@intentius/chant-lexicon-grafana 0.98.0 → 0.100.0

package/src/lint/post-synth/index.ts

@@ -7,6 +7,14 @@ import { graf104 } from "./graf104";
 import { graf105 } from "./graf105";
 import { graf106 } from "./graf106";
 import { graf107 } from "./graf107";
+import { graf108 } from "./graf108";
+import { graf109 } from "./graf109";
+import { graf110 } from "./graf110";
+import { graf111 } from "./graf111";
+import { graf112 } from "./graf112";
+import { graf113 } from "./graf113";
+import { graf114 } from "./graf114";
+import { graf115 } from "./graf115";
 
 export const postSynthChecks: PostSynthCheck[] = [
   graf101,
@@ -16,4 +24,12 @@ export const postSynthChecks: PostSynthCheck[] = [
   graf105,
   graf106,
   graf107,
+  graf108,
+  graf109,
+  graf110,
+  graf111,
+  graf112,
+  graf113,
+  graf114,
+  graf115,
 ];

package/src/lint/post-synth/post-synth.test.ts

@@ -1,13 +1,17 @@
 import { describe, expect, test } from "vitest";
+import { readdirSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 import { makePostSynthCtxFromFiles, makePostSynthCtx } from "@intentius/chant-test-utils";
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 import type { Declarable } from "@intentius/chant/declarable";
 import { grafanaSerializer } from "../../serializer";
-import { Datasource } from "../../datasource";
-import { Dashboard } from "../../dashboard";
-import { Row, StatPanel, TimeSeriesPanel, TablePanel } from "../../panels";
-import { PromQuery, TempoQuery } from "../../query";
-import { DatasourceVariable, QueryVariable } from "../../variables";
+import { Datasource, DatasourceProvisioning, ExternalDatasource } from "../../datasource";
+import { Folder } from "../../folder";
+import { Dashboard, DashboardProvider } from "../../dashboard";
+import { HeatmapPanel, Row, StatPanel, TimeSeriesPanel, TablePanel, TextPanel } from "../../panels";
+import { LokiQuery, PromQuery, TempoQuery } from "../../query";
+import { AdhocVariable, CustomVariable, DatasourceVariable, GroupByVariable, IntervalVariable, QueryVariable, SwitchVariable } from "../../variables";
 import { graf101 } from "./graf101";
 import { graf102 } from "./graf102";
 import { graf103 } from "./graf103";
@@ -15,6 +19,15 @@ import { graf104 } from "./graf104";
 import { graf105 } from "./graf105";
 import { graf106 } from "./graf106";
 import { graf107 } from "./graf107";
+import { graf108 } from "./graf108";
+import { graf109 } from "./graf109";
+import { graf110 } from "./graf110";
+import { graf115 } from "./graf115";
+import { panelUnits } from "../../validate-output";
+import { panelsOf } from "../../datasource-refs";
+import { GRAFANA_UNIT_IDS } from "../../spec/units";
+import { prometheusQueries } from "../../promql-check";
+import { knownDatasources } from "../../datasource-refs";
 
 /** Serialize entities the way a build does and hand the files to the harness. */
 function ctxOf(entities: Record<string, Declarable>) {
@@ -72,10 +85,65 @@ describe("GRAF101: undeclared datasource", () => {
     expect(graf101.check(ctxOf({ prometheus, tempo, d }))).toEqual([]);
   });
 
-  test("is silent when the build declares no datasource (another build root, chant #1939)", () => {
+  test("warns once per dashboard when the build declares no datasource, so nothing can be checked", () => {
     const panel = new StatPanel({ datasource: { type: "prometheus", uid: "elsewhere" }, targets: [up] });
+    const other = new StatPanel({ datasource: { type: "prometheus", uid: "elsewhere" }, targets: [up] });
+    const diags = graf101.check(ctxOf({ d: new Dashboard({ title: "D", panels: [panel, other] }) }));
+    expect(diags.map((d) => [d.checkId, d.severity])).toEqual([["GRAF101", "warning"]]);
+    expect(diags[0].message).toContain('datasource uid "elsewhere"');
+    expect(diags[0].message).toContain("ExternalDatasource");
+  });
+
+  test("says nothing when the build declares no datasource and the dashboard names none", () => {
+    const panel = new TextPanel({ options: { content: "hi", mode: "markdown" } });
     expect(graf101.check(ctxOf({ d: new Dashboard({ title: "D", panels: [panel] }) }))).toEqual([]);
   });
+
+  test("resolves entity and { type, uid } refs to an ExternalDatasource, and never provisions it", () => {
+    const mimir = new ExternalDatasource({ type: "prometheus", uid: "mimir", name: "Mimir" });
+    const d = new Dashboard({
+      title: "D",
+      panels: [new StatPanel({ datasource: mimir, targets: [up] }), new StatPanel({ datasource: { type: "prometheus", uid: "mimir" }, targets: [up] })],
+      variables: [new QueryVariable({ name: "job", datasource: mimir, query: "label_values(job)" })],
+    });
+    const entities = { mimir, prometheus, d };
+    expect(graf101.check(ctxOf(entities))).toEqual([]);
+    expect(graf102.check(ctxOf(entities))).toEqual([]);
+    const out = grafanaSerializer.serialize(new Map(Object.entries(entities))) as { primary: string; files: Record<string, string> };
+    expect(out.files["provisioning/datasources/chant.yaml"]).not.toContain("mimir");
+    expect(JSON.parse(out.primary).externalDatasources).toEqual([{ type: "prometheus", uid: "mimir", name: "Mimir" }]);
+  });
+
+  test("an ExternalDatasource alone is enough to check references", () => {
+    const mimir = new ExternalDatasource({ type: "prometheus", uid: "mimir" });
+    const d = new Dashboard({ title: "D", panels: [new StatPanel({ datasource: { type: "prometheus", uid: "typo" }, targets: [up] })] });
+    const diags = graf101.check(ctxOf({ mimir, d }));
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual([
+      ["GRAF101", "error"],
+      ["GRAF101", "error"],
+    ]);
+    expect(diags[0].message).toContain('Declared: "mimir"');
+  });
+
+  test("flags a DatasourceVariable whose plugin type no declared datasource has", () => {
+    const ds = new DatasourceVariable({ name: "logs", pluginType: "loki" });
+    const diags = graf101.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [ds] }) }));
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual([["GRAF101", "error"]]);
+    expect(diags[0].message).toContain('variable "logs" chooses among loki datasources');
+  });
+
+  test("passes a DatasourceVariable whose plugin type only an ExternalDatasource has", () => {
+    const ds = new DatasourceVariable({ name: "logs", pluginType: "loki" });
+    const loki = new ExternalDatasource({ type: "loki", uid: "loki-prod" });
+    expect(graf101.check(ctxOf({ prometheus, loki, d: new Dashboard({ title: "D", variables: [ds] }) }))).toEqual([]);
+  });
+
+  test("counts a DatasourceVariable in the no-datasource warning", () => {
+    const ds = new DatasourceVariable({ name: "logs", pluginType: "loki" });
+    const diags = graf101.check(ctxOf({ d: new Dashboard({ title: "D", variables: [ds] }) }));
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual([["GRAF101", "warning"]]);
+    expect(diags[0].message).toContain("datasource variables of type loki");
+  });
 });
 
 describe("GRAF102: datasource type mismatch", () => {
@@ -95,6 +163,13 @@ describe("GRAF102: datasource type mismatch", () => {
     expect(diags[0].message).toContain('variable "ds" chooses among loki');
   });
 
+  test("checks a ref's type against an ExternalDatasource", () => {
+    const traces = new ExternalDatasource({ type: "tempo", uid: "traces", name: "Traces" });
+    const panel = new StatPanel({ datasource: { type: "prometheus", uid: "traces" }, targets: [up] });
+    const diags = graf102.check(ctxOf({ traces, d: new Dashboard({ title: "D", panels: [panel] }) }));
+    expect(diags[0].message).toContain('external datasource "Traces", which is tempo');
+  });
+
   test("passes matching types", () => {
     expect(graf102.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels: [new StatPanel({ datasource: prometheus, targets: [up] })] }) }))).toEqual([]);
   });
@@ -121,6 +196,18 @@ describe("GRAF103: undeclared variables", () => {
   });
 });
 
+describe("GRAF101, GRAF103 on ad hoc and group by variables", () => {
+  test("checks an ad hoc or group by variable's datasource like a query variable's", () => {
+    const d = dashboardJson([], [
+      { type: "adhoc", name: "f", datasource: { type: "prometheus", uid: "gone" }, filters: [] },
+      { type: "groupby", name: "by", datasource: { type: "prometheus", uid: "${nope}" } },
+    ]);
+    const ctx = ctxOfJson(d, [{ name: "Prometheus", type: "prometheus", uid: "prom" }]);
+    expect(graf101.check(ctx).map((x) => x.message)).toEqual([expect.stringContaining('variable "f" uses datasource uid "gone"')]);
+    expect(graf103.check(ctx).map((x) => x.message)).toEqual([expect.stringContaining('variable "by" datasource uses $nope')]);
+  });
+});
+
 describe("GRAF104: duplicates", () => {
   test("flags duplicate dashboard uids, datasource names and panel ids", () => {
     const again = new Datasource({ name: "Prometheus", type: "prometheus", uid: "prom-2" });
@@ -180,6 +267,18 @@ describe("GRAF105: grid", () => {
   });
 });
 
+describe("GRAF104 and GRAF106 on external datasources", () => {
+  test("flags an ExternalDatasource sharing a uid with a provisioned one", () => {
+    const clash = new ExternalDatasource({ type: "prometheus", uid: "prometheus" });
+    expect(graf104.check(ctxOf({ prometheus, clash })).map((d) => d.message)).toEqual([expect.stringContaining('2 datasources share the uid "prometheus"')]);
+  });
+
+  test("flags an ExternalDatasource uid Grafana rejects", () => {
+    const bad = new ExternalDatasource({ type: "prometheus", uid: "has space" });
+    expect(graf106.check(ctxOf({ bad })).map((d) => d.message)).toEqual([expect.stringContaining('ExternalDatasource "has space"')]);
+  });
+});
+
 describe("GRAF106: uids and titles", () => {
   test("flags an over-long uid, a bad datasource uid and an empty title", () => {
     const bad = new Datasource({ name: "Bad", type: "prometheus", uid: "has space" });
@@ -197,17 +296,17 @@ describe("GRAF106: uids and titles", () => {
 });
 
 describe("GRAF107: the pinned schema", () => {
-  test("flags an unknown dashboard key, a bad panel option and an unknown query field", () => {
+  test("warns about an unknown dashboard key and query field, and fails a bad panel option", () => {
     const dash = dashboardJson(
       [panelJson({ options: { graphMode: "sparkline" }, datasource: { type: "prometheus", uid: "p" }, targets: [{ refId: "A", expr: "up", exprr: "typo" }] })],
       [],
       { owner: "team-a" },
     );
-    const messages = graf107.check(ctxOfJson(dash)).map((d) => d.message);
-    expect(messages).toEqual([
-      expect.stringContaining('must NOT have additional properties ("owner")'),
-      expect.stringContaining("/panels/0/options/graphMode: must be equal to one of the allowed values"),
-      expect.stringContaining('/panels/0/targets/0: must NOT have additional properties ("exprr")'),
+    const diags = graf107.check(ctxOfJson(dash)).map((d) => [d.severity, d.message]);
+    expect(diags).toEqual([
+      ["warning", expect.stringContaining('/: unknown key "owner" (not in the pinned schema)')],
+      ["error", expect.stringContaining("/panels/0/options/graphMode: must be equal to one of the allowed values")],
+      ["warning", expect.stringContaining('/panels/0/targets/0: unknown key "exprr" (not in the pinned schema)')],
     ]);
   });
 
@@ -229,3 +328,225 @@ describe("GRAF107: the pinned schema", () => {
     expect(graf107.check(ctx).map((d) => d.checkId)).toEqual(["GRAF107"]);
   });
 });
+
+describe("GRAF108: PromQL syntax", () => {
+  const loki = new Datasource({ name: "Loki", type: "loki" });
+
+  test("flags the unbalanced expression from the issue (#2955)", () => {
+    const cluster = new QueryVariable({ name: "cluster", datasource: prometheus, query: "label_values(up, cluster)" });
+    const panel = new StatPanel({ title: "Up", datasource: prometheus, targets: [new PromQuery({ expr: 'sum(x{cluster="$cluster"}' })] });
+    const diags = graf108.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [cluster], panels: [panel] }) }));
+    expect(diags.map((d) => [d.checkId, d.severity])).toEqual([["GRAF108", "error"]]);
+    expect(diags[0].message).toContain('panel "Up"');
+    expect(diags[0].message).toContain("query A is not valid PromQL: the expression ends early");
+  });
+
+  test("flags a query variable and a panel query inheriting a Prometheus datasource variable", () => {
+    const ds = new DatasourceVariable({ name: "ds", pluginType: "prometheus" });
+    const job = new QueryVariable({ name: "job", datasource: prometheus, query: 'label_values(up{env="prod", job, instance)' });
+    const panel = new TimeSeriesPanel({ title: "Rate", datasource: ds, targets: [new PromQuery({ expr: "rate(http_requests_total[5 m])" })] });
+    const messages = graf108.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [ds, job], panels: [panel] }) })).map((d) => d.message);
+    expect(messages).toEqual([expect.stringContaining('panel "Rate" (id 1) query A is not valid PromQL'), expect.stringContaining('variable "job" query is not valid PromQL')]);
+  });
+
+  test("passes template variables and Grafana's macros where Prometheus would see a value", () => {
+    const route = new QueryVariable({ name: "route", datasource: prometheus, query: 'label_values(http_requests_total{job="$job"}, route)' });
+    const job = new QueryVariable({ name: "job", datasource: prometheus, query: "label_values(up, job)" });
+    const exprs = [
+      'sum by (le) (rate(http_request_duration_seconds_bucket{route=~"$route"}[$__rate_interval]))',
+      'sum(increase(http_requests_total{job="${job}"}[$__range])) / $__range_s',
+      'rate(http_requests_total{job=~"[[job]]"}[$__interval]) offset $__interval',
+    ];
+    const panel = new TimeSeriesPanel({ datasource: prometheus, targets: exprs.map((expr) => new PromQuery({ expr })) });
+    expect(graf108.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [job, route], panels: [panel] }) }))).toEqual([]);
+  });
+
+  test("leaves LogQL, TraceQL and queries of unknown destination alone", () => {
+    const logs = new StatPanel({ datasource: loki, targets: [new LokiQuery({ expr: '{app="x"} |= "error" | json' })] });
+    const traces = new TablePanel({ datasource: tempo, targets: [new TempoQuery({ query: "{ .status = error }" })] });
+    const d = new Dashboard({ title: "D", panels: [logs, traces] });
+    expect(graf108.check(ctxOf({ loki, tempo, d }))).toEqual([]);
+    // No datasource anywhere: Grafana sends it to its default, whatever that is.
+    const unknown = dashboardJson([panelJson({ targets: [{ refId: "A", expr: "sum(" }] })]);
+    expect(graf108.check(ctxOfJson(unknown))).toEqual([]);
+  });
+
+  test("checks refs to a Prometheus the build does not declare, by the ref's own type", () => {
+    const dash = dashboardJson([panelJson({ datasource: { type: "prometheus", uid: "elsewhere" }, targets: [{ refId: "A", expr: "sum(up" }] })]);
+    expect(ids(graf108, ctxOfJson(dash))).toEqual([["GRAF108", "error"]]);
+  });
+});
+
+describe("GRAF110: repeats", () => {
+  test("flags a repeat over a variable Grafana cannot repeat over, and over one that holds one value", () => {
+    const ds = new DatasourceVariable({ name: "ds", pluginType: "prometheus" });
+    const w = new IntervalVariable({ name: "w", values: ["1m", "5m"] });
+    const on = new SwitchVariable({ name: "on" });
+    const f = new AdhocVariable({ name: "f", datasource: ds });
+    const env = new CustomVariable({ name: "env", values: ["a", "b"] });
+    const panels = [new StatPanel({ title: "by w", repeat: w }), new StatPanel({ title: "by on", repeat: on }), new StatPanel({ title: "by f", repeat: f }), new StatPanel({ title: "by env", repeat: env })];
+    const diags = graf110.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [ds, w, on, f, env], panels }) }));
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual(Array(4).fill(["GRAF110", "warning"]));
+    expect(diags.map((x) => x.message)).toEqual([
+      expect.stringContaining('panel "by w" (id 1) repeats over $w, an interval variable, which Grafana cannot repeat over'),
+      expect.stringContaining("repeats over $on, a switch variable"),
+      expect.stringContaining("repeats over $f, an ad hoc variable"),
+      expect.stringContaining("repeats over $env, a custom variable with neither multi nor includeAll"),
+    ]);
+  });
+
+  test("checks a row's repeat too", () => {
+    const env = new CustomVariable({ name: "env", values: ["a", "b"] });
+    const row = new Row({ title: "Per env", repeat: env, panels: [new StatPanel({ title: "s" })] });
+    expect(graf110.check(ctxOf({ d: new Dashboard({ title: "D", variables: [env], panels: [row] }) })).map((x) => x.message)).toEqual([
+      expect.stringContaining('row "Per env" repeats over $env'),
+    ]);
+  });
+
+  test("passes a multi-value or include-all variable, a group by variable, and leaves an undeclared one to GRAF103", () => {
+    const env = new CustomVariable({ name: "env", values: ["a", "b"], multi: true });
+    const job = new QueryVariable({ name: "job", datasource: prometheus, query: { query: "label_values(up, job)", qryType: 1 }, includeAll: true });
+    const ds = new DatasourceVariable({ name: "ds", pluginType: "prometheus", multi: true });
+    const by = new GroupByVariable({ name: "by", datasource: prometheus });
+    const panels = [env, job, ds, by].map((v) => new StatPanel({ title: v.variableName, repeat: v }));
+    panels.push(new StatPanel({ title: "gone", repeat: "gone" }));
+    expect(graf110.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [env, job, ds, by], panels }) }))).toEqual([]);
+  });
+});
+
+describe("GRAF108 on object-form variable queries", () => {
+  test("parses the query text of an object query sent to Prometheus", () => {
+    const ds = new DatasourceVariable({ name: "ds", pluginType: "prometheus" });
+    const bad = new QueryVariable({ name: "bad", datasource: ds, query: { qryType: 1, query: 'label_values(up{job="x", instance)', refId: "PrometheusVariableQueryEditor-VariableQuery" } });
+    const good = new QueryVariable({ name: "good", datasource: ds, query: { qryType: 4, query: 'kube_pod_info{namespace=~"$ns"}' } });
+    const ns = new CustomVariable({ name: "ns", values: ["a"] });
+    const diags = graf108.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", variables: [ds, ns, bad, good] }) }));
+    expect(diags.map((x) => x.message)).toEqual([expect.stringContaining('variable "bad" query is not valid PromQL')]);
+  });
+});
+
+describe("GRAF108 over real Grafana exports", () => {
+  const exportsDir = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "test", "fixtures", "exports");
+  const files = readdirSync(exportsDir)
+    .filter((d) => d.startsWith("grafana-"))
+    .flatMap((v) => readdirSync(join(exportsDir, v)).filter((f) => f.endsWith(".json") && !f.includes("-resource")).map((f) => `${v}/${f}`));
+
+  test.each(files)("%s has no GRAF108 errors", (name) => {
+    const text = readFileSync(join(exportsDir, name), "utf-8");
+    // Non-vacuous: every export in the corpus sends PromQL to a Prometheus.
+    expect(prometheusQueries(JSON.parse(text), knownDatasources([])).length).toBeGreaterThan(0);
+    expect(graf108.check(makePostSynthCtxFromFiles("grafana", { [name]: text }, "{}"))).toEqual([]);
+  });
+});
+
+describe("GRAF115: units", () => {
+  test("flags the units from the issue (#2954) and suggests the id meant", () => {
+    const bytes = new StatPanel({ title: "Memory", datasource: prometheus, targets: [up], fieldConfig: { defaults: { unit: "byte" } } });
+    const cores = new TimeSeriesPanel({ title: "CPU", datasource: prometheus, targets: [up], fieldConfig: { defaults: { unit: "cores" } } });
+    const diags = graf115.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels: [bytes, cores] }) }));
+    expect(diags.map((d) => [d.checkId, d.severity])).toEqual([
+      ["GRAF115", "warning"],
+      ["GRAF115", "warning"],
+    ]);
+    expect(diags[0].message).toContain('panel "Memory" (id 1) fieldConfig.defaults.unit: unit "byte" is not one Grafana knows');
+    expect(diags[0].message).toContain('Did you mean "bytes"?');
+    expect(diags[1].message).not.toContain("Did you mean");
+    expect(diags[1].message).toContain('"suffix:cores"');
+  });
+
+  test("passes registered ids, the legacy alias, an empty unit and every custom-unit syntax", () => {
+    const units = ["bytes", "s", "percentunit", "reqps", "currencyEUR", "farenheit", "", "suffix: cores", "prefix:$", "time:YYYY-MM-DD", "si:mF", "count:reqs", "currency:financial:€:suffix", "bool:up/down"];
+    const panels = units.map((unit) => new StatPanel({ datasource: prometheus, targets: [up], fieldConfig: { defaults: { unit } } }));
+    expect(graf115.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels }) }))).toEqual([]);
+  });
+
+  test("checks overrides, heatmap axes and cells, legacy y-axes and library panels", () => {
+    const heat = new HeatmapPanel({ title: "Heat", datasource: prometheus, targets: [up], options: { yAxis: { unit: "sec" }, cellValues: { unit: "Short" } } });
+    const table = new TablePanel({
+      title: "T",
+      datasource: prometheus,
+      targets: [up],
+      fieldConfig: { overrides: [{ matcher: { id: "byName", options: "x" }, properties: [{ id: "decimals", value: 2 }, { id: "unit", value: "celcius" }] }] },
+    });
+    const messages = graf115.check(ctxOf({ prometheus, d: new Dashboard({ title: "D", panels: [heat, table] }) })).map((d) => d.message);
+    expect(messages).toEqual([
+      expect.stringContaining('options.yAxis.unit: unit "sec"'),
+      expect.stringContaining('options.cellValues.unit: unit "Short" is not one Grafana knows, so it is shown as a literal suffix. Did you mean "short"?'),
+      expect.stringContaining('fieldConfig.overrides[0].properties[1]: unit "celcius" is not one Grafana knows, so it is shown as a literal suffix. Did you mean "celsius"?'),
+    ]);
+
+    const graph = panelJson({ type: "graph", yaxes: [{ format: "bytes" }, { format: "ops/s" }] });
+    const lib = panelJson({ fieldConfig: { defaults: { unit: "req/s" }, overrides: [] } });
+    const dash = dashboardJson([graph], [], { __elements: { lib: { kind: 1, model: lib } } });
+    expect(graf115.check(ctxOfJson(dash)).map((d) => d.message)).toEqual([
+      expect.stringContaining('panel "p" (id 1) yaxes[1].format: unit "ops/s"'),
+      expect.stringContaining('library panel "lib" fieldConfig.defaults.unit: unit "req/s"'),
+    ]);
+  });
+
+  test("the vendored registry is Grafana v13.2.2's", () => {
+    expect(GRAFANA_UNIT_IDS.length).toBe(274);
+    expect(GRAFANA_UNIT_IDS).toEqual(expect.arrayContaining(["none", "bytes", "decbytes", "reqps", "ms", "percentunit", "celsius", "currencyUSD", "dateTimeAsIso", "h"]));
+    expect(GRAFANA_UNIT_IDS).not.toContain("byte");
+  });
+});
+
+describe("GRAF115 over real Grafana exports and community dashboards", () => {
+  const fixtures = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "test", "fixtures");
+  const exportsDir = join(fixtures, "exports");
+  const files = [
+    ...readdirSync(exportsDir)
+      .filter((d) => d.startsWith("grafana-"))
+      .flatMap((v) => readdirSync(join(exportsDir, v)).filter((f) => f.endsWith(".json") && !f.includes("-resource")).map((f) => `exports/${v}/${f}`)),
+    ...readdirSync(join(fixtures, "community"))
+      .filter((f) => f.endsWith(".json"))
+      .map((f) => `community/${f}`),
+  ];
+  let unitsSeen = 0;
+
+  test.each(files)("%s has no GRAF115 warnings", (name) => {
+    const text = readFileSync(join(fixtures, name), "utf-8");
+    unitsSeen += panelsOf(JSON.parse(text)).flatMap(({ panel }) => panelUnits(panel)).length;
+    expect(graf115.check(makePostSynthCtxFromFiles("grafana", { [name]: text }, "{}"))).toEqual([]);
+  });
+
+  // Non-vacuous: the corpus sets hundreds of units between them.
+  test("the corpus sets units", () => {
+    expect(unitsSeen).toBeGreaterThan(200);
+  });
+});
+
+describe("annotations, folders and datasource deletes (#2953)", () => {
+  const deploys = (datasource: unknown, extra: Record<string, unknown> = {}) => ({ name: "Deploys", datasource, ...extra }) as never;
+
+  test("GRAF101 flags an annotation on an undeclared datasource, GRAF102 one of another type", () => {
+    const d = new Dashboard({ title: "D", annotations: [deploys({ type: "prometheus", uid: "gone" })] });
+    expect(ids(graf101, ctxOf({ prometheus, d }))).toEqual([["GRAF101", "error"]]);
+    const t = new Dashboard({ title: "T", annotations: [deploys({ type: "loki", uid: "prometheus" })] });
+    expect(ids(graf102, ctxOf({ prometheus, t }))).toEqual([["GRAF102", "error"]]);
+    expect(ids(graf101, ctxOf({ prometheus, ok: new Dashboard({ title: "O", annotations: [deploys(prometheus)] }) }))).toEqual([]);
+  });
+
+  test("GRAF101 flags an ExternalDatasource the provisioning file deletes", () => {
+    const old = new ExternalDatasource({ type: "prometheus", uid: "old", name: "Old" });
+    const d = new Dashboard({ title: "D", panels: [new StatPanel({ datasource: old, targets: [up] })] });
+    const diags = graf101.check(ctxOf({ prometheus, old, d, settings: new DatasourceProvisioning({ deleteDatasources: [{ name: "Old" }] }) }));
+    // The panel's own ref and its query's, as for any undeclared datasource.
+    expect(diags.map((x) => [x.checkId, x.severity])).toEqual([["GRAF101", "error"], ["GRAF101", "error"]]);
+    expect(diags[0].message).toContain("deleteDatasources");
+  });
+
+  test("GRAF103 reads an annotation's query and datasource; GRAF108 parses its PromQL", () => {
+    const d = new Dashboard({ title: "D", annotations: [deploys(prometheus, { expr: "changes(up{job=\"$job\"}[5m] > 0" })] });
+    expect(ids(graf103, ctxOf({ prometheus, d }))).toEqual([["GRAF103", "error"]]);
+    expect(ids(graf108, ctxOf({ prometheus, d }))).toEqual([["GRAF108", "error"]]);
+  });
+
+  test("GRAF104 flags two folders with one uid; GRAF106 a folder uid Grafana refuses", () => {
+    const two = ctxOf({ a: new Dashboard({ title: "A", folder: "Team A" }), b: new Dashboard({ title: "B", folder: "team-a" }) });
+    expect(ids(graf104, two)).toEqual([["GRAF104", "error"]]);
+    expect(ids(graf106, ctxOf({ g: new Dashboard({ title: "G", folder: "General" }) }))).toEqual([["GRAF106", "error"]]);
+    expect(ids(graf106, ctxOf({ f: new Folder({ title: "F", uid: "not a uid" }) }))).toEqual([["GRAF106", "error"]]);
+    expect(ids(graf106, ctxOf({ f: new Folder({ title: "F" }), d: new Dashboard({ title: "D", folder: "F/G" }) }))).toEqual([]);
+  });
+});

package/src/lint/rules/literal-secret.ts

@@ -1,15 +1,38 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import { constInitializers, constructorArgs, literalText, position, propertyName, resolveObject } from "./grafana-ast";
+import { CONTACT_POINT_SECRET_SETTINGS, EXPANDED_VALUE as EXPANDED } from "../../contact-point-secrets";
 
-/** How Grafana provisioning reads a value from outside the file: `$VAR`, `${VAR}`, `$__env{…}`, `$__file{…}`, `$__vault{…}`. */
-const EXPANDED = /\$(\{[A-Za-z_][A-Za-z0-9_]*\}|[A-Za-z_][A-Za-z0-9_]*|__(env|file|vault)\{[^}]+\})/;
+/** Follow an identifier to the array literal it was declared as, when it is one in this file. */
+function resolveArray(node: ts.Expression, consts: Map<string, ts.Expression>, depth = 0): ts.ArrayLiteralExpression | undefined {
+  let n: ts.Expression = node;
+  while (ts.isAsExpression(n) || ts.isSatisfiesExpression(n) || ts.isParenthesizedExpression(n)) n = n.expression;
+  if (ts.isArrayLiteralExpression(n)) return n;
+  if (ts.isIdentifier(n) && depth < 5) {
+    const init = consts.get(n.text);
+    if (init) return resolveArray(init, consts, depth + 1);
+  }
+  return undefined;
+}
+
+/** The value of a property, `name: value` or the shorthand `name` (followed as an identifier). */
+function prop(obj: ts.ObjectLiteralExpression, name: string): ts.Expression | undefined {
+  for (const p of obj.properties) {
+    if (propertyName(p) === name) return (p as ts.PropertyAssignment).initializer;
+    if (ts.isShorthandPropertyAssignment(p) && p.name.text === name) return p.name;
+  }
+  return undefined;
+}
 
 /**
- * GRAF002: a datasource secret written as a literal.
+ * GRAF002: a datasource or contact point secret written as a literal.
  *
- * `secureJsonData` holds passwords, tokens and TLS keys. A literal there is a
- * secret in the repository and in the emitted provisioning file. Grafana
+ * A datasource's `secureJsonData` holds passwords, tokens and TLS keys, and
+ * so do the settings Grafana stores encrypted for each contact point
+ * integration (a Slack webhook `url`, a PagerDuty `integrationKey`, a
+ * webhook's `authorization_credentials`; see `CONTACT_POINT_SECRET_SETTINGS`).
+ * A literal there is a secret in the repository and in the emitted
+ * provisioning file. Grafana
  * expands `$__env{NAME}`, `$__file{/path}` and `${NAME}` when it reads the
  * file, so the declaration never needs the value. A value written as a
  * named `const` in the same file is followed.
@@ -18,7 +41,7 @@ export const literalSecretRule: LintRule = {
   id: "GRAF002",
   severity: "error",
   category: "security",
-  description: "Datasource secureJsonData value declared as a literal instead of $__env{...} or $__file{...}",
+  description: "Datasource secureJsonData or contact point secret setting declared as a literal instead of $__env{...} or $__file{...}",
 
   check(context: LintContext): LintDiagnostic[] {
     const diagnostics: LintDiagnostic[] = [];
@@ -43,6 +66,37 @@ export const literalSecretRule: LintRule = {
         }
       }
     }
+    for (const { arg } of constructorArgs(source, (n) => n === "ContactPoint")) {
+      const receivers = prop(arg, "receivers");
+      const list = receivers ? resolveArray(receivers, consts) : undefined;
+      for (const el of list?.elements ?? []) {
+        const receiver = resolveObject(el as ts.Expression, consts);
+        if (!receiver) continue;
+        const typeNode = prop(receiver, "type");
+        const type = typeNode ? literalText(typeNode) : undefined;
+        const settingsNode = prop(receiver, "settings");
+        const settings = settingsNode ? resolveObject(settingsNode, consts) : undefined;
+        if (!type || !settings) continue;
+        for (const path of CONTACT_POINT_SECRET_SETTINGS[type] ?? []) {
+          let node: ts.ObjectLiteralExpression | undefined = settings;
+          const segments = path.split(".");
+          for (const seg of segments.slice(0, -1)) {
+            const next: ts.Expression | undefined = node ? prop(node, seg) : undefined;
+            node = next ? resolveObject(next, consts) : undefined;
+          }
+          const valueNode = node ? prop(node, segments[segments.length - 1]) : undefined;
+          const text = valueNode ? literalText(valueNode) : undefined;
+          if (!valueNode || text === undefined || text === "" || EXPANDED.test(text)) continue;
+          diagnostics.push({
+            ruleId: "GRAF002",
+            severity: "error",
+            message: `${type} contact point setting ${path} is a literal secret; write "$__env{NAME}" or "$__file{/path}" and let Grafana read it`,
+            file: context.filePath,
+            ...position(source, valueNode),
+          });
+        }
+      }
+    }
     return diagnostics;
   },
 };

package/src/lint/rules/rules.test.ts

@@ -67,4 +67,31 @@ describe("GRAF002 literal secret", () => {
     );
     expect(diags).toEqual([]);
   });
+
+  test("flags a contact point's secret setting written as a literal, inline or through consts", () => {
+    const diags = literalSecretRule.check(
+      ctx(`
+        new ContactPoint({ name: "oncall", receivers: [{ type: "slack", settings: { url: "https://hooks.slack.com/services/T/B/X", recipient: "#c" } }] });
+        const pd = { integrationKey: "abc123" };
+        const receivers = [{ type: "pagerduty", settings: pd }, { type: "webhook", settings: { url: "https://x", tlsConfig: { clientKey: "-----BEGIN" } } }];
+        new ContactPoint({ name: "pager", receivers });
+      `),
+    );
+    expect(diags.map((d) => d.message)).toEqual([
+      expect.stringContaining("slack contact point setting url"),
+      expect.stringContaining("pagerduty contact point setting integrationKey"),
+      expect.stringContaining("webhook contact point setting tlsConfig.clientKey"),
+    ]);
+  });
+
+  test("accepts expanded contact point secrets, and settings that are not secret", () => {
+    const diags = literalSecretRule.check(
+      ctx(`
+        new ContactPoint({ name: "oncall", receivers: [{ type: "slack", settings: { url: "$__env{SLACK_URL}", recipient: "#c" } }] });
+        new ContactPoint({ name: "hook", receivers: [{ type: "webhook", settings: { url: "https://tickets.example.com", authorization_credentials: "\${TOKEN}" } }] });
+        new ContactPoint({ name: "mail", receivers: [{ type: "email", settings: { addresses: "a@example.com" } }] });
+      `),
+    );
+    expect(diags).toEqual([]);
+  });
 });

package/src/load-cost.test.ts

@@ -0,0 +1,35 @@
+/**
+ * Importing the lexicon must not pay for schema validation (#2958): ajv
+ * loads the first time a schema is checked, and the schemas come from the
+ * generated `spec/schemas.gen.ts`, not from files beside the source.
+ */
+
+import { describe, expect, test } from "vitest";
+import { execFileSync } from "child_process";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { SCHEMA_NAMES } from "./pin";
+import { loadSchema } from "./spec/schemas";
+import { bundledSchema, schemaValidationUnavailable } from "./schema-validate";
+
+const srcDir = dirname(fileURLToPath(import.meta.url));
+const tsx = join(srcDir, "..", "..", "..", "node_modules", ".bin", "tsx");
+
+/** How many ajv modules a fresh process has loaded after importing `entries`. */
+function ajvModulesAfterImporting(...entries: string[]): number {
+  const imports = entries.map((e) => `import(${JSON.stringify(join(srcDir, e))})`).join(", ");
+  const script = `Promise.all([${imports}]).then(() => console.log(Object.keys(require.cache).filter((k) => k.includes("/ajv/")).length))`;
+  return Number(execFileSync(tsx, ["-e", script], { encoding: "utf-8" }).trim());
+}
+
+describe("load cost", () => {
+  test("importing the package root, its plugin or the validation subpath does not load ajv", () => {
+    // index.ts imports plugin.ts, whose post-synth checks reach schema-validate.ts.
+    expect(ajvModulesAfterImporting("index.ts", "validation.ts")).toBe(0);
+  });
+
+  test("validation reads the overlaid schemas from the generated module", () => {
+    expect(schemaValidationUnavailable()).toBeUndefined();
+    for (const name of SCHEMA_NAMES) expect(bundledSchema(name)).toEqual(loadSchema(name));
+  });
+});

package/src/lsp/completions.test.ts

@@ -14,6 +14,11 @@ describe("grafana LSP completions", () => {
     expect(items.map((i) => i.label)).toContain("TimeSeriesPanel");
   });
 
+  it("offers every panel class sharing a prefix", () => {
+    const items = completions({ uri: "file:///d.ts", content: "new Sta", position: { line: 0, character: 7 }, wordAtCursor: "Sta", linePrefix: "new Sta" });
+    expect(items.map((i) => i.label)).toEqual(expect.arrayContaining(["StatPanel", "StateTimelinePanel", "StatusHistoryPanel"]));
+  });
+
   it("offers the query classes by prefix", () => {
     const items = completions({
       uri: "file:///q.ts",

package/src/lsp/hover.test.ts

@@ -14,6 +14,13 @@ describe("grafana LSP hover", () => {
     expect(info?.contents).toContain("Panel plugin `stat`");
   });
 
+  it("names the schema a panel's options come from, or that there is none", () => {
+    const at = (word: string) => hover({ uri: "file:///d.ts", content: `new ${word}({})`, position: { line: 0, character: 6 }, word, lineText: `new ${word}({})` })?.contents;
+    expect(at("NodeGraphPanel")).toContain("Panel plugin `nodeGraph`. Options typed from");
+    expect(at("NodeGraphPanel")).toContain("(`nodegraph`)");
+    expect(at("AlertListPanel")).toContain("Grafana publishes no options schema for it");
+  });
+
   it("describes a query and its datasource type", () => {
     const info = hover({ uri: "file:///q.ts", content: "new TempoQuery({})", position: { line: 0, character: 6 }, word: "TempoQuery", lineText: "new TempoQuery({})" });
     expect(info?.contents).toContain("`tempo` datasources");