@intentius/chant-lexicon-grafana 0.99.0 → 0.100.0

package/src/schema/googlecloudmonitoring.gen.ts

@@ -0,0 +1,330 @@
+// Code generated by chant generate from the vendored Grafana schema
+// src/spec/schemas/googlecloudmonitoring.jsonschema.json (see src/pin.ts) and its correction
+// overlay in src/spec/overlay/ (see src/spec/overlay.ts). DO NOT EDIT.
+/* eslint-disable */
+
+export interface CloudMonitoringQuery {
+  /**
+   * A unique identifier for the query within the list of targets.
+   * In server side expressions, the refId is used as a variable name to identify results.
+   * By default, the UI will assign A->Z; however setting meaningful names may be useful.
+   */
+  refId?: string | null;
+  /**
+   * If hide is set to true, Grafana will filter out the response(s) associated with this query before returning it to the panel.
+   */
+  hide?: boolean;
+  /**
+   * Specify the query flavor
+   * TODO make this required and give it a default
+   */
+  queryType?: string;
+  /**
+   * Aliases can be set to modify the legend labels. e.g. {{metric.label.xxx}}. See docs for more detail.
+   */
+  aliasBy?: string;
+  /**
+   * GCM query type.
+   * queryType: #QueryType
+   * Time Series List sub-query properties.
+   */
+  timeSeriesList?: TimeSeriesList;
+  /**
+   * Time Series sub-query properties.
+   */
+  timeSeriesQuery?: TimeSeriesQuery;
+  /**
+   * SLO sub-query properties.
+   */
+  sloQuery?: SLOQuery;
+  /**
+   * PromQL sub-query properties.
+   */
+  promQLQuery?: PromQLQuery;
+  /**
+   * For mixed data sources the selected datasource is on the query level.
+   * For non mixed scenarios this is undefined.
+   * TODO find a better way to do this ^ that's friendly to schema
+   * TODO this shouldn't be unknown but DataSourceRef | null
+   */
+  datasource?: DataSourceRef;
+  /**
+   * Time interval in milliseconds.
+   */
+  intervalMs?: number;
+}
+
+/**
+ * Time Series List sub-query properties.
+ */
+export interface TimeSeriesList {
+  /**
+   * GCP project to execute the query against.
+   */
+  projectName: string;
+  /**
+   * Reducer applied across a set of time-series values. Defaults to REDUCE_NONE.
+   */
+  crossSeriesReducer: string;
+  /**
+   * Alignment period to use when regularizing data. Defaults to cloud-monitoring-auto.
+   */
+  alignmentPeriod?: string;
+  /**
+   * Alignment function to be used. Defaults to ALIGN_MEAN.
+   */
+  perSeriesAligner?: string;
+  /**
+   * Array of labels to group data by.
+   */
+  groupBys?: string[];
+  /**
+   * Array of filters to query data by. Labels that can be filtered on are defined by the metric.
+   */
+  filters?: string[];
+  /**
+   * Data view, defaults to FULL.
+   */
+  view?: string;
+  /**
+   * Annotation title.
+   */
+  title?: string;
+  /**
+   * Annotation text.
+   */
+  text?: string;
+  /**
+   * Only present if a preprocessor is selected. Reducer applied across a set of time-series values. Defaults to REDUCE_NONE.
+   */
+  secondaryCrossSeriesReducer?: string;
+  /**
+   * Only present if a preprocessor is selected. Alignment period to use when regularizing data. Defaults to cloud-monitoring-auto.
+   */
+  secondaryAlignmentPeriod?: string;
+  /**
+   * Only present if a preprocessor is selected. Alignment function to be used. Defaults to ALIGN_MEAN.
+   */
+  secondaryPerSeriesAligner?: string;
+  /**
+   * Only present if a preprocessor is selected. Array of labels to group data by.
+   */
+  secondaryGroupBys?: string[];
+  /**
+   * Preprocessor is not part of the API, but is used to store the preprocessor and not affect the UI for the rest of parameters
+   */
+  preprocessor?: PreprocessorType;
+}
+
+/**
+ * Types of pre-processor available. Defined by the metric.
+ */
+export type PreprocessorType = "none" | "rate" | "delta";
+
+/**
+ * Time Series sub-query properties.
+ */
+export interface TimeSeriesQuery {
+  /**
+   * GCP project to execute the query against.
+   */
+  projectName: string;
+  /**
+   * MQL query to be executed.
+   */
+  query: string;
+  /**
+   * To disable the graphPeriod, it should explictly be set to 'disabled'.
+   */
+  graphPeriod?: string;
+}
+
+/**
+ * SLO sub-query properties.
+ */
+export interface SLOQuery {
+  /**
+   * GCP project to execute the query against.
+   */
+  projectName: string;
+  /**
+   * Alignment function to be used. Defaults to ALIGN_MEAN.
+   */
+  perSeriesAligner?: string;
+  /**
+   * Alignment period to use when regularizing data. Defaults to cloud-monitoring-auto.
+   */
+  alignmentPeriod?: string;
+  /**
+   * SLO selector.
+   */
+  selectorName: string;
+  /**
+   * ID for the service the SLO is in.
+   */
+  serviceId: string;
+  /**
+   * Name for the service the SLO is in.
+   */
+  serviceName: string;
+  /**
+   * ID for the SLO.
+   */
+  sloId: string;
+  /**
+   * Name of the SLO.
+   */
+  sloName: string;
+  /**
+   * SLO goal value.
+   */
+  goal?: number;
+  /**
+   * Specific lookback period for the SLO.
+   */
+  lookbackPeriod?: string;
+}
+
+/**
+ * PromQL sub-query properties.
+ */
+export interface PromQLQuery {
+  /**
+   * GCP project to execute the query against.
+   */
+  projectName: string;
+  /**
+   * PromQL expression/query to be executed.
+   */
+  expr: string;
+  /**
+   * PromQL min step
+   */
+  step: string;
+}
+
+/**
+ * Defines the supported queryTypes.
+ */
+export type QueryType = "timeSeriesList" | "timeSeriesQuery" | "slo" | "annotation" | "promQL";
+
+/**
+ * @deprecated This type is for migration purposes only. Replaced by TimeSeriesList Metric sub-query properties.
+ */
+export interface MetricQuery {
+  /**
+   * GCP project to execute the query against.
+   */
+  projectName: string;
+  /**
+   * Alignment function to be used. Defaults to ALIGN_MEAN.
+   */
+  perSeriesAligner?: string;
+  /**
+   * Alignment period to use when regularizing data. Defaults to cloud-monitoring-auto.
+   */
+  alignmentPeriod?: string;
+  /**
+   * Aliases can be set to modify the legend labels. e.g. {{metric.label.xxx}}. See docs for more detail.
+   */
+  aliasBy?: string;
+  editorMode: string;
+  metricType: string;
+  /**
+   * Reducer applied across a set of time-series values. Defaults to REDUCE_NONE.
+   */
+  crossSeriesReducer: string;
+  /**
+   * Array of labels to group data by.
+   */
+  groupBys?: string[];
+  /**
+   * Array of filters to query data by. Labels that can be filtered on are defined by the metric.
+   */
+  filters?: string[];
+  metricKind?: MetricKind;
+  valueType?: string;
+  view?: string;
+  /**
+   * MQL query to be executed.
+   */
+  query: string;
+  /**
+   * Preprocessor is not part of the API, but is used to store the preprocessor and not affect the UI for the rest of parameters
+   */
+  preprocessor?: PreprocessorType;
+  /**
+   * To disable the graphPeriod, it should explictly be set to 'disabled'.
+   */
+  graphPeriod?: string;
+}
+
+export type MetricKind = "METRIC_KIND_UNSPECIFIED" | "GAUGE" | "DELTA" | "CUMULATIVE";
+
+export type ValueTypes = "VALUE_TYPE_UNSPECIFIED" | "BOOL" | "INT64" | "DOUBLE" | "STRING" | "DISTRIBUTION" | "MONEY";
+
+export type AlignmentTypes = "ALIGN_DELTA" | "ALIGN_RATE" | "ALIGN_INTERPOLATE" | "ALIGN_NEXT_OLDER" | "ALIGN_MIN" | "ALIGN_MAX" | "ALIGN_MEAN" | "ALIGN_COUNT" | "ALIGN_SUM" | "ALIGN_STDDEV" | "ALIGN_COUNT_TRUE" | "ALIGN_COUNT_FALSE" | "ALIGN_FRACTION_TRUE" | "ALIGN_PERCENTILE_99" | "ALIGN_PERCENTILE_95" | "ALIGN_PERCENTILE_50" | "ALIGN_PERCENTILE_05" | "ALIGN_PERCENT_CHANGE" | "ALIGN_NONE";
+
+/**
+ * @deprecated Use TimeSeriesList instead. Legacy annotation query properties for migration purposes.
+ */
+export interface LegacyCloudMonitoringAnnotationQuery {
+  /**
+   * GCP project to execute the query against.
+   */
+  projectName: string;
+  metricType: string;
+  /**
+   * Query refId.
+   */
+  refId: string;
+  /**
+   * Array of filters to query data by. Labels that can be filtered on are defined by the metric.
+   */
+  filters: string[];
+  metricKind: MetricKind;
+  valueType: string;
+  /**
+   * Annotation title.
+   */
+  title: string;
+  /**
+   * Annotation text.
+   */
+  text: string;
+}
+
+/**
+ * Query filter representation.
+ */
+export interface Filter {
+  /**
+   * Filter key.
+   */
+  key: string;
+  /**
+   * Filter operator.
+   */
+  operator: string;
+  /**
+   * Filter value.
+   */
+  value: string;
+  /**
+   * Filter condition.
+   */
+  condition?: string;
+}
+
+export type MetricFindQueryTypes = "projects" | "services" | "defaultProject" | "metricTypes" | "labelKeys" | "labelValues" | "resourceTypes" | "aggregations" | "aligners" | "alignmentPeriods" | "selectors" | "sloServices" | "slo";
+
+export interface DataSourceRef {
+  /**
+   * The plugin type-id
+   */
+  type?: string;
+  /**
+   * Specific datasource instance
+   */
+  uid?: string;
+}

package/src/schema/grafanapyroscope.gen.ts

@@ -0,0 +1,66 @@
+// Code generated by chant generate from the vendored Grafana schema
+// src/spec/schemas/grafanapyroscope.jsonschema.json (see src/pin.ts) and its correction
+// overlay in src/spec/overlay/ (see src/spec/overlay.ts). DO NOT EDIT.
+/* eslint-disable */
+
+export type PyroscopeQueryType = "metrics" | "profile" | "both";
+
+export interface Dataquery {
+  /**
+   * Specifies the query label selectors.
+   */
+  labelSelector: string;
+  /**
+   * Specifies the query span selectors.
+   */
+  spanSelector?: string[];
+  /**
+   * Specifies the type of profile to query.
+   */
+  profileTypeId: string;
+  /**
+   * Allows to group the results.
+   */
+  groupBy: string[];
+  /**
+   * Sets the maximum number of time series.
+   */
+  limit?: number;
+  /**
+   * Sets the maximum number of nodes in the flamegraph.
+   */
+  maxNodes?: number;
+  /**
+   * A unique identifier for the query within the list of targets.
+   * In server side expressions, the refId is used as a variable name to identify results.
+   * By default, the UI will assign A->Z; however setting meaningful names may be useful.
+   */
+  refId?: string | null;
+  /**
+   * If hide is set to true, Grafana will filter out the response(s) associated with this query before returning it to the panel.
+   */
+  hide?: boolean;
+  /**
+   * Specify the query flavor
+   * TODO make this required and give it a default
+   */
+  queryType?: string;
+  /**
+   * For mixed data sources the selected datasource is on the query level.
+   * For non mixed scenarios this is undefined.
+   * TODO find a better way to do this ^ that's friendly to schema
+   * TODO this shouldn't be unknown but DataSourceRef | null
+   */
+  datasource?: DataSourceRef;
+}
+
+export interface DataSourceRef {
+  /**
+   * The plugin type-id
+   */
+  type?: string;
+  /**
+   * Specific datasource instance
+   */
+  uid?: string;
+}

package/src/schema/index.ts

@@ -25,5 +25,11 @@ export * as geomap from "./geomap.gen";
 export * as prometheus from "./prometheus.gen";
 export * as tempo from "./tempo.gen";
 export * as loki from "./loki.gen";
+export * as elasticsearch from "./elasticsearch.gen";
+export * as cloudwatch from "./cloudwatch.gen";
+export * as azuremonitor from "./azuremonitor.gen";
+export * as googlecloudmonitoring from "./googlecloudmonitoring.gen";
+export * as bigquery from "./bigquery.gen";
+export * as grafanapyroscope from "./grafanapyroscope.gen";
 export * as expr from "./expr.gen";
 export { DASHBOARD_SCHEMA_VERSION } from "./dashboard.gen";

package/src/schema/table.gen.ts

@@ -88,6 +88,10 @@ export interface TableFieldOptions {
    * Hides any header for a column, useful for columns that show some static content or buttons.
    */
   hideHeader?: boolean;
+  /**
+   * options for the footer for this field
+   */
+  footer?: TableFieldFooterOptions;
 }
 
 /**
@@ -355,3 +359,13 @@ export interface TableMarkdownCellOptions {
 export interface TableGeoCellOptions {
   type: TableCellDisplayMode;
 }
+
+/**
+ * The footer of one field (TableFooterOptions in the CUE; renamed here because the vendored schema already has a panel-level TableFooterOptions)
+ */
+export interface TableFieldFooterOptions {
+  /**
+   * footer reducers to apply to this field
+   */
+  reducers?: string[];
+}

package/src/schema-validate.ts

@@ -26,9 +26,11 @@
  * several variants) match more than one.
  */
 
-import Ajv, { type ValidateFunction, type ErrorObject } from "ajv";
+import { createRequire } from "module";
+import type AjvClass from "ajv";
+import type { ValidateFunction, ErrorObject } from "ajv";
 import type { SchemaName } from "./pin";
-import { loadSchema } from "./spec/schemas";
+import { SCHEMA_JSON } from "./spec/schemas.gen";
 import { panelDefinitionFor } from "./panels";
 import { queryDefinitionFor } from "./query";
 
@@ -40,12 +42,61 @@ export interface SchemaProblem {
   severity: "error" | "warning";
 }
 
-let ajv: Ajv | undefined;
-function getAjv(): Ajv {
-  ajv ??= new Ajv({ strict: false, allErrors: true, validateFormats: false });
+let ajv: AjvClass | undefined;
+let ajvError: string | undefined;
+
+/**
+ * ajv, loaded on first use.
+ *
+ * Every `chant build`, `chant lint` and `chant list` loads the plugin, and the
+ * plugin's post-synth barrel reaches this module, so a top-level import would
+ * put ajv on every run that has grafana installed, validating or not.
+ * `check()` is synchronous, so `await import()` is not available;
+ * `createRequire` is (the same as the cedar lexicon's wasm, and ajv is
+ * CommonJS). Where it cannot load (a bundle with no `node_modules` beside
+ * it), {@link schemaValidationUnavailable} says why and GRAF107 reports that
+ * instead of throwing.
+ */
+function getAjv(): AjvClass | undefined {
+  if (ajv || ajvError) return ajv;
+  try {
+    const mod = createRequire(import.meta.url)("ajv") as { default?: typeof AjvClass } & typeof AjvClass;
+    const Ajv = mod.default ?? mod;
+    ajv = new Ajv({ strict: false, allErrors: true, validateFormats: false });
+  } catch (err) {
+    ajvError = (err instanceof Error ? err.message : String(err)).split("\n")[0];
+  }
   return ajv;
 }
 
+/** Why schema validation cannot run here (ajv did not load), or undefined when it can. */
+export function schemaValidationUnavailable(): string | undefined {
+  getAjv();
+  return ajvError === undefined ? undefined : `ajv could not be loaded: ${ajvError}`;
+}
+
+function requireAjv(): AjvClass {
+  const a = getAjv();
+  if (!a) throw new Error(`grafana schema validation: ${schemaValidationUnavailable()}`);
+  return a;
+}
+
+const parsed = new Map<SchemaName, Record<string, unknown>>();
+
+/**
+ * One schema as validation uses it: the vendored file with its overlay
+ * applied, from the generated `spec/schemas.gen.ts` (no filesystem read, so
+ * it works bundled), parsed on first use.
+ */
+export function bundledSchema(name: SchemaName): Record<string, unknown> {
+  let schema = parsed.get(name);
+  if (!schema) {
+    schema = JSON.parse(SCHEMA_JSON[name]) as Record<string, unknown>;
+    parsed.set(name, schema);
+  }
+  return schema;
+}
+
 const compiled = new Map<string, ValidateFunction>();
 
 interface Mode {
@@ -74,7 +125,7 @@ function validatorFor(name: SchemaName, def: string | undefined, mode: Mode): Va
   const key = `${name}#${def ?? ""}#${mode.lenient}#${mode.open}`;
   const hit = compiled.get(key);
   if (hit) return hit;
-  const schema = loadSchema(name);
+  const schema = bundledSchema(name);
   const definitions = (schema.definitions ?? {}) as Record<string, unknown>;
   const ref = def ? `#/definitions/${def}` : (schema.$ref as string | undefined);
   if (!ref) return undefined;
@@ -84,7 +135,7 @@ function validatorFor(name: SchemaName, def: string | undefined, mode: Mode): Va
     $ref: ref,
     definitions: prepare(definitions, mode),
   };
-  const fn = getAjv().compile(root);
+  const fn = requireAjv().compile(root);
   compiled.set(key, fn);
   return fn;
 }

package/src/skill-defs.ts

@@ -45,4 +45,21 @@ export const grafanaSkills = createSkillsLoader(import.meta.url, [
       },
     ],
   },
+  {
+    file: "chant-grafana-operations.md",
+    name: "chant-grafana-operations",
+    description:
+      "Start a Grafana project from a template, bring existing dashboards into chant with chant import, find what changed in a running Grafana with chant lifecycle diff --live, export a Grafana as TypeScript, and apply a build over the HTTP API",
+    triggers: [
+      { type: "context" as const, value: "grafana drift" },
+      { type: "context" as const, value: "import grafana dashboard" },
+      { type: "context" as const, value: "grafana apply" },
+    ],
+    examples: [
+      {
+        title: "See what was edited in a running Grafana since the last build",
+        output: "chant lifecycle diff staging --live",
+      },
+    ],
+  },
 ]);

package/src/skills/chant-grafana-operations.md

@@ -0,0 +1,108 @@
+---
+skill: chant-grafana-operations
+description: Start a Grafana project from a template, bring existing dashboards into chant with chant import, find what changed in a running Grafana with chant lifecycle diff --live, export a Grafana as TypeScript, and apply a build over the HTTP API
+user-invocable: true
+---
+
+# Operating Grafana with chant
+
+Use this skill when a Grafana already exists: dashboards made in the UI to bring under chant, a provisioned dashboard somebody edited, or a build to push without mounting files. For writing dashboards see the chant-grafana skill; for provisioning files and ConfigMaps, chant-grafana-provisioning; for alert rules, chant-grafana-alerting.
+
+## Start a project
+
+```bash
+chant init --lexicon grafana my-dashboards                      # a Prometheus datasource and one dashboard
+chant init --lexicon grafana --template red my-dashboards       # RedDashboard over span metrics, ExternalDatasource, Folder
+chant init --lexicon grafana --template k8s-pods my-dashboards  # pod dashboard delivered as sidecar ConfigMaps (k8s + grafana)
+chant init --lexicon grafana --template slo my-dashboards       # Slo rules, SloDashboard and SloAlertRules (prometheus + grafana)
+```
+
+Every template builds clean and passes the GRAF checks as written. `k8s-pods` and `slo` ship a `chant.config.ts` naming both lexicons and a `build` script without `--lexicon`, so both outputs and both lexicons' checks run.
+
+## Import dashboards you already have
+
+Export the dashboard in Grafana (Export > Export as JSON, classic or V2 resource), then:
+
+```bash
+chant import checkout.json --output src                      # inside a project that lists grafana
+chant import checkout.json --lexicon grafana --output src    # anywhere else
+chant build src --lexicon grafana -o dist/grafana/index.json
+```
+
+The importer also reads `GET /api/dashboards/uid/<uid>` responses, `dashboard.grafana.app` v1 and v2 resources, and datasource, dashboard and alerting provisioning files. Each dashboard lands in `src/<uid>/`: `dashboard.ts`, `panels.ts`, one `row-<title>.ts` per row, `variables.ts`, and `datasources.ts` with an `ExternalDatasource` per datasource named by uid. Replace an `ExternalDatasource` with a `Datasource` of the same uid to provision it from chant too.
+
+Read every import warning. Anything the lexicon can't express is reported, never dropped. Common ones: a v2 dashboard's tabs become rows, an export made for sharing turns `${DS_*}` inputs into `DatasourceVariable`s, and two imported dashboards naming one datasource both declare it (GRAF104; delete one declaration and import it from the other file).
+
+A dashboard inside a Kubernetes ConfigMap imports with the k8s lexicon: `chant import grafana-configmaps.yaml` gives a grafana `Dashboard` as the ConfigMap's value.
+
+## Point environments at a Grafana
+
+Observe, export and apply read `grafana.profiles.<env>` in `chant.config.ts`. Credentials are named by environment variable, never written in the file:
+
+```ts
+import type { ChantConfig } from "@intentius/chant/config";
+import "@intentius/chant-lexicon-grafana";
+
+export default {
+  lexicons: ["grafana"],
+  ownership: { stack: "shop", env: "prod" },
+  grafana: {
+    profiles: {
+      staging: { url: "https://grafana.staging.example.com", token: { env: "GRAFANA_STAGING_TOKEN" } },
+      prod: { url: "https://grafana.example.com", token: { env: "GRAFANA_PROD_TOKEN" }, orgId: 2 },
+    },
+  },
+} satisfies ChantConfig;
+```
+
+With no profile, `GRAFANA_URL` plus `GRAFANA_TOKEN` (or `GRAFANA_USER` and `GRAFANA_PASSWORD`) is used. Grafana Cloud also needs `namespace: "stacks-<id>"`. A Viewer service account can observe and export. Applying needs Editor, or a custom role with `grafanaActionsFor("Apply", "Prune")`.
+
+## Find what changed in Grafana
+
+```bash
+chant lifecycle diff staging --live
+chant lifecycle diff staging --live --json              # the same report as data
+chant lifecycle diff staging --live --update-baseline   # accept what it reported
+```
+
+Paths are in your source's terms: `panels[0].panels[1].title` is the second panel of the first row. A value you declared that differs is drift. A value you never declared, such as a panel added in the UI, is listed as unclaimed and never proposed as a change. What the build fills in (panel ids, auto grid positions, refIds) and what Grafana adds on read are not reported. A dashboard Grafana 13 stores as v2 is read at v2 and diffed after conversion, so a tab added in the UI shows as drift in the rows.
+
+Ownership decides what counts as chant's. A dashboard loaded by one of the project's providers (named `chant` unless you declared another `DashboardProvider`), or carrying the `app.kubernetes.io/managed-by: chant` label the applier writes, is `owned`. Anything else is `foreign`. Datasources and dashboards on Grafana 11 are `unknown`, and `--owned` leaves them out.
+
+A `DashboardProvider` can't be observed (Grafana serves no API for provisioning files) and is reported as not observed, not missing.
+
+## Export a Grafana as TypeScript
+
+```bash
+chant import --from staging --lexicon grafana --output src
+chant import --from staging --lexicon grafana --type Grafana::Dashboard --name checkout --output src
+chant import --from staging --lexicon grafana --owned --output src
+```
+
+It writes every dashboard and datasource in the organisation, laid out like a file import. Datasource secrets come back as `"[REDACTED]"`, each with a warning. Replace them with `$__env{NAME}` or `$__file{path}`, which GRAF002 requires.
+
+## Apply over the HTTP API
+
+When the build's files can't be mounted into Grafana, or you want real folders with pinned uids, apply from an Op:
+
+```ts
+// ops/grafana.op.ts, with "build:grafana": "chant build src --lexicon grafana -o dist/grafana.json" in package.json
+import { Op, phase, build } from "@intentius/chant/op";
+import { grafanaApply } from "@intentius/chant-lexicon-grafana";
+
+export default Op({
+  name: "grafana-prod",
+  phases: [
+    phase("Build", [build(".", { script: "build:grafana" })]),
+    phase("Apply", [grafanaApply("dist/grafana.json", { environment: "prod", prune: true })]),
+  ],
+});
+```
+
+Run it with `chant run grafana-prod`, or from an agent through the MCP `op-run`, `op-status` and `op-signal` tools. The applier creates folders parents first with their uids, writes library panels found in `__elements`, and sends each dashboard with the project's labels. A dashboard whose live content already matches is `unchanged` and not written; a panel title edited in the UI is put back. `prune` deletes only dashboards and folders labelled with this project's stack and env. It never touches UI-saved or file-provisioned dashboards, library panels, or anything on Grafana 11, and does nothing when no `ownership.stack` is set. Datasources still come from the provisioning file.
+
+## A loop that keeps UI edits
+
+1. `chant lifecycle diff prod --live` shows the edit.
+2. Either change the source to match and rebuild, or `chant import --from prod --name <uid>` to pull the dashboard, then copy the changed panel over.
+3. Apply, or let provisioning reload, and diff again. It should report nothing.