@intentius/chant-lexicon-grafana 0.97.0 → 0.99.0

package/src/lint/post-synth/post-synth.test.ts

@@ -1,12 +1,15 @@
 import { describe, expect, test } from "vitest";
+import { readdirSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 import { makePostSynthCtxFromFiles, makePostSynthCtx } from "@intentius/chant-test-utils";
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 import type { Declarable } from "@intentius/chant/declarable";
 import { grafanaSerializer } from "../../serializer";
-import { Datasource } from "../../datasource";
-import { Dashboard } from "../../dashboard";
-import { Row, StatPanel, TimeSeriesPanel, TablePanel } from "../../panels";
-import { PromQuery, TempoQuery } from "../../query";
+import { Datasource, ExternalDatasource } from "../../datasource";
+import { Dashboard, DashboardProvider } from "../../dashboard";
+import { HeatmapPanel, Row, StatPanel, TimeSeriesPanel, TablePanel, TextPanel } from "../../panels";
+import { LokiQuery, PromQuery, TempoQuery } from "../../query";
 import { DatasourceVariable, QueryVariable } from "../../variables";
 import { graf101 } from "./graf101";
 import { graf102 } from "./graf102";
@@ -15,6 +18,14 @@ import { graf104 } from "./graf104";
 import { graf105 } from "./graf105";
 import { graf106 } from "./graf106";
 import { graf107 } from "./graf107";
+import { graf108 } from "./graf108";
+import { graf109 } from "./graf109";
+import { graf115 } from "./graf115";
+import { panelUnits } from "../../validate-output";
+import { panelsOf } from "../../datasource-refs";
+import { GRAFANA_UNIT_IDS } from "../../spec/units";
+import { prometheusQueries } from "../../promql-check";
+import { knownDatasources } from "../../datasource-refs";
 
 /** Serialize entities the way a build does and hand the files to the harness. */
 function ctxOf(entities: Record<string, Declarable>) {
@@ -72,10 +83,65 @@ describe("GRAF101: undeclared datasource", () => {
     expect(graf101.check(ctxOf({ prometheus, tempo, d }))).toEqual([]);
   });
 
-  test("is silent when the build declares no datasource (another build root, chant #1939)", () => {
+  test("warns once per dashboard when the build declares no datasource, so nothing can be checked", () => {
     const panel = new StatPanel({ datasource: { type: "prometheus", uid: "elsewhere" }, targets: [up] });
+    const other = new StatPanel({ datasource: { type: "prometheus", uid: "elsewhere" }, targets: [up] });
+    const diags = graf101.check(ctxOf({ d: new Dashboard({ title: "D", panels: [panel, other] }) }));
+    expect(diags.map((d) => [d.checkId, d.severity])).toEqual([["GRAF101", "warning"]]);
+    expect(diags[0].message).toContain('datasource uid "elsewhere"');
+    expect(diags[0].message).toContain("ExternalDatasource");
+  });
+
+  test("says nothing when the build declares no datasource and the dashboard names none", () => {
+    const panel = new TextPanel({ options: { content: "hi", mode: "markdown" } });
     expect(graf101.check(ctxOf({ d: new Dashboard({ title: "D", panels: [panel] }) }))).toEqual([]);
   });
+
+  test("resolves entity and { type, uid } refs to an ExternalDatasource, and never provisions it", () => {
+    const mimir = new ExternalDatasource({ type: "prometheus", uid: "mimir", name: "Mimir" });
+    const d = new Dashboard({
+      title: "D",
+      panels: [new StatPanel({ datasource: mimir, targets: [up] }), new StatPanel({ datasource: { type: "prometheus", uid: "mimir" }, targets: [up] })],
+      variables: [new QueryVariable({ name: "job", datasource: mimir, query: "label_values(job)" })],
+    });
+    const entities = { mimir, prometheus, d };
+    expect(graf101.check(ctxOf(entities))).toEqual([]);
+    expect(graf102.check(ctxOf(entities))).toEqual([]);
+    const out = grafanaSerializer.serialize(new Map(Object.entries(entities))) as { primary: string; files: Record<string, string> };
+    expect(out.files["provisioning/datasources/chant.yaml"]).not.toContain("mimir");
+    expect(JSON.parse(out.primary).externalDatasources).toEqual([{ type: "prometheus", uid: "mimir", name: "Mimir" }]);
+  });
+
+  test("an ExternalDatasource alone is enough to check references", () => {
+    const mimir = new ExternalDatasource({ type: "prometheus", uid: "mimir" });
+    const d = new Dashboard({ title: "D", panels: [new StatPanel({ datasource: { type: "prometheus", uid: "typo" }, targets: [up] })] });
+    const diags = graf101.check(ctxOf({ mimir, d }));
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual([
+      ["GRAF101", "error"],
+      ["GRAF101", "error"],
+    ]);
+    expect(diags[0].message).toContain('Declared: "mimir"');
+  });
+
+  test("flags a DatasourceVariable whose plugin type no declared datasource has", () => {
+    const ds = new DatasourceVariable({ name: "logs", pluginType: "loki" });
+    const diags = graf101.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [ds] }) }));
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual([["GRAF101", "error"]]);
+    expect(diags[0].message).toContain('variable "logs" chooses among loki datasources');
+  });
+
+  test("passes a DatasourceVariable whose plugin type only an ExternalDatasource has", () => {
+    const ds = new DatasourceVariable({ name: "logs", pluginType: "loki" });
+    const loki = new ExternalDatasource({ type: "loki", uid: "loki-prod" });
+    expect(graf101.check(ctxOf({ prometheus, loki, d: new Dashboard({ title: "D", variables: [ds] }) }))).toEqual([]);
+  });
+
+  test("counts a DatasourceVariable in the no-datasource warning", () => {
+    const ds = new DatasourceVariable({ name: "logs", pluginType: "loki" });
+    const diags = graf101.check(ctxOf({ d: new Dashboard({ title: "D", variables: [ds] }) }));
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual([["GRAF101", "warning"]]);
+    expect(diags[0].message).toContain("datasource variables of type loki");
+  });
 });
 
 describe("GRAF102: datasource type mismatch", () => {
@@ -95,6 +161,13 @@ describe("GRAF102: datasource type mismatch", () => {
     expect(diags[0].message).toContain('variable "ds" chooses among loki');
   });
 
+  test("checks a ref's type against an ExternalDatasource", () => {
+    const traces = new ExternalDatasource({ type: "tempo", uid: "traces", name: "Traces" });
+    const panel = new StatPanel({ datasource: { type: "prometheus", uid: "traces" }, targets: [up] });
+    const diags = graf102.check(ctxOf({ traces, d: new Dashboard({ title: "D", panels: [panel] }) }));
+    expect(diags[0].message).toContain('external datasource "Traces", which is tempo');
+  });
+
   test("passes matching types", () => {
     expect(graf102.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels: [new StatPanel({ datasource: prometheus, targets: [up] })] }) }))).toEqual([]);
   });
@@ -180,6 +253,18 @@ describe("GRAF105: grid", () => {
   });
 });
 
+describe("GRAF104 and GRAF106 on external datasources", () => {
+  test("flags an ExternalDatasource sharing a uid with a provisioned one", () => {
+    const clash = new ExternalDatasource({ type: "prometheus", uid: "prometheus" });
+    expect(graf104.check(ctxOf({ prometheus, clash })).map((d) => d.message)).toEqual([expect.stringContaining('2 datasources share the uid "prometheus"')]);
+  });
+
+  test("flags an ExternalDatasource uid Grafana rejects", () => {
+    const bad = new ExternalDatasource({ type: "prometheus", uid: "has space" });
+    expect(graf106.check(ctxOf({ bad })).map((d) => d.message)).toEqual([expect.stringContaining('ExternalDatasource "has space"')]);
+  });
+});
+
 describe("GRAF106: uids and titles", () => {
   test("flags an over-long uid, a bad datasource uid and an empty title", () => {
     const bad = new Datasource({ name: "Bad", type: "prometheus", uid: "has space" });
@@ -197,17 +282,17 @@ describe("GRAF106: uids and titles", () => {
 });
 
 describe("GRAF107: the pinned schema", () => {
-  test("flags an unknown dashboard key, a bad panel option and an unknown query field", () => {
+  test("warns about an unknown dashboard key and query field, and fails a bad panel option", () => {
     const dash = dashboardJson(
       [panelJson({ options: { graphMode: "sparkline" }, datasource: { type: "prometheus", uid: "p" }, targets: [{ refId: "A", expr: "up", exprr: "typo" }] })],
       [],
       { owner: "team-a" },
     );
-    const messages = graf107.check(ctxOfJson(dash)).map((d) => d.message);
-    expect(messages).toEqual([
-      expect.stringContaining('must NOT have additional properties ("owner")'),
-      expect.stringContaining("/panels/0/options/graphMode: must be equal to one of the allowed values"),
-      expect.stringContaining('/panels/0/targets/0: must NOT have additional properties ("exprr")'),
+    const diags = graf107.check(ctxOfJson(dash)).map((d) => [d.severity, d.message]);
+    expect(diags).toEqual([
+      ["warning", expect.stringContaining('/: unknown key "owner" (not in the pinned schema)')],
+      ["error", expect.stringContaining("/panels/0/options/graphMode: must be equal to one of the allowed values")],
+      ["warning", expect.stringContaining('/panels/0/targets/0: unknown key "exprr" (not in the pinned schema)')],
     ]);
   });
 
@@ -229,3 +314,142 @@ describe("GRAF107: the pinned schema", () => {
     expect(graf107.check(ctx).map((d) => d.checkId)).toEqual(["GRAF107"]);
   });
 });
+
+describe("GRAF108: PromQL syntax", () => {
+  const loki = new Datasource({ name: "Loki", type: "loki" });
+
+  test("flags the unbalanced expression from the issue (#2955)", () => {
+    const cluster = new QueryVariable({ name: "cluster", datasource: prometheus, query: "label_values(up, cluster)" });
+    const panel = new StatPanel({ title: "Up", datasource: prometheus, targets: [new PromQuery({ expr: 'sum(x{cluster="$cluster"}' })] });
+    const diags = graf108.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [cluster], panels: [panel] }) }));
+    expect(diags.map((d) => [d.checkId, d.severity])).toEqual([["GRAF108", "error"]]);
+    expect(diags[0].message).toContain('panel "Up"');
+    expect(diags[0].message).toContain("query A is not valid PromQL: the expression ends early");
+  });
+
+  test("flags a query variable and a panel query inheriting a Prometheus datasource variable", () => {
+    const ds = new DatasourceVariable({ name: "ds", pluginType: "prometheus" });
+    const job = new QueryVariable({ name: "job", datasource: prometheus, query: 'label_values(up{env="prod", job, instance)' });
+    const panel = new TimeSeriesPanel({ title: "Rate", datasource: ds, targets: [new PromQuery({ expr: "rate(http_requests_total[5 m])" })] });
+    const messages = graf108.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [ds, job], panels: [panel] }) })).map((d) => d.message);
+    expect(messages).toEqual([expect.stringContaining('panel "Rate" (id 1) query A is not valid PromQL'), expect.stringContaining('variable "job" query is not valid PromQL')]);
+  });
+
+  test("passes template variables and Grafana's macros where Prometheus would see a value", () => {
+    const route = new QueryVariable({ name: "route", datasource: prometheus, query: 'label_values(http_requests_total{job="$job"}, route)' });
+    const job = new QueryVariable({ name: "job", datasource: prometheus, query: "label_values(up, job)" });
+    const exprs = [
+      'sum by (le) (rate(http_request_duration_seconds_bucket{route=~"$route"}[$__rate_interval]))',
+      'sum(increase(http_requests_total{job="${job}"}[$__range])) / $__range_s',
+      'rate(http_requests_total{job=~"[[job]]"}[$__interval]) offset $__interval',
+    ];
+    const panel = new TimeSeriesPanel({ datasource: prometheus, targets: exprs.map((expr) => new PromQuery({ expr })) });
+    expect(graf108.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [job, route], panels: [panel] }) }))).toEqual([]);
+  });
+
+  test("leaves LogQL, TraceQL and queries of unknown destination alone", () => {
+    const logs = new StatPanel({ datasource: loki, targets: [new LokiQuery({ expr: '{app="x"} |= "error" | json' })] });
+    const traces = new TablePanel({ datasource: tempo, targets: [new TempoQuery({ query: "{ .status = error }" })] });
+    const d = new Dashboard({ title: "D", panels: [logs, traces] });
+    expect(graf108.check(ctxOf({ loki, tempo, d }))).toEqual([]);
+    // No datasource anywhere: Grafana sends it to its default, whatever that is.
+    const unknown = dashboardJson([panelJson({ targets: [{ refId: "A", expr: "sum(" }] })]);
+    expect(graf108.check(ctxOfJson(unknown))).toEqual([]);
+  });
+
+  test("checks refs to a Prometheus the build does not declare, by the ref's own type", () => {
+    const dash = dashboardJson([panelJson({ datasource: { type: "prometheus", uid: "elsewhere" }, targets: [{ refId: "A", expr: "sum(up" }] })]);
+    expect(ids(graf108, ctxOfJson(dash))).toEqual([["GRAF108", "error"]]);
+  });
+});
+
+describe("GRAF108 over real Grafana exports", () => {
+  const exportsDir = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "test", "fixtures", "exports");
+  const files = readdirSync(exportsDir)
+    .filter((d) => d.startsWith("grafana-"))
+    .flatMap((v) => readdirSync(join(exportsDir, v)).filter((f) => f.endsWith(".json") && !f.includes("-resource")).map((f) => `${v}/${f}`));
+
+  test.each(files)("%s has no GRAF108 errors", (name) => {
+    const text = readFileSync(join(exportsDir, name), "utf-8");
+    // Non-vacuous: every export in the corpus sends PromQL to a Prometheus.
+    expect(prometheusQueries(JSON.parse(text), knownDatasources([])).length).toBeGreaterThan(0);
+    expect(graf108.check(makePostSynthCtxFromFiles("grafana", { [name]: text }, "{}"))).toEqual([]);
+  });
+});
+
+describe("GRAF115: units", () => {
+  test("flags the units from the issue (#2954) and suggests the id meant", () => {
+    const bytes = new StatPanel({ title: "Memory", datasource: prometheus, targets: [up], fieldConfig: { defaults: { unit: "byte" } } });
+    const cores = new TimeSeriesPanel({ title: "CPU", datasource: prometheus, targets: [up], fieldConfig: { defaults: { unit: "cores" } } });
+    const diags = graf115.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels: [bytes, cores] }) }));
+    expect(diags.map((d) => [d.checkId, d.severity])).toEqual([
+      ["GRAF115", "warning"],
+      ["GRAF115", "warning"],
+    ]);
+    expect(diags[0].message).toContain('panel "Memory" (id 1) fieldConfig.defaults.unit: unit "byte" is not one Grafana knows');
+    expect(diags[0].message).toContain('Did you mean "bytes"?');
+    expect(diags[1].message).not.toContain("Did you mean");
+    expect(diags[1].message).toContain('"suffix:cores"');
+  });
+
+  test("passes registered ids, the legacy alias, an empty unit and every custom-unit syntax", () => {
+    const units = ["bytes", "s", "percentunit", "reqps", "currencyEUR", "farenheit", "", "suffix: cores", "prefix:$", "time:YYYY-MM-DD", "si:mF", "count:reqs", "currency:financial:€:suffix", "bool:up/down"];
+    const panels = units.map((unit) => new StatPanel({ datasource: prometheus, targets: [up], fieldConfig: { defaults: { unit } } }));
+    expect(graf115.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels }) }))).toEqual([]);
+  });
+
+  test("checks overrides, heatmap axes and cells, legacy y-axes and library panels", () => {
+    const heat = new HeatmapPanel({ title: "Heat", datasource: prometheus, targets: [up], options: { yAxis: { unit: "sec" }, cellValues: { unit: "Short" } } });
+    const table = new TablePanel({
+      title: "T",
+      datasource: prometheus,
+      targets: [up],
+      fieldConfig: { overrides: [{ matcher: { id: "byName", options: "x" }, properties: [{ id: "decimals", value: 2 }, { id: "unit", value: "celcius" }] }] },
+    });
+    const messages = graf115.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels: [heat, table] }) })).map((d) => d.message);
+    expect(messages).toEqual([
+      expect.stringContaining('options.yAxis.unit: unit "sec"'),
+      expect.stringContaining('options.cellValues.unit: unit "Short" is not one Grafana knows, so it is shown as a literal suffix. Did you mean "short"?'),
+      expect.stringContaining('fieldConfig.overrides[0].properties[1]: unit "celcius" is not one Grafana knows, so it is shown as a literal suffix. Did you mean "celsius"?'),
+    ]);
+
+    const graph = panelJson({ type: "graph", yaxes: [{ format: "bytes" }, { format: "ops/s" }] });
+    const lib = panelJson({ fieldConfig: { defaults: { unit: "req/s" }, overrides: [] } });
+    const dash = dashboardJson([graph], [], { __elements: { lib: { kind: 1, model: lib } } });
+    expect(graf115.check(ctxOfJson(dash)).map((d) => d.message)).toEqual([
+      expect.stringContaining('panel "p" (id 1) yaxes[1].format: unit "ops/s"'),
+      expect.stringContaining('library panel "lib" fieldConfig.defaults.unit: unit "req/s"'),
+    ]);
+  });
+
+  test("the vendored registry is Grafana v13.2.2's", () => {
+    expect(GRAFANA_UNIT_IDS.length).toBe(274);
+    expect(GRAFANA_UNIT_IDS).toEqual(expect.arrayContaining(["none", "bytes", "decbytes", "reqps", "ms", "percentunit", "celsius", "currencyUSD", "dateTimeAsIso", "h"]));
+    expect(GRAFANA_UNIT_IDS).not.toContain("byte");
+  });
+});
+
+describe("GRAF115 over real Grafana exports and community dashboards", () => {
+  const fixtures = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "test", "fixtures");
+  const exportsDir = join(fixtures, "exports");
+  const files = [
+    ...readdirSync(exportsDir)
+      .filter((d) => d.startsWith("grafana-"))
+      .flatMap((v) => readdirSync(join(exportsDir, v)).filter((f) => f.endsWith(".json") && !f.includes("-resource")).map((f) => `exports/${v}/${f}`)),
+    ...readdirSync(join(fixtures, "community"))
+      .filter((f) => f.endsWith(".json"))
+      .map((f) => `community/${f}`),
+  ];
+  let unitsSeen = 0;
+
+  test.each(files)("%s has no GRAF115 warnings", (name) => {
+    const text = readFileSync(join(fixtures, name), "utf-8");
+    unitsSeen += panelsOf(JSON.parse(text)).flatMap(({ panel }) => panelUnits(panel)).length;
+    expect(graf115.check(makePostSynthCtxFromFiles("grafana", { [name]: text }, "{}"))).toEqual([]);
+  });
+
+  // Non-vacuous: the corpus sets hundreds of units between them.
+  test("the corpus sets units", () => {
+    expect(unitsSeen).toBeGreaterThan(200);
+  });
+});

package/src/lint/rules/literal-secret.ts

@@ -1,15 +1,38 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import { constInitializers, constructorArgs, literalText, position, propertyName, resolveObject } from "./grafana-ast";
+import { CONTACT_POINT_SECRET_SETTINGS, EXPANDED_VALUE as EXPANDED } from "../../contact-point-secrets";
 
-/** How Grafana provisioning reads a value from outside the file: `$VAR`, `${VAR}`, `$__env{…}`, `$__file{…}`, `$__vault{…}`. */
-const EXPANDED = /\$(\{[A-Za-z_][A-Za-z0-9_]*\}|[A-Za-z_][A-Za-z0-9_]*|__(env|file|vault)\{[^}]+\})/;
+/** Follow an identifier to the array literal it was declared as, when it is one in this file. */
+function resolveArray(node: ts.Expression, consts: Map<string, ts.Expression>, depth = 0): ts.ArrayLiteralExpression | undefined {
+  let n: ts.Expression = node;
+  while (ts.isAsExpression(n) || ts.isSatisfiesExpression(n) || ts.isParenthesizedExpression(n)) n = n.expression;
+  if (ts.isArrayLiteralExpression(n)) return n;
+  if (ts.isIdentifier(n) && depth < 5) {
+    const init = consts.get(n.text);
+    if (init) return resolveArray(init, consts, depth + 1);
+  }
+  return undefined;
+}
+
+/** The value of a property, `name: value` or the shorthand `name` (followed as an identifier). */
+function prop(obj: ts.ObjectLiteralExpression, name: string): ts.Expression | undefined {
+  for (const p of obj.properties) {
+    if (propertyName(p) === name) return (p as ts.PropertyAssignment).initializer;
+    if (ts.isShorthandPropertyAssignment(p) && p.name.text === name) return p.name;
+  }
+  return undefined;
+}
 
 /**
- * GRAF002: a datasource secret written as a literal.
+ * GRAF002: a datasource or contact point secret written as a literal.
  *
- * `secureJsonData` holds passwords, tokens and TLS keys. A literal there is a
- * secret in the repository and in the emitted provisioning file. Grafana
+ * A datasource's `secureJsonData` holds passwords, tokens and TLS keys, and
+ * so do the settings Grafana stores encrypted for each contact point
+ * integration (a Slack webhook `url`, a PagerDuty `integrationKey`, a
+ * webhook's `authorization_credentials`; see `CONTACT_POINT_SECRET_SETTINGS`).
+ * A literal there is a secret in the repository and in the emitted
+ * provisioning file. Grafana
  * expands `$__env{NAME}`, `$__file{/path}` and `${NAME}` when it reads the
  * file, so the declaration never needs the value. A value written as a
  * named `const` in the same file is followed.
@@ -18,7 +41,7 @@ export const literalSecretRule: LintRule = {
   id: "GRAF002",
   severity: "error",
   category: "security",
-  description: "Datasource secureJsonData value declared as a literal instead of $__env{...} or $__file{...}",
+  description: "Datasource secureJsonData or contact point secret setting declared as a literal instead of $__env{...} or $__file{...}",
 
   check(context: LintContext): LintDiagnostic[] {
     const diagnostics: LintDiagnostic[] = [];
@@ -43,6 +66,37 @@ export const literalSecretRule: LintRule = {
         }
       }
     }
+    for (const { arg } of constructorArgs(source, (n) => n === "ContactPoint")) {
+      const receivers = prop(arg, "receivers");
+      const list = receivers ? resolveArray(receivers, consts) : undefined;
+      for (const el of list?.elements ?? []) {
+        const receiver = resolveObject(el as ts.Expression, consts);
+        if (!receiver) continue;
+        const typeNode = prop(receiver, "type");
+        const type = typeNode ? literalText(typeNode) : undefined;
+        const settingsNode = prop(receiver, "settings");
+        const settings = settingsNode ? resolveObject(settingsNode, consts) : undefined;
+        if (!type || !settings) continue;
+        for (const path of CONTACT_POINT_SECRET_SETTINGS[type] ?? []) {
+          let node: ts.ObjectLiteralExpression | undefined = settings;
+          const segments = path.split(".");
+          for (const seg of segments.slice(0, -1)) {
+            const next: ts.Expression | undefined = node ? prop(node, seg) : undefined;
+            node = next ? resolveObject(next, consts) : undefined;
+          }
+          const valueNode = node ? prop(node, segments[segments.length - 1]) : undefined;
+          const text = valueNode ? literalText(valueNode) : undefined;
+          if (!valueNode || text === undefined || text === "" || EXPANDED.test(text)) continue;
+          diagnostics.push({
+            ruleId: "GRAF002",
+            severity: "error",
+            message: `${type} contact point setting ${path} is a literal secret; write "$__env{NAME}" or "$__file{/path}" and let Grafana read it`,
+            file: context.filePath,
+            ...position(source, valueNode),
+          });
+        }
+      }
+    }
     return diagnostics;
   },
 };

package/src/lint/rules/rules.test.ts

@@ -67,4 +67,31 @@ describe("GRAF002 literal secret", () => {
     );
     expect(diags).toEqual([]);
   });
+
+  test("flags a contact point's secret setting written as a literal, inline or through consts", () => {
+    const diags = literalSecretRule.check(
+      ctx(`
+        new ContactPoint({ name: "oncall", receivers: [{ type: "slack", settings: { url: "https://hooks.slack.com/services/T/B/X", recipient: "#c" } }] });
+        const pd = { integrationKey: "abc123" };
+        const receivers = [{ type: "pagerduty", settings: pd }, { type: "webhook", settings: { url: "https://x", tlsConfig: { clientKey: "-----BEGIN" } } }];
+        new ContactPoint({ name: "pager", receivers });
+      `),
+    );
+    expect(diags.map((d) => d.message)).toEqual([
+      expect.stringContaining("slack contact point setting url"),
+      expect.stringContaining("pagerduty contact point setting integrationKey"),
+      expect.stringContaining("webhook contact point setting tlsConfig.clientKey"),
+    ]);
+  });
+
+  test("accepts expanded contact point secrets, and settings that are not secret", () => {
+    const diags = literalSecretRule.check(
+      ctx(`
+        new ContactPoint({ name: "oncall", receivers: [{ type: "slack", settings: { url: "$__env{SLACK_URL}", recipient: "#c" } }] });
+        new ContactPoint({ name: "hook", receivers: [{ type: "webhook", settings: { url: "https://tickets.example.com", authorization_credentials: "\${TOKEN}" } }] });
+        new ContactPoint({ name: "mail", receivers: [{ type: "email", settings: { addresses: "a@example.com" } }] });
+      `),
+    );
+    expect(diags).toEqual([]);
+  });
 });

package/src/lsp/completions.test.ts

@@ -14,6 +14,11 @@ describe("grafana LSP completions", () => {
     expect(items.map((i) => i.label)).toContain("TimeSeriesPanel");
   });
 
+  it("offers every panel class sharing a prefix", () => {
+    const items = completions({ uri: "file:///d.ts", content: "new Sta", position: { line: 0, character: 7 }, wordAtCursor: "Sta", linePrefix: "new Sta" });
+    expect(items.map((i) => i.label)).toEqual(expect.arrayContaining(["StatPanel", "StateTimelinePanel", "StatusHistoryPanel"]));
+  });
+
   it("offers the query classes by prefix", () => {
     const items = completions({
       uri: "file:///q.ts",

package/src/lsp/hover.test.ts

@@ -14,6 +14,13 @@ describe("grafana LSP hover", () => {
     expect(info?.contents).toContain("Panel plugin `stat`");
   });
 
+  it("names the schema a panel's options come from, or that there is none", () => {
+    const at = (word: string) => hover({ uri: "file:///d.ts", content: `new ${word}({})`, position: { line: 0, character: 6 }, word, lineText: `new ${word}({})` })?.contents;
+    expect(at("NodeGraphPanel")).toContain("Panel plugin `nodeGraph`. Options typed from");
+    expect(at("NodeGraphPanel")).toContain("(`nodegraph`)");
+    expect(at("AlertListPanel")).toContain("Grafana publishes no options schema for it");
+  });
+
   it("describes a query and its datasource type", () => {
     const info = hover({ uri: "file:///q.ts", content: "new TempoQuery({})", position: { line: 0, character: 6 }, word: "TempoQuery", lineText: "new TempoQuery({})" });
     expect(info?.contents).toContain("`tempo` datasources");

package/src/lsp/hover.ts

@@ -2,6 +2,7 @@ import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
 import { LexiconIndex, lexiconHover, type LexiconEntry } from "@intentius/chant/lsp/lexicon-providers";
 import { BUILTIN_CATALOG, lexiconRegistry } from "../catalog";
 import { GRAFANA_SCHEMA_PIN } from "../pin";
+import { panelDefinitionFor } from "../panels";
 
 let cachedIndex: LexiconIndex | null = null;
 
@@ -20,7 +21,13 @@ function resourceHover(className: string, entry: LexiconEntry): HoverInfo | unde
   const lines = [`**${className}**`, "", `grafana type: \`${entry.resourceType}\``];
   if (cat?.description) lines.push("", cat.description);
   if (cat?.kind === "panel") {
-    lines.push("", `Panel plugin \`${cat.pluginId}\`. Options typed from ${GRAFANA_SCHEMA_PIN.source} ${GRAFANA_SCHEMA_PIN.ref}.`);
+    const schema = cat.pluginId ? panelDefinitionFor(cat.pluginId)?.schema : undefined;
+    lines.push(
+      "",
+      schema
+        ? `Panel plugin \`${cat.pluginId}\`. Options typed from ${GRAFANA_SCHEMA_PIN.source} ${GRAFANA_SCHEMA_PIN.ref} (\`${schema}\`).`
+        : `Panel plugin \`${cat.pluginId}\`. Grafana publishes no options schema for it, so GRAF107 does not check its options.`,
+    );
   } else if (cat?.kind === "query") {
     lines.push("", `For \`${cat.pluginId}\` datasources. Typed from ${GRAFANA_SCHEMA_PIN.source} ${GRAFANA_SCHEMA_PIN.ref}.`);
   }

package/src/members.ts

@@ -0,0 +1,68 @@
+/**
+ * Which dashboard holds a declared panel, row, query or variable (#2946).
+ *
+ * Panels, rows, queries and variables are property-kind declarables: they
+ * exist in Grafana only inside a dashboard's JSON. Core's live diff still
+ * hands every exported declarable to `describeResources`, so a project that
+ * exports its panels (as every example and every imported dashboard does)
+ * asks the reader about each one. Answering "absent" would make `lifecycle
+ * plan` propose creating it, and "not observed" would report a hole for every
+ * panel of a dashboard that was read in full. The honest answer is the
+ * dashboard's own verdict: a panel is there when the dashboard holding it is
+ * there, and its properties are compared as part of that dashboard's tree.
+ *
+ * Membership is by identity: a dashboard's props hold the very declarable
+ * objects, so the member is found by walking them, whatever nests it (a row's
+ * panels, a panel's queries, a `repeat` or `datasource` variable).
+ */
+
+import { DASHBOARD_TYPE } from "./dashboard";
+import { PANEL_TYPE_PREFIX, ROW_TYPE } from "./panels";
+import { QUERY_TYPE_PREFIX } from "./query";
+import { VARIABLE_TYPE_PREFIX } from "./variables";
+
+type Entities = Map<string, { entityType: string; props: Record<string, unknown> }>;
+
+function isPropertyDeclarable(v: unknown): v is { kind: "property"; props: Record<string, unknown> } {
+  return typeof v === "object" && v !== null && (v as { kind?: unknown }).kind === "property" && typeof (v as { props?: unknown }).props === "object";
+}
+
+function collect(value: unknown, into: Set<object>, seen: Set<object>): void {
+  if (typeof value !== "object" || value === null || seen.has(value)) return;
+  seen.add(value);
+  if (isPropertyDeclarable(value)) {
+    into.add(value.props);
+    collect(value.props, into, seen);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) collect(v, into, seen);
+    return;
+  }
+  if (Object.getPrototypeOf(value) === Object.prototype) {
+    for (const v of Object.values(value)) collect(v, into, seen);
+  }
+}
+
+/** Member entity name -> the name of the first declared dashboard holding it. Dashboards and datasources are not members. */
+export function dashboardMembers(entities: Entities): Map<string, string> {
+  const held = new Map<object, string>();
+  for (const [name, e] of entities) {
+    if (e.entityType !== DASHBOARD_TYPE) continue;
+    const props = new Set<object>();
+    collect(e.props, props, new Set());
+    for (const p of props) if (!held.has(p)) held.set(p, name);
+  }
+  const out = new Map<string, string>();
+  for (const [name, e] of entities) {
+    if (e.entityType === DASHBOARD_TYPE) continue;
+    const dashboard = held.get(e.props);
+    if (dashboard !== undefined) out.set(name, dashboard);
+  }
+  return out;
+}
+
+/** Entity types that only ever live inside a dashboard. */
+export function isDashboardPart(entityType: string): boolean {
+  return entityType === ROW_TYPE || [PANEL_TYPE_PREFIX, QUERY_TYPE_PREFIX, VARIABLE_TYPE_PREFIX].some((p) => entityType.startsWith(p));
+}