@intentius/chant-lexicon-grafana 0.106.1 → 0.106.3

package/dist/import/operator.d.ts

@@ -3,7 +3,9 @@
  * `chant import` (#3538).
  *
  * `GrafanaOperatorResources` (#3156) writes `GrafanaAlertRuleGroup`,
- * `GrafanaContactPoint`, `GrafanaNotificationPolicy`, `GrafanaMuteTiming` and
+ * `GrafanaContactPoint`, `GrafanaNotificationPolicy` (with, for
+ * `policyRoutes`, a `GrafanaNotificationPolicyRoute` per child route),
+ * `GrafanaMuteTiming` and
  * `GrafanaNotificationTemplate` from grafana alerting declarations. The k8s
  * parser offers the one field of each that holds the alerting content
  * (`spec.rules`, `spec.receivers`, `spec.route`, `spec.time_intervals`,
@@ -26,6 +28,9 @@
  *   name is not part of a declaration, so a contact point that reads a
  *   Secret is written with a small module holding
  *   `operatorReceivers(contactPoint, "<secret>")`;
+ * - a `GrafanaNotificationPolicyRoute`: its whole `spec` is the route, read
+ *   as the one child of a policy that has its receiver, and written back by
+ *   `operatorRouteSpec`;
  * - the policy tree: `object_matchers` go back to Alertmanager `matchers`
  *   strings where each can be written as one.
  *

package/dist/import/operator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/import/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAmB,uBAAuB,EAAkB,MAAM,kCAAkC,CAAC;AAKjH,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkBpC,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAwBhD;AAYD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAoBpH;AAWD,oIAAoI;AACpI,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAWlD;AAwCD,eAAO,MAAM,gBAAgB,EAAE,uBA2C9B,CAAC"}
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/import/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAmB,uBAAuB,EAAkB,MAAM,kCAAkC,CAAC;AAKjH,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAmBpC,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAwBhD;AAYD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAoBpH;AAWD,oIAAoI;AACpI,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAWlD;AAiDD,eAAO,MAAM,gBAAgB,EAAE,uBA2C9B,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "06345c465338218becce11ad5a3cf5e8c130d367b0eb9f8044886d2a5987489a",
+    "manifest.json": "f95101f26cc36262685fe99c9eccc904ffca12e4e4e798d9fb0e35023060f041",
     "meta.json": "330a1598c3b35ae62267e886a3416a494b0ebe9f1d2e2379253787d0a0bcb32e",
     "types/index.d.ts": "ad385264290f2486f7a54be205684de8415a25b74eee5b809ca625ae19fb08da",
     "rules/grafana-ast.ts": "51f4fac423f7a5c6d6f577074e95b4a70d4ab0a05883a86e04970a50c63d92e8",
@@ -31,5 +31,5 @@
     "skills/chant-grafana-alerting.md": "d9648dc14c848851bdccbe069dac54ad06115066f9466c90c4137d07dde6d4ad",
     "skills/chant-grafana-operations.md": "4e665f80292ab32bde6d77940cc3f3923678c58e6db0b80613489050d2cb665b"
   },
-  "composite": "4a36d87b528d23995dab52878e7e42c4429aa9611a9b9bef2c133e9c4e2c7ba5"
+  "composite": "d3f04256f6713df0d65a9e5470148e3e3c70a5a5bb7f28e766dafef40f8ccfa4"
 }

package/dist/k8s.d.ts

@@ -35,7 +35,7 @@
  */
 import { type CompositeInstance } from "@intentius/chant/composite";
 import type { Declarable } from "@intentius/chant/declarable";
-import { ConfigMap, GrafanaAlertRuleGroup, GrafanaContactPoint, GrafanaDashboard, GrafanaDatasource, GrafanaFolder, GrafanaLibraryPanel, GrafanaMuteTiming, GrafanaNotificationPolicy, GrafanaNotificationTemplate } from "@intentius/chant-lexicon-k8s/generated/index";
+import { ConfigMap, GrafanaAlertRuleGroup, GrafanaContactPoint, GrafanaDashboard, GrafanaDatasource, GrafanaFolder, GrafanaLibraryPanel, GrafanaMuteTiming, GrafanaNotificationPolicy, GrafanaNotificationPolicyRoute, GrafanaNotificationTemplate } from "@intentius/chant-lexicon-k8s/generated/index";
 import { type ProvisionedAlertRule, type ProvisionedContactPoint } from "./alerting-build.js";
 import type { AlertRuleGroupEntity, ContactPointEntity, MuteTimingEntity, NotificationPolicyEntity, NotificationTemplateEntity } from "./alerting.js";
 import { type ProvisionedDatasource } from "./build.js";
@@ -163,8 +163,18 @@ export interface GrafanaOperatorResourcesProps {
      * contact point has such a reference.
      */
     secretName?: string;
+    /**
+     * Write each direct child route of a notification policy as a
+     * `GrafanaNotificationPolicyRoute` of its own, which the policy merges in
+     * through `spec.route.routeSelector` (the operator allows `routes` or
+     * `routeSelector`, not both). The routes carry the label
+     * `grafana.chant.dev/policy: <policy resource name>`, which the selector
+     * matches. A route's own nested routes stay inline in its `spec.routes`.
+     * Defaults to false: the whole tree inline in `spec.route`.
+     */
+    policyRoutes?: boolean;
 }
-type OperatorEntity = (InstanceType<typeof GrafanaDashboard> | InstanceType<typeof GrafanaDatasource> | InstanceType<typeof GrafanaFolder> | InstanceType<typeof GrafanaLibraryPanel> | InstanceType<typeof GrafanaAlertRuleGroup> | InstanceType<typeof GrafanaContactPoint> | InstanceType<typeof GrafanaNotificationPolicy> | InstanceType<typeof GrafanaMuteTiming> | InstanceType<typeof GrafanaNotificationTemplate>) & Declarable;
+type OperatorEntity = (InstanceType<typeof GrafanaDashboard> | InstanceType<typeof GrafanaDatasource> | InstanceType<typeof GrafanaFolder> | InstanceType<typeof GrafanaLibraryPanel> | InstanceType<typeof GrafanaAlertRuleGroup> | InstanceType<typeof GrafanaContactPoint> | InstanceType<typeof GrafanaNotificationPolicy> | InstanceType<typeof GrafanaNotificationPolicyRoute> | InstanceType<typeof GrafanaMuteTiming> | InstanceType<typeof GrafanaNotificationTemplate>) & Declarable;
 export type GrafanaOperatorResourcesMembers = Record<string, OperatorEntity>;
 export type GrafanaOperatorResourcesInstance = CompositeInstance<GrafanaOperatorResourcesMembers> & GrafanaOperatorResourcesMembers;
 /**
@@ -178,6 +188,8 @@ export declare function operatorDatasource(ds: ProvisionedDatasource, secretName
     datasource: Record<string, unknown>;
     valuesFrom: Array<Record<string, unknown>>;
 };
+/** The label a `GrafanaNotificationPolicyRoute` carries for the policy whose `routeSelector` merges it in. */
+export declare const POLICY_ROUTE_LABEL = "grafana.chant.dev/policy";
 /**
  * One contact point receiver's settings for `spec.receivers[].settings`, and
  * the `valuesFrom` entries for the secrets in it. A setting that is wholly
@@ -216,6 +228,12 @@ export declare function operatorRules(group: AlertRuleGroupEntity): Array<Record
 export declare function operatorReceivers(cp: ContactPointEntity, secretName?: string): Array<Record<string, unknown>>;
 /** `GrafanaNotificationPolicy.spec.route` for a policy tree. */
 export declare function operatorPolicy(policy: NotificationPolicyEntity): Record<string, unknown>;
+/**
+ * `GrafanaNotificationPolicyRoute.spec` for a policy declaration holding the
+ * route as its one child: the child's fields, with `receiver` always set
+ * (the CRD requires it, so a child that inherits it gets the policy's).
+ */
+export declare function operatorRouteSpec(policy: NotificationPolicyEntity): Record<string, unknown>;
 /** `GrafanaMuteTiming.spec.time_intervals` for a mute timing. */
 export declare function operatorTimeIntervals(timing: MuteTimingEntity): Array<Record<string, unknown>>;
 /** `GrafanaNotificationTemplate.spec.template` for a template. */
@@ -241,7 +259,9 @@ export declare function operatorTemplate(template: NotificationTemplateEntity):
  *   a `GrafanaContactPoint` per contact point, `<name>-contact-point-<name>`,
  *   whose `${NAME}` secrets go to each receiver's `valuesFrom`; a
  *   `GrafanaNotificationPolicy`, `<name>-notification-policy`, with its
- *   nested routes inline; a `GrafanaMuteTiming` per mute timing and a
+ *   nested routes inline (or, with `policyRoutes`, one
+ *   `GrafanaNotificationPolicyRoute` per direct child route, selected by
+ *   label); a `GrafanaMuteTiming` per mute timing and a
  *   `GrafanaNotificationTemplate` per template.
  *
  * Every resource carries `instanceSelector`. Export the result from a k8s

package/dist/k8s.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"k8s.d.ts","sourceRoot":"","sources":["../src/k8s.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEnJ,OAAO,EAA4E,KAAK,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAI/H,iHAAiH;AACjH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,kHAAkH;AAClH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,8CAA8C;AAC9C,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,oHAAoH;IACpH,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4GAA4G;IAC5G,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACnD,8GAA8G;IAC9G,eAAe,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACpD,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACnC;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAeD,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,GAAG,sBAAsB,CAuBvH;AAGD,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG,UAAU,CAAC;AAEnE,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACvE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAC;AAS/G;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,kGAyBP,CAAC;AAExB,MAAM,WAAW,qBAAqB;IACpC,sIAAsI;IACtI,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2B5I;AAID,wGAAwG;AACxG,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACpH;AAED,MAAM,WAAW,6BAA6B;IAC5C,iJAAiJ;IACjJ,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,yHAAyH;IACzH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACvC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,cAAc,GAAG,CAClB,YAAY,CAAC,OAAO,gBAAgB,CAAC,GACrC,YAAY,CAAC,OAAO,iBAAiB,CAAC,GACtC,YAAY,CAAC,OAAO,aAAa,CAAC,GAClC,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,qBAAqB,CAAC,GAC1C,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,yBAAyB,CAAC,GAC9C,YAAY,CAAC,OAAO,iBAAiB,CAAC,GACtC,YAAY,CAAC,OAAO,2BAA2B,CAAC,CACnD,GACC,UAAU,CAAC;AAEb,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAC7E,MAAM,MAAM,gCAAgC,GAAG,iBAAiB,CAAC,+BAA+B,CAAC,GAAG,+BAA+B,CAAC;AAOpI;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,qBAAqB,EACzB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAsCrF;AASD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAmCnF;AAED,uHAAuH;AACvH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczH;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBhF;AA0BD,sHAAsH;AACtH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG5F;AAED;;;;;GAKG;AAEH,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEzF;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE7G;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExF;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE9F;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,wBAAwB,gHAoIP,CAAC"}
+{"version":3,"file":"k8s.d.ts","sourceRoot":"","sources":["../src/k8s.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAa,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAML,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEnJ,OAAO,EAA4E,KAAK,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAI/H,iHAAiH;AACjH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,kHAAkH;AAClH,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAExE,8CAA8C;AAC9C,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,oHAAoH;IACpH,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4GAA4G;IAC5G,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACnD,8GAA8G;IAC9G,eAAe,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACpD,oHAAoH;IACpH,gBAAgB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACnC;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,WAAW,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAeD,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,GAAG,sBAAsB,CAuBvH;AAGD,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG,UAAU,CAAC;AAEnE,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACvE,MAAM,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAC;AAS/G;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,kGAyBP,CAAC;AAExB,MAAM,WAAW,qBAAqB;IACpC,sIAAsI;IACtI,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,MAAM,CAAC,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2B5I;AAID,wGAAwG;AACxG,MAAM,WAAW,uBAAuB;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACpH;AAED,MAAM,WAAW,6BAA6B;IAC5C,iJAAiJ;IACjJ,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,yHAAyH;IACzH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IACvC;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,KAAK,cAAc,GAAG,CAClB,YAAY,CAAC,OAAO,gBAAgB,CAAC,GACrC,YAAY,CAAC,OAAO,iBAAiB,CAAC,GACtC,YAAY,CAAC,OAAO,aAAa,CAAC,GAClC,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,qBAAqB,CAAC,GAC1C,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,yBAAyB,CAAC,GAC9C,YAAY,CAAC,OAAO,8BAA8B,CAAC,GACnD,YAAY,CAAC,OAAO,iBAAiB,CAAC,GACtC,YAAY,CAAC,OAAO,2BAA2B,CAAC,CACnD,GACC,UAAU,CAAC;AAEb,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAC7E,MAAM,MAAM,gCAAgC,GAAG,iBAAiB,CAAC,+BAA+B,CAAC,GAAG,+BAA+B,CAAC;AAOpI;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,qBAAqB,EACzB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAsCrF;AAID,8GAA8G;AAC9G,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAW7D;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAmCnF;AAED,uHAAuH;AACvH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczH;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBhF;AA0BD,sHAAsH;AACtH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG5F;AAED;;;;;GAKG;AAEH,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEzF;AAED,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE7G;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAExF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAM3F;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE9F;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,wBAAwB,gHAsJP,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "grafana",
-  "version": "0.106.1",
+  "version": "0.106.3",
   "chantVersion": ">=0.1.0",
   "namespace": "Grafana",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-grafana",
-  "version": "0.106.1",
+  "version": "0.106.3",
   "description": "Grafana lexicon for chant — typed dashboards, panels, queries and datasources, serialized to dashboard JSON and Grafana provisioning files",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -83,7 +83,7 @@
     "zod": "^4.3.6"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.106.1",
+    "@intentius/chant": "^0.106.3",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   }

package/src/import/operator.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "vitest";
 import type { EmbeddedContent } from "@intentius/chant/import/embedded";
 import { grafanaPlugin } from "../plugin";
-import { operatorContactPoint, operatorPolicyRoute, operatorRule } from "../k8s";
+import { operatorContactPoint, operatorPolicyRoute, operatorRouteSpec, operatorRule } from "../k8s";
 import { operatorImporter, provisionedReceivers, provisionedRoute, provisionedRule } from "./operator";
 
 const site = (hostType: string, select: string, spec: Record<string, unknown>): EmbeddedContent => ({
@@ -25,6 +25,7 @@ describe("Grafana Operator alerting embedded in a k8s manifest (#3538)", () => {
     expect(operatorImporter.matches(site("K8s::Grafana::GrafanaAlertRuleGroup", "rules", { rules: [] }))).toBe(true);
     expect(operatorImporter.matches(site("K8s::Grafana::GrafanaContactPoint", "receivers", { receivers: [] }))).toBe(true);
     expect(operatorImporter.matches(site("K8s::Grafana::GrafanaNotificationPolicy", "route", { route: {} }))).toBe(true);
+    expect(operatorImporter.matches(site("K8s::Grafana::GrafanaNotificationPolicyRoute", "route", { route: { receiver: "r" } }))).toBe(true);
     expect(operatorImporter.matches(site("K8s::Grafana::GrafanaMuteTiming", "time_intervals", { time_intervals: [] }))).toBe(true);
     expect(operatorImporter.matches(site("K8s::Grafana::GrafanaNotificationTemplate", "template", { template: "x" }))).toBe(true);
     expect(operatorImporter.matches(site("K8s::Grafana::GrafanaAlertRuleGroup", "receivers", {}))).toBe(false);
@@ -205,6 +206,27 @@ describe("Grafana Operator alerting embedded in a k8s manifest (#3538)", () => {
       expect(template.files.map((f) => f.content).join("\n")).toContain("new NotificationTemplate(");
     });
 
+    test("a policy route is read as the child of a policy and written back through operatorRouteSpec", () => {
+      const spec = { receiver: "tickets", object_matchers: [["severity", "=", "ticket"]], mute_time_intervals: ["weekends"], routes: [{ object_matchers: [["team", "=", "a"]] }] };
+      const out = operatorImporter.import(site("K8s::Grafana::GrafanaNotificationPolicyRoute", "route", { route: spec }));
+      expect(out.value.through).toEqual({ from: "@intentius/chant-lexicon-grafana/k8s", name: "operatorRouteSpec" });
+      const text = out.files.map((f) => f.content).join("\n");
+      expect(text).toContain("new NotificationPolicy(");
+      expect(text).toContain('severity="ticket"');
+      expect(text).toContain('team="a"');
+    });
+
+    test("a policy route's routeSelector is left out with a warning, and a route with no receiver throws", () => {
+      const out = operatorImporter.import(site("K8s::Grafana::GrafanaNotificationPolicyRoute", "route", { route: { receiver: "r", routeSelector: { matchLabels: { a: "b" } } } }));
+      expect((out.warnings ?? []).join("\n")).toContain("routeSelector");
+      expect(() => operatorImporter.import(site("K8s::Grafana::GrafanaNotificationPolicyRoute", "route", { route: { matchers: [] } }))).toThrow(/spec.receiver/);
+    });
+
+    test("a policy that selects routes by label throws so the host keeps it as written", () => {
+      const route = { receiver: "oncall", routeSelector: { matchLabels: { a: "b" } } };
+      expect(() => operatorImporter.import(site("K8s::Grafana::GrafanaNotificationPolicy", "route", { route }))).toThrow(/routeSelector/);
+    });
+
     test("a policy with no receiver, and a group with no folder, throw so the host keeps them as written", () => {
       expect(() => operatorImporter.import(site("K8s::Grafana::GrafanaNotificationPolicy", "route", { route: { group_by: ["a"] } }))).toThrow();
       expect(() => operatorImporter.import(site("K8s::Grafana::GrafanaAlertRuleGroup", "rules", { name: "g", rules: [] }))).toThrow(/names no folder/);

package/src/import/operator.ts

@@ -3,7 +3,9 @@
  * `chant import` (#3538).
  *
  * `GrafanaOperatorResources` (#3156) writes `GrafanaAlertRuleGroup`,
- * `GrafanaContactPoint`, `GrafanaNotificationPolicy`, `GrafanaMuteTiming` and
+ * `GrafanaContactPoint`, `GrafanaNotificationPolicy` (with, for
+ * `policyRoutes`, a `GrafanaNotificationPolicyRoute` per child route),
+ * `GrafanaMuteTiming` and
  * `GrafanaNotificationTemplate` from grafana alerting declarations. The k8s
  * parser offers the one field of each that holds the alerting content
  * (`spec.rules`, `spec.receivers`, `spec.route`, `spec.time_intervals`,
@@ -26,6 +28,9 @@
  *   name is not part of a declaration, so a contact point that reads a
  *   Secret is written with a small module holding
  *   `operatorReceivers(contactPoint, "<secret>")`;
+ * - a `GrafanaNotificationPolicyRoute`: its whole `spec` is the route, read
+ *   as the one child of a policy that has its receiver, and written back by
+ *   `operatorRouteSpec`;
  * - the policy tree: `object_matchers` go back to Alertmanager `matchers`
  *   strings where each can be written as one.
  *
@@ -48,6 +53,7 @@ const KINDS: Record<string, { select: string; className: string; through: string
   "K8s::Grafana::GrafanaAlertRuleGroup": { select: "rules", className: "AlertRuleGroup", through: "operatorRules" },
   "K8s::Grafana::GrafanaContactPoint": { select: "receivers", className: "ContactPoint", through: "operatorReceivers" },
   "K8s::Grafana::GrafanaNotificationPolicy": { select: "route", className: "NotificationPolicy", through: "operatorPolicy" },
+  "K8s::Grafana::GrafanaNotificationPolicyRoute": { select: "route", className: "NotificationPolicy", through: "operatorRouteSpec" },
   "K8s::Grafana::GrafanaMuteTiming": { select: "time_intervals", className: "MuteTiming", through: "operatorTimeIntervals" },
   "K8s::Grafana::GrafanaNotificationTemplate": { select: "template", className: "NotificationTemplate", through: "operatorTemplate" },
 };
@@ -169,8 +175,17 @@ function provisioningFile(type: string, spec: Json, warnings: string[]): { file:
     }
     case "K8s::Grafana::GrafanaNotificationPolicy": {
       if (!isObject(spec.route)) throw new Error(`${where} has no spec.route`);
+      // The routes it selects are their own resources, and a declaration cannot hold the selector: keep it as written.
+      if (spec.route.routeSelector !== undefined) throw new Error(`${where} merges routes in with spec.route.routeSelector, which a NotificationPolicy cannot hold`);
       return { file: { apiVersion: 1, policies: [provisionedRoute(spec.route)] } };
     }
+    case "K8s::Grafana::GrafanaNotificationPolicyRoute": {
+      // The k8s parser offers the whole spec as `route`. A route has no declaration of its own, so it is read as the one child of a policy with its receiver.
+      if (!isObject(spec.route) || typeof spec.route.receiver !== "string") throw new Error(`${where} has no spec.receiver`);
+      const { routeSelector: _selector, ...route } = spec.route;
+      if (_selector !== undefined) warnings.push("the route's routeSelector (routes merged in by label) is not part of a declaration, so it is left out; import the selected routes on their own");
+      return { file: { apiVersion: 1, policies: [{ receiver: route.receiver, routes: [provisionedRoute(route)] }] } };
+    }
     case "K8s::Grafana::GrafanaMuteTiming": {
       if (typeof name !== "string") throw new Error(`${where} has no spec.name`);
       return { file: { apiVersion: 1, muteTimes: [{ name, time_intervals: spec.time_intervals }] } };

package/src/k8s.test.ts

@@ -18,6 +18,7 @@ import {
   operatorDatasource,
   operatorPolicyRoute,
   operatorReceiverSettings,
+  operatorRouteSpec,
   operatorRule,
 } from "./k8s";
 
@@ -327,6 +328,12 @@ describe("GrafanaOperatorResources alerting (#3156)", () => {
     ]);
     expect(() => operatorReceiverSettings("cp", { url: "https://x/${TOKEN}" }, "s")).toThrow(/inside the text/);
     expect(() => operatorReceiverSettings("cp", { password: "$__file{/run/pw}" }, "s")).toThrow(/inside the text/);
+    // The alert template variables are not references, even when they are the whole setting.
+    expect(operatorReceiverSettings("cp", { message: "$labels", detail: "$value", more: "$values" }, undefined)).toEqual({
+      settings: { message: "$labels", detail: "$value", more: "$values" },
+      valuesFrom: [],
+    });
+    expect(operatorReceiverSettings("cp", { url: "$labelsToken" }, "s").valuesFrom).toEqual([{ targetPath: "url", valueFrom: { secretKeyRef: { name: "s", key: "labelsToken" } } }]);
     // Go template text with a plain `$` is not a reference.
     expect(operatorReceiverSettings("cp", { message: "{{ $labels.job }} is down" }, undefined)).toEqual({ settings: { message: "{{ $labels.job }} is down" }, valuesFrom: [] });
   });
@@ -349,6 +356,33 @@ describe("GrafanaOperatorResources alerting (#3156)", () => {
     expect(() => operatorPolicyRoute({ receiver: "x", routes: [{ matchers: ["nonsense"] }] })).toThrow(/cannot read the route matcher/);
   });
 
+  test("policyRoutes writes each child route as a GrafanaNotificationPolicyRoute the policy selects by label", () => {
+    const docs = ops(alerting, { policyRoutes: true, labels: { team: "sre" } });
+    const root = docs.find((d) => d.kind === "GrafanaNotificationPolicy")!;
+    const label = { "grafana.chant.dev/policy": "grafana-notification-policy" };
+    expect(root.spec.route).toEqual({ receiver: "oncall", group_by: ["alertname"], routeSelector: { matchLabels: label } });
+    const routes = docs.filter((d) => d.kind === "GrafanaNotificationPolicyRoute");
+    expect(routes.map((d) => d.metadata.name)).toEqual(["grafana-notification-policy-route-1"]);
+    expect(routes[0].metadata.labels).toEqual({ team: "sre", ...label });
+    expect(routes[0].spec).toEqual({
+      receiver: "tickets",
+      object_matchers: [["severity", "=", "ticket"]],
+      mute_time_intervals: ["weekends"],
+      routes: [{ object_matchers: [["team", "=", "a"]] }],
+    });
+    expect(routes[0].spec.instanceSelector).toBeUndefined();
+  });
+
+  test("a policy with no child routes stays one resource under policyRoutes", () => {
+    const docs = ops([oncall, new NotificationPolicy({ receiver: oncall })], { policyRoutes: true });
+    expect(docs.some((d) => d.kind === "GrafanaNotificationPolicyRoute")).toBe(false);
+  });
+
+  test("operatorRouteSpec gives a child the policy's receiver when it has none", () => {
+    expect(operatorRouteSpec(new NotificationPolicy({ receiver: "oncall", routes: [{ matchers: ["a=\"b\""] }] }))).toEqual({ receiver: "oncall", object_matchers: [["a", "=", "b"]] });
+    expect(() => operatorRouteSpec(new NotificationPolicy({ receiver: "oncall" }))).toThrow(/no child route/);
+  });
+
   test("a build with no alerting writes none, and options reach the alerting resources", () => {
     expect(ops([prometheus]).map((d) => d.kind)).toEqual(["GrafanaDatasource"]);
     const docs = ops([weekends], { allowCrossNamespaceImport: true, resyncPeriod: "5m", namespace: "obs", name: "obs" });

package/src/k8s.ts

@@ -46,6 +46,7 @@ import {
   GrafanaLibraryPanel,
   GrafanaMuteTiming,
   GrafanaNotificationPolicy,
+  GrafanaNotificationPolicyRoute,
   GrafanaNotificationTemplate,
 } from "@intentius/chant-lexicon-k8s/generated/index";
 import {
@@ -275,6 +276,16 @@ export interface GrafanaOperatorResourcesProps {
    * contact point has such a reference.
    */
   secretName?: string;
+  /**
+   * Write each direct child route of a notification policy as a
+   * `GrafanaNotificationPolicyRoute` of its own, which the policy merges in
+   * through `spec.route.routeSelector` (the operator allows `routes` or
+   * `routeSelector`, not both). The routes carry the label
+   * `grafana.chant.dev/policy: <policy resource name>`, which the selector
+   * matches. A route's own nested routes stay inline in its `spec.routes`.
+   * Defaults to false: the whole tree inline in `spec.route`.
+   */
+  policyRoutes?: boolean;
 }
 
 type OperatorEntity = (
@@ -285,6 +296,7 @@ type OperatorEntity = (
   | InstanceType<typeof GrafanaAlertRuleGroup>
   | InstanceType<typeof GrafanaContactPoint>
   | InstanceType<typeof GrafanaNotificationPolicy>
+  | InstanceType<typeof GrafanaNotificationPolicyRoute>
   | InstanceType<typeof GrafanaMuteTiming>
   | InstanceType<typeof GrafanaNotificationTemplate>
 ) &
@@ -350,8 +362,15 @@ export function operatorDatasource(
 
 // ── Alerting (#3156) ──────────────────────────────────────────────────
 
-/** A setting that is wholly a reference to a variable: `${NAME}`, `$__env{NAME}` or `$NAME`. */
-const WHOLE_VARIABLE = /^(?:\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$__env\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*))$/;
+/** The label a `GrafanaNotificationPolicyRoute` carries for the policy whose `routeSelector` merges it in. */
+export const POLICY_ROUTE_LABEL = "grafana.chant.dev/policy";
+
+/**
+ * A setting that is wholly a reference to a variable: `${NAME}`, `$__env{NAME}` or `$NAME`.
+ * The bare `$labels`, `$value` and `$values` are alert template variables, not environment
+ * variables, so a setting of exactly that text is left as written.
+ */
+const WHOLE_VARIABLE = /^(?:\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$__env\{([A-Za-z_][A-Za-z0-9_]*)\}|\$(?!(?:labels|values?)$)([A-Za-z_][A-Za-z0-9_]*))$/;
 /** A braced reference inside longer text, which `valuesFrom` cannot substitute into. */
 const EMBEDDED_VARIABLE = /\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$__env\{[^}]*\}|\$__(?:file|vault)\{[^}]*\}/;
 
@@ -502,6 +521,19 @@ export function operatorPolicy(policy: NotificationPolicyEntity): Record<string,
   return operatorPolicyRoute(notificationPolicyJson(policy));
 }
 
+/**
+ * `GrafanaNotificationPolicyRoute.spec` for a policy declaration holding the
+ * route as its one child: the child's fields, with `receiver` always set
+ * (the CRD requires it, so a child that inherits it gets the policy's).
+ */
+export function operatorRouteSpec(policy: NotificationPolicyEntity): Record<string, unknown> {
+  const tree = operatorPolicy(policy);
+  const routes = tree.routes as Array<Record<string, unknown>> | undefined;
+  const child = routes?.[0];
+  if (!child) throw new Error("grafana: the policy has no child route to write as a GrafanaNotificationPolicyRoute");
+  return { ...child, receiver: child.receiver ?? tree.receiver };
+}
+
 /** `GrafanaMuteTiming.spec.time_intervals` for a mute timing. */
 export function operatorTimeIntervals(timing: MuteTimingEntity): Array<Record<string, unknown>> {
   return muteTimingJson(timing).time_intervals;
@@ -533,7 +565,9 @@ export function operatorTemplate(template: NotificationTemplateEntity): string {
  *   a `GrafanaContactPoint` per contact point, `<name>-contact-point-<name>`,
  *   whose `${NAME}` secrets go to each receiver's `valuesFrom`; a
  *   `GrafanaNotificationPolicy`, `<name>-notification-policy`, with its
- *   nested routes inline; a `GrafanaMuteTiming` per mute timing and a
+ *   nested routes inline (or, with `policyRoutes`, one
+ *   `GrafanaNotificationPolicyRoute` per direct child route, selected by
+ *   label); a `GrafanaMuteTiming` per mute timing and a
  *   `GrafanaNotificationTemplate` per template.
  *
  * Every resource carries `instanceSelector`. Export the result from a k8s
@@ -650,9 +684,27 @@ export const GrafanaOperatorResources = Composite<GrafanaOperatorResourcesProps,
     }
     for (const policy of alerting.policies ?? []) {
       const name = unique(`${prefix}-notification-policy`);
+      const tree = operatorPolicyRoute(policy);
+      const children = Array.isArray(tree.routes) ? (tree.routes as Array<Record<string, unknown>>) : [];
+      if (props.policyRoutes && children.length > 0) {
+        const { routes: _inline, ...root } = tree;
+        const selector = { [POLICY_ROUTE_LABEL]: name };
+        members[memberName(name, prefix)] = new GrafanaNotificationPolicy({
+          metadata: metadata(name),
+          spec: { ...common, route: { ...root, routeSelector: { matchLabels: selector } } },
+        }) as OperatorEntity;
+        children.forEach((child, i) => {
+          const routeName = unique(`${prefix}-notification-policy-route-${i + 1}`);
+          members[memberName(routeName, prefix)] = new GrafanaNotificationPolicyRoute({
+            metadata: { ...metadata(routeName), labels: { ...(props.labels ?? {}), ...selector } },
+            spec: { ...child, receiver: child.receiver ?? tree.receiver },
+          }) as OperatorEntity;
+        });
+        continue;
+      }
       members[memberName(name, prefix)] = new GrafanaNotificationPolicy({
         metadata: metadata(name),
-        spec: { ...common, route: operatorPolicyRoute(policy) },
+        spec: { ...common, route: tree },
       }) as OperatorEntity;
     }
     for (const t of alerting.muteTimes ?? []) {