.flatMap(resolveSecureJsonData(props.secureJsonDataRefs), (secureJsonData) => grafana.updateDataSourceByUID({
+  update: (props, live) => Effect7.flatMap(resolveSecureJsonData(props.secureJsonDataRefs), (secureJsonData) => grafana2.updateDataSourceByUID({
     ...fields(props),
     ...secureJsonData === undefined ? {} : { secureJsonData },
     ...live.version === undefined ? {} : { version: live.version },
     uid: props.uid
   }))
 };
-var handlers = grafanaHandlers(spec);
-var GrafanaDatasourceProvider = () => Provider.effect(GrafanaDatasource, Effect3.succeed(GrafanaDatasource.Provider.of(handlers)));
+var handlers2 = grafanaHandlers(spec2);
+var GrafanaDatasourceProvider = () => Provider2.effect(GrafanaDatasource, Effect7.succeed(GrafanaDatasource.Provider.of(handlers2)));
 // src/grafana/dashboard.ts
-import { Resource as Resource2 } from "alchemy";
-import * as Provider2 from "alchemy/Provider";
-import * as grafana2 from "@distilled.cloud/grafana";
-import * as Effect5 from "effect/Effect";
-
-// src/grafana/subset-match.ts
-var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var declaredContentMatches = (declared, live) => {
-  if (declared == null)
-    return true;
-  if (Array.isArray(declared)) {
-    return Array.isArray(live) && declared.length === live.length && declared.every((item, index) => declaredContentMatches(item, live[index]));
-  }
-  if (isPlainObject(declared)) {
-    return isPlainObject(live) && Object.entries(declared).every(([key, value]) => declaredContentMatches(value, live[key]));
-  }
-  return declared === live;
-};
+import { Resource as Resource3 } from "alchemy";
+import * as Provider3 from "alchemy/Provider";
+import * as grafana3 from "@distilled.cloud/grafana";
+import * as Effect8 from "effect/Effect";
 
 // src/grafana/dashboard-model.ts
 var VOLATILE_FIELDS = ["id", "version", "iteration"];
@@ -160,23 +286,10 @@ var normalizeModel = (model, uid) => {
 };
 var modelTitle = (model) => typeof model.title === "string" ? model.title : "";
 
-// src/grafana/provisioned.ts
-import * as Data2 from "effect/Data";
-import * as Effect4 from "effect/Effect";
-
-class GrafanaProvisionedObjectError extends Data2.TaggedError("GrafanaProvisionedObjectError") {
-}
-var refuseIfProvisioned = (kind, uid, owner) => {
-  const ownerClause = owner === undefined || owner === "" ? `(this Grafana instance did not report an owning file)` : `by ${owner}`;
-  return Effect4.fail(new GrafanaProvisionedObjectError({
-    message: `${kind} '${uid}' is file-provisioned ${ownerClause} and read-only through the classic ` + `write API this family calls. Edit the provisioning file instead — declaring this ` + `object read-only (a declaration matching what is live) is safe and will never reach ` + `this refusal.`
-  }));
-};
-
 // src/grafana/dashboard.ts
-var GrafanaDashboard = Resource2("Grafana.Dashboard");
+var GrafanaDashboard = Resource3("Grafana.Dashboard");
 var modelOf = (live) => live.dashboard !== null && typeof live.dashboard === "object" ? live.dashboard : {};
-var spec2 = {
+var spec3 = {
   attributes: (live, props) => {
     const model = normalizeModel(modelOf(live), props.uid);
     return {
@@ -190,23 +303,23 @@ var spec2 = {
       version: live.meta?.version ?? 0
     };
   },
-  create: (props) => grafana2.postDashboard({
+  create: (props) => grafana3.postDashboard({
     dashboard: normalizeModel(props.dashboard, props.uid),
     ...props.folderUid === undefined ? {} : { folderUid: props.folderUid }
   }),
-  destroy: (props, live) => Effect5.gen(function* () {
+  destroy: (props, live) => Effect8.gen(function* () {
     if (live.meta?.provisioned) {
       return yield* refuseIfProvisioned("Grafana.Dashboard", props.uid, live.meta.provisionedExternalId);
     }
-    yield* grafana2.deleteDashboard({ uid: props.uid });
+    yield* grafana3.deleteDashboard({ uid: props.uid });
   }),
-  fetchLive: (props) => grafana2.getDashboard({ uid: props.uid }).pipe(Effect5.catchTag("NotFound", () => Effect5.succeed(undefined))),
+  fetchLive: (props) => grafana3.getDashboard({ uid: props.uid }).pipe(Effect8.catchTag("NotFound", () => Effect8.succeed(undefined))),
   matches: (attributes, props) => (props.folderUid === undefined || attributes.folderUid === props.folderUid) && declaredContentMatches(normalizeModel(props.dashboard, props.uid), attributes.dashboard),
-  update: (props, live) => Effect5.gen(function* () {
+  update: (props, live) => Effect8.gen(function* () {
     if (live.meta?.provisioned) {
       return yield* refuseIfProvisioned("Grafana.Dashboard", props.uid, live.meta.provisionedExternalId);
     }
-    return yield* grafana2.postDashboard({
+    return yield* grafana3.postDashboard({
       dashboard: {
         ...normalizeModel(props.dashboard, props.uid),
         ...live.meta?.version === undefined ? {} : { version: live.meta.version }
@@ -215,21 +328,21 @@ var spec2 = {
     });
   })
 };
-var handlers2 = grafanaHandlers(spec2);
-var GrafanaDashboardProvider = () => Provider2.effect(GrafanaDashboard, Effect5.succeed(GrafanaDashboard.Provider.of(handlers2)));
+var handlers3 = grafanaHandlers(spec3);
+var GrafanaDashboardProvider = () => Provider3.effect(GrafanaDashboard, Effect8.succeed(GrafanaDashboard.Provider.of(handlers3)));
 // src/grafana/folder.ts
-import { Resource as Resource3 } from "alchemy";
-import * as Provider3 from "alchemy/Provider";
-import * as grafana3 from "@distilled.cloud/grafana";
+import { Resource as Resource4 } from "alchemy";
+import * as Provider4 from "alchemy/Provider";
+import * as grafana4 from "@distilled.cloud/grafana";
 import * as Data3 from "effect/Data";
-import * as Effect6 from "effect/Effect";
-var GrafanaFolder = Resource3("Grafana.Folder", {
+import * as Effect9 from "effect/Effect";
+var GrafanaFolder = Resource4("Grafana.Folder", {
   defaultRemovalPolicy: "retain"
 });
 
 class GrafanaFolderReparentError extends Data3.TaggedError("GrafanaFolderReparentError") {
 }
-var spec3 = {
+var spec4 = {
   attributes: (live) => ({
     id: live.id ?? 0,
     managedBy: live.managedBy ?? "",
@@ -239,30 +352,30 @@ var spec3 = {
     url: live.url ?? "",
     version: live.version ?? 0
   }),
-  create: (props) => grafana3.createFolder({
+  create: (props) => grafana4.createFolder({
     uid: props.uid,
     title: props.title,
     ...props.description === undefined ? {} : { description: props.description },
     ...props.parentUid === undefined ? {} : { parentUid: props.parentUid }
   }),
-  destroy: (props, live) => Effect6.gen(function* () {
+  destroy: (props, live) => Effect9.gen(function* () {
     if (live.managedBy) {
       return yield* refuseIfProvisioned("Grafana.Folder", props.uid, live.managedBy);
     }
-    yield* grafana3.deleteFolder({ folder_uid: props.uid });
+    yield* grafana4.deleteFolder({ folder_uid: props.uid });
   }),
-  fetchLive: (props) => grafana3.getFolderByUID({ folder_uid: props.uid }).pipe(Effect6.catchTag("NotFound", () => Effect6.succeed(undefined))),
+  fetchLive: (props) => grafana4.getFolderByUID({ folder_uid: props.uid }).pipe(Effect9.catchTag("NotFound", () => Effect9.succeed(undefined))),
   matches: (attributes, props) => attributes.title === props.title && (props.parentUid === undefined || attributes.parentUid === props.parentUid),
-  update: (props, live) => Effect6.gen(function* () {
+  update: (props, live) => Effect9.gen(function* () {
     if (live.managedBy) {
       return yield* refuseIfProvisioned("Grafana.Folder", props.uid, live.managedBy);
     }
     if (props.parentUid !== undefined && props.parentUid !== (live.parentUid ?? undefined)) {
-      return yield* Effect6.fail(new GrafanaFolderReparentError({
+      return yield* Effect9.fail(new GrafanaFolderReparentError({
         message: `Grafana.Folder '${props.uid}' declares parentUid '${props.parentUid}' but is ` + `live under '${live.parentUid ?? "(root)"}'. PUT /folders/{uid} cannot reparent a ` + `folder — move it by hand in Grafana, then update the declaration to match.`
       }));
     }
-    return yield* grafana3.updateFolder({
+    return yield* grafana4.updateFolder({
       folder_uid: props.uid,
       title: props.title,
       ...props.description === undefined ? {} : { description: props.description },
@@ -270,27 +383,14 @@ var spec3 = {
     });
   })
 };
-var handlers3 = grafanaHandlers(spec3);
-var GrafanaFolderProvider = () => Provider3.effect(GrafanaFolder, Effect6.succeed(GrafanaFolder.Provider.of(handlers3)));
-// src/grafana/contact-point.ts
-import { Resource as Resource4 } from "alchemy";
-import * as Provider4 from "alchemy/Provider";
-import * as grafana4 from "@distilled.cloud/grafana";
-import * as Effect8 from "effect/Effect";
-
-// src/grafana/alerting-provenance.ts
-import * as Effect7 from "effect/Effect";
-var WRITABLE_PROVENANCES = new Set(["", "api"]);
-var isForeignProvenance = (provenance) => provenance === undefined || !WRITABLE_PROVENANCES.has(provenance);
-var refuseIfForeignProvenance = (kind, id, provenance) => {
-  const reason = provenance === undefined ? `did not report a provenance at all — this family cannot tell whether it is safe to own` : `has provenance '${provenance}', not '(none)' or 'api'`;
-  return Effect7.fail(new GrafanaProvisionedObjectError({
-    message: `${kind} '${id}' ${reason} — something other than this API may own it (file ` + `provisioning, the Prometheus-rules importer, or similar), and writing here could take ` + `over or corrupt an object this family does not actually control. Edit it at its actual ` + `source instead — declaring this object read-only (a declaration matching what is live) ` + `is safe and will never reach this refusal.`
-  }));
-};
-
+var handlers4 = grafanaHandlers(spec4);
+var GrafanaFolderProvider = () => Provider4.effect(GrafanaFolder, Effect9.succeed(GrafanaFolder.Provider.of(handlers4)));
 // src/grafana/contact-point.ts
-var GrafanaContactPoint = Resource4("Grafana.ContactPoint");
+import { Resource as Resource5 } from "alchemy";
+import * as Provider5 from "alchemy/Provider";
+import * as grafana5 from "@distilled.cloud/grafana";
+import * as Effect10 from "effect/Effect";
+var GrafanaContactPoint = Resource5("Grafana.ContactPoint");
 var nonSecretSettings = (props) => {
   const refs = props.secureSettingsRefs;
   if (refs === undefined)
@@ -302,8 +402,8 @@ var nonSecretSettings = (props) => {
   }
   return out;
 };
-var resolveSettings = (props) => Effect8.map(resolveSecretRefs(props.secureSettingsRefs, (field) => `settings.${field}`), (secrets) => secrets === undefined ? props.settings : { ...props.settings, ...secrets });
-var spec4 = {
+var resolveSettings = (props) => Effect10.map(resolveSecretRefs(props.secureSettingsRefs, (field) => `settings.${field}`), (secrets) => secrets === undefined ? props.settings : { ...props.settings, ...secrets });
+var spec5 = {
   attributes: (live) => ({
     disableResolveMessage: live.disableResolveMessage ?? false,
     name: live.name ?? "",
@@ -312,27 +412,27 @@ var spec4 = {
     type: live.type,
     uid: live.uid ?? ""
   }),
-  create: (props) => Effect8.flatMap(resolveSettings(props), (settings) => grafana4.routePostContactpoints({
+  create: (props) => Effect10.flatMap(resolveSettings(props), (settings) => grafana5.routePostContactpoints({
     name: props.name,
     settings,
     type: props.type,
     uid: props.uid,
     ...props.disableResolveMessage === undefined ? {} : { disableResolveMessage: props.disableResolveMessage }
   })),
-  destroy: (props, live) => Effect8.gen(function* () {
+  destroy: (props, live) => Effect10.gen(function* () {
     if (isForeignProvenance(live.provenance)) {
       return yield* refuseIfForeignProvenance("Grafana.ContactPoint", props.uid, live.provenance);
     }
-    yield* grafana4.routeDeleteContactpoints({ UID: props.uid });
+    yield* grafana5.routeDeleteContactpoints({ UID: props.uid });
   }),
-  fetchLive: (props) => grafana4.routeGetContactpoints({}).pipe(Effect8.map((points) => points.find((point) => point.uid === props.uid))),
+  fetchLive: (props) => grafana5.routeGetContactpoints({}).pipe(Effect10.map((points) => points.find((point) => point.uid === props.uid))),
   matches: (attributes, props) => attributes.name === props.name && attributes.type === props.type && attributes.disableResolveMessage === (props.disableResolveMessage ?? false) && declaredContentMatches(nonSecretSettings(props), attributes.settings),
-  update: (props, live) => Effect8.gen(function* () {
+  update: (props, live) => Effect10.gen(function* () {
     if (isForeignProvenance(live.provenance)) {
       return yield* refuseIfForeignProvenance("Grafana.ContactPoint", props.uid, live.provenance);
     }
     const settings = yield* resolveSettings(props);
-    yield* grafana4.routePutContactpoint({
+    yield* grafana5.routePutContactpoint({
       UID: props.uid,
       name: props.name,
       settings,
@@ -342,99 +442,101 @@ var spec4 = {
     });
   })
 };
-var handlers4 = grafanaHandlers(spec4);
-var GrafanaContactPointProvider = () => Provider4.effect(GrafanaContactPoint, Effect8.succeed(GrafanaContactPoint.Provider.of(handlers4)));
+var handlers5 = grafanaHandlers(spec5);
+var GrafanaContactPointProvider = () => Provider5.effect(GrafanaContactPoint, Effect10.succeed(GrafanaContactPoint.Provider.of(handlers5)));
 // src/grafana/message-template.ts
-import { Resource as Resource5 } from "alchemy";
-import * as Provider5 from "alchemy/Provider";
-import * as grafana5 from "@distilled.cloud/grafana";
-import * as Effect9 from "effect/Effect";
-var GrafanaMessageTemplate = Resource5("Grafana.MessageTemplate");
-var spec5 = {
+import { Resource as Resource6 } from "alchemy";
+import * as Provider6 from "alchemy/Provider";
+import * as grafana6 from "@distilled.cloud/grafana";
+import * as Effect11 from "effect/Effect";
+var GrafanaMessageTemplate = Resource6("Grafana.MessageTemplate");
+var spec6 = {
   attributes: (live) => ({
     name: live.name ?? "",
     provenance: live.provenance,
     template: live.template ?? ""
   }),
-  create: (props) => grafana5.routePutTemplate({ name: props.name, template: props.template }),
-  destroy: (props, live) => Effect9.gen(function* () {
+  create: (props) => grafana6.routePutTemplate({ name: props.name, template: props.template }),
+  destroy: (props, live) => Effect11.gen(function* () {
     if (isForeignProvenance(live.provenance)) {
       return yield* refuseIfForeignProvenance("Grafana.MessageTemplate", props.name, live.provenance);
     }
-    yield* grafana5.routeDeleteTemplate({ name: props.name });
+    yield* grafana6.routeDeleteTemplate({ name: props.name });
   }),
-  fetchLive: (props) => grafana5.routeGetTemplate({ name: props.name }).pipe(Effect9.catchTag("NotFound", () => Effect9.succeed(undefined))),
+  fetchLive: (props) => grafana6.routeGetTemplate({ name: props.name }).pipe(Effect11.catchTag("NotFound", () => Effect11.succeed(undefined))),
   matches: (attributes, props) => attributes.template === props.template,
-  update: (props, live) => Effect9.gen(function* () {
+  update: (props, live) => Effect11.gen(function* () {
     if (isForeignProvenance(live.provenance)) {
       return yield* refuseIfForeignProvenance("Grafana.MessageTemplate", props.name, live.provenance);
     }
-    yield* grafana5.routePutTemplate({
+    yield* grafana6.routePutTemplate({
       name: props.name,
       template: props.template,
       ...live.version === undefined ? {} : { version: live.version }
     });
   })
 };
-var handlers5 = grafanaHandlers(spec5);
-var GrafanaMessageTemplateProvider = () => Provider5.effect(GrafanaMessageTemplate, Effect9.succeed(GrafanaMessageTemplate.Provider.of(handlers5)));
+var handlers6 = grafanaHandlers(spec6);
+var GrafanaMessageTemplateProvider = () => Provider6.effect(GrafanaMessageTemplate, Effect11.succeed(GrafanaMessageTemplate.Provider.of(handlers6)));
 // src/grafana/mute-timing.ts
-import { Resource as Resource6 } from "alchemy";
-import * as Provider6 from "alchemy/Provider";
-import * as grafana6 from "@distilled.cloud/grafana";
-import * as Effect10 from "effect/Effect";
-var GrafanaMuteTiming = Resource6("Grafana.MuteTiming");
-var spec6 = {
+import { Resource as Resource7 } from "alchemy";
+import * as Provider7 from "alchemy/Provider";
+import * as grafana7 from "@distilled.cloud/grafana";
+import * as Effect12 from "effect/Effect";
+var GrafanaMuteTiming = Resource7("Grafana.MuteTiming");
+var spec7 = {
   attributes: (live) => ({
     name: live.name ?? "",
     provenance: live.provenance,
     timeIntervals: live.time_intervals ?? []
   }),
-  create: (props) => grafana6.routePostMuteTiming({
+  create: (props) => grafana7.routePostMuteTiming({
     name: props.name,
     time_intervals: props.timeIntervals
   }),
-  destroy: (props, live) => Effect10.gen(function* () {
+  destroy: (props, live) => Effect12.gen(function* () {
     if (isForeignProvenance(live.provenance)) {
       return yield* refuseIfForeignProvenance("Grafana.MuteTiming", props.name, live.provenance);
     }
-    yield* grafana6.routeDeleteMuteTiming({
+    yield* grafana7.routeDeleteMuteTiming({
       name: props.name,
       ...live.version === undefined ? {} : { version: live.version }
     });
   }),
-  fetchLive: (props) => grafana6.routeGetMuteTiming({ name: props.name }).pipe(Effect10.map((live) => live), Effect10.catchTag("NotFound", () => Effect10.succeed(undefined))),
+  fetchLive: (props) => grafana7.routeGetMuteTiming({ name: props.name }).pipe(Effect12.map((live) => live), Effect12.catchTag("NotFound", () => Effect12.succeed(undefined))),
   matches: (attributes, props) => declaredContentMatches(props.timeIntervals, attributes.timeIntervals),
-  update: (props, live) => Effect10.gen(function* () {
+  update: (props, live) => Effect12.gen(function* () {
     if (isForeignProvenance(live.provenance)) {
       return yield* refuseIfForeignProvenance("Grafana.MuteTiming", props.name, live.provenance);
     }
-    yield* grafana6.routePutMuteTiming({
+    yield* grafana7.routePutMuteTiming({
       name: props.name,
       time_intervals: props.timeIntervals
     });
   })
 };
-var handlers6 = grafanaHandlers(spec6);
-var GrafanaMuteTimingProvider = () => Provider6.effect(GrafanaMuteTiming, Effect10.succeed(GrafanaMuteTiming.Provider.of(handlers6)));
+var handlers7 = grafanaHandlers(spec7);
+var GrafanaMuteTimingProvider = () => Provider7.effect(GrafanaMuteTiming, Effect12.succeed(GrafanaMuteTiming.Provider.of(handlers7)));
 // src/grafana/credentials.ts
 import { Credentials } from "@distilled.cloud/grafana/Credentials";
 import { ConfigError } from "@distilled.cloud/grafana/Errors";
-import * as Effect11 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
-var resolve = (target) => Effect11.sync(() => process.env[target.tokenEnv]).pipe(Effect11.flatMap((raw) => raw === undefined || raw.trim() === "" ? Effect11.fail(new ConfigError({
+var resolve = (target) => Effect13.sync(() => process.env[target.tokenEnv]).pipe(Effect13.flatMap((raw) => raw === undefined || raw.trim() === "" ? Effect13.fail(new ConfigError({
   message: `${target.tokenEnv} is not set. Export the Grafana service-account token there ` + `— never as an Alchemy prop — before running a stack that declares a resource ` + `against ${target.baseUrl}.`
-})) : Effect11.succeed({
+})) : Effect13.succeed({
   apiBaseUrl: target.baseUrl.replace(/\/+$/, ""),
   token: Redacted.make(raw.trim()),
   ...target.orgId === undefined ? {} : { orgId: target.orgId }
-})), Effect11.orDie);
+})), Effect13.orDie);
 var grafanaCredentials = (target) => Layer.succeed(Credentials, resolve(target));
 // src/grafana/providers.ts
 import * as Layer2 from "effect/Layer";
-var grafanaProviders = (target) => Layer2.mergeAll(GrafanaDatasourceProvider(), GrafanaFolderProvider(), GrafanaDashboardProvider(), GrafanaContactPointProvider(), GrafanaMuteTimingProvider(), GrafanaMessageTemplateProvider()).pipe(Layer2.provide(grafanaCredentials(target)));
+var grafanaProviders = (target) => Layer2.mergeAll(GrafanaDatasourceProvider(), GrafanaFolderProvider(), GrafanaDashboardProvider(), GrafanaContactPointProvider(), GrafanaMuteTimingProvider(), GrafanaMessageTemplateProvider(), GrafanaAlertRuleGroupProvider()).pipe(Layer2.provide(grafanaCredentials(target)));
 export {
+  GrafanaAlertRuleGroup,
+  GrafanaAlertRuleGroupProvider,
   GrafanaContactPoint,
   GrafanaContactPointProvider,
   GrafanaDashboard,
@@ -454,5 +556,5 @@ export {
   grafanaProviders
 };
 
-//# debugId=D93AD79265681B5F64756E2164756E21
+//# debugId=2878C6B6E21D1CEC64756E2164756E21
 //# sourceMappingURL=index.js.map