@intentius/chant-lexicon-grafana 0.105.0 → 0.106.1

package/README.md

@@ -61,6 +61,6 @@ GRAF101 and GRAF102 compare dashboards with the datasources declared in the same
 ## Plain-data API
 
 - `buildGrafana(entities)` and `grafanaFiles(entities)` render every file by path, for embedding in another lexicon's output (a ConfigMap, a volume).
-- `GrafanaConfigMaps` and `grafanaVolumes` from `@intentius/chant-lexicon-grafana/k8s` deliver dashboards and provisioning to Kubernetes as ConfigMaps labelled for the Grafana Helm chart's sidecar (`grafana_dashboard`, `grafana_datasource`), or mounted into a plain Grafana Deployment. `GrafanaOperatorResources` from the same subpath writes `GrafanaDashboard`, `GrafanaDatasource`, `GrafanaFolder` and `GrafanaLibraryPanel` resources for a Grafana the Grafana Operator runs.
+- `GrafanaConfigMaps` and `grafanaVolumes` from `@intentius/chant-lexicon-grafana/k8s` deliver dashboards and provisioning to Kubernetes as ConfigMaps labelled for the Grafana Helm chart's sidecar (`grafana_dashboard`, `grafana_datasource`), or mounted into a plain Grafana Deployment. `GrafanaOperatorResources` from the same subpath writes `GrafanaDashboard`, `GrafanaDatasource`, `GrafanaFolder` and `GrafanaLibraryPanel` resources, and `GrafanaAlertRuleGroup`, `GrafanaContactPoint`, `GrafanaNotificationPolicy`, `GrafanaMuteTiming` and `GrafanaNotificationTemplate` resources for the alerting, for a Grafana the Grafana Operator runs.
 - `renderDashboard(dashboard)` and `dashboardJson(dashboard)` render one dashboard.
 - `validateGrafanaOutput({ dashboards, datasources })` and `validateDashboardSchema(json)`, from `@intentius/chant-lexicon-grafana/validation`, run the checks without a build. They are not on the package root, so declaring dashboards does not load them; ajv loads the first time a schema is checked.

package/dist/detect.d.ts

@@ -40,6 +40,14 @@ export declare function looksLikeDashboardProvisioning(data: unknown): data is {
  * of `name` and `rules` with `expr`) is not mistaken for one.
  */
 export declare function looksLikeAlertingProvisioning(data: unknown): data is Record<string, unknown>;
+/**
+ * The `spec` of a Grafana Operator alerting resource (`GrafanaAlertRuleGroup`,
+ * `GrafanaContactPoint`, `GrafanaNotificationPolicy`, `GrafanaMuteTiming`,
+ * `GrafanaNotificationTemplate`) as the k8s importer offers it (#3538): every
+ * operator resource's spec has an `instanceSelector`, beside the field that
+ * holds the alerting content.
+ */
+export declare function looksLikeOperatorAlertingSpec(data: unknown): boolean;
 /**
  * Template detection for `chant import` and friends: dashboard JSON in any
  * of the shapes above (v2 included, #2947), or a datasource, dashboard or

package/dist/detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGjF;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE3F;AAED,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAQ1I;AAED,2GAA2G;AAC3G,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAG3D;AAED,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAE1H;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAEvK;AAED,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,EAAE,CAAA;CAAE,CAEnH;AAuBD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO5F;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAWrD"}
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGjF;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE3F;AAED,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAQ1I;AAED,2GAA2G;AAC3G,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAG3D;AAED,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAE1H;AAED,oGAAoG;AACpG,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAEvK;AAED,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,EAAE,CAAA;CAAE,CAEnH;AAuBD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO5F;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAWpE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAYrD"}

package/dist/import/embedded.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../../src/import/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAkB,MAAM,kCAAkC,CAAC;AAOhG,eAAO,MAAM,iBAAiB,EAAE,uBAyC/B,CAAC"}
+{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../../src/import/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAkB,MAAM,kCAAkC,CAAC;AAOhG,eAAO,MAAM,iBAAiB,EAAE,uBAwC/B,CAAC"}

package/dist/import/operator.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Grafana Operator alerting resources embedded in a k8s manifest, for
+ * `chant import` (#3538).
+ *
+ * `GrafanaOperatorResources` (#3156) writes `GrafanaAlertRuleGroup`,
+ * `GrafanaContactPoint`, `GrafanaNotificationPolicy`, `GrafanaMuteTiming` and
+ * `GrafanaNotificationTemplate` from grafana alerting declarations. The k8s
+ * parser offers the one field of each that holds the alerting content
+ * (`spec.rules`, `spec.receivers`, `spec.route`, `spec.time_intervals`,
+ * `spec.template`) with the whole `spec` as the document. This importer
+ * reads that spec back into the provisioning-file shape, which the alerting
+ * importer turns into declarations, and the k8s value becomes a call of the
+ * matching function in `@intentius/chant-lexicon-grafana/k8s` over the
+ * declaration, so a build gives the same field again.
+ *
+ * The reverse of what `GrafanaOperatorResources` writes:
+ *
+ * - a rule: the CRD's camel case (`missingSeriesEvalsToResolve`,
+ *   `notificationSettings`) goes back to the file's snake case, the
+ *   `__dashboardUid__` and `__panelId__` annotations go back to
+ *   `dashboardUid` and `panelId`, and the values the CRD requires and the
+ *   file leaves to Grafana's defaults (`for: 0s`, `noDataState: NoData`,
+ *   `execErrState: Alerting`) are left out;
+ * - a receiver: each `valuesFrom` entry becomes `${NAME}` at its
+ *   `targetPath` in the settings, `NAME` being the Secret key. The Secret's
+ *   name is not part of a declaration, so a contact point that reads a
+ *   Secret is written with a small module holding
+ *   `operatorReceivers(contactPoint, "<secret>")`;
+ * - the policy tree: `object_matchers` go back to Alertmanager `matchers`
+ *   strings where each can be written as one.
+ *
+ * A rule group's folder is a title in a declaration and a `GrafanaFolder`
+ * name (`folderRef`) in the resource, and the resource does not hold the
+ * title, so the declaration's `folder` is the reference, with a warning.
+ */
+import type { EmbeddedContentImporter } from "@intentius/chant/import/embedded";
+type Json = Record<string, unknown>;
+/** One entry of `GrafanaAlertRuleGroup.spec.rules` as a rule of the provisioning file. */
+export declare function provisionedRule(rule: Json): Json;
+/**
+ * `GrafanaContactPoint.spec.receivers` as the provisioning file's receivers,
+ * each `valuesFrom` entry put back as `${NAME}` in the settings, and the name
+ * of the Secret they read (one Secret, as `GrafanaOperatorResources` writes).
+ */
+export declare function provisionedReceivers(receivers: unknown[], where: string): {
+    receivers: Json[];
+    secretName?: string;
+};
+/** A route of the policy tree as the provisioning file holds it: `object_matchers` as `matchers` strings, in every nested route. */
+export declare function provisionedRoute(route: Json): Json;
+export declare const operatorImporter: EmbeddedContentImporter;
+export {};
+//# sourceMappingURL=operator.d.ts.map

package/dist/import/operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/import/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAmB,uBAAuB,EAAkB,MAAM,kCAAkC,CAAC;AAKjH,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkBpC,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAwBhD;AAYD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAoBpH;AAWD,oIAAoI;AACpI,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAWlD;AAwCD,eAAO,MAAM,gBAAgB,EAAE,uBA2C9B,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b8fcc78eb59a6ab6a0b157b359336c1925009546fcbf4b5cfdec186bc73840a1",
+    "manifest.json": "06345c465338218becce11ad5a3cf5e8c130d367b0eb9f8044886d2a5987489a",
     "meta.json": "330a1598c3b35ae62267e886a3416a494b0ebe9f1d2e2379253787d0a0bcb32e",
     "types/index.d.ts": "ad385264290f2486f7a54be205684de8415a25b74eee5b809ca625ae19fb08da",
     "rules/grafana-ast.ts": "51f4fac423f7a5c6d6f577074e95b4a70d4ab0a05883a86e04970a50c63d92e8",
@@ -27,9 +27,9 @@
     "rules/graf118.ts": "e4ad3c5b944185139331a1f30488c6107a87f37872a0d52b7afc03d9a2ed6125",
     "rules/grafana-helpers.ts": "0a538daafb10f32077dd6cda4c03b541f703b0a10abc51bfd241eae9365c9be6",
     "skills/chant-grafana.md": "6a7f4ba6d8a40d339fad892c612131370ef0c2595547860ee718801bfa893163",
-    "skills/chant-grafana-provisioning.md": "b861a848761c4db9c8c07f248650af14b254c19277b35839ff23033e484089aa",
+    "skills/chant-grafana-provisioning.md": "1c7f473ef4e1f9c2debed62833e4f0448ed0fef9f01c83fbbc94299715ed2602",
     "skills/chant-grafana-alerting.md": "d9648dc14c848851bdccbe069dac54ad06115066f9466c90c4137d07dde6d4ad",
     "skills/chant-grafana-operations.md": "4e665f80292ab32bde6d77940cc3f3923678c58e6db0b80613489050d2cb665b"
   },
-  "composite": "d9b4a6dbb4b8a8b4d6eca31c84bc537279ff5a783ceb746d9066e2cec9786c55"
+  "composite": "4a36d87b528d23995dab52878e7e42c4429aa9611a9b9bef2c133e9c4e2c7ba5"
 }

package/dist/k8s.d.ts

@@ -23,16 +23,21 @@
  * A Grafana run by the Grafana Operator reads custom resources instead
  * (#3015): `GrafanaOperatorResources` writes a `GrafanaDashboard` per
  * dashboard, a `GrafanaDatasource` per datasource, a `GrafanaFolder` per
- * folder and a `GrafanaLibraryPanel` per library panel (#3186), all
- * `grafana.integreatly.org/v1beta1` as the k8s lexicon types them from the
- * operator's CRDs (pinned in its `crd-sources.ts`).
+ * folder and a `GrafanaLibraryPanel` per library panel (#3186), and for
+ * alerting (#3156) a `GrafanaAlertRuleGroup` per rule group, a
+ * `GrafanaContactPoint` per contact point, a `GrafanaNotificationPolicy`, a
+ * `GrafanaMuteTiming` per mute timing and a `GrafanaNotificationTemplate` per
+ * template, all `grafana.integreatly.org/v1beta1` as the k8s lexicon types
+ * them from the operator's CRDs (pinned in its `crd-sources.ts`).
  *
  * This module is the only part of the grafana lexicon that loads the k8s
  * lexicon; nothing else imports it.
  */
 import { type CompositeInstance } from "@intentius/chant/composite";
 import type { Declarable } from "@intentius/chant/declarable";
-import { ConfigMap, GrafanaDashboard, GrafanaDatasource, GrafanaFolder, GrafanaLibraryPanel } from "@intentius/chant-lexicon-k8s/generated/index";
+import { ConfigMap, GrafanaAlertRuleGroup, GrafanaContactPoint, GrafanaDashboard, GrafanaDatasource, GrafanaFolder, GrafanaLibraryPanel, GrafanaMuteTiming, GrafanaNotificationPolicy, GrafanaNotificationTemplate } from "@intentius/chant-lexicon-k8s/generated/index";
+import { type ProvisionedAlertRule, type ProvisionedContactPoint } from "./alerting-build.js";
+import type { AlertRuleGroupEntity, ContactPointEntity, MuteTimingEntity, NotificationPolicyEntity, NotificationTemplateEntity } from "./alerting.js";
 import { type ProvisionedDatasource } from "./build.js";
 /** The label the Grafana Helm chart's sidecar looks for on dashboard ConfigMaps (`sidecar.dashboards.label`). */
 export declare const SIDECAR_DASHBOARD_LABEL = "grafana_dashboard";
@@ -148,15 +153,18 @@ export interface GrafanaOperatorResourcesProps {
      */
     dashboardSource?: "json" | "configMap";
     /**
-     * The Secret that datasource secrets come from. A datasource field written
-     * as `${NAME}` or `$__env{NAME}` (the way file provisioning reads the
-     * environment) becomes a `spec.valuesFrom` entry reading key `NAME` of
-     * this Secret, which the operator substitutes for `${NAME}`. Required when
-     * any datasource has such a reference.
+     * The Secret that datasource and contact point secrets come from. A
+     * datasource field written as `${NAME}` or `$__env{NAME}` (the way file
+     * provisioning reads the environment) becomes a `spec.valuesFrom` entry
+     * reading key `NAME` of this Secret, which the operator substitutes for
+     * `${NAME}`. A contact point setting that is entirely such a reference
+     * becomes a `valuesFrom` entry of its receiver, which the operator writes
+     * into the setting at `targetPath`. Required when any datasource or
+     * contact point has such a reference.
      */
     secretName?: string;
 }
-type OperatorEntity = (InstanceType<typeof GrafanaDashboard> | InstanceType<typeof GrafanaDatasource> | InstanceType<typeof GrafanaFolder> | InstanceType<typeof GrafanaLibraryPanel>) & Declarable;
+type OperatorEntity = (InstanceType<typeof GrafanaDashboard> | InstanceType<typeof GrafanaDatasource> | InstanceType<typeof GrafanaFolder> | InstanceType<typeof GrafanaLibraryPanel> | InstanceType<typeof GrafanaAlertRuleGroup> | InstanceType<typeof GrafanaContactPoint> | InstanceType<typeof GrafanaNotificationPolicy> | InstanceType<typeof GrafanaMuteTiming> | InstanceType<typeof GrafanaNotificationTemplate>) & Declarable;
 export type GrafanaOperatorResourcesMembers = Record<string, OperatorEntity>;
 export type GrafanaOperatorResourcesInstance = CompositeInstance<GrafanaOperatorResourcesMembers> & GrafanaOperatorResourcesMembers;
 /**
@@ -170,6 +178,48 @@ export declare function operatorDatasource(ds: ProvisionedDatasource, secretName
     datasource: Record<string, unknown>;
     valuesFrom: Array<Record<string, unknown>>;
 };
+/**
+ * One contact point receiver's settings for `spec.receivers[].settings`, and
+ * the `valuesFrom` entries for the secrets in it. A setting that is wholly
+ * `${NAME}` (or `$__env{NAME}`, `$NAME`) is taken out of `settings` and read
+ * from key `NAME` of `secretName` into the same path by the operator, whose
+ * `targetPath` is a dotted path inside the settings. A reference inside
+ * longer text, or a `$__file` or `$__vault` one, is an error: the operator
+ * can only replace a whole value.
+ */
+export declare function operatorReceiverSettings(where: string, settings: Record<string, unknown>, secretName: string | undefined): {
+    settings: Record<string, unknown>;
+    valuesFrom: Array<Record<string, unknown>>;
+};
+/** One contact point as `GrafanaContactPoint.spec`: its name, and its receivers with their secrets in `valuesFrom`. */
+export declare function operatorContactPoint(cp: ProvisionedContactPoint, secretName: string | undefined): Record<string, unknown>;
+/**
+ * One rule as an entry of `GrafanaAlertRuleGroup.spec.rules`. The CRD spells
+ * two fields in camel case (`missingSeriesEvalsToResolve`,
+ * `notificationSettings`), requires `for`, `noDataState` and `execErrState`
+ * (Grafana's defaults fill them), and has no use for `dashboardUid` and
+ * `panelId`, which it reads from the `__dashboardUid__` and `__panelId__`
+ * annotations.
+ */
+export declare function operatorRule(rule: ProvisionedAlertRule): Record<string, unknown>;
+/** One policy tree as `GrafanaNotificationPolicy.spec.route`. `orgId` is the operator's to set, so it is left out. */
+export declare function operatorPolicyRoute(policy: Record<string, unknown>): Record<string, unknown>;
+/**
+ * The fields `chant import` writes into an imported Grafana Operator
+ * resource (#3538): each takes the alerting declaration the field was read
+ * into and gives the field `GrafanaOperatorResources` writes for it, so the
+ * resource builds back to what was imported.
+ */
+/** `GrafanaAlertRuleGroup.spec.rules` for a rule group. */
+export declare function operatorRules(group: AlertRuleGroupEntity): Array<Record<string, unknown>>;
+/** `GrafanaContactPoint.spec.receivers` for a contact point, its `${NAME}` secrets read from `secretName`. */
+export declare function operatorReceivers(cp: ContactPointEntity, secretName?: string): Array<Record<string, unknown>>;
+/** `GrafanaNotificationPolicy.spec.route` for a policy tree. */
+export declare function operatorPolicy(policy: NotificationPolicyEntity): Record<string, unknown>;
+/** `GrafanaMuteTiming.spec.time_intervals` for a mute timing. */
+export declare function operatorTimeIntervals(timing: MuteTimingEntity): Array<Record<string, unknown>>;
+/** `GrafanaNotificationTemplate.spec.template` for a template. */
+export declare function operatorTemplate(template: NotificationTemplateEntity): string;
 /**
  * The Grafana Operator's custom resources for a set of grafana declarations
  * (`grafana.integreatly.org/v1beta1`, Grafana Operator v5.25.0):
@@ -184,7 +234,15 @@ export declare function operatorDatasource(ds: ProvisionedDatasource, secretName
  * - a `GrafanaDashboard` per dashboard, `<name>-dashboard-<uid>`, holding
  *   `dashboardJson(dashboard)` in `spec.json` and naming its folder with
  *   `folderRef`;
- * - a `GrafanaDatasource` per datasource, `<name>-datasource-<uid>`.
+ * - a `GrafanaDatasource` per datasource, `<name>-datasource-<uid>`;
+ * - for the alerting the build declares: a `GrafanaAlertRuleGroup` per rule
+ *   group, `<name>-rule-group-<folder>-<group>`, in the `GrafanaFolder` whose
+ *   title is the group's `folder` (one is written when no folder has it);
+ *   a `GrafanaContactPoint` per contact point, `<name>-contact-point-<name>`,
+ *   whose `${NAME}` secrets go to each receiver's `valuesFrom`; a
+ *   `GrafanaNotificationPolicy`, `<name>-notification-policy`, with its
+ *   nested routes inline; a `GrafanaMuteTiming` per mute timing and a
+ *   `GrafanaNotificationTemplate` per template.
  *
  * Every resource carries `instanceSelector`. Export the result from a k8s
  * build root, beside or instead of `GrafanaConfigMaps`.

package/dist/k8s.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"k8s.d.ts","sourceRoot":"","sources":["../src/k8s.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAClJ,OAAO,EAA4E,KAAK,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAI/H,iHAAiH;AACjH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,kHAAkH;AAClH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,8CAA8C;AAC9C,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,oHAAoH;IACpH,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4GAA4G;IAC5G,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACnD,8GAA8G;IAC9G,eAAe,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACpD,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACnC;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAeD,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,GAAG,sBAAsB,CAuBvH;AAGD,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG,UAAU,CAAC;AAEnE,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACvE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAC;AAS/G;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,kGAyBP,CAAC;AAExB,MAAM,WAAW,qBAAqB;IACpC,sIAAsI;IACtI,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2B5I;AAID,wGAAwG;AACxG,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACpH;AAED,MAAM,WAAW,6BAA6B;IAC5C,iJAAiJ;IACjJ,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,yHAAyH;IACzH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACvC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,cAAc,GAAG,CAClB,YAAY,CAAC,OAAO,gBAAgB,CAAC,GACrC,YAAY,CAAC,OAAO,iBAAiB,CAAC,GACtC,YAAY,CAAC,OAAO,aAAa,CAAC,GAClC,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAC3C,GACC,UAAU,CAAC;AAEb,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAC7E,MAAM,MAAM,gCAAgC,GAAG,iBAAiB,CAAC,+BAA+B,CAAC,GAAG,+BAA+B,CAAC;AAOpI;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,qBAAqB,EACzB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAsCrF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,gHA4EP,CAAC"}
+{"version":3,"file":"k8s.d.ts","sourceRoot":"","sources":["../src/k8s.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEnJ,OAAO,EAA4E,KAAK,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAI/H,iHAAiH;AACjH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,kHAAkH;AAClH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,8CAA8C;AAC9C,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,oHAAoH;IACpH,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4GAA4G;IAC5G,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACnD,8GAA8G;IAC9G,eAAe,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACpD,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACnC;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAeD,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,GAAG,sBAAsB,CAuBvH;AAGD,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG,UAAU,CAAC;AAEnE,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACvE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAC;AAS/G;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,kGAyBP,CAAC;AAExB,MAAM,WAAW,qBAAqB;IACpC,sIAAsI;IACtI,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2B5I;AAID,wGAAwG;AACxG,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACpH;AAED,MAAM,WAAW,6BAA6B;IAC5C,iJAAiJ;IACjJ,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,yHAAyH;IACzH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACvC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,cAAc,GAAG,CAClB,YAAY,CAAC,OAAO,gBAAgB,CAAC,GACrC,YAAY,CAAC,OAAO,iBAAiB,CAAC,GACtC,YAAY,CAAC,OAAO,aAAa,CAAC,GAClC,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,qBAAqB,CAAC,GAC1C,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,yBAAyB,CAAC,GAC9C,YAAY,CAAC,OAAO,iBAAiB,CAAC,GACtC,YAAY,CAAC,OAAO,2BAA2B,CAAC,CACnD,GACC,UAAU,CAAC;AAEb,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAC7E,MAAM,MAAM,gCAAgC,GAAG,iBAAiB,CAAC,+BAA+B,CAAC,GAAG,+BAA+B,CAAC;AAOpI;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,qBAAqB,EACzB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAsCrF;AASD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAmCnF;AAED,uHAAuH;AACvH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczH;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBhF;AA0BD,sHAAsH;AACtH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG5F;AAED;;;;;GAKG;AAEH,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEzF;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE7G;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExF;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE9F;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,wBAAwB,gHAoIP,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "grafana",
-  "version": "0.105.0",
+  "version": "0.106.1",
   "chantVersion": ">=0.1.0",
   "namespace": "Grafana",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAmD9D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,aA6I3B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoD9D;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,EAAE,aA6I3B,CAAC"}

package/dist/skills/chant-grafana-provisioning.md

@@ -25,7 +25,7 @@ docker run -p 3000:3000 \
 
 ## Kubernetes
 
-Use `GrafanaConfigMaps({ entities, namespace })` from `@intentius/chant-lexicon-grafana/k8s` in a k8s build root. It writes one ConfigMap per dashboard labelled `grafana_dashboard: "1"`, with the folder in the `k8s-sidecar-target-directory` annotation. The datasource file goes in a ConfigMap labelled `grafana_datasource: "1"`, and the provider file in a third. The Grafana Helm chart's sidecar picks these up as they are. For a Grafana without the sidecar, spread `grafanaVolumes({ entities })`'s `volumes` and `volumeMounts` into the Deployment: provisioning goes under `/etc/grafana/provisioning`, and each dashboard folder gets a projected volume of its own. For a Grafana the Grafana Operator runs, use `GrafanaOperatorResources({ entities, namespace, instanceSelector })` instead: a `GrafanaFolder` per folder, a `GrafanaLibraryPanel` per library panel the dashboards place, a `GrafanaDashboard` per dashboard (JSON in `spec.json`, folder by `folderRef`) and a `GrafanaDatasource` per datasource. `instanceSelector` is required and must match the labels on your `Grafana` resource. A datasource secret written `${NAME}` or `$__env{NAME}` needs `secretName`, the Secret holding key `NAME`. `grafanaFiles(entities)` still returns every file by path for any other layout.
+Use `GrafanaConfigMaps({ entities, namespace })` from `@intentius/chant-lexicon-grafana/k8s` in a k8s build root. It writes one ConfigMap per dashboard labelled `grafana_dashboard: "1"`, with the folder in the `k8s-sidecar-target-directory` annotation. The datasource file goes in a ConfigMap labelled `grafana_datasource: "1"`, and the provider file in a third. The Grafana Helm chart's sidecar picks these up as they are. For a Grafana without the sidecar, spread `grafanaVolumes({ entities })`'s `volumes` and `volumeMounts` into the Deployment: provisioning goes under `/etc/grafana/provisioning`, and each dashboard folder gets a projected volume of its own. For a Grafana the Grafana Operator runs, use `GrafanaOperatorResources({ entities, namespace, instanceSelector })` instead: a `GrafanaFolder` per folder, a `GrafanaLibraryPanel` per library panel the dashboards place, a `GrafanaDashboard` per dashboard (JSON in `spec.json`, folder by `folderRef`) a `GrafanaDatasource` per datasource, and for alerting a `GrafanaAlertRuleGroup` per rule group, a `GrafanaContactPoint` per contact point, a `GrafanaNotificationPolicy`, a `GrafanaMuteTiming` per mute timing and a `GrafanaNotificationTemplate` per template. `instanceSelector` is required and must match the labels on your `Grafana` resource. A datasource secret, or a contact point setting that is wholly a variable, written `${NAME}` or `$__env{NAME}` needs `secretName`, the Secret holding key `NAME`; contact point secrets go in each receiver's `valuesFrom`. `grafanaFiles(entities)` still returns every file by path for any other layout.
 
 ## Changing where dashboards live
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-grafana",
-  "version": "0.105.0",
+  "version": "0.106.1",
   "description": "Grafana lexicon for chant — typed dashboards, panels, queries and datasources, serialized to dashboard JSON and Grafana provisioning files",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -83,7 +83,7 @@
     "zod": "^4.3.6"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.105.0",
+    "@intentius/chant": "^0.106.1",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   }

package/src/detect.ts

@@ -88,6 +88,26 @@ export function looksLikeAlertingProvisioning(data: unknown): data is Record<str
   return data.apiVersion !== undefined || Array.isArray(data.groups);
 }
 
+/**
+ * The `spec` of a Grafana Operator alerting resource (`GrafanaAlertRuleGroup`,
+ * `GrafanaContactPoint`, `GrafanaNotificationPolicy`, `GrafanaMuteTiming`,
+ * `GrafanaNotificationTemplate`) as the k8s importer offers it (#3538): every
+ * operator resource's spec has an `instanceSelector`, beside the field that
+ * holds the alerting content.
+ */
+export function looksLikeOperatorAlertingSpec(data: unknown): boolean {
+  if (typeof data !== "object" || data === null || Array.isArray(data)) return false;
+  const d = data as Record<string, unknown>;
+  if (typeof d.instanceSelector !== "object" || d.instanceSelector === null) return false;
+  return (
+    (typeof d.name === "string" && Array.isArray(d.rules)) ||
+    (typeof d.name === "string" && Array.isArray(d.receivers)) ||
+    (typeof d.route === "object" && d.route !== null) ||
+    (typeof d.name === "string" && Array.isArray(d.time_intervals)) ||
+    (typeof d.name === "string" && typeof d.template === "string")
+  );
+}
+
 /**
  * Template detection for `chant import` and friends: dashboard JSON in any
  * of the shapes above (v2 included, #2947), or a datasource, dashboard or
@@ -95,6 +115,7 @@ export function looksLikeAlertingProvisioning(data: unknown): data is Record<str
  */
 export function detectTemplate(data: unknown): boolean {
   return (
+    looksLikeOperatorAlertingSpec(data) ||
     looksLikeDashboard(data) ||
     looksLikeLegacyRowsDashboard(data) ||
     looksLikeDashboardResource(data) ||

package/src/import/embedded.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "vitest";
 import { embeddedDocument, type EmbeddedContent } from "@intentius/chant/import/embedded";
 import { grafanaPlugin } from "../plugin";
 import { dashboardImporter } from "./embedded";
+import { operatorImporter } from "./operator";
 
 const DASHBOARD = JSON.stringify({
   title: "API",
@@ -22,7 +23,7 @@ const site = (text: string): EmbeddedContent => ({
 
 describe("dashboard JSON embedded in another lexicon's resource (#2962)", () => {
   test("the plugin registers the importer", () => {
-    expect(grafanaPlugin.embeddedImporters?.()).toEqual([dashboardImporter]);
+    expect(grafanaPlugin.embeddedImporters?.()).toEqual([dashboardImporter, operatorImporter]);
   });
 
   test("matches classic and v2 dashboard JSON; not other text", () => {
@@ -54,4 +55,11 @@ describe("dashboard JSON embedded in another lexicon's resource (#2962)", () =>
     const file = out.files.find((f) => f.path === binding.from);
     expect(file?.content).toContain(`const ${binding.name} = new Dashboard(`);
   });
+
+  test("panels and queries are written inline, as `chant import dashboard.json` writes them (#3184)", () => {
+    const out = dashboardImporter.import(site(DASHBOARD));
+    const text = out.files.map((f) => f.content).join("\n");
+    expect(text).toContain("new StatPanel(");
+    expect(text).not.toMatch(/const panel\d* = new StatPanel/);
+  });
 });

package/src/import/embedded.ts

@@ -45,12 +45,11 @@ export const dashboardImporter: EmbeddedContentImporter = {
     const resource = ir.resources.find((r) => r.type === DASHBOARD_RESOURCE_TYPE);
     if (!resource) throw new Error((ir.warnings ?? []).join(" ") || "no dashboard was read");
     const { plan } = resource.properties as unknown as PlanResourceProperties;
-    // Core gives the content a directory of its own; the plan's would nest a second one inside it. The host's
-    // project need not list grafana (a k8s project holding a dashboard ConfigMap), and then core lint does not know
-    // grafana's panels and queries are property-kind, so they keep the flat shape that lints clean without it: a
-    // const per declaration, nested values lifted, eight to a module (#2988).
-    const flat = { ...plan, directory: "", main: undefined, declarations: plan.declarations.map(({ property: _, ...d }) => d) };
-    const { files, exported } = generatePlanModules(flat);
+    // Core gives the content a directory of its own; the plan's would nest a second one inside it. Panels and
+    // queries stay inline: core lint takes property-kind classes from every lexicon the source imports (#3184), so
+    // the host's project need not list grafana.
+    const nested = { ...plan, directory: "", main: undefined };
+    const { files, exported } = generatePlanModules(nested);
     const dashboard = exported.get("dashboard");
     if (!dashboard) throw new Error("the import declared no dashboard");
     return {

package/src/import/operator.test.ts

@@ -0,0 +1,213 @@
+import { describe, expect, test } from "vitest";
+import type { EmbeddedContent } from "@intentius/chant/import/embedded";
+import { grafanaPlugin } from "../plugin";
+import { operatorContactPoint, operatorPolicyRoute, operatorRule } from "../k8s";
+import { operatorImporter, provisionedReceivers, provisionedRoute, provisionedRule } from "./operator";
+
+const site = (hostType: string, select: string, spec: Record<string, unknown>): EmbeddedContent => ({
+  host: "k8s",
+  hostType,
+  location: `${hostType.split("::").pop()} x spec.${select}`,
+  directory: "x",
+  document: spec,
+  select,
+  labels: {},
+});
+
+const SELECTOR = { matchLabels: { dashboards: "grafana" } };
+
+describe("Grafana Operator alerting embedded in a k8s manifest (#3538)", () => {
+  test("the plugin registers the importer", () => {
+    expect(grafanaPlugin.embeddedImporters?.()).toContain(operatorImporter);
+  });
+
+  test("matches the five kinds at their own field, and nothing else", () => {
+    expect(operatorImporter.matches(site("K8s::Grafana::GrafanaAlertRuleGroup", "rules", { rules: [] }))).toBe(true);
+    expect(operatorImporter.matches(site("K8s::Grafana::GrafanaContactPoint", "receivers", { receivers: [] }))).toBe(true);
+    expect(operatorImporter.matches(site("K8s::Grafana::GrafanaNotificationPolicy", "route", { route: {} }))).toBe(true);
+    expect(operatorImporter.matches(site("K8s::Grafana::GrafanaMuteTiming", "time_intervals", { time_intervals: [] }))).toBe(true);
+    expect(operatorImporter.matches(site("K8s::Grafana::GrafanaNotificationTemplate", "template", { template: "x" }))).toBe(true);
+    expect(operatorImporter.matches(site("K8s::Grafana::GrafanaAlertRuleGroup", "receivers", {}))).toBe(false);
+    expect(operatorImporter.matches(site("K8s::Core::ConfigMap", "rules", { rules: [] }))).toBe(false);
+  });
+
+  describe("a rule", () => {
+    test("goes back to the file's spelling, without the values the CRD requires and Grafana defaults", () => {
+      expect(
+        provisionedRule({
+          uid: "r",
+          title: "R",
+          condition: "A",
+          data: [],
+          for: "0s",
+          noDataState: "NoData",
+          execErrState: "Alerting",
+          missingSeriesEvalsToResolve: 3,
+          notificationSettings: { receiver: "oncall", group_by: ["a"] },
+          annotations: { __dashboardUid__: "dash", __panelId__: "2", summary: "s" },
+        }),
+      ).toEqual({
+        uid: "r",
+        title: "R",
+        condition: "A",
+        data: [],
+        missing_series_evals_to_resolve: 3,
+        notification_settings: { receiver: "oncall", group_by: ["a"] },
+        dashboardUid: "dash",
+        panelId: 2,
+        annotations: { summary: "s" },
+      });
+    });
+
+    test("keeps values that are not the defaults, and a record rule's condition is the rule's own", () => {
+      const back = provisionedRule({ uid: "r", title: "R", condition: "B", data: [], for: "5m", noDataState: "Alerting", execErrState: "Error" });
+      expect(back).toMatchObject({ for: "5m", noDataState: "Alerting", execErrState: "Error", condition: "B" });
+      expect(provisionedRule({ uid: "r", title: "R", condition: "A", data: [], record: { metric: "m", from: "A" } })).not.toHaveProperty("condition");
+    });
+
+    test("is the inverse of operatorRule", () => {
+      const rule = {
+        uid: "r",
+        title: "R",
+        condition: "A",
+        data: [],
+        for: "5m",
+        labels: { severity: "page" },
+        dashboardUid: "dash",
+        panelId: 4,
+        annotations: { summary: "s" },
+        missing_series_evals_to_resolve: 2,
+        notification_settings: { receiver: "oncall" },
+      };
+      expect(provisionedRule(operatorRule(rule))).toEqual(rule);
+    });
+  });
+
+  describe("a receiver", () => {
+    test("reads each valuesFrom entry back as ${NAME} at its path, and names the Secret", () => {
+      const forward = operatorContactPoint(
+        { name: "oncall", receivers: [{ uid: "u", type: "slack", settings: { title: "t", url: "${SLACK_URL}", tlsConfig: { clientKey: "$KEY" } } }] },
+        "grafana-secrets",
+      );
+      const back = provisionedReceivers(forward.receivers as unknown[], "contact point");
+      expect(back.secretName).toBe("grafana-secrets");
+      expect(back.receivers).toEqual([{ uid: "u", type: "slack", settings: { title: "t", url: "${SLACK_URL}", tlsConfig: { clientKey: "${KEY}" } } }]);
+    });
+
+    test("without valuesFrom there is no Secret", () => {
+      expect(provisionedReceivers([{ uid: "m", type: "email", settings: { addresses: "a@example.com" } }], "cp")).toEqual({
+        receivers: [{ uid: "m", type: "email", settings: { addresses: "a@example.com" } }],
+      });
+    });
+
+    test("refuses what a ${NAME} reference cannot say", () => {
+      const from = (valueFrom: unknown, name = "s") => [{ type: "x", settings: {}, valuesFrom: [{ targetPath: "url", valueFrom }, { targetPath: "b", valueFrom: { secretKeyRef: { name, key: "B" } } }] }];
+      expect(() => provisionedReceivers(from({ configMapKeyRef: { name: "c", key: "K" } }), "cp")).toThrow(/secretKeyRef/);
+      expect(() => provisionedReceivers(from({ secretKeyRef: { name: "s", key: "not-a-name" } }), "cp")).toThrow(/secretKeyRef/);
+      expect(() => provisionedReceivers(from({ secretKeyRef: { name: "one", key: "A" } }, "two"), "cp")).toThrow(/one secretName/);
+    });
+  });
+
+  describe("the policy tree", () => {
+    test("object_matchers go back to matchers in every nested route", () => {
+      const route = operatorPolicyRoute({
+        receiver: "oncall",
+        routes: [{ receiver: "tickets", matchers: ['severity="ticket"', "team=~a|b"], routes: [{ matchers: ["env!=dev"] }] }],
+      });
+      expect(provisionedRoute(route)).toEqual({
+        receiver: "oncall",
+        routes: [{ receiver: "tickets", matchers: ['severity="ticket"', 'team=~"a|b"'], routes: [{ matchers: ['env!="dev"'] }] }],
+      });
+    });
+
+    test("a matcher that cannot be written as a string keeps them all as objects", () => {
+      const objects = [
+        ["a", "=", "x"],
+        ["b", "=", 'say "hi"'],
+      ];
+      expect(provisionedRoute({ receiver: "r", object_matchers: objects })).toEqual({ receiver: "r", object_matchers: objects });
+    });
+  });
+
+  describe("import", () => {
+    test("a rule group becomes an AlertRuleGroup, read through operatorRules, with a warning about its folder", () => {
+      const spec = {
+        instanceSelector: SELECTOR,
+        name: "errors",
+        folderRef: "grafana-folder-alerts",
+        interval: "30s",
+        rules: [
+          {
+            uid: "high-errors",
+            title: "High errors",
+            condition: "A",
+            for: "5m",
+            noDataState: "NoData",
+            execErrState: "Alerting",
+            data: [{ refId: "A", relativeTimeRange: { from: 600, to: 0 }, datasourceUid: "prom", model: { refId: "A", expr: "up", datasource: { type: "prometheus", uid: "prom" } } }],
+          },
+        ],
+      };
+      const out = operatorImporter.import(site("K8s::Grafana::GrafanaAlertRuleGroup", "rules", spec));
+      expect(out.value.shape).toBe("single");
+      expect(out.value.through).toEqual({ from: "@intentius/chant-lexicon-grafana/k8s", name: "operatorRules" });
+      const [binding] = out.value.bindings;
+      expect(out.files.find((f) => f.path === binding.from)?.content).toContain(`const ${binding.name} = new AlertRuleGroup(`);
+      const text = out.files.map((f) => f.content).join("\n");
+      expect(text).toContain('folder: "grafana-folder-alerts"');
+      expect(text).toContain("new AlertRule(");
+      expect(out.warnings?.join("\n")).toContain('rule group "errors": a declaration\'s folder is a title');
+    });
+
+    test("a contact point that reads a Secret gets a module naming it", () => {
+      const spec = {
+        instanceSelector: SELECTOR,
+        name: "oncall",
+        receivers: [
+          {
+            uid: "oncall-slack",
+            type: "slack",
+            settings: { title: "chant" },
+            valuesFrom: [{ targetPath: "url", valueFrom: { secretKeyRef: { name: "grafana-secrets", key: "SLACK_URL" } } }],
+          },
+        ],
+      };
+      const out = operatorImporter.import(site("K8s::Grafana::GrafanaContactPoint", "receivers", spec));
+      expect(out.value.through).toBeUndefined();
+      const [binding] = out.value.bindings;
+      expect(binding).toEqual({ from: "receivers.ts", name: "receivers" });
+      const module = out.files.find((f) => f.path === "receivers.ts")!.content;
+      expect(module).toContain('import { operatorReceivers } from "@intentius/chant-lexicon-grafana/k8s";');
+      expect(module).toContain('"grafana-secrets"');
+      expect(out.files.map((f) => f.content).join("\n")).toContain("${SLACK_URL}");
+    });
+
+    test("a contact point with no Secret is read through operatorReceivers alone", () => {
+      const spec = { name: "mail", receivers: [{ uid: "m", type: "email", settings: { addresses: "a@example.com" } }] };
+      const out = operatorImporter.import(site("K8s::Grafana::GrafanaContactPoint", "receivers", spec));
+      expect(out.value.through).toEqual({ from: "@intentius/chant-lexicon-grafana/k8s", name: "operatorReceivers" });
+      expect(out.files.some((f) => f.path === "receivers.ts")).toBe(false);
+    });
+
+    test("a policy, a mute timing and a template", () => {
+      const policy = operatorImporter.import(site("K8s::Grafana::GrafanaNotificationPolicy", "route", { route: { receiver: "oncall", routes: [{ object_matchers: [["severity", "=", "page"]] }] } }));
+      expect(policy.value.through?.name).toBe("operatorPolicy");
+      const text = policy.files.map((f) => f.content).join("\n");
+      expect(text).toContain("new NotificationPolicy(");
+      expect(text).toContain('severity="page"');
+
+      const mute = operatorImporter.import(site("K8s::Grafana::GrafanaMuteTiming", "time_intervals", { name: "weekends", time_intervals: [{ weekdays: ["saturday", "sunday"] }] }));
+      expect(mute.value.through?.name).toBe("operatorTimeIntervals");
+      expect(mute.files.map((f) => f.content).join("\n")).toContain("new MuteTiming(");
+
+      const template = operatorImporter.import(site("K8s::Grafana::GrafanaNotificationTemplate", "template", { name: "t", template: '{{ define "t" }}x{{ end }}' }));
+      expect(template.value.through?.name).toBe("operatorTemplate");
+      expect(template.files.map((f) => f.content).join("\n")).toContain("new NotificationTemplate(");
+    });
+
+    test("a policy with no receiver, and a group with no folder, throw so the host keeps them as written", () => {
+      expect(() => operatorImporter.import(site("K8s::Grafana::GrafanaNotificationPolicy", "route", { route: { group_by: ["a"] } }))).toThrow();
+      expect(() => operatorImporter.import(site("K8s::Grafana::GrafanaAlertRuleGroup", "rules", { name: "g", rules: [] }))).toThrow(/names no folder/);
+    });
+  });
+});