test(dashboard-v2): e2e for editor sections, thresholds and list columns

Covers the per-kind option sections of the editor: which sections each
visualisation declares, and whether the values they hold reach the chart and
survive a save.

- sections are asserted per kind, not once. A section that a kind must not
  offer is as much a requirement as one it must: Fill gaps on TimeSeries but
  not Bar, Stack series on Bar but not TimeSeries, per-column units on Table
  instead of a panel-wide one, no axes on Number or Pie.
- axis bounds, log scale and chart appearance are read back off the live uPlot
  instance, so a control that writes the spec but never reaches the chart
  fails. A cleared bound is checked to store null rather than zero.
- thresholds cover all three variants (label, comparison, table) plus the
  editing rules — one row editable at a time, discard removing a new row but
  restoring an existing one — and then that a crossed threshold actually
  colours the rendered value, live and after a save.
- context links and the List columns editor cover their dialogs, persistence
  into panel.spec, and the collapsed-section quick-add path.

Adds per-name test ids to the List column chips and field suggestions so a
specific column can be targeted; no behaviour change.

Specs: sections (TimeSeries/Bar), sections (Number/Table/Pie/Histogram),
thresholds, context links, list columns (51 tests).

.claude/agents/playwright-test-generator.md

@@ -20,16 +20,6 @@ You are the Playwright Test Generator for the SigNoz frontend. You take a plan w
     await expect(page.getByRole('tab', { name: /alert rules/i })).toBeVisible();
   });
   ```
-- **Extended fixtures:** For features needing complex setup (seeded data, API calls, cleanup), import from domain-specific fixtures that extend `auth`. See [docs/contributing/tests/e2e.md](../../docs/contributing/tests/e2e.md) for the full pattern.
-  - `fixtures/alerts/alert-rules` — worker-scoped rule list + test-scoped rule factory
-  - `fixtures/alerts/alert-history` — extends alert-rules, adds history fixtures (waits on ruler evaluation)
-  ```ts
-  // Alert list tests - need rules, no history
-  import { test, expect } from '../../../fixtures/alerts/alert-rules';
-  
-  // Alert history tests - need evaluated history rows
-  import { test, expect } from '../../../fixtures/alerts/alert-history';
-  ```
 - **Test titles:** `TC-NN <short description>` — matches the planner's IDs.
 - **Self-contained state.** The bootstrap creates a fresh stack with **zero** dashboards / alerts / etc. — never assume pre-existing data. Two cleanup shapes are valid; pick based on the spec size:
   - **Per-test `try / finally`** — small specs (~ <10 scenarios) where each test owns its data.

.claude/agents/playwright-test-healer.md

@@ -49,7 +49,6 @@ Don't try to start the stack yourself — it can take ~4 minutes on a cold build
 - **The list pages render zero-state when the workspace is empty.** Many locators (search input, sort button, `new-dashboard-cta` testid, "All Dashboards" header) are absent in zero-state. A 30s timeout on those usually means the workspace was empty — seed first via `createDashboardViaApi`.
 - **The "Enter dashboard name…" inline field is a `RequestDashboardBtn` (template-request feedback form), not a create flow.** Tests that try to use it to create a named dashboard will silently no-op. The only UI create paths are the "New dashboard" dropdown → "Create dashboard" (default name "Sample Title", see `DEFAULT_DASHBOARD_TITLE`) or "Import JSON".
 - **Auth.** `tests/e2e/fixtures/auth.ts` logs in once per worker and caches `storageState` (cookies + localStorage with `AUTH_TOKEN`). For API-driven seeding/cleanup, use `authToken(page)` from `helpers/dashboards.ts` and pass `Authorization: Bearer <token>`. Never re-implement login.
-- **Extended fixtures.** Domain-specific fixtures extend `auth` and add seeded data. Alerts uses `fixtures/alerts/alert-rules` (worker-scoped rule list, test-scoped factory) and `fixtures/alerts/alert-history` (extends alert-rules, waits on ruler evaluation). See [docs/contributing/tests/e2e.md](../../docs/contributing/tests/e2e.md) for the pattern. When a test fails on missing data, check if it imports the wrong fixture level.
 - **Ant Design popovers** (sort menu, action menu) are click-toggle. The trigger element is often an inline `<svg>` with a `data-testid` — clicking it opens the popover; clicking it again closes. After selecting an option, the popover auto-closes. If a test interacts with the popover twice, wait for the menu items to be visible explicitly between toggles.
 - **Artifacts.** Every failed test writes to `tests/e2e/artifacts/results/<test-slug>/` — the `error-context.md` accessibility snapshot is the fastest way to see what the page actually looked like when it failed.
 - **Type-check.** After edits, run `npx tsc --noEmit -p tests/e2e/tsconfig.json` if it succeeds, or rely on `npx playwright test --list` to validate the spec parses.

.claude/opencode.json

@@ -1,7 +0,0 @@
-{
-  "$schema": "https://opencode.ai/config.json",
-  "lsp": true,
-  "experimental": {
-    "disable_paste_summary": true
-  }
-}

.claude/rules/comments.md

@@ -1,12 +0,0 @@
-# Comments
-
-Applies to everything in the repo — code, config, workflows.
-
-- **No unnecessary comments.** Do not comment where the code is self-explanatory; never restate what the code already says.
-- **Document only** non-obvious behavior, constraints, formats, and edge cases.
-- **Rationale goes in prose, not source.** Why a version is pinned, why a job exists, how a subsystem fits together — that belongs in the README or the PR.
-- **Never remove pre-existing comments** when editing code. The bar above applies to comments you write, not comments already there.
-- **Never talk to the reviewer.** No comments about where a change came from, what was changed, or why the change is correct — that belongs in the PR description and is noise the moment it merges.
-- **Less is more.** When writing something intended for human consumption, (comment, commit message, reply to prompt) use as few words as possible. Pick every word meticulously to reduce the volume to a strict minimum. Be down to the point. Less is more.
-
-Language rules build on this one: [`go-comments`](go-comments.md), [`py-comments`](py-comments.md).

.claude/rules/go-comments.md

@@ -1,12 +0,0 @@
----
-paths:
-  - "**/*.go"
----
-
-# Go comments
-
-The bar is the [`comments`](comments.md) rule: nothing where the code is self-explanatory.
-
-- **Names carry the meaning.** Make function, type, and variable names self-explanatory so the comment is unnecessary in the first place. If a comment is needed to explain what a function does, fix the name, not the comment.
-- **Godoc**: Skip comments that merely restate the identifier. Document only non-obvious behavior, constraints, formats, and edge cases.
-- **Generated code**: If the comment is emitted by an external codegen tool, leave it as-is — do not add or trim comments in generated files.

.claude/rules/go-contrib.md

@@ -1,17 +0,0 @@
----
-paths:
-  - "**/*.go"
----
-
-# Contribution guidelines
-
-- When making Go changes, always ensure they follow the contributing guildelines in [`docs/contributing/go/`](../../docs/contributing/go/).
-- Look for existing patterns in the codebase for any change before implementing the changes.
-- Any ClickHouse identifier or literal built from a name or a value goes through `pkg/clickhousesql`; compiled sqlbuilder text is wrapped with `sqlbuilder.Escape` once. See [`docs/contributing/go/clickhousesql.md`](../../docs/contributing/go/clickhousesql.md).
-- If any API contract is modified, generate the OpenAPI specs with `make gen-openapi-specs`.
-- Always keep the OpenAPI spec generated in a separate commit, so the whole commit can be dropped in case of conflicts during merge. Do not try to resolve conflict in generated files, instead just generate them again.
-- Avoid breaking function calls unncessarily into multilines for couple of arguments.
-- Try to keep most computational only logic in types package itself related to a domain type, use modules as the orchestraction layer cordinating different layers and all db queries in store layer. Check the serviceaccount modules for inspiration when confused.
-- When defining types, keep the structure of file to have any constants and variables first, then exported types and exported methods and then finally the unexported types and methods.
-- Never import types or other modules in migration files, duplicate the required type or method to keep migration free from changes.
-- Always run the gofmt tool for formating beforing commiting any changes.

.claude/rules/go-test.md

@@ -1,12 +0,0 @@
----
-paths:
-  - "**/*_test.go"
----
-
-# Go tests
-
-- **testify + table-driven.** Use `assert` / `require`; prefer table-driven cases. Tests live next to the source file.
-- **`require` vs `assert`.** `require` for anything the rest of the test cannot proceed without — setup, `require.NoError(t, err)`, nil/length checks before indexing or dereferencing. `assert` for the actual expectations, so one failed check still reports the rest.
-- **Mock with mockery.** When an interface needs mocking, list it in `.mockery.yml` and run `mockery`; never hand-write mocks. Generated mocks live in the source package's `<pkg>test` sibling (e.g. `resourcestest.NewMockAdapter(t)`).
-- **Table format.** Declare cases as `testCases := []struct{ name string; ... }` and iterate with `for _, testCase := range testCases { t.Run(testCase.name, ...) }` — the variables are named `testCases` / `testCase`. Case names are PascalCase segments joined by `_`, one segment per aspect (scenario, condition, expectation): `TimestampNotNullNoDefault`, `DropPrimaryKeyConstraint_AlterColumnNullable`, `ForeignKeyConstraint_DoesNotExist_SCreateAndDropConstraintTrue`.
-- **No hoisted test constants.** When goconst flags a repeated literal in a test, vary the fixture strings across cases instead of hoisting a constant — never introduce a shared const for test data. 

.claude/rules/pull-requests.md

@@ -1,11 +0,0 @@
-# Pull requests
-
-- **Follow the template** (`.github/pull_request_template.md`): fill in its headings (Description / Issues closed by this PR / Screenshots / Additional Information). Don't add sections the template doesn't have.
-- **Keep only the headings that apply.** Delete every heading that has nothing under it, along with its `<!--...-->` placeholder comment. The body must never contain an empty heading — if only Description applies, the body has exactly that one heading.
-- **Keep the description concise and human-readable.** A few non repetitive bullets saying what changed and why, for a reviewer skimming it — not a wall of text, not a restatement of the diff, not generated boilerplate and not the user agent conversation details.
-- **Reference issues with `Closes #issue-number`** under "Issues closed by this PR" so they auto-close on merge. This goes in the PR description only — never in commit messages.
-- **Breaking changes can be added in additional information section** if any.
-- **AI assistance in commits may optionally be disclosed with an `Assisted-by:` trailer** naming the model (e.g. `Assisted-by: Claude Opus 4.5`) — do NOT use a `Co-authored-by:` trailer for this.
-- **Keep the commit body short and human readable** focused on decision made if any. Commit body must not re-iterate the changes done, skip if title is sufficient in conveying the change.
-- **Use convensional commit format** for commits and PR title.
-- **Do not amend the commits once pushed.** Always create a new commit once changes are pushed to remote.

.claude/rules/py-comments.md

@@ -1,13 +0,0 @@
----
-paths:
-  - "**/*.py"
----
-
-# Python comments
-
-The bar is the [`comments`](comments.md) rule: nothing where the code is self-explanatory.
-
-- **Names carry the meaning.** Make function and variable names self-explanatory so the comment or docstring is unnecessary in the first place. If a docstring is needed to explain what a function does, fix the name, not the docstring.
-- **No file-level docstring.** The filename says what the module is for — `tool_bin.py` gets the tool binary. A module docstring restating that is noise, and a paragraph of design prose at the top of a file goes stale where nobody is looking. A constraint belongs next to the code it constrains, not in a preamble.
-- **Docstrings**: only when they say something the name and signature don't — drop them otherwise. Keep them short. A contract that genuinely needs a few lines (interacting flags, retry semantics, an edge case) is fine; a narrative is not.
-- **No song and dance.** Comment the constraint or the edge case. Not the narrative, not the rationale, not what the next line does.

.claude/rules/pytest.md

@@ -1,19 +0,0 @@
----
-paths:
-  - "tests/**/*.py"
----
-
-# pytest conventions
-
-For the Python integration suite under `tests/`. Setup, running, and suite layout live in [`docs/contributing/tests/integration.md`](../../docs/contributing/tests/integration.md).
-
-- **No `_`-prefixed helper functions in test modules — this is the rule that matters most.** A reader must be able to see what a test does in its body alone, without chasing private helpers that scatter the meaning across the file. Inline the logic: an expression, a comprehension, a few repeated lines are all fine — repetition across tests is cheaper than indirection. When several tests genuinely share non-trivial setup or assertions, that is what fixtures are for — in `tests/fixtures/`, see the next rule. A module-level `_helper()` is never the answer.
-- **Fixtures live in `tests/fixtures/` — never under `integration/tests/`.** Not in test modules, not in suite `conftest.py` files. `tests/fixtures/` is the shared library (auth, signoz, clickhouse, logs/metrics/traces seeding, …): reuse what's there before writing anything new; when a new fixture is genuinely needed, add it to the matching `tests/fixtures/` module and register new modules in `tests/conftest.py` `pytest_plugins`. **The one exception: SigNoz-level fixtures in a suite's `conftest.py`.** A suite that needs its own SigNoz spun up with different envs (`create_signoz`/`create_migrator` with `env_overrides` + `cache_key` — e.g. basepath, metricreduction, querier_json_body) keeps that in its `conftest.py`; that is always okay.
-- **Fixture only when there is a lifecycle; otherwise a plain function.** A fixture earns its indirection by owning setup/teardown (`yield` + cleanup — `insert_metrics` truncating on teardown) or by provisioning a resource (containers, SigNoz instances). A stateless action or lookup (`create_saved_view`, `find_saved_view_by_name`, wiping a resource list) is a plain importable function in the matching `tests/fixtures/` module, taking `signoz`/`token` as ordinary arguments — never wrap a plain callable in a fixture-factory just to inject `signoz`.
-- **Fixtures own their cleanup.** When a test needs seeded state, put the seed + cleanup pair in a fixture (`yield`, then tear down) so tests in the same suite don't interfere — the pattern `insert_metrics` sets: yield a callable, truncate on teardown.
-- **Fixture-factory over indirect parametrization.** A fixture that yields a callable (e.g. `insert_metrics(metrics)`) is clearer than `@pytest.mark.parametrize(..., indirect=True)` + `request.param` — the value is an explicit argument, not resolved by magic.
-- **Skip at collection, not inside the test body.** Use `pytest.param(..., marks=pytest.mark.skip(reason="…"))` so a skipped case shows as SKIPPED-with-reason **and** short-circuits before its fixtures run (no environment spin-up for a test that won't execute).
-- **Test config comes from explicit `--flags`, not the environment.** Wire configuration as pytest options declared in `tests/conftest.py` (`pytest_addoption` — e.g. `--sqlstore-provider`, `--clickhouse-version`); do **not** add `os.environ` fallbacks inside tests or fixtures.
-- **snake_case parametrize ids.** `ids=["fill_gaps", "fill_zero"]`, not camelCase.
-- **Name suite files with the two-digit prefix (`NN_*.py`).** `pyproject.toml` restricts collection to `[0-9][0-9]_*.py` (plus the bootstrap `setup.py` / `run.py`) — a file that doesn't match is silently never collected.
-- **Always run pytest from `tests/`.** `--import-mode=importlib` is what allows same-basename files across suites (`querier/01_logs.py` vs `rawexportdata/01_logs.py`), but it disables pytest's implicit `sys.path` injection — `import fixtures` only resolves via `pythonpath = ["."]` from that rootdir.

.claude/skills/signoz-page-story/SKILL.md

@@ -1,95 +0,0 @@
----
-name: signoz-page-story
-description: Explore a SigNoz page, map the endpoints, states and query params it has, then write its Storybook page story with control-driven msw mocks that reach every state. Use when asked to create, extend or review a Storybook story for a page under frontend/src/pages, to add controls to an existing page story, or to write defineStoryMocks handlers and mock data for a page.
----
-
-# SigNoz page stories
-
-A page story renders the real page inside the real app shell against msw, and its
-controls panel can reach every state the page has. The panel is the deliverable,
-not the story list.
-
-`frontend/src/storybook/README.md` is the API surface (providers, parameters,
-control builders, module mocks, navigation). Read it first; this skill is the
-process on top of it.
-
-## Workflow
-
-1. **Map the page**: [references/discovery.md](references/discovery.md). Produce
-   the inventory (endpoints, states, params, permissions, caps) before writing
-   code. No inventory, no story.
-2. **Skeleton first**: story + empty `defineStoryMocks`, then run it. The console
-   names the endpoints step 1 missed.
-3. **Inventory to controls**: [references/controls.md](references/controls.md).
-4. **Mock data and handlers**: builders in `__story_mockdata__`, handlers in the page's
-   mocks module.
-5. **Verify in the browser**: [references/verify.md](references/verify.md). Never
-   report the story as done without it.
-
-## Rules
-
-- **Default is the loaded page.** `export const Default: Story = {}` with no args,
-  every widget carrying data. Empty, loading and failed are variants or control
-  values, never the default.
-- **A control is a knob on a response**, resolved through `handlers`, `config` or
-  `effect`. Never a component prop, never a module mock added for one story.
-- **Every branch in the inventory is reachable from the panel.** A state that
-  needs a code edit to see is a missing control.
-- **Never re-declare what every story already has**: banner, side nav, data state
-  (loaded/loading/error), access preset, permissions, check state.
-- **A variant earns a story only when it is worth linking to**: an empty
-  workspace, a viewer, a page mid-load. Everything else stays a control.
-- **Endpoints the page owns go through `response.json`**, so the Data control
-  covers loaded, loading and failed in one declaration. Endpoints the page cannot
-  render without (ingestion detection, preferences, feature payloads) take a
-  plain resolver so the shell survives the loading and error states.
-- **Query-param state starts from `route`** (`/logs?tab=explorer`). In-page param
-  navigation works inside a story; a different pathname is blocked and reported
-  by the overlay. A control for a param is worth it only when the param is a page
-  mode someone would want to flip.
-- **File layout**: every story file for a page lives under
-  `src/pages/<Page>/stories/`: `<Page>.stories.tsx`, `<Page>.stories.mocks.tsx`,
-  payload builders in `stories/__story_mockdata__/<page>.ts`. Nothing
-  page-specific in `src/storybook/controls/`.
-- **The mocks are AI-owned and say so.** `<Page>.stories.mocks.tsx` and every file
-  under a `__story_mockdata__/` open with this banner, above the imports:
-
-  ```ts
-  /**
-   * AI-owned. Generated and maintained by the `signoz-page-story` skill.
-   * Do not hand-edit: regenerate instead.
-   */
-  ```
-
-  The root `.gitattributes` marks both paths `linguist-generated=true`, so the
-  reviewer gets them collapsed and spends the attention on the rendered page. The
-  story file is the human surface and never carries the banner. A file with the
-  banner has to stay regenerable from the page alone: no page knowledge in
-  `src/storybook/`, and builders typed from `src/api/generated` where the endpoint
-  has types, so a contract change is a compile error instead of a mock that lies.
-- **Reuse fixtures** from `src/mocks-server/` and `src/tests/fixtures/` where they
-  exist. An endpoint jest needs too belongs in `src/mocks-server/handlers.ts`.
-- **Shared response builders live in `src/storybook/msw/__story_mockdata__/`**: typed
-  helpers like `queryRangeV5ScalarResponse` that multiple pages need. Before
-  writing a response shape inline, check if a builder exists; if not and the
-  shape will repeat, add it there. Page-specific builders stay in the page's
-  `__story_mockdata__/`.
-- **No comment is the default.** Write one only for what the code cannot show:
-  a shape the backend dictates, an app bug the mock reproduces, an ordering or
-  cap the page depends on, a workaround and the reason for it. Never restate a
-  name, a type, or what a builder plainly builds; if the sentence reads as the
-  signature in prose, delete it. Nothing addressed to a reviewer. The one
-  comment a story always gets is its own doc comment: what it shows, in the
-  page's own terms.
-
-## Done means
-
-- [ ] `Default` shows the page with data, checked in dark and light
-- [ ] the mocks module and every `__story_mockdata__` file carry the AI-owned banner
-- [ ] every control flipped once, its effect seen on screen
-- [ ] console clean: no `[storybook] no msw handler`, no 501, no msw unhandled
-      request, no React warning
-- [ ] no navigation overlay on mount
-- [ ] `pnpm tsgo --noEmit`, `pnpm exec oxlint <files>`,
-      `pnpm exec oxfmt --check <files>` all clean. The repo has no
-      prettier: `pnpm exec prettier` prints a pass while exiting 254

.claude/skills/signoz-page-story/references/controls.md

@@ -1,165 +0,0 @@
-# Turning the inventory into controls
-
-Every row of the inventory becomes a control, a global control that already
-exists, or a documented reason it cannot be one.
-
-## Imports
-
-Paths written as `src/storybook/...` in prose are repo paths, not import
-specifiers. Stories import through the `@/` alias (`@/*` → `./src/*`); modules
-inside `src/storybook/` import each other relatively.
-
-| Import | From |
-| --- | --- |
-| `toggleControl`, `countControl`, `choiceControl`, `multiChoiceControl` | `../controls/controls` |
-| `defineStoryMocks`, `storyMocks` | `../controls/defineStoryMocks` |
-| `PageStoryArgs` | `../controls/resolveStoryMocks` |
-| `MockRequest`, `MockResponse` | `../controls/types` |
-| the page's mocks, from the story | `./<Page>.stories.mocks` |
-| `queryRangeV5ScalarResponse`, `queryRangeV5RawResponse`, etc. | `@/storybook/msw/__story_mockdata__/queryRange` |
-
-## Which builder
-
-`src/storybook/controls/controls.ts`:
-
-| The state is | Builder |
-| --- | --- |
-| on or off (a signal ingesting, a feature present) | `toggleControl` |
-| how many rows a list has | `countControl` |
-| one of several modes (tab, visibility, plan, severity filter) | `choiceControl` |
-| a subset (steps skipped, columns shown, signals selected) | `multiChoiceControl` |
-
-Rules that come with them:
-
-- `countControl` `max` goes past what the page renders, so a story can show the
-  cap being hit. `0` is the empty state, which is why an empty list rarely needs
-  its own story. When the cap is in the *request* (`?limit=5`) rather than the
-  renderer, stop `max` at the limit: a longer response is a body the backend
-  cannot send.
-- `choiceControl` options come from a `const` array typed with
-  `(typeof X)[number]`, not from string literals scattered in the handlers.
-- Defaults describe the fully-populated page. The panel starts where `Default`
-  starts.
-- `group` is `'<Page> · <facet>'`, such as `'Services · lists'` or
-  `'Alerts · rules'`. Keep a page's knobs in two or three groups, not one per
-  control.
-- `description` only when the name does not carry the effect (what dismissing
-  does, what the cap is, which widget it feeds).
-
-## Which hook
-
-`defineStoryMocks` takes three, all optional:
-
-- `handlers(values, response)`: the page's endpoints. Everything the page owns
-  goes through `response.json`, so the global Data control turns the whole page
-  into loading or failed without a second declaration. An endpoint the page
-  cannot render at all without (ingestion detection, preferences, license
-  payloads) takes a plain `rest.get(...)` resolver instead, so the shell stays
-  visible while the rest hangs or fails.
-- `config(values)`: `SignozStoryConfig` for knobs no endpoint covers: `route`,
-  `appContext`, `reduxState`, `queryBuilder`, `theme`.
-- `effect(values)`: module-level state no provider exposes.
-
-One endpoint feeding several widgets stays one handler that reads the request.
-`response.json` hands the request to the builder and awaits it, so reading a
-query param, or a POST body, does not cost the Data control:
-
-```ts
-rest.get(
-	'http://localhost/api/v1/explorer/views',
-	response.json((req) =>
-		savedViews(values.savedViews, req.url.searchParams.get('sourcePage') ?? 'logs'),
-	),
-),
-```
-
-```ts
-rest.post(
-	'http://localhost/api/v5/query_range',
-	response.json(async (req) => {
-		const body = (await req.json()) as QueryRangeRequestV5;
-		const signal = body.compositeQuery?.queries?.[0]?.spec?.signal;
-
-		return countResponse(values[`${signal}Ingestion`] ? 4213 : 0);
-	}),
-),
-```
-
-Reach for a plain `rest.post(url, async (req, res, ctx) => …)` only when the
-endpoint has to keep answering while the Data control is on `loading` or
-`error`: detection calls the page cannot render without.
-
-## Mutations
-
-A control drives the response, so a write the page makes against state a control
-owns does not stick: the refetch answers with the control's value and the button
-appears to do nothing. Two honest options: leave it declarative and say so in
-the PR, or move the state into `effect` so the handler can read what the page
-wrote. Never fake the write by mutating a builder's module state without saying
-where the state lives.
-
-## Wiring it up
-
-```ts
-// src/pages/Services/stories/Services.stories.mocks.tsx
-/**
- * AI-owned. Generated and maintained by the `signoz-page-story` skill.
- * Do not hand-edit: regenerate instead.
- */
-export const servicesMocks = defineStoryMocks({
-	controls: {
-		services: countControl('Services', { group: LISTS, value: 8, max: 12 }),
-		apdex: choiceControl<ApdexState>('Apdex', {
-			group: HEALTH,
-			options: APDEX_STATES,
-			value: 'mixed',
-		}),
-	},
-	handlers: (values, response) => [
-		rest.post(
-			'http://localhost/api/v2/services',
-			response.json(() => buildServices(values.services, values.apdex)),
-		),
-	],
-});
-```
-
-```tsx
-// src/pages/Services/stories/Services.stories.tsx
-type ServicesArgs = PageStoryArgs<typeof servicesMocks>;
-
-const meta = {
-	title: 'Pages/Services',
-	component: Services,
-	...storyMocks(servicesMocks, { route: ROUTES.APPLICATION, layout: 'app' }),
-} satisfies Meta<ServicesArgs>;
-```
-
-`PageStoryArgs` folds in the global controls, so a story's `args` can set
-`access`, `dataState` or `banner` next to the page's own knobs and stay typed.
-
-## Not a control
-
-- Anything the global controls already cover: banner, side nav, data state,
-  access preset, permissions, check state.
-- A knob whose effect nobody can see on the page. Delete it or find the widget it
-  was supposed to drive.
-- A raw payload as an object control. Controls carry intent (`5 dashboards`,
-  `viewer`), and the builder turns intent into the payload.
-- Anything that needs a module mock or a component prop to work. If the state
-  cannot be produced from a response, config or module state, say so in the PR
-  instead of faking it.
-
-## Control or story
-
-Default to a control. Write a story when the state is worth a link:
-
-- the fresh workspace, because that is what a new user sees
-- the restricted user, when permissions visibly change the page
-- a page-defining mode (a tab, a category) that has its own layout
-
-Combinations of controls do not need stories, which is what the panel is for.
-
-Each story gets one prose doc comment: what it shows, in the page's own terms.
-Everywhere else the comment rule in SKILL.md applies: write one only for what
-the code cannot show.

.claude/skills/signoz-page-story/references/discovery.md

@@ -1,64 +0,0 @@
-# Mapping a page
-
-Two passes: read the code, then let the running story correct you. Write the
-inventory down: it is what the controls are derived from, and the only
-protection against a story that renders one state and calls it a page.
-
-## Pass 1: read the page
-
-Start at `src/pages/<Page>/` and follow it outward: the containers it mounts
-(`src/container/<Feature>/`), the hooks those use, the components with their own
-fetches. Stop at leaf components that take props only.
-
-Grep recipes, run against the page's directories:
-
-| Looking for | Grep |
-| --- | --- |
-| endpoints | `useQuery\|useMutation\|useInfiniteQuery`, then the `api/` module it calls |
-| endpoint URLs | the api module's `axios.get\|post` |
-| endpoint URLs behind a generated hook | the hook lives in `src/api/generated/services/<name>/index.ts` and the URL only appears in the fetcher body: `rg 'url: \`' src/api/generated/services/<name>/` |
-| url state | `useUrlQuery\|useUrlQueryData\|useUrlSearchState\|useQueryState\|QueryParams\.` |
-| navigation | `useSafeNavigate\|history.push\|<Link` |
-| permissions | `useAuthZ\|AuthZGuard\|AuthZButton\|hasEditPermission\|routePermission` |
-| flags and prefs | `useFeatureFlag\|FeatureKeys\.\|USER_PREFERENCES\.\|userPreferences` |
-| empty and error branches | `isLoading\|isError\|isFetching\|length === 0\|!data` |
-| render caps | `slice(0,\|PAGE_SIZE\|pageSize\|limit` |
-
-`src/constants/routes.ts` has the route, `src/constants/query.ts` the param names,
-`src/lib/authz/README.md` how a permission check resolves.
-
-## The inventory
-
-One table, in the story's PR or scratch notes:
-
-| Endpoint | Feeds | States it can be in |
-| --- | --- | --- |
-| `GET /api/v1/x` | the header count | populated, zero, error |
-
-Plus four short lists:
-
-- **Query params** the page reads, and what each one switches.
-- **Permission checks** the page makes, and what disappears when each is denied.
-- **Preferences and flags** that change layout (dismissed banners, onboarding
-  checklists, opt-in views).
-- **Caps**: how many rows each list renders before it truncates or paginates.
-
-A state that appears in this inventory and not in the controls panel is a bug in
-the story.
-
-## Pass 2: let it run
-
-Write the story and an empty `defineStoryMocks({ controls: {} })`, point it at the
-route with `layout: 'app'`, then open it (see verify.md). The console is the
-oracle:
-
-- `[storybook] no msw handler` or a 501 from the catch-all: an endpoint pass 1
-  missed. Add it to the inventory.
-- an msw unhandled-request warning: a request going to an origin the handlers do
-  not answer on. handlers are declared against `http://localhost`.
-- a spinner that never resolves with the Data control on `loaded`: a handler
-  whose URL does not match what the page calls.
-- the navigation overlay on mount: the page redirects, usually because `route`
-  is wrong or a guard is failing on a permission the controls have not granted.
-
-Repeat until the console is silent. Only then start declaring controls.

.claude/skills/signoz-page-story/references/verify.md

@@ -1,110 +0,0 @@
-# Verifying a page story
-
-A story is not done because it compiles. It is done when each control has been
-seen changing the page and the console is silent.
-
-## Run it
-
-```bash
-cd frontend && pnpm storybook --ci --quiet   # :6006, background it
-```
-
-A newly added `.stories.tsx` takes a few seconds to appear in `index.json` on an
-already-running server; an empty first poll is not a broken `stories` glob.
-
-Story ids come from the meta title: `Pages/Services` → `pages-services`, plus the
-story export in kebab-case. Render one story on its own:
-
-```
-http://localhost:6006/iframe.html?id=pages-services--default&viewMode=story
-```
-
-## Flip controls from the URL
-
-Args are settable in the iframe URL, so a whole sweep runs headless without
-touching the panel. Booleans go as `!true` / `!false`, numbers bare, arrays
-indexed, several separated by `;`, and the theme through `globals`:
-
-```
-&args=services:0;apdex:poor;access:viewer;dataState:loading
-&args=signals[0]:logs;signals[1]:traces
-&globals=theme:light
-```
-
-That is the cheap way to check a control does something: load with and without
-it, diff the page text.
-
-## Drive it
-
-Playwright lives in the repo's e2e workspace, so a scratch script can use it
-directly:
-
-```js
-import pw from '<repo>/tests/e2e/node_modules/playwright/index.js';
-const { chromium } = pw;
-
-const browser = await chromium.launch();
-const page = await browser.newPage();
-const problems = [];
-page.on('console', (m) => {
-	if (m.type() === 'error' || m.type() === 'warning') problems.push(m.text());
-});
-page.on('pageerror', (e) => problems.push(e.message));
-
-await page.goto(`${story}&args=services:0`, { waitUntil: 'networkidle' });
-await page.locator('body').waitFor();
-console.log((await page.locator('body').innerText()).slice(0, 1500), problems);
-await browser.close();
-```
-
-Screenshots are worth taking for `Default` in both themes
-(`&globals=theme:light`): text extraction does not catch an unstyled page.
-
-## Gates
-
-- **Console silent.** `[storybook] no msw handler`, a 501 from the catch-all, an
-  msw unhandled-request warning, a React key or state warning: assume the story
-  is wrong first. A warning that survives is sometimes the app's. Prove it by
-  turning off the control that renders the widget and watching the warning go
-  with it, and by finding the same component elsewhere doing it right. Then
-  report the app bug in the PR. Never invent a field the API does not return to
-  silence a warning.
-- **No navigation overlay on mount.** "Navigation blocked in Storybook" on load
-  means the page is trying to leave: wrong `route`, or a guard denying on a
-  permission the controls did not grant.
-- **Every control moves something.** Sweep them one at a time from the URL and
-  diff the page text. A control with no diff is either wired to nothing or aimed
-  at a widget that is not rendering. Some only show their effect after an
-  interaction, such as a tab that has to be clicked or a select that has to be
-  opened. Drive that interaction rather than calling the control unobservable.
-- **Both themes render styled.** An unstyled page means the story is not inside
-  the provider decorator, or `<body data-theme>` was lost.
-- **Roles agree.** `<body data-signoz-story-role>` and
-  `<body data-signoz-context-role>` disagreeing means the page reads a different
-  `AppContext` than the story config fills.
-- **The page's own navigation works.** Tabs, filters and pagination that write
-  query params should re-render the page in place; only leaving the page belongs
-  in the overlay.
-
-## Then the usual
-
-```bash
-pnpm tsgo --noEmit
-pnpm exec oxlint <changed files>
-pnpm exec oxfmt --check <changed files>
-```
-
-There is no prettier in this repo. `pnpm exec prettier --check` fetches something
-else, prints `Prettier: All files formatted correctly` and exits 254: a pass that is
-not one.
-
-## Common failures
-
-| Symptom | Cause |
-| --- | --- |
-| endless spinner with Data on `loaded` | handler URL does not match the call; handlers answer on `http://localhost` |
-| page renders but empty | response shape wrong; compare against the api module's type, not a guess |
-| 501 in the console | endpoint nobody mocked; the catch-all is answering |
-| new control missing from the panel | project-level control added; the tab needs a reload |
-| control flips but nothing changes | the widget is gated by something else: a permission, a flag, a preference |
-| shell disappears in `loading` | an endpoint the shell needs went through `response.json`; give it a plain resolver |

.claude/skills/storybook-visual-diff/SKILL.md

@@ -1,294 +0,0 @@
----
-name: storybook-visual-diff
-description: Screenshot a set of SigNoz Storybook stories, then pixel-diff two runs to see what a CSS or component change did, with the changes tinted over the new shot. Use when asked to take story screenshots, capture a visual baseline, compare before/after of a style change, or find which pages a change affects.
----
-
-# Storybook visual diff
-
-Two scripts under `frontend/scripts`:
-
-- `story-shots.mjs` — screenshots stories off a running Storybook dev server.
-- `story-shots-diff.mjs` — pixel-diffs two runs and paints what moved.
-
-Output goes to `frontend/.story-shots/` (gitignored), one directory per run.
-
-## 0. Settle what is being compared, first
-
-A diff is only worth taking when the two runs straddle something. Run twice over
-the same tree and the answer is zero, or the noise floor: true, and useless.
-So before starting a server, pin down four things. Whatever the prompt already
-says, take it and do not ask again; ask only for what is genuinely missing, in
-**one** `AskUserQuestion` call.
-
-| To settle | Ask | Options |
-| --- | --- | --- |
-| Job | "What should this run produce?" | shoot only · baseline for a change you are about to make · compare against a change already in the working tree · compare this branch against another (`main` by default, or one the user names) · compare two configurations of the same story (`--args`, clock, width) · noise floor (same tree twice) |
-| Scope | "Which stories?" | offer 2-3 concrete selections read off `index.json` (a page, a `--title` prefix, everything), never open-ended |
-| Themes | "Which themes?" | dark · dark + light |
-| Read-out | "How should the diff read?" | `green` (changed pixels over the after shot) · `green-parallel` (before \| after \| diff, side by side) · `red` · `red-parallel` · `none` (keep both runs, do not diff) |
-
-Skip a row when the prompt answers it, and skip the whole call when the prompt
-answers all of it ("shoot the pods tooltips in both themes" needs no question).
-Skip Read-out too whenever the job is *shoot only*, and take `none` for what it
-says: shoot both sides, report both paths, run no comparison. When the prompt
-says nothing at all, ask; a silent guess here burns ~6 min per sweep on the
-wrong stories.
-
-The job decides which loop below to run:
-
-| Job | Loop |
-| --- | --- |
-| **shoot only** | §1, §2, stop. Report the paths. No diff, no second run. |
-| **baseline first** | the full loop, stopping after step 2 to hand the change back. The user makes it, then continue at step 4. |
-| **change already in the tree** | the tree *is* the after state. `git stash` (or check out the base commit) to shoot the before, restore, shoot the after. Confirm the working tree is clean enough to stash before touching it, and restore it even if a capture fails. |
-| **branch vs branch** | shoot the current branch, then `git switch <base>` in place (stash first if the tree is dirty), restart the dev server, shoot again, switch back and unstash. Restart matters: HMR does not survive a whole-branch swap cleanly. Get the tree back to where it started even if a capture fails. |
-| **noise floor** | two runs, same tree, diff. The number is the harness's floor, not a finding. |
-| **config vs config** | same tree, two runs that differ only in flags: `--args`, `--clock`, `--width`, `--theme`, `--motion`. Filenames stay identical, so the pairs line up and the caption names what changed. |
-
-## The loop
-
-1. Capture the baseline **before touching anything**.
-2. Capture it a second time and diff the two. That is the noise floor: anything
-   it reports is what the harness cannot hold still, and no conclusion about the
-   change may rest on those stories. Cheap on a handful of stories, ~6 min per
-   32, so on a wide sweep run it over the two or three stories the change is
-   aimed at instead of all of them.
-3. Make the change.
-4. Capture again into a third directory.
-5. Diff, then read the tinted shot of the largest movers to judge the change.
-
-## 1. One dev server, on a free port
-
-`storybook dev` keys its Vite dep cache off the config dir, so two servers on the
-same `-c` serve mismatched prebundles and every story dies with `Invalid hook
-call`. Check what is already up first — port 6006 is often another repo's
-Storybook, and its `index.json` then indexes the wrong stories:
-
-```bash
-for port in 6006 6007; do
-  curl -s -m 2 "http://localhost:$port/index.json" | head -c 60 && echo "  <- $port"
-done
-```
-
-Start the SigNoz one on a free port, from the repo's own binary so no package
-manager shim is in the way:
-
-```bash
-cd frontend
-nohup ./node_modules/.bin/storybook dev -p 6007 --no-open --quiet \
-  > "${TMPDIR:-/tmp}/signoz-storybook.log" 2>&1 &
-```
-
-It is ready when `curl -s localhost:6007/index.json` returns JSON whose
-`entries` hold SigNoz story ids.
-
-## 2. Capture
-
-Playwright is not a frontend dependency. The script finds it in `tests/e2e`
-(`pnpm -C tests/e2e install`, `@playwright/test` is enough) or in a global
-install, and launches Playwright's own chromium, falling back to an installed
-Chrome. Two escape hatches when that is not what a machine has:
-
-```bash
-export PLAYWRIGHT_MODULE=/path/to/playwright   # a different install
-export CHROME_PATH=/path/to/chrome             # a specific browser binary
-```
-
-Then pick the stories. `--list` prints the selection without shooting anything:
-
-```bash
-# every tooltip story of every page
-node scripts/story-shots.mjs .story-shots/baseline \
-  --port 6007 --title Pages/ --name tooltip --theme dark
-
-# a handful of stories by id or by title/name substring, both themes
-node scripts/story-shots.mjs .story-shots/baseline \
-  --port 6007 --stories pages-noz,dashboards/detail --theme dark,light
-```
-
-| Flag | Meaning |
-| --- | --- |
-| `--stories <match>` | id or `Title/Name` substring, repeatable or comma-separated. Omit for every story. |
-| `--title <prefix>` | only titles starting with the prefix (`Pages/`, `Components/`) |
-| `--name <match>` | only story names containing the match |
-| `--theme dark,light` | one pass per theme; omit for the story's own default (dark) |
-| `--args <k:v;k2:v2>` | arg overrides, Storybook's own `?args=` syntax, repeatable. A dotted value is dropped by Storybook itself, so map it to a slug inside the story's mocks |
-| `--port` | dev server port, or `$SB_PORT` |
-| `--width <px>` | the only fixed dimension, default 1680 |
-| `--height <px>` | shortest the viewport may be, default 1200 |
-| `--max-height <px>` | tallest it may grow to, default 8000 |
-| `--grow <what>` | `scrollers` (default) grows the viewport until the page's own scrollers fit, `document` only follows the document height, `none` keeps `--height` |
-| `--settle <ms>` | wait after the page goes quiet, default 1500 |
-| `--clock <iso\|live>` | wall clock the page reads, passed to the preview as `?storyClock`; `live` unfreezes it |
-| `--motion` | keep animations and transitions running (sets the `motion` global to `live`) |
-| `--ignore <selector>` | hide matching elements, on top of `[data-shot-ignore]` and `[data-chromatic="ignore"]` |
-| `--flat` | write `<out>/<id>.png`, no theme directory |
-| `--no-caption` | leave the caption band off the shots |
-| `--list` | print the matched stories and exit |
-
-Files land at `<out>/<theme>/<story-id>.png`, next to a `shots.json` recording
-what each shot is (id, title, name, theme, `ok`/`busy`, the caption's height in
-rows) and how the run was configured (args, clock, width, height, grow, motion,
-settle, ignore). Keep the flags identical between the two runs or the diff pairs
-nothing.
-
-Every shot carries the caption band described below, so a single screenshot says
-what it is on its own. `--no-caption` leaves it off, and so does a machine
-without ImageMagick (with a warning). The band never changes the shot's width
-(long text wraps rather than widening the canvas) and its height is recorded, so
-the diff crops it back off and never reports one caption against another. Two
-runs whose captions are different heights still diff to zero. A story that never held still for two
-identical frames is logged `busy` instead of `ok` — treat its diff as suspect.
-
-Dark alone is enough while iterating on the harness; add `light` for the run you
-report.
-
-## 3. Diff
-
-```bash
-node scripts/story-shots-diff.mjs .story-shots/baseline .story-shots/capped .story-shots/diff
-```
-
-Prints `<changed pixels>  <theme>/<story>.png`, largest first, and writes one
-image per pair. Needs ImageMagick for PNG encode/decode (7's `magick`, or 6's
-`convert`/`identify`/`montage`); the comparison itself is in the script.
-
-| Flag | Meaning |
-| --- | --- |
-| `--mode green` | default. The after shot with the changed pixels painted over it, exactly the pixels that changed. What Chromatic shows. |
-| `--mode green-parallel` | `previous \| current \| diff` in one image, each tile labelled above it, on a gutter inverted from the theme. The diff tile is the `green` one, so the after shot stays readable underneath. |
-| `--mode red` | the after shot faded to 10%, changed pixels in red. A pixelmatch-style diff, easiest to read when the change is a thin edge. |
-| `--mode red-parallel` | the same three tiles, with the `red` diff. Best when the change is a thin edge that the unfaded shot would swallow. |
-| `--threshold <0..1>` | how far a pixel must move to count. Default 0.063, Chromatic's `diffThreshold`. |
-| `--include-aa` | count antialiasing changes too. Off by default, as in Chromatic. |
-| `--tint <#rrggbb>` | override the mode's colour. |
-| `--no-caption` | drop the caption band. |
-
-### The caption
-
-Both scripts stamp a band on top of what they write: `story-shots.mjs` on each
-shot, from the story and the run's own settings; `story-shots-diff.mjs` on each
-diff, read out of the two runs' `shots.json`. It carries the story's
-`Title/Name`, then its id, theme and `busy` flag, then the settings both runs
-shared, each reading `key:value`. Whatever the two runs did **differently** goes
-on the side it belongs to: under `previous` and `current` on the parallel tiles,
-on two lines of the band otherwise. So a pair that differs only in `--args` says
-so on its face, which is what makes several shots of one story tellable apart.
-
-The shots' own bands are cropped off before comparing and before going into the
-tiles, so nothing in the output is a diff of a caption. Type size follows the
-image width, so it stays readable with the whole image viewed at fit-to-width;
-the heading is set in an installed sans and the detail lines in a mono, falling
-back to ImageMagick's default when neither is on the machine. Without a manifest
-the band falls back to the file path, and a directory of captioned shots whose
-`shots.json` is missing has nothing to crop by, so its captions do land in the
-diff. Keep `shots.json` next to the shots.
-
-### How the comparison works
-
-Chromatic's own capture and diff run server-side — `chromatic-cli` uploads a
-built Storybook and contains no capture or comparison code at all. What is public
-is the parameter contract, and the numbers in it say what the comparison is:
-`diffThreshold` defaults to `0.063` on a 0-1 scale, which is pixelmatch's
-`threshold`, and `diffIncludeAntiAliasing` defaults to false, which is
-pixelmatch's `includeAA: false`. So the script implements that comparison:
-
-1. Both PNGs are read as raw RGBA through `magick … RGBA:-`.
-2. Per pixel, the squared YIQ distance between the two colours (weights
-   `0.5053 / 0.299 / 0.1957`), compared against `35215 * threshold²` — 35215 is
-   the largest distance two 8-bit colours can have. Chroma is included, so a
-   colour swap at equal brightness still counts.
-3. A pixel over the threshold is dropped when it is only antialiasing: it is the
-   darkest or lightest of its eight neighbours, and the other image has a pixel
-   around there doing the same job. This is what keeps a subpixel glyph edge from
-   reading as a change.
-4. What survives is painted at full opacity, one output pixel per changed input
-   pixel. No dilation, no blobs — a one-pixel shift shows as a one-pixel line.
-
-A pair whose shots are different sizes is compared over the overlap, and every
-row and column that exists in only one of them counts as changed.
-
-Pairing is by `<theme>/<story-id>.png`, so a story that exists on only one side
-(new on the feature branch, renamed, retitled) has nothing to pair with and is
-skipped silently. On a branch-vs-branch run, compare the two runs' file lists
-before reading the numbers.
-
-## What makes a shot reproducible
-
-Most of it is in the preview, not in the script, so a Chromatic build in the
-cloud shoots the same page: `.storybook/preview-head.html` freezes the clock,
-and `settleForCapture` (the preview's `afterEach`, which runs after `play`)
-parks the animations and snaps the bottom-pinned lists. The script drives the
-rest:
-
-- **Storybook's own render phase is the readiness signal.** It waits for
-  `window.__STORYBOOK_PREVIEW__.storyRenders[].phase === 'finished'`, which is
-  reached only after the loaders, the decorators and the story's `play` are done.
-  A DOM check cannot see a `play` still running. (Storybook 10 spells the final
-  phase `finished`, not `completed`.)
-- **Network quiescence, not `networkidle`.** react-query retries and msw keep
-  requests going after load, and a few stories hang a request by design, so the
-  wait is "no request for 600ms", capped at 15s.
-- **The clock is frozen** (`2026-06-15T12:00:00Z`), by the preview itself. Chart windows, `4 mins ago`
-  labels and trial countdowns all derive from `now`; a live clock alone moved
-  8000 pixels on the dashboards list and redrew every chart axis.
-- **Animations are parked on their last frame** by `html.sb-still`, a
-  zero-length single iteration with `forwards` fill, plus `prefers-reduced-
-  motion`. The Motion toolbar item (`still` by default) turns it off. An infinite
-  spinner is otherwise caught at a random angle.
-- **`document.fonts.ready`**, because text reflows when a face lands late.
-- **Lists pinned to their bottom are snapped onto it**, once by the preview and
-  again by the script after the page goes quiet. A virtuoso list settles a
-  few pixels short of the end depending on the order its items were measured in.
-- **Two identical frames in a row**, because what a page is still waiting on is
-  often not observable from outside it.
-- **`[data-shot-ignore]`, `[data-chromatic="ignore"]` and `--ignore <selector>`**
-  hide a region that cannot be held still; Chromatic excludes the same attribute
-  from its comparison.
-- **The width is the only fixed dimension.** Chromatic's `viewports` are widths;
-  the height follows the page. `src/styles.scss` pins `html, body, #root` to
-  `height: 100%; overflow: hidden`, so the document never outgrows the viewport
-  and its height says nothing: what overflows are the shell's inner scrollers.
-  `--grow scrollers`, the default, grows the viewport until the tallest in-flow
-  scroller fits, so nothing is cut off and no scrollbar is left in the shot (the
-  dashboards list goes to 2226px in one round). Popups are skipped — they are out
-  of the flow, and a tall dropdown would otherwise drag the shot to a height
-  nothing on the page needs. A page that sizes a panel in `vh` grows its own
-  content as the viewport grows, so no height ever fits it and the rounds only
-  chase — `.alert-chart-container` is `57vh`, which puts Create Alert's fixed
-  point at 4344px with an empty band on top. Those pages are shot at `--height`
-  with their own scrollbar, which is what they look like in a browser, and the
-  log says `(viewport-sized content, stopped chasing Npx)`.
-
-With all of that, 29 of the 32 page tooltip stories are byte-identical across
-runs. The three that are not, and why:
-
-| Story | Residual | Cause |
-| --- | --- | --- |
-| `kubernetes-pods--tooltips-in-options-panel` | ~13k px | 24 tooltips held open in an overlapping cluster; they portal to `body` in mount order, and the drawer's own tooltips mount before or after the list's depending on when their data lands, so overlapping tooltips stack differently. Panel geometry itself is stable. |
-| `settings-role-editor--tooltips-in-json-editor` | ~2.5k px | monaco re-measures and lands one pixel off. |
-| `traces-trace-details--tooltips` | ~800 px | same class, one row of the waterfall. |
-
-Each is bimodal — two stable arrangements — so the same number reappears run
-after run. Diff a story against itself before believing its number, and reach
-for `--ignore` when a region cannot be settled.
-
-## Gotchas
-
-- **Zero pixels is a real answer.** A story whose tooltips are all short is
-  unaffected by a tooltip rule; it is not a broken capture.
-- **The selector matters more than the rule.** A global rule on
-  `[data-slot='…']` only reaches design-system components. antd's own tooltips
-  (`.ant-tooltip-inner`, e.g. the Create Alert help popups) are untouched, which
-  is why some stories show no diff at all.
-- **Global style overrides need `!important`.** `src/styles.scss` loads before
-  the design system injects its CSS-module styles at runtime, so a plain rule on
-  a `[data-slot='…']` element loses. A component-level `!important` of the same
-  specificity still wins over it — `PanelStatusPopover.module.scss` keeps its own
-  `max-width: 520px !important`.
-- **A fresh context per story** is why a full sweep takes ~6 min for 32 stories.
-  Reusing one page loses the msw service worker re-registration race and stories
-  start failing after a few navigations.
-- **Stories behind a hover, drawer or modal** only render what their `play`
-  reaches. If a state is missing from the shot, the story needs the `play`, not
-  the script.

.gitattributes

@@ -1,3 +1 @@
-*.css linguist-detectable=false
-*.stories.mocks.tsx linguist-generated=true
-**/__story_mockdata__/** linguist-generated=true
+*.css linguist-detectable=false

.github/CODEOWNERS

@@ -15,10 +15,6 @@
 .github @therealpandey
 go.mod @therealpandey
 
-# Security
-
-/SECURITY.md @therealpandey
-
 # Scaffold Owners
 
 /pkg/config/ @therealpandey
@@ -156,29 +152,39 @@ go.mod @therealpandey
 
 ## Dashboard Types
 
-/frontend/src/types/api/dashboard/ @SigNoz/pulse-frontend
-/frontend/src/types/api/widgets/ @SigNoz/pulse-frontend
+/frontend/src/api/types/dashboard/ @SigNoz/pulse-frontend
 
-## Widget Card
+## Dashboard List
 
-/frontend/src/container/WidgetCard/ @SigNoz/pulse-frontend
+/frontend/src/pages/DashboardsListPage/ @SigNoz/pulse-frontend
+/frontend/src/container/ListOfDashboard/ @SigNoz/pulse-frontend
+
+# Dashboard Widget Page
+
+/frontend/src/pages/DashboardWidget/ @SigNoz/pulse-frontend
+/frontend/src/container/NewWidget/ @SigNoz/pulse-frontend
+
+## Dashboard Page
+
+/frontend/src/pages/DashboardPage/ @SigNoz/pulse-frontend
+/frontend/src/container/DashboardContainer/ @SigNoz/pulse-frontend
+/frontend/src/container/GridCardLayout/ @SigNoz/pulse-frontend
 
 ## Public Dashboard Page
 
 /frontend/src/pages/PublicDashboard/ @SigNoz/pulse-frontend
+/frontend/src/container/PublicDashboardContainer/ @SigNoz/pulse-frontend
 
 ## Dashboard Libs + Components
 
 /frontend/src/lib/uPlotV2/ @SigNoz/pulse-frontend
-/frontend/src/lib/visualization/ @SigNoz/pulse-frontend
 /frontend/src/lib/dashboard/ @SigNoz/pulse-frontend
 /frontend/src/lib/dashboardVariables/ @SigNoz/pulse-frontend
 /frontend/src/components/NewSelect/ @SigNoz/pulse-frontend
 
-## Dashboard Pages
-
-/frontend/src/pages/DashboardPage/ @SigNoz/pulse-frontend
-/frontend/src/pages/DashboardsListPage/ @SigNoz/pulse-frontend
+## Dashboard V2
+/frontend/src/pages/DashboardPageV2/ @SigNoz/pulse-frontend
+/frontend/src/pages/DashboardsListPageV2/ @SigNoz/pulse-frontend
 
 ## Infrastructure Monitoring
 /frontend/src/pages/InfrastructureMonitoring/ @SigNoz/pulse-frontend

.github/pull_request_template.md

@@ -1,13 +1,85 @@
-<!--A few plain bullets saying what changed and why, for a reviewer skimming it - not a wall of text, not a restatement of the diff, not generated boilerplate.-->
-#### Description
+## Pull Request
+
+---
+
+### 📄 Summary
+> Why does this change exist?  
+> What problem does it solve, and why is this the right approach?
+
+
+
+#### Screenshots / Screen Recordings (if applicable)
+> Include screenshots or screen recordings that clearly show the behavior before the change and the result after the change. This helps reviewers quickly understand the impact and verify the update.
+
 
-<!--Reference issues using `Closes #issue-number` to enable automatic closure on merge. -->
 #### Issues closed by this PR
+> Reference issues using `Closes #issue-number` to enable automatic closure on merge.
 
-<!--If applicable, include screenshots or screen recordings that clearly show the behavior before the change and the result after the change. -->
-#### Screenshots / Screen Recordings
+---
 
-<!--Anything reviewers should keep in mind while reviewing -->
-#### Additional Information
+### ✅ Change Type
+_Select all that apply_
 
-<!--Please delete paragraphs that you did not use before submitting.-->
+- [ ] ✨ Feature
+- [ ] 🐛 Bug fix
+- [ ] ♻️ Refactor
+- [ ] 🛠️ Infra / Tooling
+- [ ] 🧪 Test-only
+
+---
+
+### 🐛 Bug Context
+> Required if this PR fixes a bug
+
+#### Root Cause
+> What caused the issue?  
+> Regression, faulty assumption, edge case, refactor, etc.
+
+#### Fix Strategy
+> How does this PR address the root cause?
+
+---
+
+### 🧪 Testing Strategy
+> How was this change validated?
+
+- Tests added/updated:
+- Manual verification:
+- Edge cases covered:
+
+---
+
+### ⚠️ Risk & Impact Assessment
+> What could break? How do we recover?
+
+- Blast radius:
+- Potential regressions:
+- Rollback plan:
+
+---
+
+### 📝 Changelog
+> Fill only if this affects users, APIs, UI, or documented behavior  
+> Use **N/A** for internal or non-user-facing changes
+
+| Field | Value |
+|------|-------|
+| Deployment Type | Cloud / OSS / Enterprise |
+| Change Type | Feature / Bug Fix / Maintenance |
+| Description | User-facing summary |
+
+---
+
+### 📋 Checklist
+- [ ] Tests added or explicitly not required
+- [ ] Manually tested
+- [ ] Breaking changes documented
+- [ ] Backward compatibility considered
+
+---
+
+## 👀 Notes for Reviewers
+
+<!-- Anything reviewers should keep in mind while reviewing -->
+
+---

.github/workflows/build-enterprise.yaml

@@ -103,6 +103,7 @@ jobs:
         -X github.com/SigNoz/signoz/pkg/version.branch=${{ needs.prepare.outputs.branch }}
         -X github.com/SigNoz/signoz/ee/zeus.url=https://api.signoz.cloud
         -X github.com/SigNoz/signoz/ee/zeus.deprecatedURL=https://license.signoz.io
+        -X github.com/SigNoz/signoz/ee/query-service/constants.LicenseSignozIo=https://license.signoz.io/api/v1
         -X github.com/SigNoz/signoz/pkg/analytics.key=9kRrJ7oPCGPEJLF6QjMPLt5bljFhRQBr'
       DOCKER_BASE_IMAGES: '{"alpine": "alpine:3.20.3"}'
       DOCKER_DOCKERFILE_PATH: ./cmd/enterprise/Dockerfile.multi-arch

.github/workflows/build-staging.yaml

@@ -109,6 +109,7 @@ jobs:
         -X github.com/SigNoz/signoz/pkg/version.branch=${{ needs.prepare.outputs.branch }}
         -X github.com/SigNoz/signoz/ee/zeus.url=https://api.staging.signoz.cloud
         -X github.com/SigNoz/signoz/ee/zeus.deprecatedURL=https://license.staging.signoz.cloud
+        -X github.com/SigNoz/signoz/ee/query-service/constants.LicenseSignozIo=https://license.staging.signoz.cloud/api/v1
         -X github.com/SigNoz/signoz/pkg/analytics.key=9kRrJ7oPCGPEJLF6QjMPLt5bljFhRQBr'
       DOCKER_BASE_IMAGES: '{"alpine": "alpine:3.20.3"}'
       DOCKER_DOCKERFILE_PATH: ./cmd/enterprise/Dockerfile.multi-arch

.github/workflows/cacheci.yml

@@ -1,92 +0,0 @@
-name: cacheci
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: write
-
-# Cancelling mid-rotation is safe: the sequential delete-then-save order
-# leaves at most one key missing at any moment.
-concurrency:
-  group: cacheci
-  cancel-in-progress: true
-
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout
-        uses: actions/checkout@v4
-      - name: restore
-        id: restore
-        uses: actions/cache/restore@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-primary
-          restore-keys: |
-            tests-secondary
-      - name: inject
-        if: steps.restore.outputs.cache-matched-key != ''
-        run: |
-          cat > "$RUNNER_TEMP/inject.Dockerfile" <<'EOF'
-          FROM busybox:1.37
-          RUN --mount=type=cache,target=/root/.cache/go-build \
-              --mount=type=cache,target=/go/pkg/mod \
-              --mount=type=cache,target=/pnpm/store \
-              --mount=type=bind,target=/restored \
-              tar -xf /restored/go-build.tar -C /root/.cache/go-build && \
-              tar -xf /restored/go-mod.tar -C /go/pkg/mod && \
-              tar -xf /restored/pnpm-store.tar -C /pnpm/store
-          EOF
-          docker build -f "$RUNNER_TEMP/inject.Dockerfile" "$RUNNER_TEMP/cacheci"
-      - name: build
-        run: |
-          docker build -f cmd/enterprise/Dockerfile.integration --build-arg TARGETARCH=amd64 --build-arg ZEUSURL=http://zeus:8080 .
-          docker build -f cmd/enterprise/Dockerfile.with-web.integration --build-arg TARGETARCH=amd64 --build-arg ZEUSURL=http://zeus:8080 .
-      # docker cp instead of --output type=local (the local exporter stalls on
-      # multi-GB outputs); tarballs instead of raw trees so the host never hits
-      # the permission and symlink semantics that broke docker cp.
-      - name: extract
-        run: |
-          rm -rf "$RUNNER_TEMP/cacheci"
-          mkdir -p "$RUNNER_TEMP/cacheci" "$RUNNER_TEMP/extract-context"
-          cat > "$RUNNER_TEMP/extract.Dockerfile" <<'EOF'
-          FROM busybox:1.37
-          RUN --mount=type=cache,target=/root/.cache/go-build \
-              --mount=type=cache,target=/go/pkg/mod \
-              --mount=type=cache,target=/pnpm/store \
-              mkdir -p /out && \
-              tar -cf /out/go-build.tar -C /root/.cache/go-build . && \
-              tar -cf /out/go-mod.tar -C /go/pkg/mod . && \
-              tar -cf /out/pnpm-store.tar -C /pnpm/store .
-          EOF
-          docker build -f "$RUNNER_TEMP/extract.Dockerfile" -t cacheci-extract "$RUNNER_TEMP/extract-context"
-          id=$(docker create cacheci-extract)
-          docker cp "$id":/out/. "$RUNNER_TEMP/cacheci/"
-          docker rm "$id"
-      # Fixed cache keys are immutable, so each key must be deleted before it
-      # can be saved again. Rotating primary and secondary one after the other
-      # keeps at least one key restorable for concurrent test runs.
-      - name: delete-primary
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh cache delete tests-primary --repo "$GITHUB_REPOSITORY" || true
-      - name: save-primary
-        uses: actions/cache/save@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-primary
-      - name: delete-secondary
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh cache delete tests-secondary --repo "$GITHUB_REPOSITORY" || true
-      - name: save-secondary
-        uses: actions/cache/save@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-secondary

.github/workflows/docs.yml

@@ -0,0 +1,83 @@
+name: "Update PR labels and Block PR until related docs are shipped for the feature"
+
+on:
+  pull_request:
+    branches:
+      - main
+    types: [opened, edited, labeled, unlabeled]
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  docs_label_check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR Title and Manage Labels
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const prTitle = context.payload.pull_request.title;
+            const prNumber = context.payload.pull_request.number;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Fetch the current PR details to get labels
+            const pr = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: prNumber
+            });
+
+            const labels = pr.data.labels.map(label => label.name);
+
+            if (prTitle.startsWith('feat:')) {
+              const hasDocsRequired = labels.includes('docs required');
+              const hasDocsShipped = labels.includes('docs shipped');
+              const hasDocsNotRequired = labels.includes('docs not required');
+
+              // If "docs not required" is present, skip the checks
+              if (hasDocsNotRequired && !hasDocsRequired) {
+                console.log("Skipping checks due to 'docs not required' label.");
+                return; // Exit the script early
+              }
+              
+              // If "docs shipped" is present, remove "docs required" if it exists
+              if (hasDocsShipped && hasDocsRequired) {
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: prNumber,
+                  name: 'docs required'
+                });
+                console.log("Removed 'docs required' label.");
+              }
+
+              // Add "docs required" label if neither "docs shipped" nor "docs required" are present
+              if (!hasDocsRequired && !hasDocsShipped) {
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number: prNumber,
+                  labels: ['docs required']
+                });
+                console.log("Added 'docs required' label.");
+              }
+            }
+
+            // Fetch the updated labels after any changes
+            const updatedPr = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: prNumber
+            });
+
+            const updatedLabels = updatedPr.data.labels.map(label => label.name);
+            const updatedHasDocsRequired = updatedLabels.includes('docs required');
+            const updatedHasDocsShipped = updatedLabels.includes('docs shipped');
+
+            // Block PR if "docs required" is still present and "docs shipped" is missing
+            if (updatedHasDocsRequired && !updatedHasDocsShipped) {
+              core.setFailed("This PR requires documentation. Please remove the 'docs required' label and add the 'docs shipped' label to proceed.");
+            }

.github/workflows/e2eci.yaml

@@ -75,30 +75,6 @@ jobs:
           docker rm pw
           echo "PLAYWRIGHT_BROWSERS_PATH=$RUNNER_TEMP/ms-playwright" >> "$GITHUB_ENV"
           cd tests/e2e && pnpm playwright install-deps ${{ matrix.project }}
-      # Restore-only: the cacheci workflow owns cache saves. Seeds the
-      # BuildKit cache mounts so the in-test image build is incremental.
-      - name: restore
-        id: restore
-        uses: actions/cache/restore@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-primary
-          restore-keys: |
-            tests-secondary
-      - name: inject
-        if: steps.restore.outputs.cache-matched-key != ''
-        run: |
-          cat > "$RUNNER_TEMP/inject.Dockerfile" <<'EOF'
-          FROM busybox:1.37
-          RUN --mount=type=cache,target=/root/.cache/go-build \
-              --mount=type=cache,target=/go/pkg/mod \
-              --mount=type=cache,target=/pnpm/store \
-              --mount=type=bind,target=/restored \
-              tar -xf /restored/go-build.tar -C /root/.cache/go-build && \
-              tar -xf /restored/go-mod.tar -C /go/pkg/mod && \
-              tar -xf /restored/pnpm-store.tar -C /pnpm/store
-          EOF
-          docker build -f "$RUNNER_TEMP/inject.Dockerfile" "$RUNNER_TEMP/cacheci"
       - name: bring-up-stack
         run: |
           cd tests && \

.github/workflows/goci.yaml

@@ -53,21 +53,6 @@ jobs:
     with:
       PRIMUS_REF: main
       GO_VERSION: 1.24
-  semconv-generated:
-    if: |
-      github.event_name == 'merge_group' ||
-      (github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login != 'dependabot[bot]' && ! contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
-      (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe-to-test'))
-    runs-on: ubuntu-latest
-    steps:
-      - name: self-checkout
-        uses: actions/checkout@v4
-      - name: go-install
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.24"
-      - name: check-semconv-generated-files
-        run: go run ./scripts/semconv -check
   build:
     if: |
       github.event_name == 'merge_group' ||

.github/workflows/integrationci.yaml

@@ -39,8 +39,6 @@ jobs:
       matrix:
         suite:
           - alerts
-          - alertmanager
-          - alertmanagerrotation
           - basepath
           - callbackauthn
           - cloudintegrations
@@ -50,21 +48,16 @@ jobs:
           - logspipelines
           - passwordauthn
           - preference
-          - quickfilter
           - querierlogs
           - queriertraces
           - queriermetrics
           - querierscalar
           - queriercommon
-          - querierai
           - rawexportdata
           - promqlconformance
-          - promapiconformance
           - querierauthz
           - role
           - rootuser
-          - savedview
-          - semconvfamilies
           - serviceaccount
           - spanmapper
           - querier_json_body
@@ -117,30 +110,6 @@ jobs:
           sudo mv chromedriver-linux64/chromedriver /usr/local/bin/chromedriver
           chromedriver -version
           google-chrome-stable --version
-      # Restore-only: the cacheci workflow owns cache saves. Seeds the
-      # BuildKit cache mounts so the in-test image build is incremental.
-      - name: restore
-        id: restore
-        uses: actions/cache/restore@v4
-        with:
-          path: ${{ runner.temp }}/cacheci
-          key: tests-primary
-          restore-keys: |
-            tests-secondary
-      - name: inject
-        if: steps.restore.outputs.cache-matched-key != ''
-        run: |
-          cat > "$RUNNER_TEMP/inject.Dockerfile" <<'EOF'
-          FROM busybox:1.37
-          RUN --mount=type=cache,target=/root/.cache/go-build \
-              --mount=type=cache,target=/go/pkg/mod \
-              --mount=type=cache,target=/pnpm/store \
-              --mount=type=bind,target=/restored \
-              tar -xf /restored/go-build.tar -C /root/.cache/go-build && \
-              tar -xf /restored/go-mod.tar -C /go/pkg/mod && \
-              tar -xf /restored/pnpm-store.tar -C /pnpm/store
-          EOF
-          docker build -f "$RUNNER_TEMP/inject.Dockerfile" "$RUNNER_TEMP/cacheci"
       - name: run
         run: |
           cd tests && \

.gitignore

@@ -90,6 +90,8 @@ queries.active
 .devenv/**/tmp/**
 .qodo
 
+.dev
+
 ### Python ###
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -229,7 +231,4 @@ cython_debug/
 # LSP config files
 pyrightconfig.json
 
-# dev
-.dev/
-.claude/worktrees/
-.claude/settings.local.json
+

Makefile

@@ -81,13 +81,10 @@ devenv-clickhouse-clean: ## Clean all ClickHouse data from filesystem
 ##############################################################
 # go commands
 ##############################################################
-SIGNOZ_SQLSTORE_SQLITE_PATH ?= signoz.db
-SIGNOZ_APISERVER_ADDRESS    ?= 0.0.0.0:8080
-
 .PHONY: go-run-enterprise
 go-run-enterprise: ## Runs the enterprise go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SIGNOZ_SQLSTORE_SQLITE_PATH) \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
@@ -104,7 +101,7 @@ go-test: ## Runs go unit tests
 .PHONY: go-run-community
 go-run-community: ## Runs the community go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SIGNOZ_SQLSTORE_SQLITE_PATH) \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
@@ -114,28 +111,6 @@ go-run-community: ## Runs the community go backend server
 	go run -race \
 		$(GO_BUILD_CONTEXT_COMMUNITY)/*.go server
 
-.PHONY: go-stop
-go-stop: ## Stops the go backend server listening on SIGNOZ_APISERVER_ADDRESS, waiting for it to release every port it holds
-	@PORT=$(lastword $(subst :, ,$(SIGNOZ_APISERVER_ADDRESS))); \
-	PIDS=$$(lsof -ti tcp:$$PORT); \
-	if [ -z "$$PIDS" ]; then \
-		echo "No signoz server running on port $$PORT."; \
-		echo "If it's running on a different port, rerun as: make go-stop SIGNOZ_APISERVER_ADDRESS=host:port"; \
-		exit 0; \
-	fi; \
-	kill $$PIDS 2>/dev/null; \
-	for i in $$(seq 1 10); do \
-		alive=$$(for p in $$PIDS; do kill -0 $$p 2>/dev/null && echo $$p; done); \
-		[ -z "$$alive" ] && break; \
-		sleep 1; \
-	done; \
-	alive=$$(for p in $$PIDS; do kill -0 $$p 2>/dev/null && echo $$p; done); \
-	if [ -n "$$alive" ]; then \
-		echo "Graceful shutdown did not finish in 10s, sending SIGKILL to $$alive"; \
-		kill -9 $$alive 2>/dev/null; \
-	fi; \
-	echo "Stopped signoz server on port $$PORT (pid $$PIDS)"
-
 .PHONY: go-build-community $(GO_BUILD_ARCHS_COMMUNITY)
 go-build-community: ## Builds the go backend server for community
 go-build-community: $(GO_BUILD_ARCHS_COMMUNITY)
@@ -234,8 +209,8 @@ py-lint: ## Run ruff check across the shared tests project
 	@cd tests && uv run ruff check --fix .
 
 .PHONY: py-test-setup
-py-test-setup: ## Bring up the shared SigNoz backend used by integration and e2e tests, rebuilding signoz from the current sources
-	@cd tests && uv run pytest --basetemp=./tmp/ -vv --reuse --rebuild --capture=no integration/bootstrap/setup.py::test_setup
+py-test-setup: ## Bring up the shared SigNoz backend used by integration and e2e tests
+	@cd tests && uv run pytest --basetemp=./tmp/ -vv --reuse --capture=no integration/bootstrap/setup.py::test_setup
 
 .PHONY: py-test-teardown
 py-test-teardown: ## Tear down the shared SigNoz backend
@@ -258,16 +233,7 @@ py-clean: ## Clear all pycache and pytest cache from tests directory recursively
 ##############################################################
 # generate commands
 ##############################################################
-.PHONY: semconv-generate
-semconv-generate: ## Regenerate semantic-convention families for Go and TypeScript
-	@go run ./scripts/semconv
-
 .PHONY: gen-mocks
 gen-mocks:
 	@echo ">> Generating mocks"
 	@mockery --config .mockery.yml
-
-.PHONY: gen-openapi-specs
-gen-openapi-specs:
-	@go run cmd/enterprise/*.go generate openapi
-	cd frontend && pnpm generate:api && cd -

SECURITY.md

@@ -1,26 +1,17 @@
 # Security Policy
 
-SigNoz is looking forward to working with security researchers across the world to keep SigNoz and our users safe. If you have found an issue in our systems/applications, please report it to us privately.
+SigNoz is looking forward to working with security researchers across the world to keep SigNoz and our users safe. If you have found an issue in our systems/applications, please reach out to us.
 
 ## Supported Versions
-
-We always recommend using the latest version of SigNoz to ensure you get all security updates.
+We always recommend using the latest version of SigNoz to ensure you get all security updates
 
 ## Reporting a Vulnerability
 
 If you believe you have found a security vulnerability within SigNoz, please let us know right away. We'll try and fix the problem as soon as possible.
 
-**Do not report vulnerabilities using public GitHub issues, discussions, or pull requests.**
+**Do not report vulnerabilities using public GitHub issues**. Instead, email <security@signoz.io> with a detailed account of the issue. Please submit one issue per email, this helps us triage vulnerabilities.
 
-Instead, report it privately through GitHub's private vulnerability reporting:
-
-1. Go to the [**Security** tab](https://github.com/SigNoz/signoz/security) of this repository.
-2. Click **Report a vulnerability**, or use [this link](https://github.com/SigNoz/signoz/security/advisories/new).
-3. Describe the issue with as much detail as you can — affected version, impact, and steps to reproduce help us triage faster. Please submit one report per vulnerability.
-
-This opens a private advisory visible only to you and the SigNoz maintainers. We'll respond there, keep you updated as we work on a fix, and coordinate disclosure. If the report is valid we'll credit you on the published advisory and request a CVE.
-
-If you're unable to use GitHub's private reporting, you can email <security@signoz.io> instead.
+Once we've received your email we'll keep you updated as we fix the vulnerability.
 
 ## Thanks
 

cmd/authz.go

@@ -96,9 +96,6 @@ func runGenerateAuthz(_ context.Context) error {
 		coretypes.NewResourceRef(coretypes.ResourceServiceAccount).String():                true,
 		coretypes.NewResourceRef(coretypes.ResourceRole).String():                          true,
 		coretypes.NewResourceRef(coretypes.ResourceMetaResourceFactorAPIKey).String():      true,
-		coretypes.NewResourceRef(coretypes.ResourceMetaResourceDashboard).String():         true,
-		coretypes.NewResourceRef(coretypes.ResourceMetaResourceLicense).String():           true,
-		coretypes.NewResourceRef(coretypes.ResourceMetaResourceSubscription).String():      true,
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceLogs).String():         true,
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceTraces).String():       true,
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceMetrics).String():      true,

cmd/community/server.go

@@ -44,11 +44,8 @@ import (
 	"github.com/SigNoz/signoz/pkg/ruler/signozruler"
 	"github.com/SigNoz/signoz/pkg/signoz"
 	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/subscription"
-	"github.com/SigNoz/signoz/pkg/subscription/noopsubscription"
 	"github.com/SigNoz/signoz/pkg/telemetrystore"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/version"
 	"github.com/SigNoz/signoz/pkg/zeus"
@@ -89,9 +86,6 @@ func runServer(ctx context.Context, config signoz.Config, logger *slog.Logger) e
 		func(_ sqlstore.SQLStore, _ zeus.Zeus, _ organization.Getter, _ analytics.Analytics) factory.ProviderFactory[licensing.Licensing, licensing.Config] {
 			return nooplicensing.NewFactory()
 		},
-		func(_ zeus.Zeus, _ licensing.Licensing) subscription.Subscription {
-			return noopsubscription.New()
-		},
 		signoz.NewEmailingProviderFactories(),
 		signoz.NewCacheProviderFactories(),
 		signoz.NewWebProviderFactories(config.Global),
@@ -109,8 +103,8 @@ func runServer(ctx context.Context, config signoz.Config, logger *slog.Logger) e
 
 			return openfgaauthz.NewProviderFactory(sqlstore, openfgaschema.NewSchema().Get(ctx), openfgaDataStore, authtypes.NewRegistry()), nil
 		},
-		func(store sqlstore.SQLStore, settings factory.ProviderSettings, analytics analytics.Analytics, orgGetter organization.Getter, queryParser queryparser.QueryParser, _ querier.Querier, _ licensing.Licensing, tagModule tag.Module, systemDashboardRegistry dashboardtypes.SystemDashboardRegistry) dashboard.Module {
-			return impldashboard.NewModule(impldashboard.NewStore(store), settings, analytics, orgGetter, queryParser, tagModule, systemDashboardRegistry)
+		func(store sqlstore.SQLStore, settings factory.ProviderSettings, analytics analytics.Analytics, orgGetter organization.Getter, queryParser queryparser.QueryParser, _ querier.Querier, _ licensing.Licensing, tagModule tag.Module) dashboard.Module {
+			return impldashboard.NewModule(impldashboard.NewStore(store), settings, analytics, orgGetter, queryParser, tagModule)
 		},
 		func(_ licensing.Licensing) factory.ProviderFactory[gateway.Gateway, gateway.Config] {
 			return noopgateway.NewProviderFactory()

cmd/enterprise/.goreleaser.yaml

@@ -31,6 +31,7 @@ builds:
       - -X github.com/SigNoz/signoz/pkg/version.branch={{ .Branch }}
       - -X github.com/SigNoz/signoz/ee/zeus.url=https://api.signoz.cloud
       - -X github.com/SigNoz/signoz/ee/zeus.deprecatedURL=https://license.signoz.io
+      - -X github.com/SigNoz/signoz/ee/query-service/constants.LicenseSignozIo=https://license.signoz.io/api/v1
       - -X github.com/SigNoz/signoz/pkg/analytics.key=9kRrJ7oPCGPEJLF6QjMPLt5bljFhRQBr
     mod_timestamp: "{{ .CommitTimestamp }}"
     tags:

cmd/enterprise/Dockerfile.integration

@@ -4,13 +4,9 @@ ARG OS="linux"
 ARG TARGETARCH
 ARG ZEUSURL
 
-# HOME comes from the build user, not the image config; declare it so the
-# /root paths below trace to it.
-ENV HOME=/root
-
 # This path is important for stacktraces
 WORKDIR $GOPATH/src/github.com/signoz/signoz
-WORKDIR $HOME
+WORKDIR /root
 
 RUN set -eux; \
 	apt-get update; \
@@ -18,36 +14,23 @@ RUN set -eux; \
 		g++ \
 		gcc \
 		libc6-dev \
+		make \
 		pkg-config \
 	; \
 	rm -rf /var/lib/apt/lists/*
 
-# Keep the literal cache-mount targets below in sync with these. The caches
-# are shared with Dockerfile.with-web.integration (same target paths).
-ENV GOCACHE=$HOME/.cache/go-build
-ENV GOMODCACHE=$GOPATH/pkg/mod
-
 COPY go.mod go.sum ./
 
-RUN --mount=type=cache,target=/go/pkg/mod \
-	go mod download
+RUN go mod download
 
 COPY ./cmd/ ./cmd/
 COPY ./ee/ ./ee/
 COPY ./pkg/ ./pkg/
 COPY ./templates /root/templates
 
-# Invoked directly instead of via make so Makefile changes don't invalidate
-# this layer; the Makefile's git-derived ldflags resolve to empty in here
-# anyway (.git is dockerignored).
-RUN --mount=type=cache,target=/go/pkg/mod \
-	--mount=type=cache,target=/root/.cache/go-build \
-	GOARCH=${TARGETARCH} GOOS=${OS} go build -C ./cmd/enterprise -race -tags timetzdata -o /root/signoz \
-	-ldflags "-s -w \
-		-X github.com/SigNoz/signoz/pkg/version.version=integration \
-		-X github.com/SigNoz/signoz/pkg/version.variant=enterprise \
-		-X github.com/SigNoz/signoz/ee/zeus.url=${ZEUSURL} \
-		-X github.com/SigNoz/signoz/ee/zeus.deprecatedURL=${ZEUSURL}/api/v1"
+COPY Makefile Makefile
+RUN TARGET_DIR=/root ARCHS=${TARGETARCH} ZEUS_URL=${ZEUSURL} LICENSE_URL=${ZEUSURL}/api/v1 make go-build-enterprise-race
+RUN mv /root/linux-${TARGETARCH}/signoz /root/signoz
 
 RUN chmod 755 /root /root/signoz
 

cmd/enterprise/Dockerfile.with-web.integration

@@ -1,23 +1,10 @@
 FROM node:22-bookworm AS build
 
 WORKDIR /opt/
-
-# HOME comes from the build user, not the image config.
-ENV HOME=/root
-# pnpm's store lives at $PNPM_HOME/store — a dedicated directory pnpm
-# manages. Keep the literal cache-mount targets below in sync.
-ENV PNPM_HOME=/pnpm
-ENV NODE_OPTIONS=--max-old-space-size=8192
-
-RUN CI=1 npm i -g pnpm@10
-
-# pnpm fetch resolves from the lockfile alone and runs no lifecycle scripts;
-# the repo's postinstall needs source files that are not copied yet.
-COPY ./frontend/package.json ./frontend/pnpm-lock.yaml ./frontend/pnpm-workspace.yaml ./
-RUN --mount=type=cache,target=/pnpm/store CI=1 pnpm fetch
-
 COPY ./frontend/ ./
-RUN --mount=type=cache,target=/pnpm/store CI=1 pnpm install --offline
+ENV NODE_OPTIONS=--max-old-space-size=8192
+RUN CI=1 npm i -g pnpm@10
+RUN CI=1 pnpm install
 RUN CI=1 pnpm build
 
 FROM golang:1.25-bookworm
@@ -26,13 +13,9 @@ ARG OS="linux"
 ARG TARGETARCH
 ARG ZEUSURL
 
-# HOME comes from the build user, not the image config; declare it so the
-# /root paths below trace to it.
-ENV HOME=/root
-
 # This path is important for stacktraces
 WORKDIR $GOPATH/src/github.com/signoz/signoz
-WORKDIR $HOME
+WORKDIR /root
 
 RUN set -eux; \
 	apt-get update; \
@@ -40,36 +23,23 @@ RUN set -eux; \
 		g++ \
 		gcc \
 		libc6-dev \
+		make \
 		pkg-config \
 	; \
 	rm -rf /var/lib/apt/lists/*
 
-# Keep the literal cache-mount targets below in sync with these. The caches
-# are shared with Dockerfile.integration (same target paths).
-ENV GOCACHE=$HOME/.cache/go-build
-ENV GOMODCACHE=$GOPATH/pkg/mod
-
 COPY go.mod go.sum ./
 
-RUN --mount=type=cache,target=/go/pkg/mod \
-	go mod download
+RUN go mod download
 
 COPY ./cmd/ ./cmd/
 COPY ./ee/ ./ee/
 COPY ./pkg/ ./pkg/
 COPY ./templates /root/templates
 
-# Invoked directly instead of via make so Makefile changes don't invalidate
-# this layer; the Makefile's git-derived ldflags resolve to empty in here
-# anyway (.git is dockerignored).
-RUN --mount=type=cache,target=/go/pkg/mod \
-	--mount=type=cache,target=/root/.cache/go-build \
-	GOARCH=${TARGETARCH} GOOS=${OS} go build -C ./cmd/enterprise -race -tags timetzdata -o /root/signoz \
-	-ldflags "-s -w \
-		-X github.com/SigNoz/signoz/pkg/version.version=integration \
-		-X github.com/SigNoz/signoz/pkg/version.variant=enterprise \
-		-X github.com/SigNoz/signoz/ee/zeus.url=${ZEUSURL} \
-		-X github.com/SigNoz/signoz/ee/zeus.deprecatedURL=${ZEUSURL}/api/v1"
+COPY Makefile Makefile
+RUN TARGET_DIR=/root ARCHS=${TARGETARCH} ZEUS_URL=${ZEUSURL} LICENSE_URL=${ZEUSURL}/api/v1 make go-build-enterprise-race
+RUN mv /root/linux-${TARGETARCH}/signoz /root/signoz
 
 COPY --from=build /opt/build ./web/
 

cmd/enterprise/server.go

@@ -28,7 +28,6 @@ import (
 	eequerier "github.com/SigNoz/signoz/ee/querier"
 	enterpriseapp "github.com/SigNoz/signoz/ee/query-service/app"
 	eerules "github.com/SigNoz/signoz/ee/query-service/rules"
-	"github.com/SigNoz/signoz/ee/subscription/httpsubscription"
 	enterprisezeus "github.com/SigNoz/signoz/ee/zeus"
 	"github.com/SigNoz/signoz/ee/zeus/httpzeus"
 	"github.com/SigNoz/signoz/pkg/alertmanager"
@@ -61,11 +60,9 @@ import (
 	"github.com/SigNoz/signoz/pkg/ruler/signozruler"
 	"github.com/SigNoz/signoz/pkg/signoz"
 	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/subscription"
 	"github.com/SigNoz/signoz/pkg/telemetrystore"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/cloudintegrationtypes"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/version"
 	"github.com/SigNoz/signoz/pkg/zeus"
@@ -105,9 +102,6 @@ func runServer(ctx context.Context, config signoz.Config, logger *slog.Logger) e
 		func(sqlstore sqlstore.SQLStore, zeus zeus.Zeus, orgGetter organization.Getter, analytics analytics.Analytics) factory.ProviderFactory[licensing.Licensing, licensing.Config] {
 			return httplicensing.NewProviderFactory(sqlstore, zeus, orgGetter, analytics)
 		},
-		func(zeus zeus.Zeus, licensing licensing.Licensing) subscription.Subscription {
-			return httpsubscription.New(zeus, licensing)
-		},
 		signoz.NewEmailingProviderFactories(),
 		signoz.NewCacheProviderFactories(),
 		signoz.NewWebProviderFactories(config.Global),
@@ -142,8 +136,8 @@ func runServer(ctx context.Context, config signoz.Config, logger *slog.Logger) e
 			}
 			return openfgaauthz.NewProviderFactory(sqlstore, openfgaschema.NewSchema().Get(ctx), openfgaDataStore, licensing, onBeforeRoleDelete, authtypes.NewRegistry()), nil
 		},
-		func(store sqlstore.SQLStore, settings factory.ProviderSettings, analytics analytics.Analytics, orgGetter organization.Getter, queryParser queryparser.QueryParser, querier querier.Querier, licensing licensing.Licensing, tagModule tag.Module, systemDashboardRegistry dashboardtypes.SystemDashboardRegistry) dashboard.Module {
-			return impldashboard.NewModule(pkgimpldashboard.NewStore(store), settings, analytics, orgGetter, queryParser, querier, licensing, tagModule, systemDashboardRegistry)
+		func(store sqlstore.SQLStore, settings factory.ProviderSettings, analytics analytics.Analytics, orgGetter organization.Getter, queryParser queryparser.QueryParser, querier querier.Querier, licensing licensing.Licensing, tagModule tag.Module) dashboard.Module {
+			return impldashboard.NewModule(pkgimpldashboard.NewStore(store), settings, analytics, orgGetter, queryParser, querier, licensing, tagModule)
 		},
 		func(licensing licensing.Licensing) factory.ProviderFactory[gateway.Gateway, gateway.Config] {
 			return httpgateway.NewProviderFactory(licensing)

conf/example.yaml

@@ -138,18 +138,6 @@ sqlstore:
 
 ##################### APIServer #####################
 apiserver:
-  # The TCP address the API server listens on, in the form "host:port".
-  address: 0.0.0.0:8080
-  # Maximum duration for reading an entire request, including the body.
-  read_timeout: 60s
-  # Keep at 0; any value cuts off streaming endpoints (livetail, SSE, export_raw_data).
-  write_timeout: 0
-  # tls:
-  #   enabled: true
-  #   cert_file: /path/to/server.crt
-  #   key_file: /path/to/server.key
-  #   # Minimum TLS version: "1.2" or "1.3". Defaults to "1.2".
-  #   min_version: "1.2"
   timeout:
     # Default request timeout.
     default: 60s
@@ -409,6 +397,7 @@ identn:
     # headers to use for tokenizer identN resolver
     headers:
       - Authorization
+      - Sec-WebSocket-Protocol
   apikey:
     # toggle apikey identN
     enabled: true

docs/contributing/development.md

@@ -83,13 +83,7 @@ This command:
 
    You should see: `{"status":"ok"}`
 
-3. Stop it when you're done:
-   ```bash
-   make go-stop
-   ```
-
-> 💡 **Tip**: The API server runs at `http://localhost:8080/` by default. You can configure this using `apiserver.address` configuration option. See
-> [running more than one instance](#how-do-i-run-more-than-one-instance) if you need that for agentic testing.
+> 💡 **Tip**: The API server runs at `http://localhost:8080/` by default
 
 ### 4. Setting up the Frontend
 
@@ -125,36 +119,6 @@ To verify everything is working correctly:
 3. **Check Backend**: `curl http://localhost:8080/api/v1/health` (should return `{"status":"ok"}`)
 4. **Check Frontend**: Open `http://localhost:3301` in your browser
 
-## How do I run more than one instance?
-
-Handy when you keep several branches checked out as separate git worktrees. Every port
-and path below is read from the environment, so set them on the `make` call:
-
-```bash
-SIGNOZ_APISERVER_ADDRESS=0.0.0.0:8081 \
-SIGNOZ_SQLSTORE_SQLITE_PATH=/path/to/main/sqlite.db \
-SIGNOZ_INSTRUMENTATION_METRICS_READERS_PULL_EXPORTER_PROMETHEUS_PORT=9091 \
-make go-run-community
-```
-
-| Variable | Default | Why you'd change it |
-| --- | --- | --- |
-| `SIGNOZ_APISERVER_ADDRESS` | `0.0.0.0:8080` | Address the API server listens on |
-| `SIGNOZ_SQLSTORE_SQLITE_PATH` | `signoz.db` in worktree | To reuse same database |
-| `SIGNOZ_INSTRUMENTATION_METRICS_READERS_PULL_EXPORTER_PROMETHEUS_PORT` | `9090` | Bound by the Prometheus metrics exporter on startup |
-
-Point the frontend at whichever backend you want, in `frontend/.env`:
-
-```env
-VITE_FRONTEND_API_ENDPOINT=http://localhost:8081
-```
-
-Stop an instance using the address it was started on:
-
-```bash
-make go-stop SIGNOZ_APISERVER_ADDRESS=0.0.0.0:8081
-```
-
 ## How to send test data?
 
 You can now send telemetry data to your local SigNoz instance:

docs/contributing/go/clickhousesql.md

@@ -1,48 +0,0 @@
-# ClickHouse SQL
-
-Telemetry queries are generated as ClickHouse SQL text, most of it through [go-sqlbuilder](https://github.com/huandu/go-sqlbuilder) and executed with [clickhouse-go](https://github.com/ClickHouse/clickhouse-go). Attribute names, label names, body keys, aliases and dashboard variable values are user or telemetry input, so every one of them has to be quoted before it becomes part of the text.
-
-## How do I quote a name or a value?
-
-Use [pkg/clickhousesql](/pkg/clickhousesql/clickhousesql.go). Never build a quoted token with `fmt.Sprintf`, string concatenation or `strings.ReplaceAll`.
-
-| You need | Use | Example |
-| --- | --- | --- |
-| a column, alias or JSON sub-column name | `clickhousesql.Identifier(name)` | `` body_v2.`user.name` `` |
-| a string in a map read, a function argument, an `IN` list | `clickhousesql.StringLiteral(value)` | `attributes_string['http.method']` |
-| a Go scalar or list rendered as a literal | `clickhousesql.Literal(value)` | `['a','b']` |
-| a needle for `LIKE` | `clickhousesql.LikePattern(value)` | `"%" + clickhousesql.LikePattern(name) + "%"` |
-
-```go
-expr := fmt.Sprintf("multiIf(mapContains(%s, %s), %s[%s], NULL)", column, clickhousesql.StringLiteral(key.Name), column, clickhousesql.StringLiteral(key.Name))
-alias := clickhousesql.Identifier(fmt.Sprintf("__GROUP_BY_KEY_%d_%s", i, key.Name))
-```
-
-Values compared against a column are bound as arguments (`sb.E(column, value)`), never rendered into the text.
-
-Filter expressions are a different language. A value placed into a filter expression string goes through `querybuilder.FilterStringLiteral`, which quotes for that grammar.
-
-## Where does `sqlbuilder.Escape` go?
-
-go-sqlbuilder compiles the text it is given: `$0`, `$1`, `${name}` and `$?` are read as argument references and `$$` as a single `$`. The compiled text is everything passed to `Select`, `SelectMore`, `GroupBy`, `OrderBy`, `Having`, `From`, a raw string passed to `Where`, `And` or `Or`, and a compiled subquery joined or selected from another builder, which is compiled a second time. The `Cond` helpers (`sb.E`, `sb.Like`, `sb.In`, `sb.IsNotNull`, ...) write their field argument verbatim.
-
-- A name or expression that ends up in compiled text is wrapped with `sqlbuilder.Escape` once, at the point where it enters that text. Materialized column names carry `$$`, so this is what keeps them intact.
-- A field passed to a `Cond` helper is not escaped.
-- Text that never passes through a builder is not escaped: CTE fragments joined with `querybuilder.CombineCTEs`, a `UNION` assembled with `fmt.Sprintf` from already compiled statements, raw queries sent straight to the store.
-- Bind placeholders produced by `sb.Var` or the `Cond` helpers must not be escaped, so escape the identifier-bearing part before combining it with them: `fmt.Sprintf("match(%s, %s)", sqlbuilder.Escape(fieldExpr), sb.Var(value))`.
-
-## How do I check SQL a user wrote?
-
-A statement typed into a ClickHouse query panel is validated with `clickhousesql.ErrIfStatementIsNotValid`. It parses the text with [clickhouse-sql-parser](https://github.com/AfterShip/clickhouse-sql-parser) and refuses anything but a single `SELECT`, a table function other than the row generators (`numbers`, `zeros`, `generate_series`), a function that reads a file, a dictionary or the server binary, the `system` and `information_schema` databases, and a `SETTINGS readonly` override. Each refusal carries one of the package's `Code*` values.
-
-## Why is `$` written as `\x24`?
-
-Inside an identifier or a literal, `clickhousesql` writes a `$` as `\x24` when a digit, `{` or `?` follows; ClickHouse decodes the escape, so the name is unchanged on the server. Two tools between the builder and ClickHouse read such a `$` as a placeholder: go-sqlbuilder resolves `$0` in a compiled fragment to its own WHERE clause and recurses, and clickhouse-go refuses a query that mixes a `$<digits>` numeric placeholder with `?` arguments. Any other `$` stays literal, so `resource_string_service$$name` renders exactly as written.
-
-## What should I remember?
-
-- Every identifier and literal built from a name or a value goes through `pkg/clickhousesql`.
-- `sqlbuilder.Escape` wraps compiled text once; `Cond` fields and text assembled outside the builder are left alone.
-- Filter expression literals use `querybuilder.FilterStringLiteral`.
-- A statement written by a user is validated with `clickhousesql.ErrIfStatementIsNotValid`.
-- When adding a builder or a module that emits SQL, run its queries with a name containing a backtick, a quote, a backslash and `$0`; the integration suites under `tests/integration/tests/queriercommon` do this for the query builder.

docs/contributing/go/readme.md

@@ -12,7 +12,6 @@ We **recommend** (almost enforce) reviewing these guides before contributing to
 
 - [Abstractions](abstractions.md) - When to introduce new types and intermediate representations
 - [Authz](authz.md) - Authorization, roles, and access control
-- [ClickHouse SQL](clickhousesql.md) - Quoting names and values in generated ClickHouse queries
 - [Errors](errors.md) - Structured error handling
 - [Endpoint](endpoint.md) - HTTP endpoint patterns
 - [Flagger](flagger.md) - Feature flag patterns

docs/contributing/go/service.md

@@ -191,7 +191,7 @@ A standalone service only has the `factory.Service` lifecycle i.e it does not se
         // ... dependencies ...
     ) user.Service {
         return &service{
-            settings: factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/user"),
+            settings: factory.NewScopedProviderSettings(providerSettings, "go.signoz.io/pkg/modules/user"),
             // ... dependencies ...
             stopC:    make(chan struct{}),
         }

docs/contributing/go/types.md

@@ -61,37 +61,31 @@ type Channel struct {
 
 ```go
 type AuthDomain struct {
-    storableAuthDomain       *StorableAuthDomain
-    storableAuthDomainConfig *StorableAuthDomainConfig
+    storableAuthDomain *StorableAuthDomain
+    authDomainConfig   *AuthDomainConfig
 }
 
 type StorableAuthDomain struct {
     bun.BaseModel `bun:"table:auth_domain"`
     types.Identifiable
     Name  string      `bun:"name"`
-    Data  string      `bun:"data"`  // StorableAuthDomainConfig serialized as JSON
+    Data  string      `bun:"data"`  // AuthDomainConfig serialized as JSON
     OrgID valuer.UUID `bun:"org_id"`
     types.TimeAuditable
 }
 
 type PostableAuthDomain struct {
-    Name        string           `json:"name" required:"true"`
-    Enabled     bool             `json:"enabled"`
-    Config      AuthDomainConfig `json:"config" required:"true"`
-    RoleMapping *RoleMapping     `json:"roleMapping"`
+    Config AuthDomainConfig `json:"config"`
+    Name   string           `json:"name"`
 }
 
-type UpdatableAuthDomain struct {
-    Enabled     bool             `json:"enabled"` // Name intentionally absent
-    Config      AuthDomainConfig `json:"config" required:"true"`
-    RoleMapping *RoleMapping     `json:"roleMapping"`
+type UpdateableAuthDomain struct {
+    Config AuthDomainConfig `json:"config"` // Name intentionally absent
 }
 
 type GettableAuthDomain struct {
-    StorableAuthDomain
-    Enabled           bool               `json:"enabled"`
-    Config            AuthDomainConfig   `json:"config"`
-    RoleMapping       *RoleMapping       `json:"roleMapping"`
+    *StorableAuthDomain
+    *AuthDomainConfig
     AuthNProviderInfo *AuthNProviderInfo `json:"authNProviderInfo"`
 }
 ```
@@ -99,74 +93,11 @@ type GettableAuthDomain struct {
 Each flavor exists for a concrete reason:
 
 - `StorableAuthDomain` stores the typed config as an opaque `Data string` column, so the schema does not need to migrate every time a config field is added.
-- `PostableAuthDomain` carries the config as a structured object (not a string) for the request; `AuthDomainConfig` is a kind/spec envelope.
-- `UpdatableAuthDomain` excludes `Name` because a domain's name cannot change after creation.
+- `PostableAuthDomain` carries the config as a structured object (not a string) for the request.
+- `UpdateableAuthDomain` excludes `Name` because a domain's name cannot change after creation.
 - `GettableAuthDomain` adds `AuthNProviderInfo`, which is derived at read time and never persisted.
 
-The core `AuthDomain` holds the two live halves — `storableAuthDomain` and `storableAuthDomainConfig` — and owns business methods such as `Update(updatable)` and `Patch(patchable)`. Conversions use the `New<Output>From<Input>` form: `NewAuthDomainFromPostableAuthDomain`, `NewAuthDomainFromStorableAuthDomain`, `NewGettableAuthDomainFromAuthDomain`.
-
-## Sum types: the kind/spec envelope
-
-When a domain type is a *sum type* — exactly one of several variants, selected by a discriminator — model it as an envelope with a `kind` and a `spec`:
-
-```go
-type FooConfig struct {
-    Kind FooKind `json:"kind" required:"true"`
-    Spec any     `json:"spec" required:"true"`
-}
-```
-
-```json
-{ "kind": "bar", "spec": { "url": "...", "timeout": "30s" } }
-```
-
-`Kind` is a `valuer.String` enum implementing `Enum()`; `Spec` holds exactly one concrete variant type (`BarSpec`, `BazSpec`, …). `RuleThresholdData` and `EvaluationEnvelope` in `pkg/types/ruletypes/` are the canonical in-tree examples; the dashboard panel/query/variable plugins in `pkg/types/dashboardtypes/` are the same pattern behind generics. (`QueryEnvelope` in querybuildertypes uses `type` as the discriminator key for historical reasons; new envelopes use `kind`.)
-
-### The envelope goes at the point of variance, not the resource root
-
-Put the envelope on the field that actually varies. The resource root is almost never a sum type — a `Foo` has a `name` and an `enabled` flag regardless of which kind it is configured with; only its configuration varies, so the envelope is the `config` field:
-
-```json
-{ "name": "my-foo", "enabled": true, "config": { "kind": "bar", "spec": { "...": "..." } } }
-```
-
-Hoisting `kind`/`spec` to the root would turn the whole resource into a `oneOf`: every flavor (`PostableFoo`, `UpdatableFoo`, `GettableFoo`) then needs one variant schema per kind, each repeating the common fields; every new common field has to be added to all of them; and generated clients get unions of large objects instead of one small union that narrows on `config.kind`. A root-level `kind` also collides with the resource-model meaning of the word — root `kind` conventionally answers "what resource is this" (`Dashboard`), never "which flavor of config does it hold".
-
-The existing domains already follow this placement:
-
-- **Rules** — plain root; envelopes on the varying fields: `thresholds: {kind, spec}` and `evaluation: {kind, spec}`.
-- **Dashboards** — metadata at the root plus one typed `spec`; the unions sit deep inside, at each panel/query/variable plugin (`{kind, spec}` in `perses_plugin_wrappers.go`).
-- **Saved views** — root `{schemaVersion, spec}`, where `spec` is a *versioning* envelope holding one fixed type, not a union; the unions are inside it (`spec.queries: [{type, spec}]`). Same word, different job — a versioned body is not a discriminated union.
-
-### Why this tagging style
-
-Of the union encodings in common use, the envelope is the *adjacently tagged* one — tag and payload side by side. Variant payloads stay collision-free, and each kind maps to a named wrapper schema that carries the discriminator, which is exactly what OpenAPI generators need. The alternatives lose on those points: *internally tagged* (`{"kind": "bar", ...fields flattened}`) mixes common and variant fields, admits cross-variant key collisions, and forces every variant schema to redeclare the discriminator; *sibling optional fields* (`{"kind": "bar", "barConfig": {}, "bazConfig": {}}`) is the anti-pattern the first rule below exists to prevent.
-
-The rules that make the envelope work:
-
-- **Never model variants as sibling fields.** A struct with `Bar *BarSpec`, `Baz *BazSpec` next to a discriminator cannot be expressed as an OpenAPI discriminated union, forces nilability checks on every consumer, and silently admits contradictory payloads (kind=bar with a baz spec). The chosen variant *is* the payload.
-- **The envelope owns `UnmarshalJSON`.** Decode `kind` first, then switch on it to decode and validate the matching concrete type into `Spec`. Unknown kinds and missing specs are rejected at the boundary:
-
-    ```go
-    func (typ *FooConfig) UnmarshalJSON(data []byte) error {
-        var raw map[string]json.RawMessage
-        // ... unmarshal raw, decode raw["kind"] ...
-        switch kind {
-        case FooKindBar:
-            spec := BarSpec{}
-            if err := json.Unmarshal(raw["spec"], &spec); err != nil {
-                return err
-            }
-            typ.Spec = spec
-        // ... one case per kind, default rejects ...
-        }
-        typ.Kind = kind
-        return nil
-    }
-    ```
-- **Consumers type-assert on `Spec`** (`config.Spec.(BarSpec)`) after switching on `Kind`. If assertion sites multiply, add typed accessors on the envelope (see `EvaluationEnvelope.GetEvaluation()`).
-- **OpenAPI needs one unexported variant struct per kind** (`fooConfigBar{Kind; Spec BarSpec}`), exposed via `JSONSchemaOneOf()` and mapped via `PrepareJSONSchema` with the `x-signoz-discriminator` extension. The schema mechanics are covered in [handler.md](handler.md#oneof-with-a-discriminator).
-- **A legacy persisted shape gets a data migration or a `StorableX`.** When rows were written before the envelope existed, prefer an idempotent `sqlmigration` that rewrites them into the new shape, so the storable type simply nests the envelope. Only when the old shape must keep being written (external writers, rollback windows) keep it in a storable twin and convert at the type boundary.
+The core `AuthDomain` holds the two live halves — `storableAuthDomain` and `authDomainConfig` — and owns business methods such as `Update(config)`. Conversions use the `New<Output>From<Input>` form: `NewAuthDomainFromConfig`, `NewAuthDomainFromStorableAuthDomain`, `NewGettableAuthDomainFromAuthDomain`.
 
 ## Conventions that tie the flavors together
 
@@ -208,8 +139,6 @@ Both are optional. Do not introduce them if `PostableX` already covers the case.
 
 - Every domain package defines the core type `X`. Only `X` is mandatory.
 - Add `PostableX` / `GettableX` / `UpdatableX` / `StorableX` one at a time, only when the shape actually diverges from `X`.
-- Model sum types as a `{kind, spec}` envelope with a validating `UnmarshalJSON` — never as sibling variant fields next to a discriminator.
-- The envelope goes on the field that varies, never at the resource root — common fields stay on the resource, outside the union.
 - Domain logic lives on `X`, not on the flavor types.
 - Conversions can be a `New<Output>From<Input>` constructor or a receiver-style `ToY()` method — pick whichever reads best at the call site.
 - Use a type alias when two shapes are truly identical.

docs/contributing/prometheus.md

@@ -1,381 +0,0 @@
-# PromQL Serving — clickhouseprometheusv2
-
-This document gives the context for `pkg/prometheus/clickhouseprometheusv2`.
-This package is the second-generation ClickHouse-backed Prometheus provider.
-The document tells you why the package exists. It tells you the correctness
-rules that shaped it. It shows how we prove that each construct does not
-change results. Keep these invariants when you change the provider. If your
-change breaks an invariant, flag it and discuss it first.
-
----
-
-## Why a second provider
-
-The v1 provider (`pkg/prometheus/clickhouseprometheus`) serves the promql
-engine through the remote-read protobuf adapter. It fetches every raw sample
-of a query's union window. It serializes all of them and gives them to the
-engine. The cost follows the ingested data, not the question. This is how a
-dashboard of PromQL panels can take an instance down.
-
-In v2, each query runs in one of two ways. The classifier decides per query:
-
-- **Transpiled**: ClickHouse evaluates the query. Only final (or near-final)
-  per-group grid arrays come back. The statements use the
-  `timeSeries*ToGrid` aggregate functions. The supported ClickHouse floor is
-  25.6 or later, so these functions are assumed available.
-- **Engine**: the stock promql engine evaluates over this package's native
-  `storage.Querier`. Every shape that does not transpile takes this path.
-
-**The core rule: a PromQL result that differs from upstream Prometheus is a
-lost user. A construct that cannot reproduce engine semantics exactly falls
-back. It does not approximate.** The conformance suite
-(`tests/integration/tests/promqlconformance/`) replays Prometheus' own test
-corpus against both providers. It is the arbiter. The classification golden
-(`testdata/classification_golden.json`) freezes the route of each corpus
-expression. The rest of this document is the PromQL-to-SQL story. That
-mapping is where correctness is won or lost.
-
----
-
-## The evaluation model the SQL must reproduce
-
-A PromQL range query is an instant query evaluated at each grid point
-`t_i = start + i*step`, for `i = 0..(end-start)/step`. At each `t_i`:
-
-- An instant selector resolves to the latest sample in the left-open
-  lookback window `(t_i - lookback, t_i]`. If that latest sample is a stale
-  marker, the selector resolves to nothing. Older real samples in the window
-  do not change this.
-- A range selector `[r]` collects every sample in `(t_i - r, t_i]`. Stale
-  markers are excluded.
-- `offset d` shifts both windows to `(t_i - d - w, t_i - d]`.
-
-The transpilation invariant follows from this model. Each transpiled
-construct produces one array per output series. The array has exactly one
-slot per grid point. Slot `i` holds the value at `t_i`. NULL means absent.
-This makes composition correct, not only convenient. The engine evaluates
-these operators independently per `t_i`. A representation that gets every
-slot right gets the whole query right. Spatial aggregation over arrays is
-sound because it combines values that belong to the same `t_i` by
-construction. Scan time maps slot `i` back to `t_i = start + i*step`
-(`toMatrix`). The sections below fill those slots with exactly the numbers
-the engine computes. We validated each equivalence against the vendored
-engine on live data before its shape entered the allowlist. An unproven
-shape stays on the engine path.
-
-## Classification: finding what a statement can answer
-
-`classify` walks the parsed AST and looks for "core units". A core unit is a
-maximal subtree of this shape:
-
-	[agg by/without (...)] [fn(] selector[range] [offset d] [)] [op scalar]...
-
-`classifyCore` peels that chain from the outside in. It takes an optional
-sum/min/max/avg/count aggregation. It then takes one allowlisted function or
-a bare instant selector. It then takes the selector with its offset. On the
-way out, it collects number-literal arithmetic, comparisons (including
-`bool`), and unary minus into a scalar-op pipeline. A node qualifies only if
-its type, arguments, and children are in the proven set. This is an
-allowlist. An overlooked construct becomes a fallback, not a wrong number.
-
-Three unit kinds come out. Each kind has its own SQL form:
-
-- `unitRange`: rate, irate, increase, delta, idelta over a range selector.
-- `unitInstant`: instant vector selection, bare or comparison-filtered.
-- `unitOverTime`: avg/min/max/sum/count/last `_over_time`.
-
-If the whole tree is one unit, the plan is "full". The statement's rows are
-the query result. Otherwise, `rewrite` cuts out each maximal unit and puts a
-synthetic selector `__signoz_transpiled_N__` in its place. The engine then
-runs the rewritten expression over the units' materialized results. This is
-a "hybrid" plan. `histogram_quantile`, `topk`, `or`/`and`/`unless`, and
-vector matching keep exact engine semantics. Their expensive inputs were
-aggregated server-side.
-
-Classification refuses a shape when it cannot guarantee exact semantics
-server-side:
-
-- The `@` modifier, anywhere.
-- Default-resolution subqueries. Their resolution is a server runtime
-  setting that the transpiler cannot see.
-- Duration expressions (`offset step()`, `[range()]`, ...), anywhere. The
-  engine resolves them into the selector's static fields only at evaluation
-  time. At classification time those fields hold zero values. A transpile
-  would silently use the wrong offset or range.
-- Steps or ranges that are not whole seconds. The grid functions take
-  whole-second parameters.
-- Grouping by `__name__`, or matching on it, in hybrid plans. The synthetic
-  name would leak into results.
-- Name-keeping units in hybrid plans. Bare and comparison-filtered instant
-  selectors and `last_over_time` keep their real `__name__` (`keepsName`).
-  Substitution would replace that name. These units transpile only as full
-  plans.
-- Every function outside the allowlist: changes, resets,
-  quantile_over_time, absent, native-histogram functions, and more.
-
-Units inside a fixed-resolution subquery evaluate on the subquery's own
-grid, not the query grid. That grid is the set of epoch-aligned multiples of
-the resolution strictly after `outerStart - offset - range`, ending at
-`outer end - offset`. This is the exact derivation the engine uses. A grid
-shifted by one step changes which samples every window sees.
-
-## From one unit to one statement
-
-`buildUnitSQL` renders each unit as one statement. For
-`sum by (pod) (rate(m{job="api"}[5m]))` the skeleton is:
-
-	SELECT g0, sumForEach(grid) AS grid FROM (
-	    SELECT any(series.g0) AS g0,
-	           timeSeriesRateToGrid(<start>, <end>, <step>, <range>)(fromUnixTimestamp64Milli(unix_milli), value) AS grid
-	    FROM signoz_metrics.distributed_samples_v4 AS points
-	    INNER JOIN (
-	        SELECT fingerprint, JSONExtractString(labels, 'pod') AS g0
-	        FROM signoz_metrics.time_series_v4
-	        WHERE <series predicates>
-	        GROUP BY fingerprint, g0
-	    ) AS series ON points.fingerprint = series.fingerprint
-	    WHERE metric_name = ? AND temporality IN ['Cumulative', 'Unspecified']
-	      AND unix_milli > <start - range> AND unix_milli <= <end>
-	      AND bitAnd(flags, 1) = 0
-	    GROUP BY points.fingerprint
-	) GROUP BY g0
-	SETTINGS allow_experimental_ts_to_grid_aggregate_function = 1
-
-Read it from the inside out.
-
-**The time window** is the selector's semantics, verbatim. Strict `>` on the
-lower bound and `<=` on the upper bound is the left-open `(t - w, t]` rule.
-The offset shifts the whole window. `bitAnd(flags, 1) = 0` drops stale
-markers. PromQL excludes them from range vectors.
-
-**The inner GROUP BY** computes one grid array per series.
-`timeSeriesRateToGrid(start, end, step, range)` is a parametric aggregate.
-It takes (timestamp, value) pairs and produces `Array(Nullable(Float64))`
-with one slot per grid point. It is correct because it implements the
-engine's `extrapolatedRate`, decision for decision: counter resets, the
-zero-point clamp, the extrapolation thresholds, the two-samples rule, and
-the left-open window. We verified this: we fed identical samples to both and
-compared slot for slot. The only observed difference is the last bit.
-ClickHouse's C++ and Go round the same formula differently. That is the
-floating-point floor, not a semantic gap. irate/delta/idelta map to their
-own `timeSeries*ToGrid` functions, with the same verification. `increase`
-has no function of its own. We emit
-`arrayMap(x -> x * <range seconds>, <rate expr>)`. This is exact by
-definition: `extrapolatedRate` computes the same extrapolated delta for both
-and divides by the range only when `isRate`. The multiplication reverses it
-exactly. The grid parameters render as literals, not bound args. They are
-aggregate-function parameters. The experimental gate rides as a SETTINGS
-clause on the statement itself, so telemetrystore hooks cannot remove it.
-
-The group key is functionally dependent on the fingerprint: one fingerprint
-is the hash of one labelset. So the inner query groups by the fingerprint
-alone and reads the key columns with `any()`. This is exact, and it makes
-the per-row hash key smaller.
-
-**The join** gives each series its group key, in one of two forms.
-`by (...)` extracts each listed label as a plain column
-(`JSONExtractString(labels, 'pod') AS g0`) and groups on the columns. The
-projection is a known short list, and the label names live in Go. To build,
-sort, and stringify every label pair per row would be waste. This is correct
-because column-tuple equality is label-set equality on the projection. An
-extracted `''` means the label is absent. That is Prometheus semantics for
-`by()` over missing labels. The empties are skipped when the columns turn
-back into labels. `without` and no-aggregation project a label set that
-varies per series. They get the canonical key: `toJSONString` of the sorted
-[label, value] pairs that the unit projects. `without` excludes the listed
-labels plus `__name__`. No-aggregation keeps everything; the name comes off
-in Go, per the engine's name-dropping rules. Here the sort is load-bearing.
-Stored JSON key order is not canonical across fingerprints. Two orderings of
-the same labels must land in one group. Empty values are filtered for the
-same absent-label reason. The same string parses back into the output label
-set (`labelsFromGroupKey`).
-
-**The outer GROUP BY** is the spatial aggregation. sum/min/max/avg/count
-by/without become the `-ForEach` combinators. Element-wise aggregation over
-grid arrays is the engine's per-`t_i` aggregation: slot `i` of every input
-array refers to the same `t_i`. The combinators skip NULLs. That is the
-engine aggregating only the series present at `t_i`. An index where every
-series is absent stays NULL. Two edges need explicit handling. First,
-`countForEach` wraps in a map of 0 back to NULL. A count over an all-absent
-index is an absent point, not 0. Second, a unit without aggregation still
-passes through `maxForEach`. That is the identity for the common
-one-fingerprint group. It is a deterministic NULL-skipping merge when a
-regex `__name__` selector collapses distinct metrics onto one projected
-label set. One caveat is inherent: the summation order over series differs
-from the engine's. Spatial aggregates can differ in the last ULP. Float
-addition is not associative. No ordering reproduces the engine's result
-bit-exactly from inside a GROUP BY.
-
-## Instant selectors: staleness needs two aggregates
-
-`unitInstant` uses window = lookback. It must reproduce the shadowing rule:
-the point is absent when the latest in-window sample is a stale marker.
-`timeSeriesLastToGrid` alone cannot express that. To skip stale rows in
-WHERE would resurrect the older real sample that the marker buried. So stale
-rows stay in the scan for this kind only. The grid expression compares three
-aggregates per slot:
-
-	arrayMap((tall, tok, vok) -> if(tall IS NULL OR tok IS NULL OR tall != tok, NULL, vok),
-	         timeSeriesLastToGrid(...)(ts, toFloat64(unix_milli)),                           -- last sample overall
-	         timeSeriesLastToGridIf(...)(ts, toFloat64(unix_milli), bitAnd(flags, 1) = 0),   -- last non-stale, its timestamp
-	         timeSeriesLastToGridIf(...)(ts, value, bitAnd(flags, 1) = 0))                   -- last non-stale, its value
-
-This is correct by cases on a slot's window. No samples at all: both
-timestamp aggregates are NULL, so the slot is NULL. That is absent, as the
-engine says. Latest sample non-stale: it is the latest overall and the
-latest non-stale. The timestamps agree. The slot takes its value. That is
-the engine's pick. Latest sample stale: the last-overall timestamp is the
-marker's. The last-non-stale timestamp is older, or NULL when the window
-holds only markers. They disagree. The slot is NULL. The marker shadows,
-exactly as the engine's rule says. Timestamps are unique per series (ingest
-dedups). So timestamp equality identifies "the same sample" without
-ambiguity. We probed the `-If` combinator against these experimental
-aggregates before we trusted it.
-
-## Windowed *_over_time: whole buckets instead of a grid function
-
-avg/min/max/sum/count `_over_time` aggregate every raw sample in the window.
-No `timeSeries*ToGrid` function computes them. (`last_over_time` is the
-exception. The last sample of a range vector is exactly
-`timeSeriesLastToGrid`. PromQL excludes stale markers from range vectors; we
-exclude them in WHERE.) These shapes transpile only when the range is a
-whole multiple of the step. Then the window needs no per-sample fan-out.
-With `W = range/step`, the window `(t_k - range, t_k]` is exactly the union
-of W step buckets. Both are left-open on the same boundaries. So bucket
-membership fully determines window membership. Each sample lands in exactly
-one bucket:
-
-	intDiv(unix_milli - <start> + <range> - 1, <step>)
-
-This is `ceil((ts - start)/step)` shifted by W-1, so the earliest in-window
-sample sits at 0. Slot k's window is buckets in `[k, k+W-1]`. The
-alternative fans each sample into all W windows that cover it. That
-multiplies rows by W. For a long range over a short step, that is a row
-explosion measured in billions. The bucketed form's row count is
-series × buckets: the size of the output, for any W.
-
-Each series aggregates in one group. The `-Resample` combinator
-(`sumResample`, `countResample`) holds the dense per-bucket partials inside
-one group state: a bucket count, plus the function's value aggregate (sum
-for sum/avg, min, max). An earlier form grouped by (series, bucket) and
-assembled with `groupArrayInsertAt`. At scale that made 37M hash groups, and
-per-thread partials scaled memory with the thread count. The slide then
-combines each slot's at-most-W bucket partials by direct aggregation
-(`arraySum(arraySlice(...))`). Window sums are added the way the engine adds
-them. There is no prefix-sum differencing: its large-minus-large
-cancellation would drift past the shadow tolerance on counter-sized values.
-This is correct per slot because the bucket union is the exact window
-multiset, and avg/min/max/sum/count are order-insensitive on a multiset
-(sum/avg up to summation order; see the float caveat above). A slot with
-zero window count is absent. min/max filter their slices on the bucket
-counts. An empty bucket's default can never look like a value: a real sample
-can legitimately be +Inf.
-
-Two shapes fall back to the engine path, which is exact: a range that does
-not divide the step, and a window wider than `maxWindowBuckets` buckets (the
-slide costs W combines per slot). A range narrower than the step needs
-neither gate: the windows are pairwise disjoint, one bucket per slot, no
-slide. That form is exact only together with the window-sliver predicate
-below.
-
-## Scalar ops, full plans, hybrid plans
-
-The scalar-op pipeline runs in Go on the returned arrays
-(`applyScalarOps`), slot by slot. Arithmetic operators compute. Comparisons
-filter: the slot keeps the vector-side value or becomes NULL. Under `bool`
-they return 0/1. This is trivially correct. It is the same float64 operation
-the engine applies, to the same slot value, in the same operator order the
-AST dictates. Go instead of another SQL layer changes where, not what.
-
-A full plan's arrays map straight to the result matrix. A hybrid plan
-materializes each unit's arrays as synthetic series under its
-`__signoz_transpiled_N__` name. The engine evaluates the rewritten
-expression over a storage that serves synthetic names from memory and
-everything else live. Substitution is sound because a unit's output is a
-plain instant vector to the engine: same values at same timestamps, under a
-different name. The name cannot matter. Plans that group by or match on
-`__name__` were refused at classification. Name-keeping units are never
-substituted. One subtlety makes it exact: we write stale markers at absent
-grid points. Without them, the engine's lookback would resurrect a point
-from up to `lookback` earlier. The marker encodes "absent here" the way the
-engine itself encodes it. Units evaluate concurrently. Each unit is one
-grid statement: the group-key join resolves the matchers, and the samples
-primary key takes the metric name straight from the selector. Only a
-selector without a static `__name__` runs the series lookup first, to learn
-the concrete metric names. A step of 0 is an instant query: a single
-evaluation at `end`.
-
-A note on the window sliver: when the window is narrower than the step, the
-grid windows cover only `window/step` of the timeline. A sample in a gap
-belongs to no window. It cannot move any grid point, but the grid aggregate
-would buffer it. A WHERE predicate keeps only the in-window rows:
-`positiveModulo(selStart - unix_milli, step) < window`, with the scan capped
-at the last grid point. The lattice anchors at the selector start, because
-the end can sit off-lattice on unaligned grids. This cut a 36k-series
-one-week rate from 74s/28GiB to 16s/4.3GiB on fleet data. Over slivered
-rows, `timeSeriesLastToGrid`'s window widening is harmless, so instant
-selectors and `last_over_time` transpile at window < step too.
-
-## Series lookup
-
-The engine path resolves matchers once per selector (`selectSeries`); the
-transpiled path builds the same conditions into its group-key join. Both
-read the same tables. The series tables hold one row per (fingerprint, bucket)
-at 1h/6h/1d/1w granularities. The shared schema package
-(`pkg/telemetryschema/metricstelemetryschema`) picks the table whose bucket
-fits the window. It rounds the window start down to the bucket boundary, so
-a window that begins mid-bucket still matches the bucket's row. How matchers
-become SQL, and why regexes are anchored, is documented at
-`applySeriesConditions`. Empty-valued labels come off at this boundary. An
-empty value means "label absent" in Prometheus, but stored attribute JSON
-can carry them.
-
-## The engine path
-
-Queries that do not transpile run in the stock engine over this package's
-`storage.Querier`. This is still not the v1 path. Samples are fetched per
-selector with the engine's per-selector hints, not the query-wide union
-window. So `foo / foo offset 1d` reads two narrow windows, not the widest
-one twice. Instant selectors of subquery-free queries fetch only the last
-sample per step bucket (`lastSamplePerStep`). Buckets anchor at the
-selector's first evaluation timestamp. The code recovers it from the hints
-as `hints.Start + lookback - 1ms`, the inverse of how the engine derives
-`hints.Start`. Bucket boundaries then coincide with evaluation timestamps.
-A non-final sample of a bucket can never be the latest sample in
-`(t - lookback, t]` for any grid `t`. Real timestamps are preserved, so the
-engine's own lookback and staleness handling stay exact. Range selectors
-always fetch raw: every sample feeds the range function. The subquery-free
-proof travels in the context as `prometheus.QueryTraits`. Subquery selectors
-evaluate at the subquery's step, while the hints carry the top-level step.
-Row assembly maps stale flags to the engine's StaleNaN. It merges series
-with identical label sets (`sortAndMerge`): the engine assumes storages
-never emit duplicates.
-
-## Sharding
-
-`samples_v4` and `time_series_v4` (and all their rollups) shard on the same
-key: `cityHash64(env, temporality, metric_name, fingerprint)`. So a series'
-samples and catalog rows live on the same shard. The transpiled statement
-exploits that. The distributed samples table at the top-level FROM makes
-ClickHouse rewrite the whole inner query per shard. The join against the
-shard-local series table and the per-series grid aggregation run next to
-the data. The initiator only merges aggregate states and applies the
-spatial `-ForEach` step. This is the same layout as the telemetrymetrics
-statement builder. The group-key join alone restricts the transpiled scan
-to the matched series. The engine path's samples fetch restricts by the
-same predicates as a shard-local semi-join, not a GLOBAL broadcast of the
-matched set. The temporality filter on every samples statement is a
-semantic no-op: the matched fingerprints already come from those
-temporalities. It engages the leading samples primary-key column.
-Delta-temporality series stay invisible to PromQL here, exactly as in v1.
-The rollout gate is parity with v1. To make Delta visible is its own change
-with its own semantics to design. A Delta stream fed to `rate()`
-as-if-cumulative would be wrong, not just new.
-
-## Observability
-
-Every statement carries a `log_comment` with
-`code.namespace=clickhouse-prometheus-v2` and `code.function.name` naming
-the call site (`selectSeries`, `selectSamples`, `transpiledUnit`,
-`LabelValues`, `LabelNames`). This provider's work is attributable in
-`system.query_log` without guessing from query text.

docs/contributing/tests/e2e.md

@@ -30,11 +30,11 @@ yarn install:browsers   # one-time Playwright browser install
 
 ### Starting the Test Environment
 
-To spin up the backend stack (SigNoz, ClickHouse, Postgres, ClickHouse Keeper, Zeus mock, gateway mock, seeder, migrator-with-web) and keep it running:
+To spin up the backend stack (SigNoz, ClickHouse, Postgres, Zookeeper, Zeus mock, gateway mock, seeder, migrator-with-web) and keep it running:
 
 ```bash
 cd tests
-uv run pytest --basetemp=./tmp/ -vv --reuse --rebuild --with-web \
+uv run pytest --basetemp=./tmp/ -vv --reuse --with-web \
   e2e/bootstrap/setup.py::test_setup
 ```
 
@@ -45,13 +45,8 @@ This command will:
 - Start the HTTP seeder container (`tests/seeder/` — exposing `/telemetry/{traces,logs,metrics}` POST + DELETE)
 - Write backend coordinates to `tests/e2e/.env.local` (loaded by `playwright.config.ts` via dotenv)
 - Keep containers running via the `--reuse` flag
-- Rebuild the SigNoz container from the current sources via the `--rebuild` flag
 
-The `--with-web` flag builds the frontend into the SigNoz container — required for E2E. The build takes ~4 mins on a cold start; later builds are incremental.
-
-### Rebuilding After Source Changes
-
-The `--with-web` image bakes the built frontend in, so neither backend nor frontend changes are picked up while `--reuse` keeps the container running. `--rebuild` fixes that for both: it kills the SigNoz container, rebuilds the image incrementally (go build cache + pnpm store — a frontend-only change rebuilds in about a minute), and starts a fresh one while databases, mocks, migrations, and the seeder stay reused. The setup command above passes it, so the iteration loop is: change code → re-run the setup command → re-run your specs. `--rebuild` requires `--reuse` and cannot be combined with `--teardown` or `--clean`.
+The `--with-web` flag builds the frontend into the SigNoz container — required for E2E. The build takes ~4 mins on a cold start.
 
 ### Stopping the Test Environment
 
@@ -112,41 +107,6 @@ These two folders look similar but mean different things:
 
 Rule of thumb: if it's a `test.extend` fixture, put it in `fixtures/`. If it's a function you call explicitly (or a constant the function uses), put it in `helpers/`. If it's a static file the helpers read, put it in `testdata/`.
 
-### Extended fixtures
-
-For features needing complex setup (API-seeded data, ruler evaluation waits, cleanup), create domain-specific fixtures that extend `auth`. Group them in `fixtures/<domain>/`.
-
-**Fixture scopes:**
-- **test scope** — fresh data per test. Use for mutations (edit, delete, rename).
-- **worker scope** — shared across tests in one worker. Use for read-only data. Worker scope pays the setup cost once per worker instead of once per test.
-
-**The alerts pattern** (`fixtures/alerts/`) demonstrates extending fixtures:
-
-```
-fixtures/alerts/
-├── alert-rules.ts   # extends auth — worker-scoped rule list + test-scoped factory
-└── alert-history.ts # extends alert-rules — adds history fixtures (waits on ruler)
-```
-
-Specs import from the fixture they need:
-
-```ts
-// List tests — just need rules, no history
-import { test, expect } from '../../../fixtures/alerts/alert-rules';
-
-// History tests — need history rows from ruler evaluation
-import { test, expect } from '../../../fixtures/alerts/alert-history';
-```
-
-**When creating new fixtures:**
-
-1. **Identify scope** — Will tests mutate the data? If yes, test-scoped. If read-only, worker-scoped.
-2. **Group by domain** — Put fixtures in `fixtures/<domain>/`. Helpers in `helpers/<domain>/`.
-3. **Extend existing fixtures** — Chain from `auth` or another fixture to inherit its setup.
-4. **Handle timeouts** — Worker-scoped fixtures that wait on backend processing need explicit timeouts.
-5. **Clean up** — Always delete seeded data in the fixture teardown (after `use()`).
-6. **Extract logic into functions** — Keep the `test.extend()` block lean; move setup/teardown logic to named functions so the extend block reads as a manifest of "what fixtures exist."
-
 Each spec follows these principles:
 
 1. **Directory per feature**: `tests/e2e/tests/<feature>/*.spec.ts`. Cross-resource junction concerns (e.g. cascade-delete) go in their own file, not packed into one giant spec.
@@ -267,14 +227,11 @@ cd tests/e2e
 # Single feature dir
 npx playwright test tests/alerts/ --project=chromium
 
-# Single sub-area
-npx playwright test tests/alerts/history/ --project=chromium
-
 # Single file
-npx playwright test tests/alerts/page.spec.ts --project=chromium
+npx playwright test tests/alerts/alerts.spec.ts --project=chromium
 
 # Single test by title grep
-npx playwright test --project=chromium -g "AL-01"
+npx playwright test --project=chromium -g "TC-01"
 ```
 
 ### Iterative modes
@@ -308,14 +265,7 @@ yarn test:staging
 | `SIGNOZ_E2E_PASSWORD` | Admin password. Bootstrap writes the integration-test default. |
 | `SIGNOZ_E2E_SEEDER_URL` | Seeder HTTP base URL — hit by specs that need per-test telemetry. |
 
-Precedence in `playwright.config.ts`, lowest to highest: `.env` (user-provided, staging) → `.env.local` (bootstrap-generated, local mode) → whatever is already in `process.env`. The config parses both files itself and only fills in keys the environment does not already define, so exporting a variable always wins:
-
-```bash
-# runs against a locally served frontend, not whatever .env.local points at
-SIGNOZ_E2E_BASE_URL=http://127.0.0.1:3301 pnpm test tests/alerts
-```
-
-This is deliberately not `dotenv.config({ override: true })`. That flag makes the *file* beat `process.env`, which silently discarded exported values — including the `SIGNOZ_E2E_BASE_URL` in `pnpm test:staging`, whenever a `.env.local` happened to exist.
+Loading order in `playwright.config.ts`: `.env` first (user-provided, staging), then `.env.local` with `override: true` (bootstrap-generated, local mode). Anything already set in `process.env` at yarn-test time wins because dotenv doesn't touch vars that are already present.
 
 ### Playwright options
 
@@ -331,16 +281,13 @@ The full `playwright.config.ts` is the source of truth. Common things to tweak:
 The same pytest flags integration tests expose work here, since E2E reuses the shared fixture graph:
 
 - `--reuse` — keep containers warm between runs (required for all iteration).
-- `--rebuild` — recreate the SigNoz container from the current sources (backend and, with `--with-web`, frontend) while the rest of the stack stays up. Requires `--reuse`.
 - `--teardown` — tear everything down.
-- `--clean` — prune the docker build caches, forcing the next image build to start cold.
 - `--with-web` — build the frontend into the SigNoz container. **Required for E2E**; integration tests don't need it.
-- `--sqlstore-provider`, `--postgres-version`, `--clickhouse-version`, etc. — see `docs/contributing/tests/integration.md`.
+- `--sqlstore-provider`, `--postgres-version`, `--clickhouse-version`, etc. — see `docs/contributing/integration.md`.
 
 ## What should I remember?
 
-- **Always use the `--reuse` flag** when setting up the E2E stack. `--with-web` adds a ~4 min frontend build on a cold start; later builds are incremental.
-- **Changed backend or frontend code? Re-run the setup command** — it passes `--rebuild`, swapping the SigNoz container for one built from your current sources while the rest of the stack stays up.
+- **Always use the `--reuse` flag** when setting up the E2E stack. `--with-web` adds a ~4 min frontend build; you only want to pay that once.
 - **Don't teardown before setup.** `--reuse` correctly handles partially-set-up state, so chaining teardown → setup wastes time.
 - **Prefer UI-driven flows.** Playwright captures BE requests in the trace; a parallel `fetch` probe is almost always redundant. Drop to `page.request.*` only when the UI can't reach what you need.
 - **Use `page.waitForResponse` on UI clicks** to assert BE contracts — it still exercises the UI trigger path.

docs/contributing/tests/integration.md

@@ -37,34 +37,13 @@ make py-test-setup
 Under the hood this runs, from `tests/`:
 
 ```bash
-uv run pytest --basetemp=./tmp/ -vv --reuse --rebuild --capture=no integration/bootstrap/setup.py::test_setup
+uv run pytest --basetemp=./tmp/ -vv --reuse integration/bootstrap/setup.py::test_setup
 ```
 
 This command will:
-- Start all required services (ClickHouse, PostgreSQL, ClickHouse Keeper, SigNoz, Zeus mock, gateway mock)
+- Start all required services (ClickHouse, PostgreSQL, Zookeeper, SigNoz, Zeus mock, gateway mock)
 - Register an admin user
 - Keep containers running via the `--reuse` flag
-- Rebuild the SigNoz container from the current sources via the `--rebuild` flag
-
-### Rebuilding After Source Changes
-
-`--reuse` keeps the running SigNoz container, which means backend source changes are not picked up. `--rebuild` fixes exactly that: it kills the existing SigNoz container, rebuilds the image (incremental — only changed packages recompile thanks to the build cache), and starts a fresh one, while everything else (databases, mocks, migrations) stays reused. `make py-test-setup` passes it by default, so the iteration loop is simply:
-
-```bash
-make py-test-setup      # (re)build signoz from your current sources
-uv run pytest --basetemp=./tmp/ -vv --reuse integration/tests/<suite>/
-# ... edit backend code or tests ...
-make py-test-setup      # pick up the backend changes
-uv run pytest --basetemp=./tmp/ -vv --reuse integration/tests/<suite>/
-```
-
-The same applies to the e2e stack. `--rebuild` requires `--reuse` and cannot be combined with `--teardown` or `--clean`.
-
-Some suites define their own SigNoz variant in a suite-local `conftest.py` (`create_signoz(..., cache_key=...)` — e.g. `basepath`, `metricreduction`, `querier_json_body`). Those containers are not touched by `make py-test-setup`, which only rebuilds the default instance. For such suites, pass `--rebuild` on the suite run itself — it rebuilds every SigNoz variant the run instantiates:
-
-```bash
-uv run pytest --basetemp=./tmp/ -vv --reuse --rebuild integration/tests/<suite>/
-```
 
 ### Stopping the Test Environment
 
@@ -77,21 +56,11 @@ make py-test-teardown
 Which runs:
 
 ```bash
-uv run pytest --basetemp=./tmp/ -vv --teardown --capture=no integration/bootstrap/setup.py::test_teardown
+uv run pytest --basetemp=./tmp/ -vv --teardown integration/bootstrap/setup.py::test_teardown
 ```
 
 This destroys the running integration test setup and cleans up resources.
 
-### Cleaning the Image Build Cache
-
-The `signoz:integration` image build keeps its Go build and module caches in BuildKit cache mounts, so rebuilds only recompile what changed. These caches survive `--teardown` (they belong to the Docker builder, not to any container). If a cache ever needs to be nuked — suspected corruption, disk pressure, or to force a genuinely cold build — pass the `--clean` flag:
-
-```bash
-uv run pytest --basetemp=./tmp/ -vv --teardown --clean integration/bootstrap/setup.py::test_teardown
-```
-
-`--clean` prunes the docker build artifacts backing the incremental image build at session start, so the next build starts from a clean slate. Images and regular layer cache stay intact, but note the pruning is host-wide — it clears build caches for other projects too, not just SigNoz's. The flag composes with any invocation — passing it on a normal `--reuse` run simply makes the next image build start cold (~3–4 minutes instead of seconds).
-
 ## Understanding the Integration Test Framework
 
 Python and pytest form the foundation of the integration testing framework. Testcontainers are used to spin up disposable integration environments. WireMock is used to spin up **test doubles** of external services (Zeus cloud API, gateway, etc.).
@@ -130,7 +99,7 @@ tests/
 │       ├── passwordauthn/
 │       ├── querier/
 │       └── ...
-└── e2e/                     # Playwright suite (see docs/contributing/tests/e2e.md)
+└── e2e/                     # Playwright suite (see docs/contributing/e2e.md)
 ```
 
 Each test suite follows these principles:
@@ -255,9 +224,9 @@ Tests can be configured using pytest options:
 - `--sqlstore-provider` — Choose the SQL store provider (default: `postgres`)
 - `--sqlite-mode` — SQLite journal mode: `delete` or `wal` (default: `delete`). Only relevant when `--sqlstore-provider=sqlite`.
 - `--postgres-version` — PostgreSQL version (default: `15`)
-- `--clickhouse-version` — ClickHouse version, also used for ClickHouse Keeper (default: `25.12.5`)
-- `--schema-migrator-version` — SigNoz schema migrator version (default: `v0.144.9`)
-- `--with-web` — Build the frontend into the SigNoz image (required for e2e)
+- `--clickhouse-version` — ClickHouse version (default: `25.5.6`)
+- `--zookeeper-version` — Zookeeper version (default: `3.7.1`)
+- `--schema-migrator-version` — SigNoz schema migrator version (default: `v0.144.2`)
 
 Example:
 
@@ -270,7 +239,6 @@ uv run pytest --basetemp=./tmp/ -vv --reuse \
 ## What should I remember?
 
 - **Always use the `--reuse` flag** when setting up the environment or running tests to keep containers warm. Without it every run rebuilds the stack (~4 mins).
-- **Changed backend code? Re-run `make py-test-setup`** — it passes `--rebuild`, swapping the SigNoz container for one built from your current sources while the rest of the stack stays up.
 - **Use the `--teardown` flag** only when cleaning up — mixing `--teardown` with `--reuse` is a contradiction.
 - **Do not pre-emptively teardown before setup.** If the stack is partially up, `--reuse` picks up from wherever it is. `make py-test-teardown` then `make py-test-setup` wastes minutes.
 - **Follow the naming convention** with two-digit numeric prefixes (`01_`, `02_`) for ordered test execution within a suite.
@@ -279,5 +247,5 @@ uv run pytest --basetemp=./tmp/ -vv --reuse \
 - **Use descriptive test names** that clearly indicate what is being tested.
 - **Leverage fixtures** for common setup. The shared fixture package is at `tests/fixtures/` — reuse before adding new ones.
 - **Test both success and failure scenarios** (4xx / 5xx paths) to ensure robust functionality.
-- **Run `make py-fmt` and `make py-lint` before committing** Python changes — ruff format + ruff check.
+- **Run `make py-fmt` and `make py-lint` before committing** Python changes — black + isort + autoflake + pylint.
 - **`--sqlite-mode=wal` does not work on macOS.** The integration test environment runs SigNoz inside a Linux container with the SQLite database file mounted from the macOS host. WAL mode requires shared memory between connections, and connections crossing the VM boundary (macOS host ↔ Linux container) cannot share the WAL index, resulting in `SQLITE_IOERR_SHORT_READ`. WAL mode is tested in CI on Linux only.

ee/authn/callbackauthn/oidccallbackauthn/authn.go

@@ -53,6 +53,10 @@ func New(store authtypes.AuthNStore, licensing licensing.Licensing, providerSett
 }
 
 func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (string, error) {
+	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderOIDC {
+		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "domain type is not oidc")
+	}
+
 	_, oauth2Config, err := a.oidcProviderAndoauth2Config(ctx, siteURL, authDomain)
 	if err != nil {
 		return "", err
@@ -81,11 +85,6 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}
 
-	oidcConfig, err := authDomain.Config().OIDCConfig()
-	if err != nil {
-		return nil, err
-	}
-
 	oidcProvider, oauth2Config, err := a.oidcProviderAndoauth2Config(ctx, state.URL, authDomain)
 	if err != nil {
 		return nil, err
@@ -107,14 +106,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, err
 	}
 
-	if claims == nil && oidcConfig.GetUserInfo {
+	if claims == nil && authDomain.AuthDomainConfig().OIDC.GetUserInfo {
 		claims, err = a.claimsFromUserInfo(ctx, oidcProvider, token)
 		if err != nil {
 			return nil, err
 		}
 	}
 
-	emailClaim, ok := claims[oidcConfig.ClaimMapping.Email].(string)
+	emailClaim, ok := claims[authDomain.AuthDomainConfig().OIDC.ClaimMapping.Email].(string)
 	if !ok {
 		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email in claims")
 	}
@@ -124,7 +123,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 		return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: failed to parse email").WithAdditional(err.Error())
 	}
 
-	if !oidcConfig.InsecureSkipEmailVerified {
+	if !authDomain.AuthDomainConfig().OIDC.InsecureSkipEmailVerified {
 		emailVerifiedClaim, ok := claims["email_verified"].(bool)
 		if !ok {
 			return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email_verified in claims")
@@ -136,14 +135,14 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}
 
 	name := ""
-	if nameClaim := oidcConfig.ClaimMapping.Name; nameClaim != "" {
+	if nameClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Name; nameClaim != "" {
 		if n, ok := claims[nameClaim].(string); ok {
 			name = n
 		}
 	}
 
 	var groups []string
-	if groupsClaim := oidcConfig.ClaimMapping.Groups; groupsClaim != "" {
+	if groupsClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Groups; groupsClaim != "" {
 		if claimValue, exists := claims[groupsClaim]; exists {
 			switch g := claimValue.(type) {
 			case []any:
@@ -162,7 +161,7 @@ func (a *AuthN) HandleCallback(ctx context.Context, query url.Values) (*authtype
 	}
 
 	role := ""
-	if roleClaim := oidcConfig.ClaimMapping.Role; roleClaim != "" {
+	if roleClaim := authDomain.AuthDomainConfig().OIDC.ClaimMapping.Role; roleClaim != "" {
 		if r, ok := claims[roleClaim].(string); ok {
 			role = r
 		}
@@ -178,16 +177,11 @@ func (a *AuthN) ProviderInfo(ctx context.Context, authDomain *authtypes.AuthDoma
 }
 
 func (a *AuthN) oidcProviderAndoauth2Config(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (*oidc.Provider, *oauth2.Config, error) {
-	oidcConfig, err := authDomain.Config().OIDCConfig()
-	if err != nil {
-		return nil, nil, err
+	if authDomain.AuthDomainConfig().OIDC.IssuerAlias != "" {
+		ctx = oidc.InsecureIssuerURLContext(ctx, authDomain.AuthDomainConfig().OIDC.IssuerAlias)
 	}
 
-	if oidcConfig.IssuerAlias != "" {
-		ctx = oidc.InsecureIssuerURLContext(ctx, oidcConfig.IssuerAlias)
-	}
-
-	oidcProvider, err := oidc.NewProvider(ctx, oidcConfig.Issuer)
+	oidcProvider, err := oidc.NewProvider(ctx, authDomain.AuthDomainConfig().OIDC.Issuer)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -195,13 +189,13 @@ func (a *AuthN) oidcProviderAndoauth2Config(ctx context.Context, siteURL *url.UR
 	scopes := make([]string, len(defaultScopes))
 	copy(scopes, defaultScopes)
 
-	if authDomain.RoleMapping() != nil && len(authDomain.RoleMapping().GroupMappings) > 0 {
+	if authDomain.AuthDomainConfig().RoleMapping != nil && len(authDomain.AuthDomainConfig().RoleMapping.GroupMappings) > 0 {
 		scopes = append(scopes, "groups")
 	}
 
 	return oidcProvider, &oauth2.Config{
-		ClientID:     oidcConfig.ClientID,
-		ClientSecret: oidcConfig.ClientSecret,
+		ClientID:     authDomain.AuthDomainConfig().OIDC.ClientID,
+		ClientSecret: authDomain.AuthDomainConfig().OIDC.ClientSecret,
 		Endpoint:     oidcProvider.Endpoint(),
 		Scopes:       scopes,
 		RedirectURL: (&url.URL{
@@ -218,12 +212,7 @@ func (a *AuthN) claimsFromIDToken(ctx context.Context, authDomain *authtypes.Aut
 		return nil, errors.New(errors.TypeNotFound, errors.CodeNotFound, "oidc: no id_token in token response")
 	}
 
-	oidcConfig, err := authDomain.Config().OIDCConfig()
-	if err != nil {
-		return nil, err
-	}
-
-	verifier := provider.Verifier(&oidc.Config{ClientID: oidcConfig.ClientID})
+	verifier := provider.Verifier(&oidc.Config{ClientID: authDomain.AuthDomainConfig().OIDC.ClientID})
 	idToken, err := verifier.Verify(ctx, rawIDToken)
 	if err != nil {
 		return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "oidc: failed to verify token").WithAdditional(err.Error())

ee/authn/callbackauthn/samlcallbackauthn/authn.go

@@ -40,6 +40,10 @@ func New(ctx context.Context, store authtypes.AuthNStore, licensing licensing.Li
 }
 
 func (a *AuthN) LoginURL(ctx context.Context, siteURL *url.URL, authDomain *authtypes.AuthDomain) (string, error) {
+	if authDomain.AuthDomainConfig().AuthNProvider != authtypes.AuthNProviderSAML {
+		return "", errors.Newf(errors.TypeInternal, authtypes.ErrCodeAuthDomainMismatch, "saml: domain type is not saml")
+	}
+
 	sp, err := a.serviceProvider(siteURL, authDomain)
 	if err != nil {
 		return "", err
@@ -69,11 +73,6 @@ func (a *AuthN) HandleCallback(ctx context.Context, formValues url.Values) (*aut
 		return nil, errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}
 
-	samlConfig, err := authDomain.Config().SamlConfig()
-	if err != nil {
-		return nil, err
-	}
-
 	sp, err := a.serviceProvider(state.URL, authDomain)
 	if err != nil {
 		return nil, err
@@ -102,19 +101,19 @@ func (a *AuthN) HandleCallback(ctx context.Context, formValues url.Values) (*aut
 	}
 
 	name := ""
-	if nameAttribute := samlConfig.AttributeMapping.Name; nameAttribute != "" {
+	if nameAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Name; nameAttribute != "" {
 		if val := assertionInfo.Values.Get(nameAttribute); val != "" {
 			name = val
 		}
 	}
 
 	var groups []string
-	if groupAttribute := samlConfig.AttributeMapping.Groups; groupAttribute != "" {
+	if groupAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Groups; groupAttribute != "" {
 		groups = assertionInfo.Values.GetAll(groupAttribute)
 	}
 
 	role := ""
-	if roleAttribute := samlConfig.AttributeMapping.Role; roleAttribute != "" {
+	if roleAttribute := authDomain.AuthDomainConfig().SAML.AttributeMapping.Role; roleAttribute != "" {
 		if val := assertionInfo.Values.Get(roleAttribute); val != "" {
 			role = val
 		}
@@ -132,12 +131,7 @@ func (a *AuthN) ProviderInfo(ctx context.Context, authDomain *authtypes.AuthDoma
 }
 
 func (a *AuthN) serviceProvider(siteURL *url.URL, authDomain *authtypes.AuthDomain) (*saml2.SAMLServiceProvider, error) {
-	samlConfig, err := authDomain.Config().SamlConfig()
-	if err != nil {
-		return nil, err
-	}
-
-	certStore, err := a.getCertificateStore(samlConfig)
+	certStore, err := a.getCertificateStore(authDomain)
 	if err != nil {
 		return nil, err
 	}
@@ -148,32 +142,32 @@ func (a *AuthN) serviceProvider(siteURL *url.URL, authDomain *authtypes.AuthDoma
 	// The ServiceProviderIssuer is the client id in case of keycloak. Since we set it to the host here, we need to set the client id == host in keycloak.
 	// For AWSSSO, this is the value of Application SAML audience.
 	return &saml2.SAMLServiceProvider{
-		IdentityProviderSSOURL:      samlConfig.Location,
-		IdentityProviderIssuer:      samlConfig.EntityID,
+		IdentityProviderSSOURL:      authDomain.AuthDomainConfig().SAML.SamlIdp,
+		IdentityProviderIssuer:      authDomain.AuthDomainConfig().SAML.SamlEntity,
 		ServiceProviderIssuer:       siteURL.Host,
 		AssertionConsumerServiceURL: acsURL.String(),
-		SignAuthnRequests:           !samlConfig.InsecureSkipAuthNRequestsSigned,
+		SignAuthnRequests:           !authDomain.AuthDomainConfig().SAML.InsecureSkipAuthNRequestsSigned,
 		AllowMissingAttributes:      true,
 		IDPCertificateStore:         certStore,
 		SPKeyStore:                  dsig.RandomKeyStoreForTest(),
 	}, nil
 }
 
-func (a *AuthN) getCertificateStore(samlConfig authtypes.SamlConfig) (dsig.X509CertificateStore, error) {
+func (a *AuthN) getCertificateStore(authDomain *authtypes.AuthDomain) (dsig.X509CertificateStore, error) {
 	certStore := &dsig.MemoryX509CertificateStore{
 		Roots: []*x509.Certificate{},
 	}
 
 	var certBytes []byte
-	if strings.Contains(samlConfig.Certificate, "-----BEGIN CERTIFICATE-----") {
-		block, _ := pem.Decode([]byte(samlConfig.Certificate))
+	if strings.Contains(authDomain.AuthDomainConfig().SAML.SamlCert, "-----BEGIN CERTIFICATE-----") {
+		block, _ := pem.Decode([]byte(authDomain.AuthDomainConfig().SAML.SamlCert))
 		if block == nil {
 			return certStore, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "no valid pem cert found")
 		}
 
 		certBytes = block.Bytes
 	} else {
-		certData, err := base64.StdEncoding.DecodeString(samlConfig.Certificate)
+		certData, err := base64.StdEncoding.DecodeString(authDomain.AuthDomainConfig().SAML.SamlCert)
 		if err != nil {
 			return certStore, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to read certificate: %s", err.Error())
 		}

ee/gateway/httpgateway/provider.go

@@ -108,20 +108,6 @@ func (provider *Provider) SearchIngestionKeysByName(ctx context.Context, orgID v
 	}, nil
 }
 
-func (provider *Provider) GetIngestionKey(ctx context.Context, orgID valuer.UUID, keyID string) (*gatewaytypes.IngestionKey, error) {
-	responseBody, err := provider.do(ctx, orgID, http.MethodGet, "/v1/workspaces/me/keys/"+keyID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	var ingestionKey gatewaytypes.IngestionKey
-	if err := json.Unmarshal([]byte(gjson.GetBytes(responseBody, "data").String()), &ingestionKey); err != nil {
-		return nil, err
-	}
-
-	return &ingestionKey, nil
-}
-
 func (provider *Provider) CreateIngestionKey(ctx context.Context, orgID valuer.UUID, name string, tags []string, expiresAt time.Time) (*gatewaytypes.GettableCreatedIngestionKey, error) {
 	requestBody := gatewaytypes.PostableIngestionKey{
 		Name:      name,
@@ -175,7 +161,7 @@ func (provider *Provider) DeleteIngestionKey(ctx context.Context, orgID valuer.U
 }
 
 func (provider *Provider) CreateIngestionKeyLimit(ctx context.Context, orgID valuer.UUID, keyID string, signal string, limitConfig gatewaytypes.LimitConfig, tags []string) (*gatewaytypes.GettableCreatedIngestionKeyLimit, error) {
-	requestBody := gatewaytypes.DeprecatedPostableIngestionKeyLimit{
+	requestBody := gatewaytypes.PostableIngestionKeyLimit{
 		Signal: signal,
 		Config: limitConfig,
 		Tags:   tags,
@@ -198,34 +184,6 @@ func (provider *Provider) CreateIngestionKeyLimit(ctx context.Context, orgID val
 	return &createdIngestionKeyLimitResponse, nil
 }
 
-func (provider *Provider) GetIngestionKeyLimit(ctx context.Context, orgID valuer.UUID, limitID string) (*gatewaytypes.Limit, error) {
-	responseBody, err := provider.do(ctx, orgID, http.MethodGet, "/v1/workspaces/me/limits/"+limitID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	var limit gatewaytypes.Limit
-	if err := json.Unmarshal([]byte(gjson.GetBytes(responseBody, "data").String()), &limit); err != nil {
-		return nil, err
-	}
-
-	return &limit, nil
-}
-
-func (provider *Provider) GetIngestionKeyLimits(ctx context.Context, orgID valuer.UUID, keyID string) ([]gatewaytypes.Limit, error) {
-	responseBody, err := provider.do(ctx, orgID, http.MethodGet, "/v1/workspaces/me/keys/"+keyID+"/limits", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	var limits []gatewaytypes.Limit
-	if err := json.Unmarshal([]byte(gjson.GetBytes(responseBody, "data").String()), &limits); err != nil {
-		return nil, err
-	}
-
-	return limits, nil
-}
-
 func (provider *Provider) UpdateIngestionKeyLimit(ctx context.Context, orgID valuer.UUID, limitID string, limitConfig gatewaytypes.LimitConfig, tags []string) error {
 	requestBody := gatewaytypes.UpdatableIngestionKeyLimit{
 		Config: limitConfig,

ee/licensing/httplicensing/api.go

@@ -0,0 +1,168 @@
+package httplicensing
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/http/render"
+	"github.com/SigNoz/signoz/pkg/licensing"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/licensetypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+type licensingAPI struct {
+	licensing licensing.Licensing
+}
+
+func NewLicensingAPI(licensing licensing.Licensing) licensing.API {
+	return &licensingAPI{licensing: licensing}
+}
+
+func (api *licensingAPI) Activate(rw http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "orgId is invalid"))
+		return
+	}
+
+	req := new(licensetypes.PostableLicense)
+	err = json.NewDecoder(r.Body).Decode(&req)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	err = api.licensing.Activate(r.Context(), orgID, req.Key)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusAccepted, nil)
+}
+
+func (api *licensingAPI) GetActive(rw http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "orgId is invalid"))
+		return
+	}
+
+	license, err := api.licensing.GetActive(r.Context(), orgID)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	gettableLicense := licensetypes.NewGettableLicense(license.Data, license.Key)
+	render.Success(rw, http.StatusOK, gettableLicense)
+}
+
+func (api *licensingAPI) Refresh(rw http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "orgId is invalid"))
+		return
+	}
+
+	err = api.licensing.Refresh(r.Context(), orgID)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusNoContent, nil)
+}
+
+func (api *licensingAPI) Checkout(rw http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "orgId is invalid"))
+		return
+	}
+
+	req := new(licensetypes.PostableSubscription)
+	if err := json.NewDecoder(r.Body).Decode(req); err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	gettableSubscription, err := api.licensing.Checkout(ctx, orgID, req)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusCreated, gettableSubscription)
+}
+
+func (api *licensingAPI) Portal(rw http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "orgId is invalid"))
+		return
+	}
+
+	req := new(licensetypes.PostableSubscription)
+	if err := json.NewDecoder(r.Body).Decode(req); err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	gettableSubscription, err := api.licensing.Portal(ctx, orgID, req)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusCreated, gettableSubscription)
+}

ee/licensing/httplicensing/provider.go

@@ -2,9 +2,12 @@ package httplicensing
 
 import (
 	"context"
+	"encoding/json"
 	"log/slog"
 	"time"
 
+	"github.com/tidwall/gjson"
+
 	"github.com/SigNoz/signoz/ee/licensing/licensingstore/sqllicensingstore"
 	"github.com/SigNoz/signoz/pkg/analytics"
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -92,65 +95,24 @@ func (provider *provider) Validate(ctx context.Context) error {
 	return nil
 }
 
-func (provider *provider) Activate(ctx context.Context, organizationID valuer.UUID, key string) (*licensetypes.License, error) {
-	zeusLicense, err := provider.zeus.GetLicense(ctx, key)
+func (provider *provider) Activate(ctx context.Context, organizationID valuer.UUID, key string) error {
+	data, err := provider.zeus.GetLicense(ctx, key)
 	if err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "unable to fetch license data with upstream server")
+		return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "unable to fetch license data with upstream server")
 	}
 
-	license, err := licensetypes.NewLicense(zeusLicense, organizationID)
+	license, err := licensetypes.NewLicense(data, organizationID)
 	if err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to create license entity")
+		return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to create license entity")
 	}
 
 	storableLicense := licensetypes.NewStorableLicenseFromLicense(license)
 	err = provider.store.Create(ctx, storableLicense)
-	if err != nil {
-		return nil, err
-	}
-
-	return license, nil
-}
-
-func (provider *provider) Get(ctx context.Context, organizationID valuer.UUID, licenseID valuer.UUID) (*licensetypes.License, error) {
-	storableLicense, err := provider.store.Get(ctx, organizationID, licenseID)
-	if err != nil {
-		return nil, err
-	}
-
-	return licensetypes.NewLicenseFromStorableLicense(storableLicense)
-}
-
-func (provider *provider) List(ctx context.Context, organizationID valuer.UUID) ([]*licensetypes.License, error) {
-	storableLicenses, err := provider.store.GetAll(ctx, organizationID)
-	if err != nil {
-		return nil, err
-	}
-
-	licenses := make([]*licensetypes.License, 0, len(storableLicenses))
-	for _, storableLicense := range storableLicenses {
-		license, err := licensetypes.NewLicenseFromStorableLicense(storableLicense)
-		if err != nil {
-			return nil, err
-		}
-
-		licenses = append(licenses, license)
-	}
-
-	return licenses, nil
-}
-
-func (provider *provider) Delete(ctx context.Context, organizationID valuer.UUID, licenseID valuer.UUID) error {
-	license, err := provider.Get(ctx, organizationID, licenseID)
 	if err != nil {
 		return err
 	}
 
-	if err := license.ErrIfCloud(); err != nil {
-		return errors.WithAdditionalf(err, "license %s cannot be deleted", licenseID.StringValue())
-	}
-
-	return provider.store.Delete(ctx, organizationID, licenseID)
+	return nil
 }
 
 func (provider *provider) GetActive(ctx context.Context, organizationID valuer.UUID) (*licensetypes.License, error) {
@@ -177,7 +139,7 @@ func (provider *provider) Refresh(ctx context.Context, organizationID valuer.UUI
 		return err
 	}
 
-	zeusLicense, err := provider.zeus.GetLicense(ctx, activeLicense.Key)
+	data, err := provider.zeus.GetLicense(ctx, activeLicense.Key)
 	if err != nil {
 		if time.Since(activeLicense.LastValidatedAt) > time.Duration(provider.config.FailureThreshold)*provider.config.PollInterval {
 			activeLicense.UpdateFeatures(licensetypes.BasicPlan)
@@ -192,7 +154,7 @@ func (provider *provider) Refresh(ctx context.Context, organizationID valuer.UUI
 		return err
 	}
 
-	err = activeLicense.Update(zeusLicense)
+	err = activeLicense.Update(data)
 	if err != nil {
 		return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to create license entity from license data")
 	}
@@ -225,6 +187,47 @@ func (provider *provider) Refresh(ctx context.Context, organizationID valuer.UUI
 	return nil
 }
 
+func (provider *provider) Checkout(ctx context.Context, organizationID valuer.UUID, postableSubscription *licensetypes.PostableSubscription) (*licensetypes.GettableSubscription, error) {
+	activeLicense, err := provider.GetActive(ctx, organizationID)
+	if err != nil {
+		return nil, err
+	}
+
+	body, err := json.Marshal(postableSubscription)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to marshal checkout payload")
+	}
+
+	response, err := provider.zeus.GetCheckoutURL(ctx, activeLicense.Key, body)
+	if err != nil {
+		if errors.Ast(err, errors.TypeAlreadyExists) {
+			return nil, errors.WithAdditionalf(err, "checkout has already been completed for this account. Please click 'Refresh Status' to sync your subscription")
+		}
+		return nil, err
+	}
+
+	return &licensetypes.GettableSubscription{RedirectURL: gjson.GetBytes(response, "url").String()}, nil
+}
+
+func (provider *provider) Portal(ctx context.Context, organizationID valuer.UUID, postableSubscription *licensetypes.PostableSubscription) (*licensetypes.GettableSubscription, error) {
+	activeLicense, err := provider.GetActive(ctx, organizationID)
+	if err != nil {
+		return nil, err
+	}
+
+	body, err := json.Marshal(postableSubscription)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to marshal portal payload")
+	}
+
+	response, err := provider.zeus.GetPortalURL(ctx, activeLicense.Key, body)
+	if err != nil {
+		return nil, err
+	}
+
+	return &licensetypes.GettableSubscription{RedirectURL: gjson.GetBytes(response, "url").String()}, nil
+}
+
 func (provider *provider) GetFeatureFlags(ctx context.Context, organizationID valuer.UUID) ([]*licensetypes.Feature, error) {
 	license, err := provider.GetActive(ctx, organizationID)
 	if err != nil {

ee/licensing/licensingstore/sqllicensingstore/store.go

@@ -64,22 +64,6 @@ func (store *store) GetAll(ctx context.Context, organizationID valuer.UUID) ([]*
 	return storableLicenses, nil
 }
 
-func (store *store) Delete(ctx context.Context, organizationID valuer.UUID, licenseID valuer.UUID) error {
-	_, err := store.
-		sqlstore.
-		BunDB().
-		NewDelete().
-		Model(new(licensetypes.StorableLicense)).
-		Where("org_id = ?", organizationID).
-		Where("id = ?", licenseID).
-		Exec(ctx)
-	if err != nil {
-		return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "unable to delete license with ID: %s", licenseID)
-	}
-
-	return nil
-}
-
 func (store *store) Update(ctx context.Context, organizationID valuer.UUID, storableLicense *licensetypes.StorableLicense) error {
 	_, err := store.
 		sqlstore.

ee/modules/dashboard/impldashboard/module.go

@@ -32,9 +32,9 @@ type module struct {
 	tagModule          tag.Module
 }
 
-func NewModule(store dashboardtypes.Store, settings factory.ProviderSettings, analytics analytics.Analytics, orgGetter organization.Getter, queryParser queryparser.QueryParser, querier querier.Querier, licensing licensing.Licensing, tagModule tag.Module, systemDashboardRegistry dashboardtypes.SystemDashboardRegistry) dashboard.Module {
+func NewModule(store dashboardtypes.Store, settings factory.ProviderSettings, analytics analytics.Analytics, orgGetter organization.Getter, queryParser queryparser.QueryParser, querier querier.Querier, licensing licensing.Licensing, tagModule tag.Module) dashboard.Module {
 	scopedProviderSettings := factory.NewScopedProviderSettings(settings, "github.com/SigNoz/signoz/ee/modules/dashboard/impldashboard")
-	pkgDashboardModule := pkgimpldashboard.NewModule(store, settings, analytics, orgGetter, queryParser, tagModule, systemDashboardRegistry)
+	pkgDashboardModule := pkgimpldashboard.NewModule(store, settings, analytics, orgGetter, queryParser, tagModule)
 
 	return &module{
 		pkgDashboardModule: pkgDashboardModule,
@@ -276,10 +276,6 @@ func (module *module) GetV2(ctx context.Context, orgID valuer.UUID, id valuer.UU
 	return module.pkgDashboardModule.GetV2(ctx, orgID, id)
 }
 
-func (module *module) MigrateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error) {
-	return module.pkgDashboardModule.MigrateV2(ctx, orgID, id)
-}
-
 func (module *module) UpdateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error) {
 	return module.pkgDashboardModule.UpdateV2(ctx, orgID, id, updatedBy, updatable)
 }
@@ -361,14 +357,6 @@ func (module *module) LockUnlock(ctx context.Context, orgID valuer.UUID, id valu
 	return module.pkgDashboardModule.LockUnlock(ctx, orgID, id, updatedBy, isAdmin, lock)
 }
 
-func (module *module) ReconcileSystemDashboards(ctx context.Context, orgID valuer.UUID) error {
-	return module.pkgDashboardModule.ReconcileSystemDashboards(ctx, orgID)
-}
-
-func (module *module) GetSystemDashboard(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
-	return module.pkgDashboardModule.GetSystemDashboard(ctx, orgID, name)
-}
-
 func (module *module) delete(ctx context.Context, orgID, id valuer.UUID) error {
 	return module.store.RunInTx(ctx, func(ctx context.Context) error {
 		if err := module.store.DeletePublic(ctx, id.String()); err != nil && !errors.Ast(err, errors.TypeNotFound) {

ee/query-service/app/api/api.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/SigNoz/signoz/ee/licensing/httplicensing"
 	"github.com/SigNoz/signoz/ee/query-service/usage"
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
@@ -41,6 +42,7 @@ func NewAPIHandler(opts APIHandlerOptions, signoz *signoz.SigNoz, config signoz.
 		IntegrationsController:        opts.IntegrationsController,
 		LogsParsingPipelineController: opts.LogsParsingPipelineController,
 		FluxInterval:                  opts.FluxInterval,
+		LicensingAPI:                  httplicensing.NewLicensingAPI(signoz.Licensing),
 		Signoz:                        signoz,
 		QueryParserAPI:                queryparser.NewAPI(signoz.Instrumentation.ToProviderSettings(), signoz.QueryParser),
 	}, config)
@@ -65,11 +67,20 @@ func (ah *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	// note: add ee override methods first
 
 	// routes available only in ee version
-	router.HandleFunc("/api/v1/features", am.OpenAccess(ah.getFeatureFlags)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/features", am.ViewAccess(ah.getFeatureFlags)).Methods(http.MethodGet)
 
 	// base overrides
 	router.HandleFunc("/api/v1/version", am.OpenAccess(ah.getVersion)).Methods(http.MethodGet)
 
+	router.HandleFunc("/api/v1/checkout", am.AdminAccess(ah.LicensingAPI.Checkout)).Methods(http.MethodPost)
+	router.HandleFunc("/api/v1/billing", am.AdminAccess(ah.getBilling)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/portal", am.AdminAccess(ah.LicensingAPI.Portal)).Methods(http.MethodPost)
+
+	// v3
+	router.HandleFunc("/api/v3/licenses", am.AdminAccess(ah.LicensingAPI.Activate)).Methods(http.MethodPost)
+	router.HandleFunc("/api/v3/licenses", am.AdminAccess(ah.LicensingAPI.Refresh)).Methods(http.MethodPut)
+	router.HandleFunc("/api/v3/licenses/active", am.ViewAccess(ah.LicensingAPI.GetActive)).Methods(http.MethodGet)
+
 	// v4
 	router.HandleFunc("/api/v4/query_range", am.ViewAccess(ah.queryRangeV4)).Methods(http.MethodPost)
 

ee/query-service/app/api/featureFlags.go

@@ -80,6 +80,15 @@ func (ah *APIHandler) getFeatureFlags(w http.ResponseWriter, r *http.Request) {
 		Route:      "",
 	})
 
+	fineGrainedAuthz := ah.Signoz.Flagger.BooleanOrEmpty(ctx, flagger.FeatureUseFineGrainedAuthz, evalCtx)
+	featureSet = append(featureSet, &licensetypes.Feature{
+		Name:       valuer.NewString(flagger.FeatureUseFineGrainedAuthz.String()),
+		Active:     fineGrainedAuthz,
+		Usage:      0,
+		UsageLimit: -1,
+		Route:      "",
+	})
+
 	aiObservability := ah.Signoz.Flagger.BooleanOrEmpty(ctx, flagger.FeatureEnableAIObservability, evalCtx)
 	featureSet = append(featureSet, &licensetypes.Feature{
 		Name:       valuer.NewString(flagger.FeatureEnableAIObservability.String()),
@@ -98,6 +107,23 @@ func (ah *APIHandler) getFeatureFlags(w http.ResponseWriter, r *http.Request) {
 		Route:      "",
 	})
 
+	infraMonitoringV2 := ah.Signoz.Flagger.BooleanOrEmpty(ctx, flagger.FeatureUseInfraMonitoringV2, evalCtx)
+	featureSet = append(featureSet, &licensetypes.Feature{
+		Name:       valuer.NewString(flagger.FeatureUseInfraMonitoringV2.String()),
+		Active:     infraMonitoringV2,
+		Usage:      0,
+		UsageLimit: -1,
+		Route:      "",
+	})
+
+	if constants.IsDotMetricsEnabled {
+		for idx, feature := range featureSet {
+			if feature.Name == licensetypes.DotMetricsEnabled {
+				featureSet[idx].Active = true
+			}
+		}
+	}
+
 	ah.Respond(w, featureSet)
 }
 

ee/query-service/app/api/license.go

@@ -0,0 +1,122 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/SigNoz/signoz/ee/query-service/constants"
+	"github.com/SigNoz/signoz/ee/query-service/model"
+	"github.com/SigNoz/signoz/pkg/flagger"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/featuretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+type DayWiseBreakdown struct {
+	Type      string        `json:"type"`
+	Breakdown []DayWiseData `json:"breakdown"`
+}
+
+type DayWiseData struct {
+	Timestamp int64   `json:"timestamp"`
+	Count     float64 `json:"count"`
+	Size      float64 `json:"size"`
+	UnitPrice float64 `json:"unitPrice"`
+	Quantity  float64 `json:"quantity"`
+	Total     float64 `json:"total"`
+}
+
+type tierBreakdown struct {
+	UnitPrice float64 `json:"unitPrice"`
+	Quantity  float64 `json:"quantity"`
+	TierStart int64   `json:"tierStart"`
+	TierEnd   int64   `json:"tierEnd"`
+	TierCost  float64 `json:"tierCost"`
+}
+
+type usageResponse struct {
+	Type             string           `json:"type"`
+	Unit             string           `json:"unit"`
+	Tiers            []tierBreakdown  `json:"tiers"`
+	DayWiseBreakdown DayWiseBreakdown `json:"dayWiseBreakdown"`
+}
+
+type details struct {
+	Total     float64         `json:"total"`
+	Breakdown []usageResponse `json:"breakdown"`
+	BaseFee   float64         `json:"baseFee"`
+	BillTotal float64         `json:"billTotal"`
+}
+
+type billingData struct {
+	BillingPeriodStart int64   `json:"billingPeriodStart"`
+	BillingPeriodEnd   int64   `json:"billingPeriodEnd"`
+	Details            details `json:"details"`
+	Discount           float64 `json:"discount"`
+	SubscriptionStatus string  `json:"subscriptionStatus"`
+}
+
+type billingDetails struct {
+	Status string      `json:"status"`
+	Data   billingData `json:"data"`
+}
+
+func (ah *APIHandler) getBilling(w http.ResponseWriter, r *http.Request) {
+	licenseKey := r.URL.Query().Get("licenseKey")
+
+	if licenseKey == "" {
+		RespondError(w, model.BadRequest(fmt.Errorf("license key is required")), nil)
+		return
+	}
+
+	claims, err := authtypes.ClaimsFromContext(r.Context())
+	if err != nil {
+		RespondError(w, model.InternalError(err), nil)
+		return
+	}
+
+	orgID := valuer.MustNewUUID(claims.OrgID)
+	evalCtx := featuretypes.NewFlaggerEvaluationContext(orgID)
+	useZeus := ah.Signoz.Flagger.BooleanOrEmpty(r.Context(), flagger.FeatureGetMetersFromZeus, evalCtx)
+
+	if useZeus {
+		data, err := ah.Signoz.Zeus.GetMeters(r.Context(), licenseKey)
+		if err != nil {
+			RespondError(w, model.InternalError(err), nil)
+			return
+		}
+
+		var billing billingData
+		if err := json.Unmarshal(data, &billing); err != nil {
+			RespondError(w, model.InternalError(err), nil)
+			return
+		}
+
+		ah.Respond(w, billing)
+		return
+	}
+
+	billingURL := fmt.Sprintf("%s/usage?licenseKey=%s", constants.LicenseSignozIo, licenseKey)
+
+	hClient := &http.Client{}
+	req, err := http.NewRequest("GET", billingURL, nil)
+	if err != nil {
+		RespondError(w, model.InternalError(err), nil)
+		return
+	}
+	req.Header.Add("X-SigNoz-SecretKey", constants.LicenseAPIKey)
+	billingResp, err := hClient.Do(req)
+	if err != nil {
+		RespondError(w, model.InternalError(err), nil)
+		return
+	}
+
+	var billingResponse billingDetails
+	if err := json.NewDecoder(billingResp.Body).Decode(&billingResponse); err != nil {
+		RespondError(w, model.InternalError(err), nil)
+		return
+	}
+
+	ah.Respond(w, billingResponse.Data)
+}

ee/query-service/app/server.go

@@ -3,29 +3,56 @@ package app
 import (
 	"context"
 	"fmt"
+	"net"
+	"net/http"
+	"slices"
+
+	"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux"
+	"go.opentelemetry.io/otel/propagation"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+
+	"github.com/gorilla/handlers"
+
+	"github.com/rs/cors"
+	"github.com/soheilhy/cmux"
 
 	"github.com/SigNoz/signoz/ee/query-service/app/api"
 	"github.com/SigNoz/signoz/ee/query-service/usage"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
 	"github.com/SigNoz/signoz/pkg/signoz"
+	"github.com/SigNoz/signoz/pkg/web"
 
 	"log/slog"
 
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
+	baseapp "github.com/SigNoz/signoz/pkg/query-service/app"
 	"github.com/SigNoz/signoz/pkg/query-service/app/clickhouseReader"
 	"github.com/SigNoz/signoz/pkg/query-service/app/integrations"
 	"github.com/SigNoz/signoz/pkg/query-service/app/logparsingpipeline"
 	"github.com/SigNoz/signoz/pkg/query-service/app/opamp"
 	opAmpModel "github.com/SigNoz/signoz/pkg/query-service/app/opamp/model"
 	baseconst "github.com/SigNoz/signoz/pkg/query-service/constants"
+	"github.com/SigNoz/signoz/pkg/query-service/healthcheck"
+	"github.com/SigNoz/signoz/pkg/query-service/utils"
 )
 
-// Server runs auxiliary servers (opamp) alongside the signoz apiserver
+// Server runs HTTP, Mux and a grpc server
 type Server struct {
+	config signoz.Config
+	signoz *signoz.SigNoz
+
+	// public http router
+	httpConn     net.Listener
+	httpServer   *http.Server
+	httpHostPort string
+
 	opampServer *opamp.Server
 
 	// Usage manager
 	usageManager *usage.Manager
+
+	unavailableChannel chan healthcheck.Status
 }
 
 // NewServer creates and initializes Server
@@ -100,25 +127,22 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		return nil, err
 	}
 
-	// Register the legacy query-service routes on the apiserver router. The
-	// apiserver owns the HTTP server and applies the middleware chain at serve
-	// time, so these routes get the same treatment as the apiserver routes.
-	r := signoz.APIServer.Router()
-	am := middleware.NewAuthZ(signoz.Instrumentation.Logger(), signoz.Modules.OrgGetter, signoz.Authz)
-
-	apiHandler.RegisterRoutes(r, am)
-	apiHandler.RegisterLogsRoutes(r, am)
-	apiHandler.RegisterIntegrationRoutes(r, am)
-	apiHandler.RegisterQueryRangeV3Routes(r, am)
-	apiHandler.RegisterQueryRangeV4Routes(r, am)
-	apiHandler.RegisterMessagingQueuesRoutes(r, am)
-	apiHandler.RegisterThirdPartyApiRoutes(r, am)
-	apiHandler.RegisterTraceFunnelsRoutes(r, am)
-
 	s := &Server{
-		usageManager: usageManager,
+		config:             config,
+		signoz:             signoz,
+		httpHostPort:       baseconst.HTTPHostPort,
+		unavailableChannel: make(chan healthcheck.Status),
+		usageManager:       usageManager,
 	}
 
+	httpServer, err := s.createPublicServer(apiHandler, signoz.Web)
+
+	if err != nil {
+		return nil, err
+	}
+
+	s.httpServer = httpServer
+
 	s.opampServer = opamp.InitializeServer(
 		&opAmpModel.AllAgents, agentConfMgr, signoz.Instrumentation,
 	)
@@ -126,18 +150,147 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 	return s, nil
 }
 
-// Start starts the opamp websocket server. The HTTP API server is started by
-// the signoz registry.
-func (s *Server) Start(ctx context.Context) error {
-	slog.Info("Starting OpAmp Websocket server", "addr", baseconst.OpAmpWsEndpoint)
-	if err := s.opampServer.Start(baseconst.OpAmpWsEndpoint); err != nil {
+// HealthCheckStatus returns health check status channel a client can subscribe to
+func (s Server) HealthCheckStatus() chan healthcheck.Status {
+	return s.unavailableChannel
+}
+
+func (s *Server) createPublicServer(apiHandler *api.APIHandler, web web.Web) (*http.Server, error) {
+	r := baseapp.NewRouter()
+	am := middleware.NewAuthZ(s.signoz.Instrumentation.Logger(), s.signoz.Modules.OrgGetter, s.signoz.Authz)
+
+	r.Use(middleware.NewRecovery(s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(otelmux.Middleware(
+		"apiserver",
+		otelmux.WithMeterProvider(s.signoz.Instrumentation.MeterProvider()),
+		otelmux.WithTracerProvider(s.signoz.Instrumentation.TracerProvider()),
+		otelmux.WithPropagators(propagation.NewCompositeTextMapPropagator(propagation.Baggage{}, propagation.TraceContext{})),
+		otelmux.WithFilter(func(r *http.Request) bool {
+			return !slices.Contains([]string{"/api/v1/health"}, r.URL.Path)
+		}),
+	))
+	r.Use(middleware.NewIdentN(s.signoz.IdentNResolver, s.signoz.Sharder, s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(middleware.NewTimeout(s.signoz.Instrumentation.Logger(),
+		s.config.APIServer.Timeout.ExcludedRoutes,
+		s.config.APIServer.Timeout.Default,
+		s.config.APIServer.Timeout.Max,
+	).Wrap)
+	r.Use(middleware.NewResource(s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(middleware.NewAudit(s.signoz.Instrumentation.Logger(), s.config.APIServer.Logging.ExcludedRoutes, s.signoz.Auditor).Wrap)
+	r.Use(middleware.NewComment().Wrap)
+
+	apiHandler.RegisterRoutes(r, am)
+	apiHandler.RegisterLogsRoutes(r, am)
+	apiHandler.RegisterIntegrationRoutes(r, am)
+	apiHandler.RegisterQueryRangeV3Routes(r, am)
+	apiHandler.RegisterInfraMetricsRoutes(r, am)
+	apiHandler.RegisterQueryRangeV4Routes(r, am)
+	apiHandler.RegisterWebSocketPaths(r, am)
+	apiHandler.RegisterMessagingQueuesRoutes(r, am)
+	apiHandler.RegisterThirdPartyApiRoutes(r, am)
+	apiHandler.RegisterTraceFunnelsRoutes(r, am)
+
+	err := s.signoz.APIServer.AddToRouter(r)
+	if err != nil {
+		return nil, err
+	}
+
+	c := cors.New(cors.Options{
+		AllowedOrigins: []string{"*"},
+		AllowedMethods: []string{"GET", "DELETE", "POST", "PUT", "PATCH", "OPTIONS"},
+		AllowedHeaders: []string{"Accept", "Authorization", "Content-Type", "cache-control", "X-SIGNOZ-QUERY-ID", "Sec-WebSocket-Protocol"},
+	})
+
+	handler := c.Handler(r)
+
+	handler = handlers.CompressHandler(handler)
+
+	err = web.AddToRouter(r)
+	if err != nil {
+		return nil, err
+	}
+
+	routePrefix := s.config.Global.ExternalPath()
+	if routePrefix != "" {
+		prefixed := http.StripPrefix(routePrefix, handler)
+		handler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			switch req.URL.Path {
+			case "/api/v1/health", "/api/v2/healthz", "/api/v2/readyz", "/api/v2/livez":
+				r.ServeHTTP(w, req)
+				return
+			}
+
+			prefixed.ServeHTTP(w, req)
+		})
+	}
+
+	return &http.Server{
+		Handler: handler,
+	}, nil
+}
+
+// initListeners initialises listeners of the server
+func (s *Server) initListeners() error {
+	// listen on public port
+	var err error
+	publicHostPort := s.httpHostPort
+	if publicHostPort == "" {
+		return fmt.Errorf("baseconst.HTTPHostPort is required")
+	}
+
+	s.httpConn, err = net.Listen("tcp", publicHostPort)
+	if err != nil {
 		return err
 	}
 
+	slog.Info(fmt.Sprintf("Query server started listening on %s...", s.httpHostPort))
+
+	return nil
+}
+
+// Start listening on http and private http port concurrently
+func (s *Server) Start(ctx context.Context) error {
+	err := s.initListeners()
+	if err != nil {
+		return err
+	}
+
+	var httpPort int
+	if port, err := utils.GetPort(s.httpConn.Addr()); err == nil {
+		httpPort = port
+	}
+
+	go func() {
+		slog.Info("Starting HTTP server", "port", httpPort, "addr", s.httpHostPort)
+
+		switch err := s.httpServer.Serve(s.httpConn); err {
+		case nil, http.ErrServerClosed, cmux.ErrListenerClosed:
+			// normal exit, nothing to do
+		default:
+			slog.Error("Could not start HTTP server", errors.Attr(err))
+		}
+		s.unavailableChannel <- healthcheck.Unavailable
+	}()
+
+	go func() {
+		slog.Info("Starting OpAmp Websocket server", "addr", baseconst.OpAmpWsEndpoint)
+		err := s.opampServer.Start(baseconst.OpAmpWsEndpoint)
+		if err != nil {
+			slog.Error("opamp ws server failed to start", errors.Attr(err))
+			s.unavailableChannel <- healthcheck.Unavailable
+		}
+	}()
+
 	return nil
 }
 
 func (s *Server) Stop(ctx context.Context) error {
+	if s.httpServer != nil {
+		if err := s.httpServer.Shutdown(ctx); err != nil {
+			return err
+		}
+	}
+
 	s.opampServer.Stop()
 
 	// stop usage manager

ee/query-service/constants/constants.go

@@ -4,6 +4,8 @@ import (
 	"os"
 )
 
+var LicenseSignozIo = "https://license.signoz.io/api/v1"
+var LicenseAPIKey = GetOrDefaultEnv("SIGNOZ_LICENSE_API_KEY", "")
 var SaasSegmentKey = GetOrDefaultEnv("SIGNOZ_SAAS_SEGMENT_KEY", "")
 var FetchFeatures = GetOrDefaultEnv("FETCH_FEATURES", "false")
 var ZeusFeaturesURL = GetOrDefaultEnv("ZEUS_FEATURES_URL", "ZeusFeaturesURL")
@@ -15,3 +17,15 @@ func GetOrDefaultEnv(key string, fallback string) string {
 	}
 	return v
 }
+
+// constant functions that override env vars
+
+const DotMetricsEnabled = "DOT_METRICS_ENABLED"
+
+var IsDotMetricsEnabled = false
+
+func init() {
+	if GetOrDefaultEnv(DotMetricsEnabled, "true") == "true" {
+		IsDotMetricsEnabled = true
+	}
+}

ee/subscription/httpsubscription/provider.go

@@ -1,95 +0,0 @@
-package httpsubscription
-
-import (
-	"context"
-	"encoding/json"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/licensing"
-	"github.com/SigNoz/signoz/pkg/subscription"
-	"github.com/SigNoz/signoz/pkg/types/subscriptiontypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/SigNoz/signoz/pkg/zeus"
-	"github.com/tidwall/gjson"
-)
-
-const upstreamTimeout = 10 * time.Second
-
-type provider struct {
-	zeus      zeus.Zeus
-	licensing licensing.Licensing
-}
-
-func New(zeus zeus.Zeus, licensing licensing.Licensing) subscription.Subscription {
-	return &provider{
-		zeus:      zeus,
-		licensing: licensing,
-	}
-}
-
-func (provider *provider) Create(ctx context.Context, organizationID valuer.UUID, postableSubscription *subscriptiontypes.PostableSubscription) (*subscriptiontypes.GettableSubscription, error) {
-	ctx, cancel := context.WithTimeout(ctx, upstreamTimeout)
-	defer cancel()
-
-	license, err := provider.licensing.GetActive(ctx, organizationID)
-	if err != nil {
-		return nil, err
-	}
-
-	body, err := json.Marshal(postableSubscription)
-	if err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to marshal subscription payload")
-	}
-
-	response, err := provider.zeus.GetCheckoutURL(ctx, license.Key, body)
-	if err != nil {
-		if errors.Ast(err, errors.TypeAlreadyExists) {
-			return nil, errors.WithAdditionalf(err, "checkout has already been completed for this account. Please click 'Refresh Status' to sync your subscription")
-		}
-		return nil, err
-	}
-
-	return &subscriptiontypes.GettableSubscription{RedirectURL: gjson.GetBytes(response, "url").String()}, nil
-}
-
-func (provider *provider) Update(ctx context.Context, organizationID valuer.UUID, postableSubscription *subscriptiontypes.PostableSubscription) (*subscriptiontypes.GettableSubscription, error) {
-	ctx, cancel := context.WithTimeout(ctx, upstreamTimeout)
-	defer cancel()
-
-	license, err := provider.licensing.GetActive(ctx, organizationID)
-	if err != nil {
-		return nil, err
-	}
-
-	body, err := json.Marshal(postableSubscription)
-	if err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "failed to marshal subscription payload")
-	}
-
-	response, err := provider.zeus.GetPortalURL(ctx, license.Key, body)
-	if err != nil {
-		return nil, err
-	}
-
-	return &subscriptiontypes.GettableSubscription{RedirectURL: gjson.GetBytes(response, "url").String()}, nil
-}
-
-func (provider *provider) Get(ctx context.Context, organizationID valuer.UUID) (*subscriptiontypes.GettableSubscriptionUsage, error) {
-	license, err := provider.licensing.GetActive(ctx, organizationID)
-	if err != nil {
-		return nil, err
-	}
-
-	data, err := provider.zeus.GetMeters(ctx, license.Key)
-	if err != nil {
-		return nil, err
-	}
-
-	usage, err := subscriptiontypes.NewGettableSubscriptionUsage(data)
-	if err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInternal, zeus.ErrCodeResponseMalformed, "failed to unmarshal subscription usage")
-	}
-
-	return usage, nil
-}

ee/zeus/httpzeus/provider.go

@@ -51,7 +51,7 @@ func New(ctx context.Context, providerSettings factory.ProviderSettings, config
 	}, nil
 }
 
-func (provider *Provider) GetLicense(ctx context.Context, key string) (*zeustypes.License, error) {
+func (provider *Provider) GetLicense(ctx context.Context, key string) ([]byte, error) {
 	response, err := provider.do(
 		ctx,
 		provider.config.URL.JoinPath("/v2/licenses/me"),
@@ -63,12 +63,7 @@ func (provider *Provider) GetLicense(ctx context.Context, key string) (*zeustype
 		return nil, err
 	}
 
-	license := new(zeustypes.License)
-	if err := json.Unmarshal([]byte(gjson.GetBytes(response, "data").String()), license); err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInternal, zeus.ErrCodeResponseMalformed, "failed to unmarshal license data")
-	}
-
-	return license, nil
+	return []byte(gjson.GetBytes(response, "data").String()), nil
 }
 
 func (provider *Provider) GetCheckoutURL(ctx context.Context, key string, body []byte) ([]byte, error) {

frontend/.gitignore

@@ -28,11 +28,4 @@ e2e/test-plan/saved-views/
 e2e/test-plan/service-map/
 e2e/test-plan/services/
 e2e/test-plan/traces/
-e2e/test-plan/user-preferences/
-
-# Storybook
-/storybook-static/
-debug-storybook.log
-
-# Storybook screenshot sweeps (scripts/story-shots.mjs)
-/.story-shots/
+e2e/test-plan/user-preferences/

frontend/.oxlintrc.json

@@ -323,10 +323,9 @@
             "name": "react",
             "importNames": [
               "createContext",
-              "useContext",
-              "useSyncExternalStore"
+              "useContext"
             ],
-            "message": "[State mgmt] React Context and hand-rolled external stores are deprecated. Migrate shared state to Zustand."
+            "message": "[State mgmt] React Context is deprecated. Migrate shared state to Zustand."
           },
           {
             "name": "immer",
@@ -488,11 +487,8 @@
     // Simplifies boolean returns
     "sonarjs/prefer-while": "error",
     // Suggests while loops over for loops
-    "sonarjs/elseif-without-else": "off",
+    "sonarjs/elseif-without-else": "off"
     // Requires final else in if-else-if chains (was disabled)
-    "signoz/no-conditional-text-nodes-with-siblings": "warn",
-    // Vendored from eslint-plugin-react-google-translate
-    "signoz/no-return-text-nodes": "warn"
   },
   "ignorePatterns": [
     "src/parser/*.ts",
@@ -566,27 +562,16 @@
       }
     },
     {
-      // Root dashboard pages own the fetch lifecycle; useDashboardFetchRequired wraps it.
+      // Root V2 pages own the dashboard fetch lifecycle; useDashboardFetchRequired wraps it.
       // Everywhere else must use useDashboardFetchRequired().
       "files": [
-        "src/pages/DashboardPage/DashboardPage.tsx",
-        "src/pages/DashboardPage/PanelEditorPage/PanelEditorPage.tsx",
-        "src/pages/DashboardPage/DashboardContainer/hooks/useDashboardFetchRequired.ts"
+        "src/pages/DashboardPageV2/DashboardPageV2.tsx",
+        "src/pages/DashboardPageV2/PanelEditorPage/PanelEditorPage.tsx",
+        "src/pages/DashboardPageV2/DashboardContainer/hooks/useDashboardFetchRequired.ts"
       ],
       "rules": {
         "signoz/no-dashboard-fetch-outside-root": "off"
       }
-    },
-    {
-      // Dev-tooling CLIs: stdout is their output, and they carry ported pixel/heap
-      // algorithms that read worse when split up.
-      "files": [
-        "scripts/**"
-      ],
-      "rules": {
-        "no-console": "off",
-        "sonarjs/cognitive-complexity": "off"
-      }
     }
   ]
 }

frontend/.storybook/main.ts

@@ -1,89 +0,0 @@
-import { dirname, resolve } from 'path';
-import { fileURLToPath } from 'url';
-import type { StorybookConfig } from '@storybook/react-vite';
-import type { Plugin, PluginOption } from 'vite';
-
-const srcPath = resolve(dirname(fileURLToPath(import.meta.url)), '../src');
-
-/**
- * Modules replaced for every story. Same idea as `moduleNameMapper` in
- * `jest.config.ts`: the app keeps importing its own paths, Storybook resolves
- * them to a mock. Regexes so only exact specifiers match: `lib/history` must
- * not catch `lib/historyUtils`.
- *
- * Each replacement is typed as the module it stands in for, so drift is a
- * compile error rather than a story that fails at render. The `jest` note on
- * each entry is where the same import lands under the other runner. The two
- * only diverge where the runner needs them to.
- */
-const mockAliases = [
-	{
-		// jest: not replaced, jsdom drives a real browser history.
-		find: /^(?:src\/)?lib\/history$/,
-		replacement: `${srcPath}/storybook/navigation/history.alias.ts`,
-	},
-	{
-		// jest: src/__tests__/logEventMock.ts
-		find: /^(?:src\/)?api\/common\/logEvent$/,
-		replacement: `${srcPath}/storybook/mocks/logEvent.mock.ts`,
-	},
-	{
-		// jest: __mocks__/env.ts, which leaves `baseURL` empty because jsdom already
-		// resolves a relative `/api/...` against `http://localhost`.
-		find: /^(?:src\/)?constants\/env$/,
-		replacement: `${srcPath}/storybook/mocks/env.mock.ts`,
-	},
-];
-
-/**
- * Plugins from `vite.config.ts` that either target the app's `index.html` or
- * only pay off in a production build.
- */
-const EXCLUDED_PLUGINS = [
-	'vite-plugin-checker',
-	'dev-base-path',
-	'dev-boot-data',
-	'vite-plugin-image-optimizer',
-	'vite-plugin-compression',
-];
-
-const isExcluded = (plugin: PluginOption): boolean =>
-	!!plugin &&
-	typeof plugin === 'object' &&
-	'name' in plugin &&
-	EXCLUDED_PLUGINS.includes((plugin as Plugin).name);
-
-const config: StorybookConfig = {
-	framework: '@storybook/react-vite',
-	stories: ['../src/**/*.stories.@(ts|tsx)'],
-	// `../public` carries the fonts, icons and i18n bundles the app expects at
-	// the root; `./public` carries the msw worker, which must not ship in a
-	// production build.
-	staticDirs: ['../public', './public'],
-	addons: ['@storybook/addon-a11y'],
-	core: { disableTelemetry: true },
-	viteFinal: async (viteConfig) => {
-		const plugins = (viteConfig.plugins ?? [])
-			.flat(Infinity as 1)
-			.filter((plugin) => !isExcluded(plugin as PluginOption));
-
-		const existingAlias = viteConfig.resolve?.alias;
-		const normalizedAlias = Array.isArray(existingAlias)
-			? existingAlias
-			: Object.entries(existingAlias ?? {}).map(([find, replacement]) => ({
-					find,
-					replacement: replacement as string,
-				}));
-
-		return {
-			...viteConfig,
-			plugins,
-			resolve: {
-				...viteConfig.resolve,
-				alias: [...mockAliases, ...normalizedAlias],
-			},
-		};
-	},
-};
-
-export default config;

frontend/.storybook/modes.ts

@@ -1,10 +0,0 @@
-/**
- * Chromatic modes: one snapshot per entry, per story. The globals in a mode are
- * Storybook's own, so `theme` is the toolbar's theme and the story renders the
- * way it does locally. The width matches `scripts/story-shots.mjs` (`--width`),
- * so a cloud snapshot and a local shot frame the same page.
- */
-export const allModes = {
-	dark: { theme: 'dark', viewport: { width: 1680, height: 1200 } },
-	light: { theme: 'light', viewport: { width: 1680, height: 1200 } },
-} as const;

frontend/.storybook/preview-head.html

@@ -1,24 +0,0 @@
-<link rel="preconnect" href="https://fonts.googleapis.com" />
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-<link
-	href="https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&display=swap"
-	rel="stylesheet"
-/>
-<link rel="stylesheet" href="css/uPlot.min.css" />
-
-<script>
-	// i18n's language detector would pick the browser locale (e.g. `en-US`), which
-	// /public/locales does not ship; pin it to the bundled language instead.
-	window.localStorage.setItem('i18nextLng', 'en');
-
-	// The Go backend injects this at boot; every integration it enables is off in
-	// Storybook so no third-party script loads inside the iframe.
-	window.signozBootData = {
-		settings: {
-			posthog: { enabled: false, apiHost: '', key: '', uiHost: '' },
-			appcues: { enabled: false, appId: '' },
-			sentry: { enabled: false, dsn: '', tunnel: '' },
-			pylon: { enabled: false, appId: '', identitySecret: '' },
-		},
-	};
-</script>

frontend/.storybook/preview.tsx

@@ -1,133 +0,0 @@
-import type { Preview } from '@storybook/react-vite';
-import type { SetupWorker } from 'msw';
-import { setupWorker } from 'msw';
-
-import { settleForCapture } from '../src/storybook/visual/settleForCapture';
-import { withProviders } from '../src/storybook/decorators/withProviders';
-import { globalMocks } from '../src/storybook/globals';
-import { resetStoryHistory } from '../src/storybook/navigation/containment';
-import { clearBlockedNavigations } from '../src/storybook/navigation/blockedNavigationStore';
-import {
-	resolveStory,
-	type StoryRuntimeContext,
-} from '../src/storybook/runtime/resolveStory';
-import { allModes } from './modes';
-
-import '../src/ReactI18';
-
-import '../src/styles.scss';
-
-import '../src/storybook/storybook-root.scss';
-
-interface StorybookWorkerHolder {
-	__signozStorybookWorker?: StorybookWorker;
-}
-
-const holder = window as unknown as StorybookWorkerHolder;
-
-/**
- * One worker per page, even if this module is re-executed by HMR. Two live
- * workers both answer the service worker and the story gets whichever replies
- * first.
- */
-interface StorybookWorker {
-	worker: SetupWorker;
-	ready: Promise<unknown>;
-}
-
-const { worker, ready } = (holder.__signozStorybookWorker ??=
-	((): StorybookWorker => {
-		const instance = setupWorker();
-
-		return {
-			worker: instance,
-			ready: instance.start({
-				serviceWorker: { url: './mockServiceWorker.js' },
-				// Storybook's own traffic (index.json, HMR, telemetry) goes unhandled by
-				// design; only flag the app's API calls so a missing handler is obvious.
-				onUnhandledRequest: (request, print): void => {
-					const url = new URL(request.url.href);
-					const isStaticAsset =
-						/\.(?:woff2?|ttf|otf|css|js|map|png|jpe?g|svg|webp|ico)$/.test(
-							url.pathname,
-						);
-					const isAppRequest =
-						!isStaticAsset &&
-						(url.pathname.startsWith('/api/') || url.host !== window.location.host);
-
-					if (isAppRequest) {
-						print.warning();
-					}
-				},
-			}),
-		};
-	})());
-
-const preview: Preview = {
-	parameters: {
-		layout: 'fullscreen',
-		controls: { expanded: true },
-		// One cloud snapshot per theme, for every story. A mode carries Storybook
-		// globals, so `theme` here is the same toolbar global the app reads out of
-		// localStorage. Widths are Chromatic's only real dimension, as they are
-		// locally: the app shell sizes itself to the viewport, so the height is the
-		// one it is given.
-		chromatic: { modes: allModes },
-	},
-	globalTypes: {
-		theme: {
-			description: 'SigNoz color scheme',
-			toolbar: {
-				title: 'Theme',
-				icon: 'paintbrush',
-				items: [
-					{ value: 'dark', title: 'Dark' },
-					{ value: 'light', title: 'Light' },
-				],
-				dynamicTitle: true,
-			},
-		},
-		motion: {
-			description:
-				'Park every animation on its last frame once the story has settled. Still is what both capture stacks shoot; Live is for watching a transition.',
-			toolbar: {
-				title: 'Motion',
-				icon: 'play',
-				items: [
-					{ value: 'still', title: 'Still' },
-					{ value: 'live', title: 'Live' },
-				],
-				dynamicTitle: true,
-			},
-		},
-	},
-	initialGlobals: { theme: 'dark', motion: 'still' },
-	// Controls every story carries: permissions, banners, and whether the page's
-	// own endpoints answer, hang or fail.
-	args: globalMocks.args,
-	argTypes: globalMocks.argTypes,
-	decorators: [withProviders],
-	loaders: [
-		// Runs on every render, args changes included, and ahead of the decorators:
-		// the whole story world is put in place here, so the provider tree only has
-		// to read it. Re-registering the handlers per render also means an edit to a
-		// handler module takes effect on the next render instead of leaving the
-		// worker on the set it was created with.
-		async (context): Promise<void> => {
-			const world = resolveStory(context as unknown as StoryRuntimeContext);
-
-			world.apply();
-			world.install(worker);
-
-			await ready;
-		},
-	],
-	beforeEach: () => {
-		clearBlockedNavigations();
-		resetStoryHistory();
-	},
-	// After `play`, which is the moment both capture stacks shoot at.
-	afterEach: settleForCapture,
-};
-
-export default preview;

frontend/.storybook/public/mockServiceWorker.js

@@ -1,303 +0,0 @@
-/* eslint-disable */
-/* tslint:disable */
-
-/**
- * Mock Service Worker (1.3.2).
- * @see https://github.com/mswjs/msw
- * - Please do NOT modify this file.
- * - Please do NOT serve this file on production.
- */
-
-const INTEGRITY_CHECKSUM = '3d6b9f06410d179a7f7404d4bf4c3c70'
-const activeClientIds = new Set()
-
-self.addEventListener('install', function () {
-  self.skipWaiting()
-})
-
-self.addEventListener('activate', function (event) {
-  event.waitUntil(self.clients.claim())
-})
-
-self.addEventListener('message', async function (event) {
-  const clientId = event.source.id
-
-  if (!clientId || !self.clients) {
-    return
-  }
-
-  const client = await self.clients.get(clientId)
-
-  if (!client) {
-    return
-  }
-
-  const allClients = await self.clients.matchAll({
-    type: 'window',
-  })
-
-  switch (event.data) {
-    case 'KEEPALIVE_REQUEST': {
-      sendToClient(client, {
-        type: 'KEEPALIVE_RESPONSE',
-      })
-      break
-    }
-
-    case 'INTEGRITY_CHECK_REQUEST': {
-      sendToClient(client, {
-        type: 'INTEGRITY_CHECK_RESPONSE',
-        payload: INTEGRITY_CHECKSUM,
-      })
-      break
-    }
-
-    case 'MOCK_ACTIVATE': {
-      activeClientIds.add(clientId)
-
-      sendToClient(client, {
-        type: 'MOCKING_ENABLED',
-        payload: true,
-      })
-      break
-    }
-
-    case 'MOCK_DEACTIVATE': {
-      activeClientIds.delete(clientId)
-      break
-    }
-
-    case 'CLIENT_CLOSED': {
-      activeClientIds.delete(clientId)
-
-      const remainingClients = allClients.filter((client) => {
-        return client.id !== clientId
-      })
-
-      // Unregister itself when there are no more clients
-      if (remainingClients.length === 0) {
-        self.registration.unregister()
-      }
-
-      break
-    }
-  }
-})
-
-self.addEventListener('fetch', function (event) {
-  const { request } = event
-  const accept = request.headers.get('accept') || ''
-
-  // Bypass server-sent events.
-  if (accept.includes('text/event-stream')) {
-    return
-  }
-
-  // Bypass navigation requests.
-  if (request.mode === 'navigate') {
-    return
-  }
-
-  // Opening the DevTools triggers the "only-if-cached" request
-  // that cannot be handled by the worker. Bypass such requests.
-  if (request.cache === 'only-if-cached' && request.mode !== 'same-origin') {
-    return
-  }
-
-  // Bypass all requests when there are no active clients.
-  // Prevents the self-unregistered worked from handling requests
-  // after it's been deleted (still remains active until the next reload).
-  if (activeClientIds.size === 0) {
-    return
-  }
-
-  // Generate unique request ID.
-  const requestId = Math.random().toString(16).slice(2)
-
-  event.respondWith(
-    handleRequest(event, requestId).catch((error) => {
-      if (error.name === 'NetworkError') {
-        console.warn(
-          '[MSW] Successfully emulated a network error for the "%s %s" request.',
-          request.method,
-          request.url,
-        )
-        return
-      }
-
-      // At this point, any exception indicates an issue with the original request/response.
-      console.error(
-        `\
-[MSW] Caught an exception from the "%s %s" request (%s). This is probably not a problem with Mock Service Worker. There is likely an additional logging output above.`,
-        request.method,
-        request.url,
-        `${error.name}: ${error.message}`,
-      )
-    }),
-  )
-})
-
-async function handleRequest(event, requestId) {
-  const client = await resolveMainClient(event)
-  const response = await getResponse(event, client, requestId)
-
-  // Send back the response clone for the "response:*" life-cycle events.
-  // Ensure MSW is active and ready to handle the message, otherwise
-  // this message will pend indefinitely.
-  if (client && activeClientIds.has(client.id)) {
-    ;(async function () {
-      const clonedResponse = response.clone()
-      sendToClient(client, {
-        type: 'RESPONSE',
-        payload: {
-          requestId,
-          type: clonedResponse.type,
-          ok: clonedResponse.ok,
-          status: clonedResponse.status,
-          statusText: clonedResponse.statusText,
-          body:
-            clonedResponse.body === null ? null : await clonedResponse.text(),
-          headers: Object.fromEntries(clonedResponse.headers.entries()),
-          redirected: clonedResponse.redirected,
-        },
-      })
-    })()
-  }
-
-  return response
-}
-
-// Resolve the main client for the given event.
-// Client that issues a request doesn't necessarily equal the client
-// that registered the worker. It's with the latter the worker should
-// communicate with during the response resolving phase.
-async function resolveMainClient(event) {
-  const client = await self.clients.get(event.clientId)
-
-  if (client?.frameType === 'top-level') {
-    return client
-  }
-
-  const allClients = await self.clients.matchAll({
-    type: 'window',
-  })
-
-  return allClients
-    .filter((client) => {
-      // Get only those clients that are currently visible.
-      return client.visibilityState === 'visible'
-    })
-    .find((client) => {
-      // Find the client ID that's recorded in the
-      // set of clients that have registered the worker.
-      return activeClientIds.has(client.id)
-    })
-}
-
-async function getResponse(event, client, requestId) {
-  const { request } = event
-  const clonedRequest = request.clone()
-
-  function passthrough() {
-    // Clone the request because it might've been already used
-    // (i.e. its body has been read and sent to the client).
-    const headers = Object.fromEntries(clonedRequest.headers.entries())
-
-    // Remove MSW-specific request headers so the bypassed requests
-    // comply with the server's CORS preflight check.
-    // Operate with the headers as an object because request "Headers"
-    // are immutable.
-    delete headers['x-msw-bypass']
-
-    return fetch(clonedRequest, { headers })
-  }
-
-  // Bypass mocking when the client is not active.
-  if (!client) {
-    return passthrough()
-  }
-
-  // Bypass initial page load requests (i.e. static assets).
-  // The absence of the immediate/parent client in the map of the active clients
-  // means that MSW hasn't dispatched the "MOCK_ACTIVATE" event yet
-  // and is not ready to handle requests.
-  if (!activeClientIds.has(client.id)) {
-    return passthrough()
-  }
-
-  // Bypass requests with the explicit bypass header.
-  // Such requests can be issued by "ctx.fetch()".
-  if (request.headers.get('x-msw-bypass') === 'true') {
-    return passthrough()
-  }
-
-  // Notify the client that a request has been intercepted.
-  const clientMessage = await sendToClient(client, {
-    type: 'REQUEST',
-    payload: {
-      id: requestId,
-      url: request.url,
-      method: request.method,
-      headers: Object.fromEntries(request.headers.entries()),
-      cache: request.cache,
-      mode: request.mode,
-      credentials: request.credentials,
-      destination: request.destination,
-      integrity: request.integrity,
-      redirect: request.redirect,
-      referrer: request.referrer,
-      referrerPolicy: request.referrerPolicy,
-      body: await request.text(),
-      bodyUsed: request.bodyUsed,
-      keepalive: request.keepalive,
-    },
-  })
-
-  switch (clientMessage.type) {
-    case 'MOCK_RESPONSE': {
-      return respondWithMock(clientMessage.data)
-    }
-
-    case 'MOCK_NOT_FOUND': {
-      return passthrough()
-    }
-
-    case 'NETWORK_ERROR': {
-      const { name, message } = clientMessage.data
-      const networkError = new Error(message)
-      networkError.name = name
-
-      // Rejecting a "respondWith" promise emulates a network error.
-      throw networkError
-    }
-  }
-
-  return passthrough()
-}
-
-function sendToClient(client, message) {
-  return new Promise((resolve, reject) => {
-    const channel = new MessageChannel()
-
-    channel.port1.onmessage = (event) => {
-      if (event.data && event.data.error) {
-        return reject(event.data.error)
-      }
-
-      resolve(event.data)
-    }
-
-    client.postMessage(message, [channel.port2])
-  })
-}
-
-function sleep(timeMs) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, timeMs)
-  })
-}
-
-async function respondWithMock(response) {
-  await sleep(response.delay)
-  return new Response(response.body, response)
-}

frontend/README.md

@@ -88,17 +88,6 @@ pnpm test
 pnpm tsgo --noEmit
 ```
 
-## Storybook
-
-```bash
-pnpm storybook
-```
-
-Opens [http://localhost:6006](http://localhost:6006). Pages run against msw
-mocks with no backend; query-param navigation works inside a story, leaving the
-page is blocked. See [`src/storybook/README.md`](src/storybook/README.md) for the
-override surface.
-
 ## Linting
 
 ```bash

frontend/docs/authz-guide.md

@@ -34,9 +34,6 @@ These hold for every page. The per-pattern sections below only add to them.
 4. **Never gate per row.** If a user can `list`, render every row. Check `read` only when the row is opened (drawer or
    detail route).
 5. **Gate the narrowest thing that works**, a button over a section, a section over a page.
-   - **Gate a page on `read` alone.** It is the only verb the page's own request needs. `update` and `delete` gate
-     individual controls, so waiting for them holds up the whole page for nothing — pass them as `preloadChecks` and
-     they resolve in the same request, leaving the controls to read from cache.
 6. **A resource may be gated while a sub-resource is not.** A user without `read` on Service Accounts can still hold
    `create` on API Keys, so blocking the outer container would hide work they are allowed to do.
 7. **Verbs not covered here** (`attach`, `detach`, `assignee`) behave like `delete`: gate the control that triggers
@@ -48,20 +45,11 @@ These hold for every page. The per-pattern sections below only add to them.
 
 ![Visual rules for structuring a list page](./assets/list-example.svg)
 
-Without `list`, but with any of `read` / `create` / `update`, the table and
-everything that only feeds it are blocked:
+Without `list`, but with any of `read` / `create` / `update`, only the table is blocked:
 
-- Title, description, search, filters and action buttons stay visible. Nothing is
-  hidden for lack of permission.
-- Disable what only shapes the blocked request — the search box, the filter chips,
-  a Clear button — and give it the same denial. It edits a query that has nowhere
-  to run, so leaving it live invites the user to compose a filter and watch
-  nothing happen.
-- Gate a region as one section when several of its controls are dead. A saved
-  views rail is a block with a single callout, not a column of identical
-  tooltips; a row of filters is one tooltip zone, not one per control.
-- The create button stays enabled if the user holds `create`. It is independent
-  of `list`.
+- Title, description, search filters and action buttons stay visible.
+- Filters and any control that drives the table are non-interactive.
+- The create button stays enabled if the user holds `create`.
 
 ### Edit page
 
@@ -108,11 +96,6 @@ Blocking is always a visible denial, never a silent removal. Use the components
 [`lib/authz/components`](../src/lib/authz/components/README.md) rather than hand-rolling a check, they carry the
 denial message and the loading state.
 
-**Denial copy comes from the components.** Never write a custom message for a permission check. `disabledTooltip` is
-for a block that is *not* a permission — a lock, an immutable resource, a mount that is deliberately read-only. It
-takes precedence over the checks, which are then skipped, so set it only when that block is the real obstacle: a
-missing permission must still surface its own wording.
-
 | Scope           | Component                                 | Denied state                                |
 | --------------- | ----------------------------------------- | ------------------------------------------- |
 | Button          | `AuthZButton`                             | Disabled + tooltip                          |

frontend/jest.config.ts

@@ -56,10 +56,10 @@ const config: Config.InitialOptions = {
 	transformIgnorePatterns: [
 		// @chenglou/pretext is ESM-only; @signozhq/ui pulls it in via text-ellipsis.
 		// Pattern 1: allow .pnpm virtual store through (handled by pattern 2), plus root-level ESM packages.
-		'node_modules/(?!(\\.pnpm|react-json-tree|react-base16-styling|lodash-es|react-dnd|core-dnd|@react-dnd|dnd-core|react-dnd-html5-backend|axios|@chenglou/pretext|@signozhq/design-tokens|@signozhq|date-fns|d3-interpolate|d3-color|api|@codemirror|@lezer|@marijn|@grafana|nuqs|uuid|copy-text-to-clipboard|react-markdown|vfile|vfile-message|unist-util-stringify-position|unified|bail|is-plain-obj|trough|remark-parse|mdast-util-from-markdown|mdast-util-to-string|micromark|micromark-core-commonmark|micromark-extension-gfm|micromark-extension-gfm-autolink-literal|micromark-extension-gfm-footnote|micromark-extension-gfm-strikethrough|micromark-extension-gfm-table|micromark-extension-gfm-tagfilter|micromark-extension-gfm-task-list-item|micromark-factory-destination|micromark-factory-label|micromark-factory-space|micromark-factory-title|micromark-factory-whitespace|micromark-util-character|micromark-util-chunked|micromark-util-classify-character|micromark-util-combine-extensions|micromark-util-decode-numeric-character-reference|micromark-util-decode-string|micromark-util-encode|micromark-util-html-tag-name|micromark-util-normalize-identifier|micromark-util-resolve-all|micromark-util-sanitize-uri|micromark-util-subtokenize|micromark-util-symbol|micromark-util-types|decode-named-character-reference|remark-rehype|mdast-util-to-hast|unist-util-position|trim-lines|unist-util-visit|unist-util-visit-parents|unist-util-is|unist-util-generated|mdast-util-definitions|property-information|hast-util-whitespace|space-separated-tokens|comma-separated-tokens|rehype-raw|hast-util-raw|hast-util-from-parse5|devlop|hastscript|hast-util-parse-selector|vfile-location|web-namespaces|hast-util-to-parse5|zwitch|html-void-elements)/)',
+		'node_modules/(?!(\\.pnpm|lodash-es|react-dnd|core-dnd|@react-dnd|dnd-core|react-dnd-html5-backend|axios|@chenglou/pretext|@signozhq/design-tokens|@signozhq|date-fns|d3-interpolate|d3-color|api|@codemirror|@lezer|@marijn|@grafana|nuqs|uuid|copy-text-to-clipboard|react-markdown|vfile|vfile-message|unist-util-stringify-position|unified|bail|is-plain-obj|trough|remark-parse|mdast-util-from-markdown|mdast-util-to-string|micromark|micromark-core-commonmark|micromark-extension-gfm|micromark-extension-gfm-autolink-literal|micromark-extension-gfm-footnote|micromark-extension-gfm-strikethrough|micromark-extension-gfm-table|micromark-extension-gfm-tagfilter|micromark-extension-gfm-task-list-item|micromark-factory-destination|micromark-factory-label|micromark-factory-space|micromark-factory-title|micromark-factory-whitespace|micromark-util-character|micromark-util-chunked|micromark-util-classify-character|micromark-util-combine-extensions|micromark-util-decode-numeric-character-reference|micromark-util-decode-string|micromark-util-encode|micromark-util-html-tag-name|micromark-util-normalize-identifier|micromark-util-resolve-all|micromark-util-sanitize-uri|micromark-util-subtokenize|micromark-util-symbol|micromark-util-types|decode-named-character-reference|remark-rehype|mdast-util-to-hast|unist-util-position|trim-lines|unist-util-visit|unist-util-visit-parents|unist-util-is|unist-util-generated|mdast-util-definitions|property-information|hast-util-whitespace|space-separated-tokens|comma-separated-tokens|rehype-raw|hast-util-raw|hast-util-from-parse5|devlop|hastscript|hast-util-parse-selector|vfile-location|web-namespaces|hast-util-to-parse5|zwitch|html-void-elements)/)',
 		// Pattern 2: pnpm virtual store — ignore everything except ESM-only packages.
 		// pnpm encodes scoped packages as @scope+name@version, so match on scope prefix.
-		'node_modules/\\.pnpm/(?!(react-json-tree|react-base16-styling|lodash-es|react-dnd|core-dnd|@react-dnd|dnd-core|react-dnd-html5-backend|axios|@chenglou|@signozhq|date-fns|d3-interpolate|d3-color|api|@codemirror|@lezer|@marijn|@grafana|nuqs|uuid|copy-text-to-clipboard|react-markdown|vfile|vfile-message|unist-util-stringify-position|unified|bail|is-plain-obj|trough|remark-parse|mdast-util-from-markdown|mdast-util-to-string|micromark|decode-named-character-reference|remark-rehype|mdast-util-to-hast|unist-util-position|trim-lines|unist-util-visit|unist-util-visit-parents|unist-util-is|unist-util-generated|mdast-util-definitions|property-information|hast-util-whitespace|space-separated-tokens|comma-separated-tokens|rehype-raw|hast-util-raw|hast-util-from-parse5|devlop|hastscript|hast-util-parse-selector|vfile-location|web-namespaces|hast-util-to-parse5|zwitch|html-void-elements)[^/]*/node_modules)',
+		'node_modules/\\.pnpm/(?!(lodash-es|react-dnd|core-dnd|@react-dnd|dnd-core|react-dnd-html5-backend|axios|@chenglou|@signozhq|date-fns|d3-interpolate|d3-color|api|@codemirror|@lezer|@marijn|@grafana|nuqs|uuid|copy-text-to-clipboard|react-markdown|vfile|vfile-message|unist-util-stringify-position|unified|bail|is-plain-obj|trough|remark-parse|mdast-util-from-markdown|mdast-util-to-string|micromark|decode-named-character-reference|remark-rehype|mdast-util-to-hast|unist-util-position|trim-lines|unist-util-visit|unist-util-visit-parents|unist-util-is|unist-util-generated|mdast-util-definitions|property-information|hast-util-whitespace|space-separated-tokens|comma-separated-tokens|rehype-raw|hast-util-raw|hast-util-from-parse5|devlop|hastscript|hast-util-parse-selector|vfile-location|web-namespaces|hast-util-to-parse5|zwitch|html-void-elements)[^/]*/node_modules)',
 	],
 	setupFilesAfterEnv: ['<rootDir>/jest.setup.ts'],
 	testPathIgnorePatterns: ['/node_modules/', '/public/'],

frontend/jest.setup.ts

@@ -62,40 +62,6 @@ if (typeof window.ResizeObserver === 'undefined') {
 	(window as any).ResizeObserver = ResizeObserverMock;
 }
 
-if (typeof globalThis.DOMRect === 'undefined') {
-	(globalThis as any).DOMRect = class DOMRect {
-		x = 0;
-		y = 0;
-		width = 0;
-		height = 0;
-		top = 0;
-		right = 0;
-		bottom = 0;
-		left = 0;
-		constructor(x = 0, y = 0, width = 0, height = 0) {
-			this.x = x;
-			this.y = y;
-			this.width = width;
-			this.height = height;
-			this.top = y;
-			this.right = x + width;
-			this.bottom = y + height;
-			this.left = x;
-		}
-		toJSON(): any {
-			return { x: this.x, y: this.y, width: this.width, height: this.height };
-		}
-		static fromRect(rect?: {
-			x?: number;
-			y?: number;
-			width?: number;
-			height?: number;
-		}): DOMRect {
-			return new DOMRect(rect?.x, rect?.y, rect?.width, rect?.height);
-		}
-	};
-}
-
 // Patch getComputedStyle to handle CSS parsing errors from @signozhq/* packages.
 // These packages inject CSS at import time via style-inject / vite-plugin-css-injected-by-js.
 // jsdom's nwsapi cannot parse some of the injected selectors (e.g. Tailwind's :animate-in),

frontend/package.json

@@ -7,8 +7,6 @@
     "preinstall": "npx only-allow pnpm",
     "i18n:generate-hash": "node ./i18-generate-hash.cjs",
     "dev": "vite",
-    "storybook": "storybook dev -p 6006",
-    "storybook:build": "storybook build -o storybook-static",
     "build": "vite build",
     "preview": "vite preview",
     "prettify": "oxfmt",
@@ -18,7 +16,6 @@
     "lint:generated": "oxlint ./src/api/generated --fix",
     "lint:fix": "oxlint ./src --fix",
     "lint:styles": "stylelint \"src/**/*.scss\"",
-    "test:plugins": "node --test \"plugins/__tests__/*.test.mjs\"",
     "jest": "jest",
     "jest:coverage": "jest --coverage",
     "jest:watch": "jest --watch",
@@ -50,9 +47,9 @@
     "@monaco-editor/react": "^4.7.0",
     "@sentry/react": "10.57.0",
     "@sentry/vite-plugin": "5.3.0",
-    "@signozhq/design-tokens": "2.1.6",
+    "@signozhq/design-tokens": "2.1.4",
     "@signozhq/icons": "0.4.0",
-    "@signozhq/ui": "0.1.0",
+    "@signozhq/ui": "0.0.23",
     "@tanstack/react-table": "8.21.3",
     "@tanstack/react-virtual": "3.13.22",
     "@uiw/codemirror-theme-copilot": "4.23.11",
@@ -90,7 +87,6 @@
     "jest": "30.2.0",
     "js-base64": "^3.7.2",
     "lodash-es": "^4.17.21",
-    "monaco-editor": "0.55.1",
     "motion": "12.4.13",
     "nuqs": "2.8.8",
     "overlayscrollbars": "^2.16.0",
@@ -129,7 +125,6 @@
     "rrule": "2.8.1",
     "styled-components": "^5.3.11",
     "timestamp-nano": "^1.0.0",
-    "translation-resilience": "^0.2.0",
     "typescript": "5.9.3",
     "uplot": "1.6.31",
     "uuid": "14.0.1",
@@ -160,9 +155,6 @@
     "@commitlint/config-conventional": "20.4.4",
     "@jest/globals": "30.4.1",
     "@jest/types": "30.2.0",
-    "@storybook/addon-a11y": "10.5.9",
-    "@storybook/react-vite": "10.5.9",
-    "@testing-library/dom": "8.20.0",
     "@testing-library/jest-dom": "5.16.5",
     "@testing-library/react": "13.4.0",
     "@testing-library/user-event": "14.4.3",
@@ -202,13 +194,12 @@
     "oxfmt": "0.54.0",
     "oxlint": "1.69.0",
     "oxlint-tsgolint": "0.23.0",
-    "postcss": "8.5.26",
+    "postcss": "8.5.14",
     "postcss-scss": "4.0.9",
     "react-resizable": "3.0.4",
     "redux-mock-store": "1.5.4",
     "sass": "1.97.3",
     "sharp": "0.35.0",
-    "storybook": "10.5.9",
     "stylelint": "17.7.0",
     "svgo": "4.0.2",
     "ts-jest": "29.4.9",

frontend/plugins/__tests__/README.md

@@ -1,130 +0,0 @@
-# Plugin rule tests
-
-Tests for the custom oxlint rules in `plugins/rules/`.
-
-```bash
-pnpm test:plugins
-```
-
-Runs on `node --test` rather than jest. The jest config is built for application
-code — jsdom, ts-jest ESM transforms, a large `transformIgnorePatterns` wall —
-and none of it applies to a suite whose only job is to shell out to the linter.
-
-## Why it drives the real binary
-
-Each case is written to a temp file and linted by the actual `oxlint` binary,
-with every builtin category switched off so the only diagnostics that can appear
-belong to the rule under test. Assertions therefore describe what CI enforces.
-
-The alternative — walking the AST in-process — would need a stand-in for
-oxlint's JS plugin AST. That AST is ESTree-shaped but not ESTree, and it carries
-no type information, so a stand-in would drift from the runtime it claims to
-model and the tests would certify behaviour that never happens.
-
-All cases in a suite share one `oxlint` invocation and are mapped back by
-filename. Per-case spawning costs roughly 80ms each; batching keeps both suites
-together at around 250ms.
-
-## Adding a suite
-
-```js
-import { ruleTester } from './rule-tester.mjs';
-
-await ruleTester({
-	rule: 'no-navigator-clipboard',
-	valid: ['const x = 1;'],
-	invalid: [
-		{
-			code: 'navigator.clipboard.writeText("x");',
-			errors: [{ message: 'useCopyToClipboard', line: 1, column: 1 }],
-		},
-	],
-});
-```
-
-`ruleTester` must be awaited at the top level — it loads the plugin and runs
-`oxlint` before declaring the tests.
-
-- `rule` — the key the plugin exports it under. `plugin` defaults to
-  `plugins/signoz.mjs`; pass a path relative to `frontend/` for another plugin.
-- Cases are `.tsx` unless a `filename` gives another extension.
-- `errors` takes a count or an array. Each entry may assert `message` (substring
-  or `RegExp`), `line` and `column`; omitted fields are not checked.
-- `name` labels the case in the output and defaults to its first line of code.
-- `output` asserts the source after suggestions are applied — see below.
-- `todo` marks a case as a known defect — see below.
-
-## Suggestions
-
-Both Google Translate rules attach their wrap as a *suggestion*, not a fix, so
-`--fix` leaves the code alone and `--fix-suggestions` applies it. The wrap is
-`<span className="translate-safe">`, and `.translate-safe` is `display: contents`
-in `src/styles.scss`: React owns an element that absorbs Translate's `<font>`
-swap, while the box tree stays as it was, so a flex or grid parent still sees one
-contiguous text run rather than a new item with its own `gap`.
-
-It stays a suggestion because the element is still a DOM child even with no box:
-`> *`, `:nth-child` and sibling selectors still count it, and a component that
-inspects its children — `React.Children.map`, antd `Tooltip`, `Space` — sees an
-element where a string used to be. That is what oxlint means by "May change
-program behavior" in `--fix-suggestions --help`.
-
-An invalid case carrying `output` is linted twice: once for diagnostics, and
-once with `--fix-suggestions` over an untouched copy of the same files. The
-second run costs one extra `oxlint` spawn per suite and only happens when at
-least one case asks for it.
-
-```js
-{
-	code: "export const A = () => <div>{f ? 'a' : 'b'}<b/></div>;",
-	errors: 2,
-	output:
-		'export const A = () => <div>{f ? <span className="translate-safe">a</span> : <span className="translate-safe">b</span>}<b/></div>;',
-}
-```
-
-Suggestions do not reformat, so a real run is `oxlint --fix-suggestions` then
-`oxfmt`.
-
-## Known defects
-
-A case carrying `todo` asserts what the rule *should* do. It still runs, but a
-failure is reported as a todo rather than failing the suite, so a bug can be
-pinned as an executable spec instead of prose. Fixing the rule turns the todo
-green; deleting the flag then makes it a regression guard.
-
-Cases are prefixed `FP:` where the rule reports something it should not, `GAP:`
-where it misses something it should catch, and `TYPE-AWARE:` where the miss is
-only fixable once the linter can resolve types. Everything without a flag is a
-characterisation test recording current behaviour.
-
-The current todos:
-
-**Gaps — constructs the rules never visit.** `isProblematicConditional` requires
-a `JSXElement` parent, so a conditional inside a fragment is never inspected even
-though the failure does not care about the parent's kind. `no-return-text-nodes`
-listens only for `FunctionDeclaration` and reads the name off `node.id`, so
-arrow-function components and anonymous default exports are invisible — this
-codebase writes components as arrow functions, which is why that rule reports
-nothing across `src`.
-
-Class components are left out deliberately rather than pinned as a gap: there
-are none in `src`.
-
-**Type-aware gaps.** Upstream resolves branch types through
-`@typescript-eslint/utils` and reports anything typed `string` or `number`.
-oxlint's JS plugin runtime exposes no type information — `sourceCode.parserServices`
-is always `{}` — so those code paths were removed rather than left dormant. The
-`TYPE-AWARE:` todos record what they used to catch, and become the acceptance
-criteria if oxlint ever hands types to JS plugins.
-
-## Not a defect
-
-Without types, `no-conditional-text-nodes-with-siblings` falls back to a callee
-allowlist (`t`, `formatMessage`, `toString`, `toLocaleString`). Cases around
-that allowlist pin its edges; widening it is the supported way to catch more
-call expressions.
-
-Both branches of a ternary are reported separately, so one fix can clear two
-diagnostics. That inflates the count but every reported node is genuinely a text
-node, so the cases assert both.

frontend/plugins/__tests__/no-conditional-text-nodes-with-siblings.test.mjs

@@ -1,302 +0,0 @@
-import { ruleTester } from './rule-tester.mjs';
-
-const CONDITIONAL = 'Conditionally rendered text nodes with siblings';
-const PRECEDED = 'Text nodes which are preceded by a conditional expression';
-
-await ruleTester({
-	rule: 'no-conditional-text-nodes-with-siblings',
-	valid: [
-		{
-			name: 'conditional text node without siblings',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? 'yes' : 'no'}\n\t</div>\n);",
-		},
-		{
-			name: 'boolean branches are not text',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? true : false}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'null branches are not text',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? null : null}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'element branches are already wrapped',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? <b>y</b> : <i>n</i>}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'text node before the conditional is safe',
-			code:
-				'export const A = () => (\n\t<div>\n\t\tleading text\n\t\t{flag && <b>y</b>}\n\t</div>\n);',
-		},
-		{
-			name: 'member expression on the condition side is not rendered',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{obj.name && <b>y</b>}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'binary comparison on the condition side is not rendered',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{obj.name === 'x' && <b>y</b>}\n\t\t<span>x</span>\n\t</div>\n);",
-		},
-		// An empty string renders no text node at all, so there is nothing for
-		// Google Translate to wrap and nothing for React to lose. Reporting it used
-		// to be the rule's most common false positive.
-		{
-			name: 'element branch with an empty-string fallback',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? <b>Free Trial</b> : ''}\n\t\t<span>s</span>\n\t</div>\n);",
-		},
-		{
-			name: 'both branches empty',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? '' : ''}\n\t\t<span>s</span>\n\t</div>\n);",
-		},
-		{
-			name: 'logical and with an empty-string right-hand side',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag && ''}\n\t\t<span>s</span>\n\t</div>\n);",
-		},
-
-		// A template literal is checked the same way as the quoted form, so `{' '}`
-		// and ``{` `}`` agree.
-		{
-			name: 'empty template literal branch',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? `` : ''}\n\t\t<span>s</span>\n\t</div>\n);",
-		},
-		{
-			name: 'whitespace-only template literal branch is skipped',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? ` ` : <b>x</b>}\n\t\t<span>s</span>\n\t</div>\n);',
-		},
-	],
-	invalid: [
-		{
-			name: 'string literal branches with an element sibling',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? 'yes' : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 19 },
-			],
-			output:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? <span className="translate-safe">yes</span> : <span className="translate-safe">no</span>}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'logical and with a string right-hand side',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag && 'yes'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [{ message: CONDITIONAL, line: 3, column: 12 }],
-		},
-		{
-			name: 'numeric literals render as text',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? 1 : 2}\n\t\t<span>x</span>\n\t</div>\n);',
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 15 },
-			],
-			output:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? <span className="translate-safe">{1}</span> : <span className="translate-safe">{2}</span>}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'template literal branch',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? `yes ${n}` : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 24 },
-			],
-			output:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? <span className="translate-safe">{`yes ${n}`}</span> : <span className="translate-safe">no</span>}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'member expression branch',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? obj.name : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 22 },
-			],
-			output:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? <span className="translate-safe">{obj.name}</span> : <span className="translate-safe">no</span>}\n\t\t<span>x</span>\n\t</div>\n);',
-		},
-		{
-			name: 'a string needing escapes stays inside braces',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? "it\'s" : <b>x</b>}\n\t\t<span>s</span>\n\t</div>\n);',
-			errors: [{ message: CONDITIONAL, line: 3, column: 11 }],
-			output:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? <span className="translate-safe">{"it\'s"}</span> : <b>x</b>}\n\t\t<span>s</span>\n\t</div>\n);',
-		},
-		{
-			name: 'optional chaining branch',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? obj?.deep?.name : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 29 },
-			],
-		},
-		{
-			name: 'nested ternary reports every text branch',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{a ? (b ? 'x' : 'y') : 'z'}\n\t\t<span>s</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 13 },
-				{ message: CONDITIONAL, line: 3, column: 19 },
-				{ message: CONDITIONAL, line: 3, column: 26 },
-			],
-		},
-		{
-			name: 'static text following a conditional',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag && <b>y</b>}\n\t\ttrailing text\n\t</div>\n);',
-			errors: [{ message: PRECEDED, line: 3, column: 21 }],
-			// Only the visible run is wrapped; the surrounding newlines and tabs are
-			// formatting and must stay outside the element.
-			output:
-				'export const A = () => (\n\t<div>\n\t\t{flag && <b>y</b>}\n\t\t<span className="translate-safe">trailing text</span>\n\t</div>\n);',
-		},
-		{
-			name: 'conditional text plus trailing static text reports both kinds',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? 'a' : 'b'}\n\t\tliteral tail\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 17 },
-				{ message: PRECEDED, line: 3, column: 21 },
-			],
-		},
-
-		// The callee allowlist below is the untyped fallback. Without type
-		// information the rule can only recognise known string-returning helpers,
-		// so `t()` and `formatMessage()` are reported while an arbitrary call is
-		// not. These cases pin that boundary.
-		{
-			name: 't() branch is reported via the callee allowlist',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? t('key') : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 22 },
-			],
-		},
-		{
-			name: 'formatMessage() branch is reported via the callee allowlist',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? formatMessage({id:'k'}) : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 37 },
-			],
-		},
-		{
-			name: 'arbitrary call is not recognised, only the literal branch reports',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? getString() : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [{ message: CONDITIONAL, line: 3, column: 25 }],
-		},
-		{
-			name: 'bare identifier is not recognised, only the literal branch reports',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? name : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [{ message: CONDITIONAL, line: 3, column: 18 }],
-		},
-		{
-			name: 'toString() branch is reported',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? val.toString() : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 28 },
-			],
-		},
-		{
-			name: 'toLocaleString() branch is reported',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? val.toLocaleString() : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 34 },
-			],
-		},
-		{
-			name: 't() in its own container following a conditional',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag && <b>y</b>}\n\t\t{t('key')}\n\t</div>\n);",
-			errors: [{ message: PRECEDED, line: 4, column: 4 }],
-		},
-		{
-			name: 'toString() in its own container following a conditional',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag && <b>y</b>}\n\t\t{val.toString()}\n\t</div>\n);',
-			errors: [{ message: PRECEDED, line: 4, column: 4 }],
-			// The whole container is replaced, so the result is not `{<span>{…}</span>}`.
-			output:
-				'export const A = () => (\n\t<div>\n\t\t{flag && <b>y</b>}\n\t\t<span className="translate-safe">{val.toString()}</span>\n\t</div>\n);',
-		},
-		{
-			name: 'whitespace-only string branch is skipped, the other branch reports',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? ' ' : 'x'}\n\t\t<span>s</span>\n\t</div>\n);",
-			errors: [{ message: CONDITIONAL, line: 3, column: 17 }],
-		},
-		{
-			name: 'template literal holding an expression is not blank',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag ? `${n}` : <b>x</b>}\n\t\t<span>s</span>\n\t</div>\n);',
-			errors: [{ message: CONDITIONAL, line: 3, column: 11 }],
-		},
-
-		// Upstream resolves branch types through `@typescript-eslint/utils` and
-		// reports anything typed `string` or `number`. oxlint's JS plugin runtime
-		// exposes no type information, so those paths were dropped and only the
-		// callee allowlist remains. Kept as todos: if oxlint ever hands types to JS
-		// plugins these become the acceptance criteria.
-		{
-			todo: 'needs type information to know the call returns a string',
-			name: 'TYPE-AWARE: call returning a string',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? getString() : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 25 },
-			],
-		},
-		{
-			todo: 'needs type information to know the identifier is a string',
-			name: 'TYPE-AWARE: identifier holding a string',
-			code:
-				"export const A = () => (\n\t<div>\n\t\t{flag ? name : 'no'}\n\t\t<span>x</span>\n\t</div>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 18 },
-			],
-		},
-		{
-			todo: 'needs type information to know the identifier is a string',
-			name: 'TYPE-AWARE: string identifier following a conditional',
-			code:
-				'export const A = () => (\n\t<div>\n\t\t{flag && <b>y</b>}\n\t\t{label}\n\t</div>\n);',
-			errors: [{ message: PRECEDED, line: 4, column: 4 }],
-		},
-
-		// `isChildOfJSXElement` matches only `JSXElement`, so a fragment parent is
-		// never inspected. The Google Translate failure does not care whether the
-		// parent is an element or a fragment.
-		{
-			todo: 'fragment parents are never inspected',
-			name: 'GAP: conditional text with a sibling inside a fragment',
-			code:
-				"export const A = () => (\n\t<>\n\t\t{flag ? 'yes' : 'no'}\n\t\t<span>x</span>\n\t</>\n);",
-			errors: [
-				{ message: CONDITIONAL, line: 3, column: 11 },
-				{ message: CONDITIONAL, line: 3, column: 19 },
-			],
-		},
-	],
-});

frontend/plugins/__tests__/no-return-text-nodes.test.mjs

@@ -1,162 +0,0 @@
-import { ruleTester } from './rule-tester.mjs';
-
-const RETURNS_TEXT = 'React components should avoid returning text nodes';
-
-await ruleTester({
-	rule: 'no-return-text-nodes',
-	valid: [
-		{
-			name: 'lowercase function is not a component',
-			code: "export function foo() {\n\treturn 'text';\n}",
-		},
-		{
-			name: 'returning JSX',
-			code: 'export function Foo() {\n\treturn <div>hi</div>;\n}',
-		},
-		{
-			name: 'returning null',
-			code: 'export function Foo() {\n\treturn null;\n}',
-		},
-		{
-			name: 'returning boolean',
-			code: 'export function Foo() {\n\treturn true;\n}',
-		},
-		{ name: 'bare return', code: 'export function Foo() {\n\treturn;\n}' },
-		{
-			name: 'returning a variable is not a literal',
-			code: "export function Foo() {\n\tconst s = 'x';\n\treturn s;\n}",
-		},
-		{
-			name: 'lowercase nested function inside a component',
-			code:
-				"export function Foo() {\n\tfunction helper() {\n\t\treturn 'x';\n\t}\n\treturn <div/>;\n}",
-		},
-
-		{
-			// The repo has no class components, so this is out of scope rather than
-			// a gap worth closing.
-			name: 'class method',
-			code: "export class Foo {\n\trender() {\n\t\treturn 'text';\n\t}\n}",
-		},
-	],
-	invalid: [
-		{
-			name: 'string literal',
-			code: "export function Foo() {\n\treturn 'text';\n}",
-			errors: [{ message: RETURNS_TEXT, line: 2, column: 2 }],
-			output:
-				'export function Foo() {\n\treturn <span className="translate-safe">{\'text\'}</span>;\n}',
-		},
-		{
-			// JSX does not parse in a `.ts` file, so no suggestion is offered there.
-			name: 'string literal in a non-JSX file',
-			filename: 'case.ts',
-			code: "export function Foo() {\n\treturn 'text';\n}",
-			errors: [{ message: RETURNS_TEXT, line: 2, column: 2 }],
-			output: "export function Foo() {\n\treturn 'text';\n}",
-		},
-		{
-			name: 'numeric literal',
-			code: 'export function Foo() {\n\treturn 42;\n}',
-			errors: [{ message: RETURNS_TEXT, line: 2, column: 2 }],
-		},
-		{
-			name: 'template literal',
-			code: 'export function Foo() {\n\treturn `text ${x}`;\n}',
-			errors: [{ message: RETURNS_TEXT, line: 2, column: 2 }],
-		},
-		{
-			name: 'inside an if consequent',
-			code:
-				"export function Foo() {\n\tif (a) {\n\t\treturn 'x';\n\t}\n\treturn <div/>;\n}",
-			errors: [{ message: RETURNS_TEXT, line: 3, column: 3 }],
-		},
-		{
-			name: 'inside an else block',
-			code:
-				"export function Foo() {\n\tif (a) {\n\t\treturn <div/>;\n\t} else {\n\t\treturn 'x';\n\t}\n}",
-			errors: [{ message: RETURNS_TEXT, line: 5, column: 3 }],
-		},
-		{
-			name: 'inside an else-if chain',
-			code:
-				"export function Foo() {\n\tif (a) {\n\t\treturn <div/>;\n\t} else if (b) {\n\t\treturn 'x';\n\t}\n\treturn null;\n}",
-			errors: [{ message: RETURNS_TEXT, line: 5, column: 3 }],
-		},
-		{
-			name: 'inside a switch case',
-			code:
-				"export function Foo() {\n\tswitch (a) {\n\t\tcase 1:\n\t\t\treturn 'x';\n\t\tdefault:\n\t\t\treturn <div/>;\n\t}\n}",
-			errors: [{ message: RETURNS_TEXT, line: 4, column: 4 }],
-		},
-		{
-			name: 'inside try, catch and finally',
-			code:
-				"export function Foo() {\n\ttry {\n\t\treturn 'a';\n\t} catch {\n\t\treturn 'b';\n\t} finally {\n\t\treturn 'c';\n\t}\n}",
-			errors: [
-				{ message: RETURNS_TEXT, line: 3, column: 3 },
-				{ message: RETURNS_TEXT, line: 5, column: 3 },
-				{ message: RETURNS_TEXT, line: 7, column: 3 },
-			],
-		},
-		{
-			name: 'inside a for loop',
-			code:
-				"export function Foo() {\n\tfor (let i = 0; i < 3; i++) {\n\t\treturn 'x';\n\t}\n\treturn <div/>;\n}",
-			errors: [{ message: RETURNS_TEXT, line: 3, column: 3 }],
-		},
-		{
-			name: 'inside a for-of loop',
-			code:
-				"export function Foo() {\n\tfor (const i of list) {\n\t\treturn 'x';\n\t}\n\treturn <div/>;\n}",
-			errors: [{ message: RETURNS_TEXT, line: 3, column: 3 }],
-		},
-		{
-			name: 'inside a for-in loop',
-			code:
-				"export function Foo() {\n\tfor (const k in obj) {\n\t\treturn 'x';\n\t}\n\treturn <div/>;\n}",
-			errors: [{ message: RETURNS_TEXT, line: 3, column: 3 }],
-		},
-		{
-			name: 'inside a while loop',
-			code:
-				"export function Foo() {\n\twhile (a) {\n\t\treturn 'x';\n\t}\n\treturn <div/>;\n}",
-			errors: [{ message: RETURNS_TEXT, line: 3, column: 3 }],
-		},
-		{
-			name: 'inside a do-while loop',
-			code: "export function Foo() {\n\tdo {\n\t\treturn 'x';\n\t} while (a);\n}",
-			errors: [{ message: RETURNS_TEXT, line: 3, column: 3 }],
-		},
-		{
-			name: 'capitalised nested function is treated as a component',
-			code:
-				"export function Foo() {\n\tfunction Helper() {\n\t\treturn 'x';\n\t}\n\treturn <div/>;\n}",
-			errors: [{ message: RETURNS_TEXT, line: 3, column: 3 }],
-		},
-
-		// The rule listens only for `FunctionDeclaration` and reads the component
-		// name off `node.id`. Everything below returns a text node from something
-		// React renders as a component, and none of it is reported. This codebase
-		// writes components as arrow functions, which is why the rule currently
-		// finds nothing in `src`.
-		{
-			todo: 'arrow function components are never visited',
-			name: 'GAP: arrow component with an expression body',
-			code: "export const Foo = () => 'text';",
-			errors: 1,
-		},
-		{
-			todo: 'arrow function components are never visited',
-			name: 'GAP: arrow component with a block body',
-			code: "export const Foo = () => {\n\treturn 'text';\n};",
-			errors: [{ message: RETURNS_TEXT, line: 2, column: 2 }],
-		},
-		{
-			todo: 'anonymous declarations have no node.id to read a name from',
-			name: 'GAP: anonymous default-exported component',
-			code: "export default function () {\n\treturn 'text';\n}",
-			errors: [{ message: RETURNS_TEXT, line: 2, column: 2 }],
-		},
-	],
-});

frontend/plugins/__tests__/rule-tester.mjs

@@ -1,257 +0,0 @@
-/**
- * Test harness for oxlint JS plugins.
- *
- * Rules are exercised through the real `oxlint` binary rather than a hand-rolled
- * AST walker, so what the tests assert is exactly what CI enforces. oxlint's JS
- * plugin AST is close to ESTree but not identical, and it exposes no type
- * information, so any in-process fake would drift from the real runtime.
- *
- * All cases in a suite are written to one temp directory and linted in a single
- * oxlint invocation, then mapped back by filename. Spawning per case costs ~80ms
- * each; batching keeps a full suite under a second.
- */
-
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import {
-	mkdirSync,
-	mkdtempSync,
-	readFileSync,
-	rmSync,
-	writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-
-const FRONTEND_DIR = path.resolve(fileURLToPath(import.meta.url), '../../..');
-const OXLINT_BIN = path.join(FRONTEND_DIR, 'node_modules/.bin/oxlint');
-
-// oxlint enables its default categories unless every one is switched off, and a
-// stray builtin diagnostic would be indistinguishable from the rule under test.
-const CATEGORIES_OFF = {
-	correctness: 'off',
-	suspicious: 'off',
-	pedantic: 'off',
-	perf: 'off',
-	style: 'off',
-	restriction: 'off',
-	nursery: 'off',
-};
-
-function normaliseCase(entry, index) {
-	const testCase = typeof entry === 'string' ? { code: entry } : entry;
-	const extension = testCase.filename
-		? path.extname(testCase.filename).slice(1)
-		: 'tsx';
-	return {
-		...testCase,
-		index,
-		basename: `case-${String(index).padStart(3, '0')}.${extension}`,
-	};
-}
-
-function diagnosticFilename(diagnostic) {
-	const raw = diagnostic.filename ?? '';
-	const asPath = raw.startsWith('file://') ? fileURLToPath(raw) : raw;
-	return path.basename(asPath);
-}
-
-function toError(diagnostic) {
-	const span = diagnostic.labels?.[0]?.span;
-	return {
-		message: diagnostic.message,
-		line: span?.line,
-		column: span?.column,
-	};
-}
-
-function runOxlint(dir, configPath, extraArgs = []) {
-	const args = ['--config', configPath, '--format', 'json', ...extraArgs, '.'];
-	try {
-		return execFileSync(OXLINT_BIN, args, {
-			cwd: dir,
-			encoding: 'utf8',
-			// A rule that reports on every case can produce a lot of output.
-			maxBuffer: 64 * 1024 * 1024,
-		});
-	} catch (error) {
-		// oxlint exits non-zero whenever it reports a diagnostic, which is the
-		// expected outcome for every `invalid` case.
-		if (typeof error.stdout === 'string' && error.stdout.trim() !== '') {
-			return error.stdout;
-		}
-		throw new Error(`oxlint failed to run:\n${error.stderr || error.message}`, {
-			cause: error,
-		});
-	}
-}
-
-function writeSuite(dir, cases, { pluginPath, ruleId }) {
-	for (const testCase of cases) {
-		const target = path.join(dir, testCase.basename);
-		mkdirSync(path.dirname(target), { recursive: true });
-		writeFileSync(target, testCase.code);
-	}
-
-	const configPath = path.join(dir, '.oxlintrc.json');
-	writeFileSync(
-		configPath,
-		JSON.stringify({
-			jsPlugins: [pluginPath],
-			categories: CATEGORIES_OFF,
-			rules: { [ruleId]: 'error' },
-		}),
-	);
-	return configPath;
-}
-
-/**
- * Lints every case in one pass, and applies suggestions in a second pass over an
- * untouched copy when any case declares `output`.
- *
- * @returns {{errors: Map<string, object[]>, outputs: Map<string, string>}}
- */
-function lintCases(cases, options) {
-	const root = mkdtempSync(path.join(tmpdir(), 'oxlint-rule-tester-'));
-	try {
-		const lintDir = path.join(root, 'lint');
-		mkdirSync(lintDir);
-		const report = JSON.parse(
-			runOxlint(lintDir, writeSuite(lintDir, cases, options)),
-		);
-
-		const errors = new Map(cases.map((testCase) => [testCase.basename, []]));
-		for (const diagnostic of report.diagnostics ?? []) {
-			const bucket = errors.get(diagnosticFilename(diagnostic));
-			// oxlint reports config-level problems without a filename; surfacing
-			// them as a suite failure beats silently testing nothing.
-			if (!bucket) {
-				throw new Error(`Unexpected diagnostic: ${diagnostic.message}`);
-			}
-			bucket.push(toError(diagnostic));
-		}
-
-		const outputs = new Map();
-		if (cases.some((testCase) => testCase.output !== undefined)) {
-			const fixDir = path.join(root, 'fix');
-			mkdirSync(fixDir);
-			runOxlint(fixDir, writeSuite(fixDir, cases, options), ['--fix-suggestions']);
-			for (const testCase of cases) {
-				outputs.set(
-					testCase.basename,
-					readFileSync(path.join(fixDir, testCase.basename), 'utf8'),
-				);
-			}
-		}
-
-		return { errors, outputs };
-	} finally {
-		rmSync(root, { recursive: true, force: true });
-	}
-}
-
-function assertMessage(actual, expected, label) {
-	if (expected instanceof RegExp) {
-		assert.match(actual, expected, label);
-	} else {
-		assert.ok(
-			actual.includes(expected),
-			`${label}\n  expected message to contain: ${expected}\n  actual: ${actual}`,
-		);
-	}
-}
-
-function assertErrors(actual, expected, code) {
-	const context = `\n--- code ---\n${code}\n--- reported ---\n${JSON.stringify(actual, null, 2)}`;
-
-	if (typeof expected === 'number') {
-		assert.equal(actual.length, expected, `error count${context}`);
-		return;
-	}
-
-	assert.equal(actual.length, expected.length, `error count${context}`);
-	expected.forEach((want, i) => {
-		const got = actual[i];
-		if (want.message !== undefined) {
-			assertMessage(got.message, want.message, `error[${i}] message${context}`);
-		}
-		if (want.line !== undefined) {
-			assert.equal(got.line, want.line, `error[${i}] line${context}`);
-		}
-		if (want.column !== undefined) {
-			assert.equal(got.column, want.column, `error[${i}] column${context}`);
-		}
-	});
-}
-
-/**
- * Declares a suite for one rule.
- *
- * A case carrying `todo` asserts the behaviour the rule *should* have. It still
- * runs, but a failure is reported as a todo instead of failing the suite, so a
- * known bug can be pinned as an executable spec. Delete the flag once the rule
- * is fixed and the case starts guarding the fix.
- *
- * An invalid case carrying `output` also asserts the source after
- * `--fix-suggestions` has been applied.
- *
- * @param {object} options
- * @param {string} options.rule - rule name as exported by the plugin
- * @param {string} [options.plugin] - path to the plugin, relative to `frontend/`
- * @param {Array<string | {code: string, name?: string, filename?: string, todo?: string}>} options.valid
- * @param {Array<{code: string, name?: string, filename?: string, todo?: string, output?: string, errors: number | Array<{message?: string | RegExp, line?: number, column?: number}>}>} options.invalid
- */
-export async function ruleTester({
-	rule,
-	plugin = 'plugins/signoz.mjs',
-	valid = [],
-	invalid = [],
-}) {
-	const pluginPath = path.join(FRONTEND_DIR, plugin);
-	const { default: pluginModule } = await import(pathToFileURL(pluginPath));
-
-	assert.ok(
-		pluginModule.rules?.[rule],
-		`plugin ${plugin} does not export a rule named "${rule}"`,
-	);
-
-	const ruleId = `${pluginModule.meta.name}/${rule}`;
-	const validCases = valid.map(normaliseCase);
-	const invalidCases = invalid.map((entry, i) =>
-		normaliseCase(entry, valid.length + i),
-	);
-	const { errors, outputs } = lintCases([...validCases, ...invalidCases], {
-		pluginPath,
-		ruleId,
-	});
-
-	const declare = (t, testCase, expected) => {
-		const label = testCase.name ?? testCase.code.trim().split('\n')[0];
-		return t.test(label, { todo: testCase.todo }, () => {
-			assertErrors(errors.get(testCase.basename), expected, testCase.code);
-			if (testCase.output !== undefined) {
-				assert.equal(
-					outputs.get(testCase.basename),
-					testCase.output,
-					`suggestion output\n--- code ---\n${testCase.code}`,
-				);
-			}
-		});
-	};
-
-	test(ruleId, async (t) => {
-		await t.test('valid', async (t) => {
-			for (const testCase of validCases) {
-				await declare(t, testCase, 0);
-			}
-		});
-
-		await t.test('invalid', async (t) => {
-			for (const testCase of invalidCases) {
-				await declare(t, testCase, testCase.errors);
-			}
-		});
-	});
-}

frontend/plugins/rules/no-conditional-text-nodes-with-siblings.mjs

@@ -1,313 +0,0 @@
-/**
- * Rule: no-conditional-text-nodes-with-siblings
- *
- * Conditionally rendered text nodes with siblings should be wrapped in an
- * element (for example a `<span>`), otherwise Google Translate causes a browser
- * error. Translate replaces the text node with a `<font>` wrapper, React still
- * holds a reference to the original node, and the next render throws on
- * `removeChild`.
- *
- * Adapted from https://github.com/getcouped/eslint-plugin-react-google-translate
- * (v1.0.4). The upstream rule resolves branch types through
- * `@typescript-eslint/utils`; oxlint's JS plugin runtime exposes no type
- * information, so those paths are dropped and call expressions are matched
- * against the allowlist below instead.
- */
-
-// Calls known to render as text. Without types this is the only way to
-// recognise a string-returning call; widen it to catch more helpers.
-const TEXT_RETURNING_CALLEES = new Set(['formatMessage', 't']);
-const STRINGIFY_METHODS = new Set(['toString', 'toLocaleString']);
-
-function calleeName(node) {
-	return node.type === 'Identifier' ? node.name : null;
-}
-
-function isTextReturningCall(node) {
-	const { callee } = node;
-
-	if (TEXT_RETURNING_CALLEES.has(calleeName(callee))) {
-		return node.arguments.length > 0;
-	}
-
-	if (callee.type === 'MemberExpression' && !callee.computed) {
-		return STRINGIFY_METHODS.has(calleeName(callee.property));
-	}
-
-	return STRINGIFY_METHODS.has(calleeName(callee));
-}
-
-/**
- * True when the node renders no visible text. An empty or whitespace-only value
- * produces no DOM text node, so Google Translate has nothing to wrap and React
- * nothing to lose.
- */
-function isBlankText(node) {
-	if (node.type === 'Literal' || node.type === 'JSXText') {
-		return typeof node.value === 'string' && node.value.trim() === '';
-	}
-	if (node.type === 'TemplateLiteral') {
-		return (
-			node.expressions.length === 0 &&
-			node.quasis.every((quasi) => (quasi.value.cooked ?? '').trim() === '')
-		);
-	}
-	return false;
-}
-
-function isConditionallyRendered(node) {
-	const parent = node.parent;
-	return (
-		parent?.type === 'ConditionalExpression' ||
-		parent?.type === 'LogicalExpression'
-	);
-}
-
-function isRenderedConditional(node) {
-	return (
-		node.type === 'JSXExpressionContainer' &&
-		(node.expression?.type === 'ConditionalExpression' ||
-			node.expression?.type === 'LogicalExpression')
-	);
-}
-
-/** Children that produce output, i.e. everything but formatting whitespace. */
-function renderedChildren(node) {
-	const children = node?.children;
-	if (!children) {
-		return null;
-	}
-	return children.filter((child) => !isBlankText(child));
-}
-
-/** True when `node` is a JSX child rendered alongside at least one other child. */
-function hasSiblings(node) {
-	if (!(node?.parent?.children?.length > 1)) {
-		return false;
-	}
-	return renderedChildren(node.parent).some((child) => child !== node);
-}
-
-function isPrecededByConditional(node) {
-	const children = renderedChildren(node?.parent);
-	if (!children) {
-		return false;
-	}
-	return children.some(
-		(child) => child.start < node.start && isRenderedConditional(child),
-	);
-}
-
-/** Walk out of nested conditionals so nested branches report against the outer container. */
-function getOutermostConditional(node) {
-	let current = node;
-	while (isConditionallyRendered(current)) {
-		current = current.parent;
-	}
-	return current;
-}
-
-/** True when `node` is a conditional branch rendered directly beside other JSX children. */
-function isProblematicConditional(node) {
-	if (!isConditionallyRendered(node)) {
-		return false;
-	}
-
-	const container = getOutermostConditional(node);
-	return (
-		container.parent?.type === 'JSXExpressionContainer' &&
-		container.parent.parent?.type === 'JSXElement' &&
-		hasSiblings(container.parent)
-	);
-}
-
-/** True when `node` renders after a sibling conditional, i.e. the DOM order Translate breaks. */
-function followsConditionalSibling(node) {
-	return (
-		node.parent?.parent?.type === 'JSXElement' &&
-		hasSiblings(node.parent) &&
-		isPrecededByConditional(node.parent)
-	);
-}
-
-/**
- * `A && B` and the test of a ternary are conditions, not rendered output.
- */
-function isCondition(node) {
-	let current = node;
-	while (current.parent?.type === 'LogicalExpression') {
-		if (current.parent.left === current) {
-			return true;
-		}
-		current = current.parent;
-	}
-	if (current.parent?.type === 'ConditionalExpression') {
-		return current.parent.test === current;
-	}
-	return false;
-}
-
-function isConditionOperand(node) {
-	if (node.parent?.type === 'BinaryExpression') {
-		return isCondition(node.parent);
-	}
-	return isCondition(node);
-}
-
-// A string may only be inlined as JSX text when it needs no escaping and no
-// whitespace of its own: JSX collapses leading and trailing whitespace, and
-// these characters would either close the element or start an entity.
-const NEEDS_BRACES = /['"{}<>&\r\n]/;
-
-// `display: contents`, declared in src/styles.scss. React owns the element so
-// Translate's `<font>` swap is absorbed, while the box tree stays as it was and
-// a flex or grid parent still sees one contiguous text run.
-const OPEN = '<span className="translate-safe">';
-const CLOSE = '</span>';
-
-/** Wraps the reported expression so React owns an element Translate cannot replace. */
-function wrapExpression(fixer, sourceCode, node) {
-	// A call reported on its own already sits in a container. Replacing the
-	// container yields `<span …>{expr}</span>` rather than `{<span …>{expr}</span>}`.
-	const target =
-		node.parent?.type === 'JSXExpressionContainer' ? node.parent : node;
-
-	if (
-		node.type === 'Literal' &&
-		typeof node.value === 'string' &&
-		!NEEDS_BRACES.test(node.value) &&
-		node.value.trim() === node.value
-	) {
-		return fixer.replaceText(target, `${OPEN}${node.value}${CLOSE}`);
-	}
-
-	return fixer.replaceText(
-		target,
-		`${OPEN}{${sourceCode.getText(node)}}${CLOSE}`,
-	);
-}
-
-/**
- * Wraps static JSX text. Only the visible run is wrapped: the node also spans
- * the formatting whitespace around it, which has to stay outside the element.
- */
-function wrapJsxText(fixer, node) {
-	const raw = node.value;
-	const leading = raw.length - raw.trimStart().length;
-	const trailing = raw.length - raw.trimEnd().length;
-	return fixer.replaceTextRange(
-		[node.start + leading, node.end - trailing],
-		`${OPEN}${raw.trim()}${CLOSE}`,
-	);
-}
-
-export default {
-	meta: {
-		type: 'problem',
-		docs: {
-			description:
-				'Conditionally rendered text nodes should be wrapped in an element (for example a `<span>`), otherwise Google Translate can cause a browser error.',
-			url: 'https://github.com/getcouped/eslint-plugin-react-google-translate#eslint-plugin-react-google-translate',
-		},
-		schema: [],
-		// Wrapping adds a DOM element, which can turn into a flex/grid item or
-		// break `> *` and `:nth-child` selectors, so it is offered as a suggestion
-		// (`--fix-suggestions`) rather than applied by a bare `--fix`.
-		hasSuggestions: true,
-		messages: {
-			'conditional-text-node':
-				'Conditionally rendered text nodes with siblings, rendered as a direct child of a JSX element, must be wrapped so Google Translate cannot break React\'s DOM: `<span className="translate-safe">{value}</span>`. Translate replaces the bare text node with a `<font>` element and React then throws on `removeChild`. This also applies to values returned from functions, so `getString()` becomes `<span className="translate-safe">{getString()}</span>`.',
-			'text-node-preceded-by-conditional':
-				'Text nodes which are preceded by a conditional expression, rendered as a direct child of a JSX element, must be wrapped so Google Translate cannot break React\'s DOM: `<span className="translate-safe">text</span>`. Translate replaces the bare text node with a `<font>` element and React then throws on `removeChild`.',
-		},
-	},
-
-	createOnce(context) {
-		const suggestWrap = (build) => [{ desc: 'Wrap in a <span>', fix: build }];
-
-		const wrap = (fixer, node) => wrapExpression(fixer, context.sourceCode, node);
-
-		const reportConditional = (node) => {
-			context.report({
-				node,
-				messageId: 'conditional-text-node',
-				suggest: suggestWrap((fixer) => wrap(fixer, node)),
-			});
-		};
-
-		const reportPreceded = (node, build) => {
-			context.report({
-				node,
-				messageId: 'text-node-preceded-by-conditional',
-				suggest: suggestWrap(build),
-			});
-		};
-
-		return {
-			// String and numeric branches: `{flag ? 'yes' : 'no'}`
-			Literal(node) {
-				if (node.value === null || typeof node.value === 'boolean') {
-					return;
-				}
-				if (isBlankText(node)) {
-					return;
-				}
-				if (isProblematicConditional(node)) {
-					reportConditional(node);
-				}
-			},
-
-			TemplateLiteral(node) {
-				if (isBlankText(node)) {
-					return;
-				}
-				if (isProblematicConditional(node)) {
-					reportConditional(node);
-				}
-			},
-
-			// Static text rendered after a conditional: `{flag && <b/>}trailing`
-			JSXText(node) {
-				if (isBlankText(node)) {
-					return;
-				}
-				if (hasSiblings(node) && isPrecededByConditional(node)) {
-					reportPreceded(node, (fixer) => wrapJsxText(fixer, node));
-				}
-			},
-
-			CallExpression(node) {
-				if (isCondition(node) || !isTextReturningCall(node)) {
-					return;
-				}
-
-				if (isProblematicConditional(node)) {
-					reportConditional(node);
-				}
-				if (followsConditionalSibling(node)) {
-					reportPreceded(node, (fixer) => wrap(fixer, node));
-				}
-			},
-
-			// Values read off an object: `{flag ? user.name : 'anonymous'}`
-			MemberExpression(node) {
-				if (isConditionOperand(node)) {
-					return;
-				}
-				if (isProblematicConditional(node)) {
-					reportConditional(node);
-				}
-			},
-
-			// Optional chaining wraps the member expression: `{flag ? a?.b?.c : 'x'}`
-			ChainExpression(node) {
-				if (isConditionOperand(node)) {
-					return;
-				}
-				if (isProblematicConditional(node)) {
-					reportConditional(node);
-				}
-			},
-		};
-	},
-};

frontend/plugins/rules/no-return-text-nodes.mjs

@@ -1,115 +0,0 @@
-/**
- * Rule: no-return-text-nodes
- *
- * React components should not return a bare text node. Google Translate keeps
- * displaying the stale translated text after a state change and nothing throws,
- * which makes the bug very hard to track down. Numbers count too: JSX renders
- * them as text.
- *
- * Adapted from https://github.com/getcouped/eslint-plugin-react-google-translate
- * (v1.0.4). Upstream walks the function body statement by statement; this
- * version visits `ReturnStatement` directly and walks up to the enclosing
- * function, which covers the same constructs without enumerating them.
- */
-
-const FUNCTION_TYPES = new Set([
-	'FunctionDeclaration',
-	'FunctionExpression',
-	'ArrowFunctionExpression',
-]);
-
-function isTextNode(node) {
-	if (!node) {
-		return false;
-	}
-	if (node.type === 'TemplateLiteral') {
-		return true;
-	}
-	return (
-		node.type === 'Literal' &&
-		(typeof node.value === 'string' || typeof node.value === 'number')
-	);
-}
-
-function getEnclosingFunction(node) {
-	let current = node.parent;
-	while (current) {
-		if (FUNCTION_TYPES.has(current.type)) {
-			return current;
-		}
-		current = current.parent;
-	}
-	return null;
-}
-
-function isComponentName(name) {
-	return (
-		typeof name === 'string' && name !== '' && name[0] === name[0].toUpperCase()
-	);
-}
-
-// The suggestion introduces JSX, which only parses in a JSX-enabled file.
-function allowsJsx(filename) {
-	return filename.endsWith('.tsx') || filename.endsWith('.jsx');
-}
-
-export default {
-	meta: {
-		type: 'problem',
-		docs: {
-			description:
-				'React components should avoid returning text nodes directly (or numerical values which will be rendered as text). When a React component returns values other than JSX / null, Google Translate can continue to display stale values after state changes, without any error being thrown. Since this is very hard to debug it is better to avoid it altogether.',
-			url: 'https://github.com/getcouped/eslint-plugin-react-google-translate#eslint-plugin-react-google-translate',
-		},
-		schema: [],
-		// Wrapping changes what the component renders, so it is offered as a
-		// suggestion (`--fix-suggestions`) rather than applied by a bare `--fix`.
-		hasSuggestions: true,
-		messages: {
-			'return-value-is-text-node':
-				'React components should avoid returning text nodes directly (or numerical values which will be rendered as text). When a React component returns values other than JSX / null, Google Translate can continue to display stale values after state changes, without any error being thrown. Since this is very hard to debug it is better to avoid it altogether.',
-		},
-	},
-
-	createOnce(context) {
-		const buildSuggestion = (node) => {
-			if (!allowsJsx(context.filename)) {
-				return undefined;
-			}
-			return [
-				{
-					desc: 'Wrap in a <span>',
-					fix: (fixer) =>
-						fixer.replaceText(
-							node.argument,
-							`<span className="translate-safe">{${context.sourceCode.getText(node.argument)}}</span>`,
-						),
-				},
-			];
-		};
-
-		return {
-			ReturnStatement(node) {
-				if (!isTextNode(node.argument)) {
-					return;
-				}
-
-				// Only named function declarations are recognised as components, so a
-				// text return from a nested helper or a class method is left alone.
-				const fn = getEnclosingFunction(node);
-				if (fn?.type !== 'FunctionDeclaration') {
-					return;
-				}
-				if (!isComponentName(fn.id?.name)) {
-					return;
-				}
-
-				context.report({
-					node,
-					messageId: 'return-value-is-text-node',
-					suggest: buildSuggestion(node),
-				});
-			},
-		};
-	},
-};

frontend/plugins/signoz.mjs

@@ -13,8 +13,6 @@ import noAntdComponents from './rules/no-antd-components.mjs';
 import noSignozhqUiBarrel from './rules/no-signozhq-ui-barrel.mjs';
 import noCssModuleBracketAccess from './rules/no-css-module-bracket-access.mjs';
 import noDashboardFetchOutsideRoot from './rules/no-dashboard-fetch-outside-root.mjs';
-import noConditionalTextNodesWithSiblings from './rules/no-conditional-text-nodes-with-siblings.mjs';
-import noReturnTextNodes from './rules/no-return-text-nodes.mjs';
 
 export default {
 	meta: {
@@ -29,7 +27,5 @@ export default {
 		'no-signozhq-ui-barrel': noSignozhqUiBarrel,
 		'no-css-module-bracket-access': noCssModuleBracketAccess,
 		'no-dashboard-fetch-outside-root': noDashboardFetchOutsideRoot,
-		'no-conditional-text-nodes-with-siblings': noConditionalTextNodesWithSiblings,
-		'no-return-text-nodes': noReturnTextNodes,
 	},
 };

frontend/pnpm-workspace.yaml

@@ -13,16 +13,7 @@ overrides:
  '@babel/core@<=7.29.0': '>=7.29.6 <8'
  # via: jest > babel-plugin-istanbul > @istanbuljs/load-nyc-config@1.1.0 (js-yaml ^3.13.1)
  # remove: blocked — 1.1.0 is latest and still depends on js-yaml 3.x
- '@istanbuljs/load-nyc-config>js-yaml': '>=4.3.1 <5'
- # via: babel-plugin-istanbul > test-exclude@6 > minimatch@3.1.5 (^1.1.7); also glob@7
- # remove: blocked — babel-plugin-istanbul pins test-exclude@6, which pins minimatch@3
- brace-expansion@<1.1.18: '>=1.1.18 <2'
- # via: jest > glob@10 > minimatch@9.0.9 (^2.0.1); also minimatch@5.1.9 (^2.0.1)
- # remove: blocked — jest 30 resolves glob@10 > minimatch@9 internally
- 'brace-expansion@>=2.0.0 <2.1.4': '>=2.1.4 <3'
- # via: eslint-plugin-sonarjs@4.0.2 (minimatch ^10.2.4) > minimatch@10.2.5 (^5.0.5)
- # remove: blocked — minimatch@10.2.6 (latest) only widens to ^5.0.8, still vulnerable
- 'brace-expansion@>=5.0.0 <5.0.9': '>=5.0.9 <6'
+ '@istanbuljs/load-nyc-config>js-yaml': '>=4.2.0 <5'
  # via: msw@1.3.2 (devDep) > cookie ^0.4.2
  # remove: upgrade msw to >=2 (ships cookie ^1). Do NOT open the cap: cookie >=1 is
  # ESM-only and breaks msw under jest's CJS sandbox (kills every test suite)
@@ -36,26 +27,13 @@ overrides:
  # remove: blocked on rolldown-vite (7.3.1 is latest, still ^0.27.0);
  #         orval >=8.20.0 and ts-jest >=29.4.11 already fixed on their side
  esbuild@>=0.27.3 <0.28.1: '>=0.28.1 <0.29.0'
- # via: @commitlint/cli > @commitlint/config-validator > ajv@8 (fast-uri ^3.0.1)
- # remove: blocked — ajv@8 caps fast-uri at ^3, and only 3.1.5 carries the fix
- fast-uri@<3.1.5: '>=3.1.5 <4'
- # via: direct devDep sass@1.97.3 (immutable ^5.0.2)
- # remove: blocked — plain sass bumps stay within ^5, so the floor is what pulls 5.1.8
- immutable@<5.1.8: '>=5.1.8 <6'
  # via: react-use@17.5.1 (direct, js-cookie ^2.2.1); @grafana/data > react-use@17.6.0
  # remove: bump react-use to >=17.6.1 (js-cookie ^3); @grafana/data side blocked
  js-cookie@<=3.0.5: '>=3.0.7 <4'
  # via: @orval/core@8.9.1 (devDep, js-yaml 4.1.1 EXACT pin — not deletable);
  #      json-schema-to-typescript@15 > @apidevtools/json-schema-ref-parser (^4.1.0)
  # remove: upgrade orval to >=8.20.0 (drops js-yaml dependency entirely)
- 'js-yaml@>=4.0.0 <4.3.1': '>=4.3.1 <5'
- # via: typescript-plugin-css-modules@5.2.0 (less ^4.2.0) > less@4.4.0 (image-size ~0.5.0)
- # remove: bump typescript-plugin-css-modules once it floors less itself; image-size has
- #         no patched release at all, so dropping the dep is the only fix — less@4.5.0 did
- less@<4.5.0: '>=4.5.0 <5'
- # via: direct dep postcss (nanoid ^3.3.17)
- # remove: blocked — postcss 8.5.26 (latest) caps nanoid at ^3, fix landed in 3.3.18
- nanoid@<3.3.18: '>=3.3.18 <4'
+ js-yaml@>=4.0.0 <=4.1.1: '>=4.2.0 <5'
  # via: react-syntax-highlighter@15.5.0 (prismjs ^1.27.0 + refractor@3 ~1.27.0 tilde-pinned)
  # remove: bump react-syntax-highlighter to >=16.1.1 (prismjs ^1.30.0, refractor@5)
  prismjs@<1.30.0: '>=1.30.0 <2'

frontend/public/locales/en-GB/channels.json

@@ -24,77 +24,6 @@
   "tooltip_opsgenie_api_key": "Learn how to obtain the API key from your OpsGenie account [here](https://support.atlassian.com/opsgenie/docs/integrate-opsgenie-with-prometheus/).",
   "tooltip_email_to": "Enter email addresses separated by commas.",
   "tooltip_ms_teams_url": "The URL of the Microsoft Teams [webhook](https://support.microsoft.com/en-us/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498) to send alerts to. Learn more about Microsoft Teams integration in the docs [here](https://signoz.io/docs/alerts-management/notification-channel/ms-teams/).",
-  "tooltip_google_chat_url": "The URL of the Google Chat space [incoming webhook](https://developers.google.com/workspace/chat/quickstart/webhooks) to send alerts to. It must be an https URL on chat.googleapis.com.",
-  "google_chat_webhook_url_invalid": "Webhook URL must be an https URL on chat.googleapis.com",
-  "field_jira_site": "Site URL",
-  "tooltip_jira_site": "Your Jira Cloud base URL, e.g. https://your-domain.atlassian.net. Only Jira Cloud is supported.",
-  "jira_site_invalid": "Site URL must be an https URL on an atlassian.net domain",
-  "jira_required_fields": "Site URL, email, API token, project and issue type are required",
-  "jira_service_account_tip": "Recommended: use a Jira service account so alerts aren't reported under a personal name and the channel keeps working when someone leaves.",
-  "jira_service_account_tip_link": "Learn how",
-  "field_jira_email": "Email",
-  "help_jira_email": "The Atlassian account email used for authentication.",
-  "field_jira_api_token": "API token",
-  "help_jira_api_token": "Create one at id.atlassian.com under Security → API tokens.",
-  "field_jira_project": "Project key",
-  "field_jira_issue_type": "Issue type",
-  "help_jira_issue_type": "An issue type that exists in the project, e.g. Task, Bug or Incident.",
-  "field_jira_summary": "Summary (issue title)",
-  "help_jira_summary": "Template for the Jira issue title.",
-  "field_jira_description": "Description",
-  "help_jira_description": "Template for the issue description. Rendered as rich text with a status panel and links back to SigNoz.",
-  "jira_advanced_section": "Advanced Options",
-  "field_jira_priority": "Priority",
-  "placeholder_jira_priority": "Leave empty to use the project default",
-  "help_jira_priority": "Must match a priority in the project's scheme, e.g. High.",
-  "field_jira_labels": "Labels",
-  "placeholder_jira_labels": "Type a label and press Enter",
-  "help_jira_labels": "signoz and a deduplication label are added automatically.",
-  "field_jira_resolve_transition": "Resolve transition",
-  "field_jira_reopen_transition": "Reopen transition",
-  "help_jira_resolve_transition": "When the alert resolves, SigNoz moves the Jira issue to a \"Done\" status via a workflow transition. This is auto-detected — leave it empty unless your project has more than one \"Done\" transition (e.g. Done vs. Won't Do) and you want to force a specific one by name.",
-  "help_jira_reopen_transition": "When a resolved alert fires again (within the reopen window), SigNoz moves the issue back out of \"Done\" to an active status via a workflow transition. This is auto-detected — leave it empty unless you want to force a specific one by name (e.g. To Do or Reopen).",
-  "placeholder_jira_resolve_transition": "Auto-detected, e.g. Done",
-  "placeholder_jira_reopen_transition": "Auto-detected, e.g. To Do",
-  "field_jira_wont_fix_resolution": "Won't-fix resolution",
-  "help_jira_wont_fix_resolution": "If the issue was resolved with this resolution (e.g. Won't Do), SigNoz won't reopen it when the alert fires again; a new issue is created instead. Leave empty to always reopen.",
-  "placeholder_jira_wont_fix_resolution": "e.g. Won't Do",
-  "field_jira_reopen_duration": "Reopen window",
-  "placeholder_jira_reopen_duration": "e.g. 72h",
-  "help_jira_reopen_duration": "If a resolved alert fires again within this window, the same ticket is reopened; after the window, a re-fire opens a new ticket instead. Default: 3d.",
-  "tooltip_jira_reopen_duration": "Accepted units: m (minutes), h (hours), d (days), w (weeks), y (years) — e.g. 30m, 72h or 3d. Minimum 1m.",
-  "jira_reopen_duration_invalid": "Reopen window must be a duration like 30m, 72h or 3d (minimum 1m)",
-  "jsmops_tip": "Create an API integration on your JSM team's Operations page and paste its key below.",
-  "jsmops_tip_link": "Learn how",
-  "field_jsmops_api_key": "API key",
-  "help_jsmops_api_key": "The JSM Ops integration API key, from your team's Operations → Integrations → API. Make sure the integration is turned on.",
-  "field_jsmops_message": "Message (alert title)",
-  "help_jsmops_message": "Template for the alert title. Truncated to 130 characters.",
-  "field_jsmops_description": "Description",
-  "help_jsmops_description": "Template for the alert description. Rendered as rich text; kept under 15,000 characters.",
-  "jsmops_advanced_section": "Advanced Options",
-  "field_jsmops_priority": "Priority",
-  "help_jsmops_priority": "Template resolving to one of P1–P5. Leave as-is to map from alert severity.",
-  "field_jsmops_tags": "Tags",
-  "placeholder_jsmops_tags": "Type a tag and press Enter",
-  "help_jsmops_tags": "Tags added to every alert.",
-  "incidentio_tip": "Create an HTTP alert source in incident.io (On-call \u2192 Alert routing \u2192 Sources) and paste its URL and token below.",
-  "incidentio_tip_link": "Learn how",
-  "field_incidentio_url": "Alert source URL",
-  "help_incidentio_url": "The alert events URL from the source's setup page, e.g. https://api.incident.io/v2/alert_events/http/<source_config_id>.",
-  "field_incidentio_token": "Token",
-  "help_incidentio_token": "The alert source's secret token, from the same setup page.",
-  "field_incidentio_title": "Title",
-  "help_incidentio_title": "Template for the alert title. Kept stable while the alert fires \u2014 incident.io ignores content updates on repeat events.",
-  "field_incidentio_description": "Description",
-  "help_incidentio_description": "Template for the alert description. Markdown, rendered natively by incident.io.",
-  "incidentio_required_fields": "Alert source URL and token are required",
-  "incidentio_url_invalid": "URL must be an incident.io alert events URL (https://api.incident.io/v2/alert_events/http/<source_config_id>)",
-  "field_incidentio_metadata": "Additional metadata",
-  "help_incidentio_metadata": "Key-value pairs added to every alert's metadata, on top of the alert's labels (these win on a key clash). Values may use templates, e.g. {{ .CommonLabels.severity }}.",
-  "placeholder_incidentio_metadata_key": "Key",
-  "placeholder_incidentio_metadata_value": "Value",
-  "button_incidentio_add_metadata": "Add metadata",
 
   "field_slack_recipient": "Recipient",
   "field_slack_title": "Title",

frontend/public/locales/en/channels.json

@@ -24,77 +24,6 @@
   "tooltip_opsgenie_api_key": "Learn how to obtain the API key from your OpsGenie account [here](https://support.atlassian.com/opsgenie/docs/integrate-opsgenie-with-prometheus/).",
   "tooltip_email_to": "Enter email addresses separated by commas.",
   "tooltip_ms_teams_url": "The URL of the Microsoft Teams [webhook](https://support.microsoft.com/en-us/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498) to send alerts to. Learn more about Microsoft Teams integration in the docs [here](https://signoz.io/docs/alerts-management/notification-channel/ms-teams/).",
-  "tooltip_google_chat_url": "The URL of the Google Chat space [incoming webhook](https://developers.google.com/workspace/chat/quickstart/webhooks) to send alerts to. It must be an https URL on chat.googleapis.com.",
-  "google_chat_webhook_url_invalid": "Webhook URL must be an https URL on chat.googleapis.com",
-  "field_jira_site": "Site URL",
-  "tooltip_jira_site": "Your Jira Cloud base URL, e.g. https://your-domain.atlassian.net. Only Jira Cloud is supported.",
-  "jira_site_invalid": "Site URL must be an https URL on an atlassian.net domain",
-  "jira_required_fields": "Site URL, email, API token, project and issue type are required",
-  "jira_service_account_tip": "Recommended: use a Jira service account so alerts aren't reported under a personal name and the channel keeps working when someone leaves.",
-  "jira_service_account_tip_link": "Learn how",
-  "field_jira_email": "Email",
-  "help_jira_email": "The Atlassian account email used for authentication.",
-  "field_jira_api_token": "API token",
-  "help_jira_api_token": "Create one at id.atlassian.com under Security → API tokens.",
-  "field_jira_project": "Project key",
-  "field_jira_issue_type": "Issue type",
-  "help_jira_issue_type": "An issue type that exists in the project, e.g. Task, Bug or Incident.",
-  "field_jira_summary": "Summary (issue title)",
-  "help_jira_summary": "Template for the Jira issue title.",
-  "field_jira_description": "Description",
-  "help_jira_description": "Template for the issue description. Rendered as rich text with a status panel and links back to SigNoz.",
-  "jira_advanced_section": "Advanced Options",
-  "field_jira_priority": "Priority",
-  "placeholder_jira_priority": "Leave empty to use the project default",
-  "help_jira_priority": "Must match a priority in the project's scheme, e.g. High.",
-  "field_jira_labels": "Labels",
-  "placeholder_jira_labels": "Type a label and press Enter",
-  "help_jira_labels": "signoz and a deduplication label are added automatically.",
-  "field_jira_resolve_transition": "Resolve transition",
-  "field_jira_reopen_transition": "Reopen transition",
-  "help_jira_resolve_transition": "When the alert resolves, SigNoz moves the Jira issue to a \"Done\" status via a workflow transition. This is auto-detected — leave it empty unless your project has more than one \"Done\" transition (e.g. Done vs. Won't Do) and you want to force a specific one by name.",
-  "help_jira_reopen_transition": "When a resolved alert fires again (within the reopen window), SigNoz moves the issue back out of \"Done\" to an active status via a workflow transition. This is auto-detected — leave it empty unless you want to force a specific one by name (e.g. To Do or Reopen).",
-  "placeholder_jira_resolve_transition": "Auto-detected, e.g. Done",
-  "placeholder_jira_reopen_transition": "Auto-detected, e.g. To Do",
-  "field_jira_wont_fix_resolution": "Won't-fix resolution",
-  "help_jira_wont_fix_resolution": "If the issue was resolved with this resolution (e.g. Won't Do), SigNoz won't reopen it when the alert fires again; a new issue is created instead. Leave empty to always reopen.",
-  "placeholder_jira_wont_fix_resolution": "e.g. Won't Do",
-  "field_jira_reopen_duration": "Reopen window",
-  "placeholder_jira_reopen_duration": "e.g. 72h",
-  "help_jira_reopen_duration": "If a resolved alert fires again within this window, the same ticket is reopened; after the window, a re-fire opens a new ticket instead. Default: 3d.",
-  "tooltip_jira_reopen_duration": "Accepted units: m (minutes), h (hours), d (days), w (weeks), y (years) — e.g. 30m, 72h or 3d. Minimum 1m.",
-  "jira_reopen_duration_invalid": "Reopen window must be a duration like 30m, 72h or 3d (minimum 1m)",
-  "jsmops_tip": "Create an API integration on your JSM team's Operations page and paste its key below.",
-  "jsmops_tip_link": "Learn how",
-  "field_jsmops_api_key": "API key",
-  "help_jsmops_api_key": "The JSM Ops integration API key, from your team's Operations → Integrations → API. Make sure the integration is turned on.",
-  "field_jsmops_message": "Message (alert title)",
-  "help_jsmops_message": "Template for the alert title. Truncated to 130 characters.",
-  "field_jsmops_description": "Description",
-  "help_jsmops_description": "Template for the alert description. Rendered as rich text; kept under 15,000 characters.",
-  "jsmops_advanced_section": "Advanced Options",
-  "field_jsmops_priority": "Priority",
-  "help_jsmops_priority": "Template resolving to one of P1–P5. Leave as-is to map from alert severity.",
-  "field_jsmops_tags": "Tags",
-  "placeholder_jsmops_tags": "Type a tag and press Enter",
-  "help_jsmops_tags": "Tags added to every alert.",
-  "incidentio_tip": "Create an HTTP alert source in incident.io (On-call \u2192 Alert routing \u2192 Sources) and paste its URL and token below.",
-  "incidentio_tip_link": "Learn how",
-  "field_incidentio_url": "Alert source URL",
-  "help_incidentio_url": "The alert events URL from the source's setup page, e.g. https://api.incident.io/v2/alert_events/http/<source_config_id>.",
-  "field_incidentio_token": "Token",
-  "help_incidentio_token": "The alert source's secret token, from the same setup page.",
-  "field_incidentio_title": "Title",
-  "help_incidentio_title": "Template for the alert title. Kept stable while the alert fires \u2014 incident.io ignores content updates on repeat events.",
-  "field_incidentio_description": "Description",
-  "help_incidentio_description": "Template for the alert description. Markdown, rendered natively by incident.io.",
-  "incidentio_required_fields": "Alert source URL and token are required",
-  "incidentio_url_invalid": "URL must be an incident.io alert events URL (https://api.incident.io/v2/alert_events/http/<source_config_id>)",
-  "field_incidentio_metadata": "Additional metadata",
-  "help_incidentio_metadata": "Key-value pairs added to every alert's metadata, on top of the alert's labels (these win on a key clash). Values may use templates, e.g. {{ .CommonLabels.severity }}.",
-  "placeholder_incidentio_metadata_key": "Key",
-  "placeholder_incidentio_metadata_value": "Value",
-  "button_incidentio_add_metadata": "Add metadata",
   "field_slack_recipient": "Recipient",
   "field_slack_title": "Title",
   "field_slack_description": "Description",

frontend/public/locales/en/dashboard.json

@@ -25,13 +25,11 @@
 	"dashboard_has_been_updated": "Dashboard has been updated",
 	"do_you_want_to_refresh_the_dashboard": "Do you want to refresh the dashboard?",
 	"locked_dashboard_delete_tooltip_admin_author": "Dashboard is locked. Please unlock the dashboard to enable delete.",
+	"locked_dashboard_delete_tooltip_editor": "Dashboard is locked. Please contact admin to delete the dashboard.",
 	"delete_dashboard_success": "{{name}} dashboard deleted successfully",
 	"dashboard_unsave_changes": "There are unsaved changes in the Query builder, please stage and run the query or the changes will be lost. Press OK to discard.",
 	"dashboard_save_changes": "Your graph built with {{queryTag}} query will be saved. Press OK to confirm.",
 	"your_graph_build_with": "Your graph built with",
 	"dashboard_ok_confirm": "query will be saved. Press OK to confirm.",
-	"variable_name_already_exists": "Variable \"{{name}}\" already exists",
-	"dashboard_locked": "This dashboard is locked",
-	"dashboard_read_only_here": "This dashboard is read-only here",
-	"lock_integration_dashboard": "An integration dashboard cannot be locked or unlocked"
+	"variable_name_already_exists": "Variable \"{{name}}\" already exists"
 }

frontend/scripts/story-shots-caption.mjs

@@ -1,167 +0,0 @@
-import { spawnSync } from 'node:child_process';
-
-/**
- * The caption band both story-shots.mjs and story-shots-diff.mjs stamp on their
- * output, and the ImageMagick plumbing under it. A shot records the band's
- * height in `shots.json` so the diff can crop it back off before comparing:
- * otherwise two runs whose captions differ would report the caption as a change.
- */
-export const CONFIG_KEYS = [
-	'args',
-	'clock',
-	'width',
-	'height',
-	'grow',
-	'motion',
-	'settle',
-	'ignore',
-];
-
-let tools;
-
-const detect = () =>
-	(tools ??= {
-		seven: spawnSync('magick', ['-version']).status === 0,
-		six: spawnSync('convert', ['-version']).status === 0,
-	});
-
-export const hasMagick = () => {
-	const { seven, six } = detect();
-	return seven || six;
-};
-
-export const requireMagick = () => {
-	if (hasMagick()) {
-		return;
-	}
-	console.error(
-		'ImageMagick not found. Install it (brew install imagemagick, apt install imagemagick).',
-	);
-	process.exit(1);
-};
-
-export const magick = (args, input) => {
-	// ImageMagick 6 has no `magick`: its tools are separate binaries.
-	const [command, ...rest] = detect().seven
-		? ['magick', ...args]
-		: ['identify', 'montage'].includes(args[0])
-			? args
-			: ['convert', ...args];
-	const result = spawnSync(command, rest, {
-		input,
-		maxBuffer: 1024 * 1024 * 1024,
-	});
-	if (result.status !== 0) {
-		throw new Error(`${command} ${rest.join(' ')}: ${result.stderr}`);
-	}
-	return result.stdout;
-};
-
-/**
- * ImageMagick's built-in default is a serif that reads as a book, not as a
- * screenshot label, so the band asks for what is installed: a sans for the
- * heading, a mono for the lines that carry ids, args and numbers. An
- * unrecognised name is fatal to `convert`, hence the check against the list it
- * reports; a machine with none of them keeps the default.
- */
-const FONTS = {
-	heading: [
-		'Helvetica-Bold',
-		'DejaVu-Sans-Bold',
-		'Liberation-Sans-Bold',
-		'Arial-Bold',
-		'Noto-Sans-Bold',
-		'DejaVu-Sans',
-		'Liberation-Sans',
-	],
-	body: [
-		'Menlo',
-		'DejaVu-Sans-Mono',
-		'Liberation-Mono',
-		'JetBrainsMono-NF-Regular',
-		'Courier',
-	],
-};
-
-let installed;
-
-const fontArgs = (role) => {
-	installed ??= new Set(
-		[
-			...magick(['-list', 'font'])
-				.toString()
-				.matchAll(/^\s*Font:\s*(\S+)/gm),
-		].map(([, name]) => name),
-	);
-	const font = FONTS[role].find((name) => installed.has(name));
-	return font ? ['-font', font] : [];
-};
-
-/** Readable at fit-to-width, whatever the image is. */
-export const pointsize = (width) =>
-	Math.min(Math.max(Math.round(width / 45), 24), 140);
-
-// `label:` expands ImageMagick's own escapes and reads a file when the text
-// starts with @, so story names and arg values go through neither.
-export const bodyFont = () => fontArgs('body');
-
-export const literal = (text) => text.replaceAll('%', '%%').replace(/^@/, ' @');
-
-/** The gutter is the opposite of the theme, so the band keeps an edge. */
-export const palette = (theme) =>
-	theme === 'light'
-		? { background: '#101014', foreground: '#f4f4f5' }
-		: { background: '#f4f4f5', foreground: '#101014' };
-
-export const settingsLine = (config, keys = CONFIG_KEYS) =>
-	keys
-		.filter((key) => config?.[key])
-		.map((key) => `${key}:${config[key]}`)
-		.join('  ');
-
-const heightOf = (file) => Number(magick(['identify', '-format', '%h', file]));
-
-/**
- * Writes `from` to `to` with `lines` above it, and returns how many rows that
- * added — which is what a reader has to crop off to get the original back, so
- * the band must never change the width. Each line is a `caption:` at the
- * image's own width, wrapping instead of widening the canvas: a run whose
- * caption is longer must still produce a shot the next run's shot pairs with.
- * Type size follows the width, since a three-tile montage of 1680px shots is
- * over 5000px wide and is read at fit-to-width.
- */
-export const stamp = ({ lines, from, to, theme }) => {
-	const { background, foreground } = palette(theme);
-	const width = Number(magick(['identify', '-format', '%w', from]));
-	const heading = pointsize(width);
-	const before = heightOf(from);
-	const spacer = [
-		'-size',
-		`${width}x${Math.round(heading * 0.4)}`,
-		`xc:${background}`,
-	];
-
-	magick([
-		'-background',
-		background,
-		'-fill',
-		foreground,
-		'-gravity',
-		'center',
-		...spacer,
-		...lines.flatMap((line, index) => [
-			...fontArgs(index ? 'body' : 'heading'),
-			'-size',
-			`${width}x`,
-			'-pointsize',
-			String(index ? Math.round(heading * 0.62) : heading),
-			`caption:${literal(line)}`,
-		]),
-		...spacer,
-		from,
-		'-append',
-		to,
-	]);
-
-	return heightOf(to) - before;
-};

frontend/scripts/story-shots-diff.mjs

@@ -1,460 +0,0 @@
-#!/usr/bin/env node
-import { mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
-import { parseArgs } from 'node:util';
-import path from 'node:path';
-import os from 'node:os';
-
-import {
-	bodyFont,
-	CONFIG_KEYS,
-	literal,
-	magick,
-	palette,
-	pointsize,
-	requireMagick,
-	settingsLine,
-	stamp,
-} from './story-shots-caption.mjs';
-
-/**
- * Pairs the PNGs of two story-shots.mjs runs by relative path and reports what
- * moved, per pair, largest first.
- *
- * The comparison is Chromatic's: a pixel counts as changed when its YIQ
- * distance from the baseline pixel is over `threshold` of the largest distance
- * two colours can have, and pixels that are only antialiasing around an
- * otherwise identical edge do not count. `threshold` is their `diffThreshold`
- * and its default is theirs too.
- */
-const MAX_YIQ_DELTA = 35_215;
-
-const { values: opts, positionals } = parseArgs({
-	allowPositionals: true,
-	options: {
-		mode: { type: 'string', default: 'green' },
-		threshold: { type: 'string', default: '0.063' },
-		'include-aa': { type: 'boolean', default: false },
-		tint: { type: 'string', default: '' },
-		'no-caption': { type: 'boolean', default: false },
-		help: { type: 'boolean', short: 'h', default: false },
-	},
-});
-
-const [baseDir, afterDir, outArg] = positionals;
-const MODES = new Set(['green', 'green-parallel', 'red', 'red-parallel']);
-
-if (opts.help || !baseDir || !afterDir || !MODES.has(opts.mode)) {
-	console.log(`usage: node scripts/story-shots-diff.mjs <baseline-dir> <after-dir> [diff-dir]
-
-  --mode green           the after shot, changed pixels painted over it (default)
-  --mode green-parallel  previous | current | green diff, side by side and labelled
-  --mode red             the after shot faded out, changed pixels painted red
-  --mode red-parallel    previous | current | red diff, side by side and labelled
-  --threshold <0..1>     YIQ distance a pixel must move to count (default 0.063)
-  --include-aa           count antialiasing changes too (default: ignore them)
-  --tint <#rrggbb>       override the mode's highlight colour
-  --no-caption           do not stamp the story and the run settings on top
-
-Prints "<changed pixels>  <relative path>", largest first. Needs ImageMagick.`);
-	process.exit(opts.help ? 0 : 1);
-}
-
-const outDir = outArg ?? path.join(path.dirname(baseDir), 'diff');
-const threshold = Number(opts.threshold);
-const maxDelta = MAX_YIQ_DELTA * threshold * threshold;
-const highlight = hexToRgb(
-	opts.tint || (opts.mode.startsWith('green') ? '#00e05a' : '#ff003a'),
-);
-
-function hexToRgb(hex) {
-	const value = Number.parseInt(hex.replace('#', ''), 16);
-	return [(value >> 16) & 255, (value >> 8) & 255, value & 255];
-}
-
-requireMagick();
-
-/**
- * `top` rows are dropped: story-shots.mjs stamps a caption on its shots and
- * records how tall it is, and a caption is not part of what the two runs are
- * being compared on.
- */
-const readRgba = (file, top = 0) => {
-	const [width, height] = magick(['identify', '-format', '%w %h', file])
-		.toString()
-		.split(' ')
-		.map(Number);
-	const data = magick([file, '-depth', '8', 'RGBA:-']);
-	return top > 0 && top < height
-		? { width, height: height - top, data: data.subarray(top * width * 4) }
-		: { width, height, data };
-};
-
-const writeRgba = ({ width, height, data }, file) =>
-	writeFile(
-		file,
-		magick(
-			['-depth', '8', '-size', `${width}x${height}`, 'RGBA:-', 'png:-'],
-			data,
-		),
-	);
-
-/* The pixelmatch colour maths, which is what Chromatic's threshold is scaled to. */
-const y = (r, g, b) => r * 0.29889531 + g * 0.58662247 + b * 0.11448223;
-const i = (r, g, b) => r * 0.59597799 - g * 0.2741761 - b * 0.32180189;
-const q = (r, g, b) => r * 0.21147017 - g * 0.52261711 + b * 0.31114694;
-
-/** Squared YIQ distance, signed by which pixel is brighter. */
-const colorDelta = (a, b, posA, posB, yOnly = false) => {
-	let r1 = a[posA];
-	let g1 = a[posA + 1];
-	let b1 = a[posA + 2];
-	const a1 = a[posA + 3];
-	let r2 = b[posB];
-	let g2 = b[posB + 1];
-	let b2 = b[posB + 2];
-	const a2 = b[posB + 3];
-
-	if (a1 === a2 && r1 === r2 && g1 === g2 && b1 === b2) {
-		return 0;
-	}
-
-	// Anything translucent is composited over the same mid grey in both images,
-	// so a difference in alpha alone still registers.
-	if (a1 < 255) {
-		const alpha = a1 / 255;
-		r1 = r1 * alpha + 255 * (1 - alpha) * 0.5;
-		g1 = g1 * alpha + 255 * (1 - alpha) * 0.5;
-		b1 = b1 * alpha + 255 * (1 - alpha) * 0.5;
-	}
-	if (a2 < 255) {
-		const alpha = a2 / 255;
-		r2 = r2 * alpha + 255 * (1 - alpha) * 0.5;
-		g2 = g2 * alpha + 255 * (1 - alpha) * 0.5;
-		b2 = b2 * alpha + 255 * (1 - alpha) * 0.5;
-	}
-
-	const deltaY = y(r1, g1, b1) - y(r2, g2, b2);
-	if (yOnly) {
-		return deltaY;
-	}
-
-	const deltaI = i(r1, g1, b1) - i(r2, g2, b2);
-	const deltaQ = q(r1, g1, b1) - q(r2, g2, b2);
-	return (
-		0.5053 * deltaY * deltaY + 0.299 * deltaI * deltaI + 0.1957 * deltaQ * deltaQ
-	);
-};
-
-/**
- * True when the pixel sits on an edge that is drawn one subpixel over rather
- * than moved: it is the darkest or lightest of its neighbours in one image, and
- * the other image has a pixel around there doing the same job.
- */
-const antialiased = (a, x1, y1, width, height, b) => {
-	const x0 = Math.max(x1 - 1, 0);
-	const y0 = Math.max(y1 - 1, 0);
-	const x2 = Math.min(x1 + 1, width - 1);
-	const y2 = Math.min(y1 + 1, height - 1);
-	const pos = (y1 * width + x1) * 4;
-	let zeroes = x1 === x0 || x1 === x2 || y1 === y0 || y1 === y2 ? 1 : 0;
-	let min = 0;
-	let max = 0;
-	let minX = 0;
-	let minY = 0;
-	let maxX = 0;
-	let maxY = 0;
-
-	for (let x = x0; x <= x2; x += 1) {
-		for (let yy = y0; yy <= y2; yy += 1) {
-			if (x === x1 && yy === y1) {
-				continue;
-			}
-
-			const delta = colorDelta(a, a, pos, (yy * width + x) * 4, true);
-			if (delta === 0) {
-				zeroes += 1;
-				if (zeroes > 2) {
-					return false;
-				}
-			} else if (delta < min) {
-				min = delta;
-				minX = x;
-				minY = yy;
-			} else if (delta > max) {
-				max = delta;
-				maxX = x;
-				maxY = yy;
-			}
-		}
-	}
-
-	if (min === 0 || max === 0) {
-		return false;
-	}
-
-	return (
-		(hasManySiblings(a, minX, minY, width, height) &&
-			hasManySiblings(b, minX, minY, width, height)) ||
-		(hasManySiblings(a, maxX, maxY, width, height) &&
-			hasManySiblings(b, maxX, maxY, width, height))
-	);
-};
-
-/** Whether the pixel has at least three identical neighbours. */
-const hasManySiblings = (img, x1, y1, width, height) => {
-	const x0 = Math.max(x1 - 1, 0);
-	const y0 = Math.max(y1 - 1, 0);
-	const x2 = Math.min(x1 + 1, width - 1);
-	const y2 = Math.min(y1 + 1, height - 1);
-	const pos = (y1 * width + x1) * 4;
-	let zeroes = x1 === x0 || x1 === x2 || y1 === y0 || y1 === y2 ? 1 : 0;
-
-	for (let x = x0; x <= x2; x += 1) {
-		for (let yy = y0; yy <= y2; yy += 1) {
-			if (x === x1 && yy === y1) {
-				continue;
-			}
-
-			const other = (yy * width + x) * 4;
-			if (
-				img[pos] === img[other] &&
-				img[pos + 1] === img[other + 1] &&
-				img[pos + 2] === img[other + 2] &&
-				img[pos + 3] === img[other + 3]
-			) {
-				zeroes += 1;
-				if (zeroes > 2) {
-					return true;
-				}
-			}
-		}
-	}
-
-	return false;
-};
-
-/**
- * The changed pixels of the pair, painted over the after shot. The `red` modes
- * fade the shot out first, the way a pixelmatch diff reads; the `green` ones
- * leave it alone, the way Chromatic's does.
- */
-const diffPair = (base, after, mode) => {
-	const width = Math.min(base.width, after.width);
-	const height = Math.min(base.height, after.height);
-	const out = Buffer.from(after.data);
-	const fade = !mode.startsWith('green');
-	let changed = 0;
-
-	if (fade) {
-		for (let pos = 0; pos < out.length; pos += 4) {
-			const grey = y(out[pos], out[pos + 1], out[pos + 2]);
-			const value = 255 + (grey - 255) * 0.1;
-			out[pos] = value;
-			out[pos + 1] = value;
-			out[pos + 2] = value;
-			out[pos + 3] = 255;
-		}
-	}
-
-	for (let row = 0; row < height; row += 1) {
-		for (let column = 0; column < width; column += 1) {
-			const basePos = (row * base.width + column) * 4;
-			const afterPos = (row * after.width + column) * 4;
-			const delta = colorDelta(base.data, after.data, basePos, afterPos);
-			if (Math.abs(delta) <= maxDelta) {
-				continue;
-			}
-			if (
-				!opts['include-aa'] &&
-				(antialiased(base.data, column, row, base.width, base.height, after.data) ||
-					antialiased(after.data, column, row, after.width, after.height, base.data))
-			) {
-				continue;
-			}
-
-			changed += 1;
-			out[afterPos] = highlight[0];
-			out[afterPos + 1] = highlight[1];
-			out[afterPos + 2] = highlight[2];
-			out[afterPos + 3] = 255;
-		}
-	}
-
-	// A shot that grew or shrank has no counterpart for the extra rows and
-	// columns, so all of them are a change.
-	const extra =
-		after.width * after.height -
-		width * height +
-		(base.width * base.height - width * height);
-
-	return {
-		data: out,
-		width: after.width,
-		height: after.height,
-		changed: changed + extra,
-	};
-};
-
-/**
- * What each run was and how it was configured, from the `shots.json`
- * story-shots.mjs leaves beside its output. A run shot before that existed, or
- * a directory assembled by hand, simply gets no caption.
- */
-const manifest = async (dir) => {
-	try {
-		return JSON.parse(await readFile(path.join(dir, 'shots.json'), 'utf8'));
-	} catch {
-		return null;
-	}
-};
-
-const [baseRun, afterRun] = await Promise.all([
-	manifest(baseDir),
-	manifest(afterDir),
-]);
-
-/** The settings the two runs disagree on: what a difference in the shots may be. */
-const changedKeys = CONFIG_KEYS.filter(
-	(key) => (baseRun?.config?.[key] ?? '') !== (afterRun?.config?.[key] ?? ''),
-);
-
-const settings = (run, keys) => settingsLine(run?.config, keys);
-
-const shotOf = (run, rel) =>
-	run?.shots?.find((shot) => shot.file === rel.split(path.sep).join('/'));
-
-const captionOf = (run, rel) => shotOf(run, rel)?.caption ?? 0;
-
-/** ImageMagick's inline crop, so a tile shows the shot without its caption. */
-const withoutCaption = (file, { width, height }, top) =>
-	top > 0 ? `${file}[${width}x${height}+0+${top}]` : file;
-
-/** Story, then the settings both runs shared. One line each, widest font first. */
-const header = (rel) => {
-	const shot = shotOf(afterRun, rel) ?? shotOf(baseRun, rel);
-	const shared = settings(
-		afterRun,
-		CONFIG_KEYS.filter((key) => !changedKeys.includes(key)),
-	);
-	return [
-		shot ? `${shot.title}/${shot.name}` : rel.replace(/\.png$/, ''),
-		[shot?.id ?? '', shot?.theme ?? '', shot?.status === 'busy' ? '(busy)' : '']
-			.filter(Boolean)
-			.join('  '),
-		shared,
-	].filter(Boolean);
-};
-
-/** A tile's own line: which side it is, and where its run differed. */
-const sideLabel = (side, run) =>
-	[side, settings(run, changedKeys)].filter(Boolean).join('   ');
-
-const captionLines = (rel, lines) =>
-	opts['no-caption'] ? [] : [...header(rel), ...lines].filter(Boolean);
-
-const pngs = async (dir, prefix = '') => {
-	const entries = await readdir(path.join(dir, prefix), { withFileTypes: true });
-	const files = [];
-	for (const entry of entries) {
-		const rel = path.join(prefix, entry.name);
-		if (entry.isDirectory()) {
-			files.push(...(await pngs(dir, rel)));
-		} else if (entry.name.endsWith('.png')) {
-			files.push(rel);
-		}
-	}
-	return files;
-};
-
-const results = [];
-await mkdir(outDir, { recursive: true });
-
-for (const rel of (await pngs(baseDir)).sort()) {
-	const afterFile = path.join(afterDir, rel);
-	const base = readRgba(path.join(baseDir, rel), captionOf(baseRun, rel));
-	let after;
-	try {
-		after = readRgba(afterFile, captionOf(afterRun, rel));
-	} catch {
-		console.error(`missing in after: ${rel}`);
-		continue;
-	}
-
-	await mkdir(path.join(outDir, path.dirname(rel)), { recursive: true });
-	const diff = diffPair(base, after, opts.mode);
-	const target = path.join(outDir, rel);
-	const parallel = opts.mode.endsWith('-parallel');
-	// With no tiles to label, a run's own settings go in the caption instead.
-	const caption = captionLines(
-		rel,
-		parallel || !changedKeys.length
-			? []
-			: [sideLabel('previous', baseRun), sideLabel('current', afterRun)],
-	);
-	const diffFile = path.join(os.tmpdir(), `story-shots-${process.pid}.png`);
-	const body = path.join(os.tmpdir(), `story-shots-${process.pid}-body.png`);
-
-	// The gutter is the opposite of the theme's own background, so the tiles and
-	// the caption keep an edge instead of bleeding into it.
-	const shot = shotOf(afterRun, rel) ?? shotOf(baseRun, rel);
-	const theme = shot?.theme ?? rel.split(path.sep)[0];
-	const { background, foreground } = palette(theme);
-
-	if (parallel) {
-		await writeRgba(diff, diffFile);
-		const tile = (label, file) => [
-			'(',
-			`label:${literal(label)}`,
-			file,
-			'-gravity',
-			'center',
-			'-append',
-			'-bordercolor',
-			background,
-			'-border',
-			'12',
-			')',
-		];
-		magick([
-			'-background',
-			background,
-			'-fill',
-			foreground,
-			...bodyFont(),
-			'-pointsize',
-			// The tiles end up side by side, so they are read at the montage's width.
-			String(Math.round(pointsize(after.width * 3) * 0.62)),
-			...tile(
-				sideLabel('previous', baseRun),
-				withoutCaption(path.join(baseDir, rel), base, captionOf(baseRun, rel)),
-			),
-			...tile(
-				sideLabel('current', afterRun),
-				withoutCaption(afterFile, after, captionOf(afterRun, rel)),
-			),
-			...tile('diff', diffFile),
-			'-gravity',
-			'north',
-			'+append',
-			caption.length ? body : target,
-		]);
-		if (caption.length) {
-			stamp({ lines: caption, from: body, to: target, theme });
-		}
-	} else {
-		await writeRgba(diff, caption.length ? body : target);
-		if (caption.length) {
-			stamp({ lines: caption, from: body, to: target, theme });
-		}
-	}
-
-	results.push([diff.changed, rel]);
-}
-
-results
-	.sort((a, b) => b[0] - a[0])
-	.forEach(([changed, rel]) =>
-		console.log(`${String(changed).padStart(10)}  ${rel}`),
-	);
-
-console.error(`diffs in ${outDir}`);

frontend/scripts/story-shots.mjs

@@ -1,514 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from 'node:child_process';
-import { mkdir, rename, writeFile } from 'node:fs/promises';
-import { createRequire } from 'node:module';
-import { parseArgs } from 'node:util';
-import { pathToFileURL } from 'node:url';
-import path from 'node:path';
-import os from 'node:os';
-
-import {
-	CONFIG_KEYS,
-	hasMagick,
-	settingsLine,
-	stamp,
-} from './story-shots-caption.mjs';
-
-/**
- * The wall clock every shot is taken at, passed to the preview as `storyClock`.
- * `.storybook/preview-head.html` freezes the same instant by itself, so a
- * Chromatic build reads the clock this run does.
- */
-const FROZEN_CLOCK = '2026-06-15T12:00:00.000Z';
-
-const { values: opts, positionals } = parseArgs({
-	allowPositionals: true,
-	options: {
-		out: { type: 'string', short: 'o' },
-		stories: { type: 'string', multiple: true, default: [] },
-		title: { type: 'string', default: '' },
-		name: { type: 'string', default: '' },
-		theme: { type: 'string', multiple: true, default: [] },
-		args: { type: 'string', multiple: true, default: [] },
-		port: { type: 'string', default: process.env.SB_PORT ?? '6006' },
-		width: { type: 'string', default: '1680' },
-		height: { type: 'string', default: '1200' },
-		'max-height': { type: 'string', default: '8000' },
-		grow: { type: 'string', default: 'scrollers' },
-		settle: { type: 'string', default: '1500' },
-		clock: { type: 'string', default: FROZEN_CLOCK },
-		motion: { type: 'boolean', default: false },
-		ignore: { type: 'string', multiple: true, default: [] },
-		flat: { type: 'boolean', default: false },
-		'no-caption': { type: 'boolean', default: false },
-		list: { type: 'boolean', default: false },
-		help: { type: 'boolean', short: 'h', default: false },
-	},
-});
-
-const outDir = opts.out ?? positionals[0];
-const themes = opts.theme.flatMap((value) => value.split(',')).filter(Boolean);
-const storyArgs = opts.args.filter(Boolean).join(';');
-
-if (opts.help || (!outDir && !opts.list)) {
-	console.log(`usage: node scripts/story-shots.mjs <out-dir> [options]
-
-  --stories <match>   only stories whose id or title/name path contains <match>
-                      (repeatable, comma-separated; default: every story)
-  --title <prefix>    only stories whose title starts with <prefix>
-  --name <match>      only stories whose name contains <match>
-  --theme <themes>    themes to shoot, e.g. dark,light (default: story default)
-  --args <k:v;k2:v2>  arg overrides, storybook's own ?args= syntax (repeatable).
-                      A value containing a dot is dropped by storybook itself
-  --port <port>       storybook dev server port (default 6006, or $SB_PORT)
-  --width <px>        viewport width, the only fixed dimension (default 1680)
-  --height <px>       shortest the viewport may be (default 1200)
-  --max-height <px>   tallest the viewport may grow to (default 8000)
-  --grow <what>       scrollers (default) grows the viewport until the page's
-                      own scrollers fit, document only follows the document
-                      height (a no-op on any page with the app shell), none
-                      keeps --height
-  --settle <ms>       wait after the page goes quiet (default 1500)
-  --clock <iso|live>  wall clock the page reads (default ${FROZEN_CLOCK})
-  --motion            keep animations and transitions running
-  --ignore <selector> hide matching elements, on top of [data-shot-ignore]
-  --flat              write <out>/<id>.png instead of <out>/<theme>/<id>.png
-  --no-caption        do not stamp the story and the run settings on the shot
-  --list              print the matched stories and exit
-
-Screenshots land in <out-dir>/<theme>/<story-id>.png, alongside a shots.json
-recording what each shot is, how the run was configured, and how tall the
-caption on it is. story-shots-diff.mjs reads that to crop the caption off before
-comparing, so two runs never diff their own captions.
-
-Captioning needs ImageMagick; without it the shots are written bare.
-
-Playwright is looked up in tests/e2e, then in the global install; override with
-PLAYWRIGHT_MODULE. The browser is playwright's own chromium, else an installed
-Chrome; override with CHROME_PATH.`);
-	process.exit(opts.help ? 0 : 1);
-}
-
-const base = `http://localhost:${opts.port}`;
-
-// `index.json` carries raw control characters from story jsdoc, so it is read as
-// text rather than piped through anything that revalidates it.
-const index = JSON.parse(await (await fetch(`${base}/index.json`)).text());
-
-const matches = opts.stories
-	.flatMap((value) => value.split(','))
-	.filter(Boolean);
-
-const stories = Object.values(index.entries)
-	.filter((entry) => {
-		if (entry.type !== 'story') {
-			return false;
-		}
-		if (opts.title && !entry.title.startsWith(opts.title)) {
-			return false;
-		}
-		if (
-			opts.name &&
-			!entry.name.toLowerCase().includes(opts.name.toLowerCase())
-		) {
-			return false;
-		}
-		if (!matches.length) {
-			return true;
-		}
-
-		const haystack = `${entry.id} ${entry.title}/${entry.name}`.toLowerCase();
-		return matches.some((match) => haystack.includes(match.toLowerCase()));
-	})
-	.sort((a, b) => a.id.localeCompare(b.id));
-
-if (opts.list) {
-	stories.forEach((story) =>
-		console.log(`${story.id}\t${story.title}/${story.name}`),
-	);
-	console.log(`${stories.length} stories`);
-	process.exit(0);
-}
-
-if (!stories.length) {
-	console.error('no story matched');
-	process.exit(1);
-}
-
-const ignoreSelectors = opts.ignore
-	.flatMap((value) => value.split(','))
-	.map((value) => value.trim())
-	.filter(Boolean);
-
-if (opts.clock !== 'live' && Number.isNaN(Date.parse(opts.clock))) {
-	console.error(`--clock: not a date: ${opts.clock}`);
-	process.exit(1);
-}
-
-/**
- * `[data-shot-ignore]` and `--ignore` hide what cannot be settled, the local
- * half of Chromatic's `data-chromatic="ignore"`. Everything else the shot needs
- * held still - the frozen clock, the parked animations, the lists snapped onto
- * their bottom - is done by the preview itself, so a Chromatic build and a shot
- * from here see the same page.
- */
-const ignoreCss = (
-	ignore,
-) => `[data-shot-ignore], [data-chromatic='ignore']${ignore
-	.map((selector) => `, ${selector}`)
-	.join('')} {
-	visibility: hidden !important;
-}`;
-
-/**
- * Playwright is not a frontend dependency: it lives in `tests/e2e`, or globally,
- * or wherever `$PLAYWRIGHT_MODULE` points. `@playwright/test` re-exports
- * `chromium`, so an e2e install alone is enough.
- */
-const resolvePlaywright = () => {
-	const specifiers = process.env.PLAYWRIGHT_MODULE
-		? [process.env.PLAYWRIGHT_MODULE]
-		: ['playwright', '@playwright/test'];
-
-	const find = (roots) => {
-		for (const specifier of specifiers) {
-			for (const root of roots) {
-				try {
-					return createRequire(path.join(root, '-')).resolve(specifier);
-				} catch {
-					/* next candidate */
-				}
-			}
-		}
-		return null;
-	};
-
-	const local = find([
-		import.meta.dirname,
-		path.resolve(import.meta.dirname, '../../tests/e2e'),
-	]);
-	if (local) {
-		return local;
-	}
-
-	// `npm root -g` prints the global node_modules; resolution starts a level up.
-	const globalRoot = spawnSync('npm', ['root', '-g'], { encoding: 'utf8' });
-	const global =
-		globalRoot.status === 0 && find([path.dirname(globalRoot.stdout.trim())]);
-	if (global) {
-		return global;
-	}
-
-	console.error(
-		'playwright not found. Install it (pnpm -C tests/e2e install, or npm i -g playwright) or set PLAYWRIGHT_MODULE.',
-	);
-	return process.exit(1);
-};
-
-const pwModule = await import(pathToFileURL(resolvePlaywright()).href);
-const pw = pwModule.chromium ? pwModule : pwModule.default;
-
-console.log(
-	`${stories.length} stories x ${themes.length || 1} theme(s) -> ${outDir}`,
-);
-
-/**
- * A playwright install carries no browser of its own, and the revision it wants
- * is often not the one that was downloaded, so an installed Chrome is the
- * fallback before giving up.
- */
-const launch = async () => {
-	if (process.env.CHROME_PATH) {
-		return pw.chromium.launch({ executablePath: process.env.CHROME_PATH });
-	}
-	try {
-		return await pw.chromium.launch();
-	} catch (error) {
-		try {
-			return await pw.chromium.launch({ channel: 'chrome' });
-		} catch {
-			console.error(
-				`${error.message.split('\n')[0]}\nRun 'playwright install chromium' or set CHROME_PATH to a browser binary.`,
-			);
-			return process.exit(1);
-		}
-	}
-};
-
-const browser = await launch();
-
-const failures = [];
-const shots = [];
-
-const runConfig = {
-	args: storyArgs,
-	clock: opts.clock,
-	width: opts.width,
-	height: opts.height,
-	grow: opts.grow,
-	motion: opts.motion ? 'live' : 'still',
-	settle: opts.settle,
-	ignore: ignoreSelectors.join(', '),
-};
-
-const captioning = !opts['no-caption'] && hasMagick();
-
-if (!opts['no-caption'] && !captioning) {
-	console.error('ImageMagick not found: shots are written without a caption.');
-}
-
-const configLine = settingsLine(runConfig, CONFIG_KEYS);
-
-for (const theme of themes.length ? themes : [null]) {
-	const dir = opts.flat ? outDir : path.join(outDir, theme ?? 'default');
-	await mkdir(dir, { recursive: true });
-	if (theme) {
-		console.log(`\n[${theme}]`);
-	}
-
-	for (const story of stories) {
-		// A context per story: reusing one page loses the msw worker
-		// re-registration race after a few navigations and the story then dies on
-		// a missing worker.
-		const context = await browser.newContext({
-			viewport: { width: Number(opts.width), height: Number(opts.height) },
-			reducedMotion: opts.motion ? 'no-preference' : 'reduce',
-		});
-		const page = await context.newPage();
-
-		// react-query retries and msw both keep requests going long after load, so
-		// the settle waits on the page being quiet rather than on a fixed delay.
-		let inFlight = 0;
-		let lastActivity = Date.now();
-		page.on('request', () => {
-			inFlight += 1;
-			lastActivity = Date.now();
-		});
-		const done = () => {
-			inFlight = Math.max(inFlight - 1, 0);
-			lastActivity = Date.now();
-		};
-		page.on('requestfinished', done);
-		page.on('requestfailed', done);
-
-		// The height the rounds had reached when the page turned out to grow with
-		// the viewport, kept only to flag the story in the log.
-		let chasing = 0;
-
-		const url = new URL(`${base}/iframe.html`);
-		url.searchParams.set('viewMode', 'story');
-		url.searchParams.set('id', story.id);
-		// The preview owns the clock and the motion state, so both are asked for in
-		// the URL rather than injected here: a Chromatic build gets the defaults.
-		url.searchParams.set('storyClock', opts.clock);
-		const globals = [theme && `theme:${theme}`, opts.motion && 'motion:live']
-			.filter(Boolean)
-			.join(';');
-		if (globals) {
-			url.searchParams.set('globals', globals);
-		}
-		if (storyArgs) {
-			url.searchParams.set('args', storyArgs);
-		}
-
-		try {
-			await page.goto(url.href, { waitUntil: 'domcontentloaded' });
-
-			// Storybook's own render phase is the readiness signal: it reaches
-			// `finished` only once the loaders, the decorators and the story's `play`
-			// are all done, which a DOM check cannot see. The dev server transforms
-			// each page module on first visit, so this is the slow wait.
-			await page.waitForFunction(
-				() =>
-					(window.__STORYBOOK_PREVIEW__?.storyRenders ?? []).some((render) =>
-						['finished', 'errored', 'aborted'].includes(render.phase),
-					) || document.body.classList.contains('sb-show-errordisplay'),
-				undefined,
-				{ timeout: 120_000 },
-			);
-
-			await page.addStyleTag({ content: ignoreCss(ignoreSelectors) });
-			if (!opts.motion) {
-				// Videos and GIFs are parked on their first frame, as Chromatic does.
-				await page.evaluate(() =>
-					document.querySelectorAll('video').forEach((video) => video.pause?.()),
-				);
-			}
-
-			// Text reflows when a webfont lands, so the shot waits for the faces the
-			// page asked for. Some stories keep a request open by design, hence the
-			// cap on the quiet wait rather than a plain networkidle.
-			await page.evaluate(() => document.fonts.ready);
-			const quietUntil = Date.now() + 15_000;
-			while (
-				Date.now() < quietUntil &&
-				(inFlight > 0 || Date.now() - lastActivity < 600)
-			) {
-				await page.waitForTimeout(200);
-			}
-			await page.waitForTimeout(Number(opts.settle));
-
-			// The width is the fixed dimension and the height follows the page, the
-			// way a Chromatic viewport does. `src/styles.scss` pins
-			// `html, body, #root` to `height: 100%; overflow: hidden`, so the
-			// document can never outgrow the viewport and its height says nothing
-			// about what is on the page: what overflows are the shell's inner
-			// scrollers. `scrollers` grows the viewport until the tallest of those
-			// fits, so nothing is cut off and no scrollbar is left in the shot.
-			// Growing changes the layout, hence the rounds. A page that sizes a panel
-			// in `vh` grows its own content as the viewport grows, so no height ever
-			// fits it and the rounds only chase: `.alert-chart-container` is `57vh`,
-			// which puts Create Alert's fixed point at 4344px with an empty band on
-			// top. Such a page is shot at `--height` with its own scrollbar instead,
-			// which is what it looks like in a browser.
-			if (opts.grow !== 'none') {
-				const maximum = Number(opts['max-height']);
-				const requested = Number(opts.height);
-				let height = requested;
-				let fits = false;
-				for (let round = 0; round < 3 && !fits; round += 1) {
-					const needed = Math.min(
-						maximum,
-						await page.evaluate((withScrollers) => {
-							const document_ = Math.max(
-								document.documentElement.scrollHeight,
-								document.body.scrollHeight,
-							);
-							if (!withScrollers) {
-								return document_;
-							}
-
-							// Popups are skipped: they are out of the flow, and a tall
-							// dropdown or tooltip would otherwise drag the shot to a
-							// height nothing on the page itself needs.
-							const inFlow = (element) => {
-								for (
-									let node = element;
-									node && node !== document.documentElement;
-									node = node.parentElement
-								) {
-									const { position } = getComputedStyle(node);
-									if (position === 'fixed' || position === 'absolute') {
-										return false;
-									}
-								}
-								return true;
-							};
-
-							return [...document.querySelectorAll('*')].reduce((tallest, element) => {
-								const { overflowY } = getComputedStyle(element);
-								if (
-									!['auto', 'scroll', 'overlay'].includes(overflowY) ||
-									element.scrollHeight - element.clientHeight <= 1 ||
-									!inFlow(element)
-								) {
-									return tallest;
-								}
-
-								const box = element.getBoundingClientRect();
-								const above = box.top + window.scrollY;
-								const below = Math.max(0, document_ - (box.bottom + window.scrollY));
-								return Math.max(tallest, above + element.scrollHeight + below);
-							}, document_);
-						}, opts.grow === 'scrollers'),
-					);
-					fits = needed <= height;
-					if (fits) {
-						break;
-					}
-
-					height = needed;
-					await page.setViewportSize({ width: Number(opts.width), height });
-					await page.waitForTimeout(Number(opts.settle));
-				}
-
-				if (!fits && height !== requested) {
-					chasing = height;
-					height = requested;
-					await page.setViewportSize({ width: Number(opts.width), height });
-					await page.waitForTimeout(Number(opts.settle));
-				}
-			}
-
-			// The preview snapped its bottom-pinned lists at `afterEach`, before the
-			// page went quiet; a virtuoso list is usually still measuring then.
-			await page.evaluate(() => window.__signozSnapPinnedScrollers?.());
-
-			// A page that is still moving — a list scrolling itself to the bottom, a
-			// monaco editor re-measuring, a tooltip being repositioned — is shot
-			// twice in a row until two frames come back identical, since what the
-			// page is waiting on is not observable from here.
-			let shot = await page.screenshot();
-			let stable = false;
-			for (let attempt = 0; attempt < 8 && !stable; attempt += 1) {
-				await page.waitForTimeout(400);
-				const next = await page.screenshot();
-				stable = next.equals(shot);
-				shot = next;
-			}
-
-			const file = path.join(dir, `${story.id}.png`);
-			await writeFile(file, shot);
-
-			// The band goes on the shot itself so a single screenshot says what it
-			// is, and its height is recorded so a diff can take it back off.
-			let caption = 0;
-			if (captioning) {
-				const temporary = path.join(
-					os.tmpdir(),
-					`story-shots-caption-${process.pid}.png`,
-				);
-				caption = stamp({
-					lines: [
-						`${story.title}/${story.name}`,
-						[story.id, theme ?? 'default', stable ? '' : '(busy)']
-							.filter(Boolean)
-							.join('  '),
-						configLine,
-					].filter(Boolean),
-					from: file,
-					to: temporary,
-					theme: theme ?? 'dark',
-				});
-				await rename(temporary, file);
-			}
-
-			shots.push({
-				file: path.posix.join(
-					opts.flat ? '' : (theme ?? 'default'),
-					`${story.id}.png`,
-				),
-				id: story.id,
-				title: story.title,
-				name: story.name,
-				theme: theme ?? 'default',
-				status: stable ? 'ok' : 'busy',
-				caption,
-			});
-			console.log(
-				`  ${stable ? 'ok  ' : 'busy'} ${story.id}${
-					chasing ? ` (viewport-sized content, stopped chasing ${chasing}px)` : ''
-				}`,
-			);
-		} catch (error) {
-			failures.push(`${theme ?? 'default'}/${story.id}`);
-			console.log(`  FAIL ${story.id}: ${error.message.split('\n')[0]}`);
-		} finally {
-			await context.close();
-		}
-	}
-}
-
-await browser.close();
-
-// The diff script captions its output from this, so the run's own settings sit
-// next to the shots they produced rather than only in the shell history.
-await writeFile(
-	path.join(outDir, 'shots.json'),
-	`${JSON.stringify({ config: runConfig, shots }, null, '\t')}\n`,
-);
-
-if (failures.length) {
-	console.error(`\n${failures.length} failed: ${failures.join(', ')}`);
-	process.exit(1);
-}

frontend/src/AppRoutes/Private.tsx

@@ -169,12 +169,12 @@ function PrivateRoute({ children }: PrivateRouteProps): JSX.Element {
 	// Check for workspace blocked (trial expired)
 	if (!isFetchingActiveLicense && isCloudPlatform && trialInfo?.workSpaceBlock) {
 		const isRouteEnabledForWorkspaceBlockedState =
-			pathname === ROUTES.SETTINGS ||
-			pathname === ROUTES.BILLING ||
-			(isAdmin &&
-				(pathname === ROUTES.ORG_SETTINGS ||
-					pathname === ROUTES.MEMBERS_SETTINGS ||
-					pathname === ROUTES.MY_SETTINGS));
+			isAdmin &&
+			(pathname === ROUTES.SETTINGS ||
+				pathname === ROUTES.ORG_SETTINGS ||
+				pathname === ROUTES.MEMBERS_SETTINGS ||
+				pathname === ROUTES.BILLING ||
+				pathname === ROUTES.MY_SETTINGS);
 
 		if (
 			pathname !== ROUTES.WORKSPACE_LOCKED &&

frontend/src/AppRoutes/__tests__/Private.test.tsx

@@ -103,30 +103,30 @@ function createMockLicense(
 	overrides: Partial<LicenseResModel> = {},
 ): LicenseResModel {
 	return {
-		id: 'test-license-id',
-		eventQueue: {
-			createdAt: '0',
+		key: 'test-key',
+		event_queue: {
+			created_at: '0',
 			event: LicenseEvent.NO_EVENT,
-			scheduledAt: '0',
+			scheduled_at: '0',
 			status: '',
-			updatedAt: '0',
+			updated_at: '0',
 		},
 		state: LicenseState.ACTIVATED,
 		status: LicenseStatus.VALID,
 		platform: LicensePlatform.CLOUD,
-		createdAt: '0',
+		created_at: '0',
 		plan: {
-			id: '0',
-			createdAt: '0',
+			created_at: '0',
 			description: '',
-			isActive: true,
+			is_active: true,
 			name: '',
-			updatedAt: '0',
+			updated_at: '0',
 		},
-		freeUntil: '0',
-		updatedAt: '0',
-		validFrom: 0,
-		validUntil: 0,
+		plan_id: '0',
+		free_until: '0',
+		updated_at: '0',
+		valid_from: 0,
+		valid_until: 0,
 		...overrides,
 	};
 }
@@ -739,7 +739,7 @@ describe('PrivateRoute', () => {
 			assertStaysOnRoute(ROUTES.MY_SETTINGS);
 		});
 
-		it('should allow VIEWER to access /settings when workspace is blocked', () => {
+		it('should redirect VIEWER to workspace locked even when trying to access settings', async () => {
 			renderPrivateRoute({
 				initialRoute: ROUTES.SETTINGS,
 				appContext: {
@@ -752,10 +752,10 @@ describe('PrivateRoute', () => {
 				isCloudUser: true,
 			});
 
-			assertStaysOnRoute(ROUTES.SETTINGS);
+			await assertRedirectsTo(ROUTES.WORKSPACE_LOCKED);
 		});
 
-		it('should allow VIEWER to access /settings/billing when workspace is blocked', () => {
+		it('should redirect VIEWER to workspace locked when trying to access billing', async () => {
 			renderPrivateRoute({
 				initialRoute: ROUTES.BILLING,
 				appContext: {
@@ -768,7 +768,7 @@ describe('PrivateRoute', () => {
 				isCloudUser: true,
 			});
 
-			assertStaysOnRoute(ROUTES.BILLING);
+			await assertRedirectsTo(ROUTES.WORKSPACE_LOCKED);
 		});
 
 		it('should redirect VIEWER to workspace locked when trying to access org-settings', async () => {
@@ -819,7 +819,7 @@ describe('PrivateRoute', () => {
 			await assertRedirectsTo(ROUTES.WORKSPACE_LOCKED);
 		});
 
-		it('should allow EDITOR to access /settings when workspace is blocked', () => {
+		it('should redirect EDITOR to workspace locked when trying to access settings', async () => {
 			renderPrivateRoute({
 				initialRoute: ROUTES.SETTINGS,
 				appContext: {
@@ -832,7 +832,7 @@ describe('PrivateRoute', () => {
 				isCloudUser: true,
 			});
 
-			assertStaysOnRoute(ROUTES.SETTINGS);
+			await assertRedirectsTo(ROUTES.WORKSPACE_LOCKED);
 		});
 
 		it('should not redirect when already on workspace locked page', () => {
@@ -850,22 +850,6 @@ describe('PrivateRoute', () => {
 			assertStaysOnRoute(ROUTES.WORKSPACE_LOCKED);
 		});
 
-		it('should keep a custom role (ANONYMOUS) on workspace locked instead of bouncing to unauthorized', () => {
-			renderPrivateRoute({
-				initialRoute: ROUTES.WORKSPACE_LOCKED,
-				appContext: {
-					isLoggedIn: true,
-					isFetchingActiveLicense: false,
-					activeLicense: createMockLicense({ platform: LicensePlatform.CLOUD }),
-					trialInfo: createMockTrialInfo({ workSpaceBlock: true }),
-					user: createMockUser({ role: USER_ROLES.ANONYMOUS as ROLES }),
-				},
-				isCloudUser: true,
-			});
-
-			assertStaysOnRoute(ROUTES.WORKSPACE_LOCKED);
-		});
-
 		it('should not redirect self-hosted users to workspace locked even when workSpaceBlock is true', () => {
 			renderPrivateRoute({
 				initialRoute: ROUTES.HOME,
@@ -1040,24 +1024,6 @@ describe('PrivateRoute', () => {
 			assertStaysOnRoute(ROUTES.WORKSPACE_SUSPENDED);
 		});
 
-		it('should keep a custom role (ANONYMOUS) on workspace suspended instead of bouncing to unauthorized', () => {
-			renderPrivateRoute({
-				initialRoute: ROUTES.WORKSPACE_SUSPENDED,
-				appContext: {
-					isLoggedIn: true,
-					isFetchingActiveLicense: false,
-					activeLicense: createMockLicense({
-						platform: LicensePlatform.CLOUD,
-						state: LicenseState.DEFAULTED,
-					}),
-					user: createMockUser({ role: USER_ROLES.ANONYMOUS as ROLES }),
-				},
-				isCloudUser: true,
-			});
-
-			assertStaysOnRoute(ROUTES.WORKSPACE_SUSPENDED);
-		});
-
 		it('should not redirect self-hosted users to workspace suspended when license is defaulted', () => {
 			renderPrivateRoute({
 				initialRoute: ROUTES.HOME,
@@ -1558,18 +1524,6 @@ describe('PrivateRoute', () => {
 			keyof typeof routeWithInitialAuthZSupport,
 			AuthzRouteCase
 		> = {
-			ALL_DASHBOARD: { path: ROUTES.ALL_DASHBOARD, deniedRoles: DENIED_ROLES },
-			DASHBOARD: {
-				path: ROUTES.DASHBOARD.replace(':dashboardId', 'dashboard-id-1'),
-				deniedRoles: DENIED_ROLES,
-			},
-			DASHBOARD_PANEL_EDITOR: {
-				path: ROUTES.DASHBOARD_PANEL_EDITOR.replace(
-					':dashboardId',
-					'dashboard-id-1',
-				).replace(':panelId', 'panel-id-1'),
-				deniedRoles: DENIED_ROLES,
-			},
 			// Everything under /settings resolves to the non-exact SETTINGS route
 			SETTINGS: { path: ROUTES.SETTINGS, deniedRoles: DENIED_ROLES },
 			MY_SETTINGS: { path: ROUTES.MY_SETTINGS, deniedRoles: DENIED_ROLES },
@@ -1626,19 +1580,6 @@ describe('PrivateRoute', () => {
 				path: ROUTES.SUPPORT,
 				deniedRoles: [USER_ROLES.AUTHOR as ROLES],
 			},
-			WORKSPACE_LOCKED: {
-				path: ROUTES.WORKSPACE_LOCKED,
-				deniedRoles: DENIED_ROLES,
-			},
-			WORKSPACE_SUSPENDED: {
-				path: ROUTES.WORKSPACE_SUSPENDED,
-				deniedRoles: DENIED_ROLES,
-			},
-			WORKSPACE_ACCESS_RESTRICTED: {
-				path: ROUTES.WORKSPACE_ACCESS_RESTRICTED,
-				deniedRoles: DENIED_ROLES,
-			},
-			BILLING: { path: ROUTES.BILLING, deniedRoles: DENIED_ROLES },
 		};
 
 		const authzRouteRolePairs: [string, string, ROLES][] = Object.entries(

frontend/src/AppRoutes/index.tsx

@@ -1,12 +1,11 @@
-import { ReactNode, Suspense, useCallback, useEffect, useState } from 'react';
+import { Suspense, useCallback, useEffect, useState } from 'react';
 import { Route, Router, Switch } from 'react-router-dom';
 import { CompatRouter } from 'react-router-dom-v5-compat';
 import * as Sentry from '@sentry/react';
+import { ConfigProvider } from 'antd';
 import getLocalStorageApi from 'api/browser/localstorage/get';
 import setLocalStorageApi from 'api/browser/localstorage/set';
 import logEvent from 'api/common/logEvent';
-import AppPageProviders from 'app/AppPageProviders';
-import AppShell from 'app/AppShell';
 import AppLoading from 'components/AppLoading/AppLoading';
 import { CmdKPalette } from 'components/cmdKPalette/cmdKPalette';
 import NotFound from 'components/NotFound';
@@ -18,15 +17,22 @@ import ROUTES from 'constants/routes';
 import AppLayout from 'container/AppLayout';
 import Hex from 'crypto-js/enc-hex';
 import HmacSHA256 from 'crypto-js/hmac-sha256';
+import { KeyboardHotkeysProvider } from 'hooks/hotkeys/useKeyboardHotkeys';
 import { useIsAIAssistantEnabled } from 'hooks/useIsAIAssistantEnabled';
-import { useIsDarkMode } from 'hooks/useDarkMode';
+import { useIsDarkMode, useThemeConfig } from 'hooks/useDarkMode';
 import { useGetTenantLicense } from 'hooks/useGetTenantLicense';
+import { NotificationProvider } from 'hooks/useNotifications';
+import { ResourceProvider } from 'hooks/useResourceAttribute';
 import { StatusCodes } from 'http-status-codes';
 import history from 'lib/history';
 import ErrorBoundaryFallback from 'pages/ErrorBoundaryFallback/ErrorBoundaryFallback';
 import posthog from 'posthog-js';
 import { useAppContext } from 'providers/App/App';
 import { IUser } from 'providers/App/types';
+import { CmdKProvider } from 'providers/cmdKProvider';
+import { ErrorModalProvider } from 'providers/ErrorModalProvider';
+import { PreferenceContextProvider } from 'providers/preferences/context/PreferenceContextProvider';
+import { QueryBuilderProvider } from 'providers/QueryBuilder';
 import { LicenseStatus } from 'types/api/licensesV3/getActive';
 import { extractDomain } from 'utils/app';
 
@@ -38,17 +44,8 @@ import defaultRoutes, {
 	SUPPORT_ROUTE,
 } from './routes';
 
-const appRouter = (children: ReactNode): ReactNode => (
-	<Router history={history}>
-		<CompatRouter>{children}</CompatRouter>
-	</Router>
-);
-
-const appLayout = (children: ReactNode): ReactNode => (
-	<AppLayout>{children}</AppLayout>
-);
-
 function App(): JSX.Element {
+	const themeConfig = useThemeConfig();
 	const {
 		user,
 		isFetchingUser,
@@ -357,16 +354,6 @@ function App(): JSX.Element {
 					tunnel: window.signozBootData.settings.sentry.tunnel,
 					environment: process.env.ENVIRONMENT,
 					release: process.env.VERSION,
-					// A tab that outlived a deploy requests hashed assets the new build no longer
-					// has. `lazyRetry` recovers by reloading once, so this class is not worth
-					// reporting. The stylesheet message is Vite's own; the module ones are the
-					// same failure worded differently by Chromium, Firefox and Safari.
-					ignoreErrors: [
-						/Unable to preload CSS for/,
-						/Failed to fetch dynamically imported module/,
-						/error loading dynamically imported module/,
-						/Importing a module script failed/,
-					],
 					integrations: [
 						// Kept for the `transaction` tag used in routing, even though
 						// tracing is disabled. Ref: https://github.com/SigNoz/platform-pod/issues/2393#issuecomment-4603658055
@@ -379,23 +366,7 @@ function App(): JSX.Element {
 					tracesSampleRate: 0, // Ref: https://github.com/SigNoz/platform-pod/issues/2393#issuecomment-4603658055
 					replaysSessionSampleRate: 0.1, // This sets the sample rate at 10%. You may want to change it to 100% while in development and then sample at a lower rate in production.
 					replaysOnErrorSampleRate: 1.0, // If you're not already sampling the entire session, change the sample rate to 100% when sampling sessions where errors occur.
-					beforeSend(event, hint) {
-						const error = hint?.originalException as
-							| { name?: string; code?: string | number }
-							| undefined;
-
-						// Ignore benign aborted/cancelled requests (axios + fetch).
-						if (error?.code === 'ERR_CANCELED' || error?.code === 'ECONNABORTED') {
-							return null;
-						}
-						if (error?.name === 'AbortError') {
-							return null;
-						}
-						// Ignore benign Monaco cancellation errors (name 'Canceled').
-						if (error?.name === 'Canceled') {
-							return null;
-						}
-
+					beforeSend(event) {
 						// Drop the event if its level is 'warning' or 'info'
 						if (event.level === 'warning' || event.level === 'info') {
 							return null;
@@ -454,36 +425,48 @@ function App(): JSX.Element {
 
 	return (
 		<Sentry.ErrorBoundary fallback={<ErrorBoundaryFallback />}>
-			<AppShell
-				router={appRouter}
-				overlays={
-					isLoggedInState && (
-						<>
-							<CmdKPalette userRole={user.role} />
-							<ShiftHoldOverlayController userRole={user.role} />
-						</>
-					)
-				}
-			>
-				<PrivateRoute>
-					<AppPageProviders layout={appLayout}>
-						<Suspense fallback={<Spinner size="large" tip="Loading..." />}>
-							<Switch>
-								{routes.map(({ path, component, exact }) => (
-									<Route
-										key={`${path}`}
-										exact={exact}
-										path={path}
-										component={component}
-									/>
-								))}
-								<Route exact path="/" component={Home} />
-								<Route path="*" component={NotFound} />
-							</Switch>
-						</Suspense>
-					</AppPageProviders>
-				</PrivateRoute>
-			</AppShell>
+			<ConfigProvider theme={themeConfig}>
+				<Router history={history}>
+					<CompatRouter>
+						<CmdKProvider>
+							<NotificationProvider>
+								<ErrorModalProvider>
+									{isLoggedInState && <CmdKPalette userRole={user.role} />}
+									{isLoggedInState && (
+										<ShiftHoldOverlayController userRole={user.role} />
+									)}
+									<PrivateRoute>
+										<ResourceProvider>
+											<QueryBuilderProvider>
+												<KeyboardHotkeysProvider>
+													<AppLayout>
+														<PreferenceContextProvider>
+															<Suspense fallback={<Spinner size="large" tip="Loading..." />}>
+																<Switch>
+																	{routes.map(({ path, component, exact }) => (
+																		<Route
+																			key={`${path}`}
+																			exact={exact}
+																			path={path}
+																			component={component}
+																		/>
+																	))}
+																	<Route exact path="/" component={Home} />
+																	<Route path="*" component={NotFound} />
+																</Switch>
+															</Suspense>
+														</PreferenceContextProvider>
+													</AppLayout>
+												</KeyboardHotkeysProvider>
+											</QueryBuilderProvider>
+										</ResourceProvider>
+									</PrivateRoute>
+								</ErrorModalProvider>
+							</NotificationProvider>
+						</CmdKProvider>
+					</CompatRouter>
+				</Router>
+			</ConfigProvider>
 		</Sentry.ErrorBoundary>
 	);
 }

frontend/src/AppRoutes/pageComponents.ts

@@ -102,10 +102,15 @@ export const DashboardPage = Loadable(
 	() => import(/* webpackChunkName: "DashboardPage" */ 'pages/DashboardPage'),
 );
 
+export const DashboardWidget = Loadable(
+	() =>
+		import(/* webpackChunkName: "DashboardWidgetPage" */ 'pages/DashboardWidget'),
+);
+
 export const DashboardPanelEditorPage = Loadable(
 	() =>
 		import(
-			/* webpackChunkName: "DashboardPanelEditorPage" */ 'pages/DashboardPage/PanelEditorPage/PanelEditorPage'
+			/* webpackChunkName: "DashboardPanelEditorPage" */ 'pages/DashboardPageV2/PanelEditorPage/PanelEditorPage'
 		),
 );
 

frontend/src/AppRoutes/routes.ts

@@ -13,6 +13,7 @@ import {
 	DashboardPage,
 	DashboardPanelEditorPage,
 	DashboardsListPage,
+	DashboardWidget,
 	EditRulesPage,
 	ErrorDetails,
 	ForgotPassword,
@@ -182,6 +183,13 @@ const routes: AppRoutes[] = [
 		isPrivate: false,
 		key: 'PUBLIC_DASHBOARD',
 	},
+	{
+		path: ROUTES.DASHBOARD_WIDGET,
+		exact: true,
+		component: DashboardWidget,
+		isPrivate: true,
+		key: 'DASHBOARD_WIDGET',
+	},
 	{
 		path: ROUTES.DASHBOARD_PANEL_EDITOR,
 		exact: true,
@@ -519,13 +527,6 @@ const routes: AppRoutes[] = [
 		key: 'AI_OBSERVABILITY_OVERVIEW',
 		isPrivate: true,
 	},
-	{
-		path: ROUTES.AI_OBSERVABILITY_EXPLORER,
-		exact: true,
-		component: LLMObservabilityPage,
-		key: 'AI_OBSERVABILITY_EXPLORER',
-		isPrivate: true,
-	},
 	{
 		path: ROUTES.AI_OBSERVABILITY_CONFIGURATION,
 		exact: true,

frontend/src/api/ErrorResponseHandler.ts

@@ -53,7 +53,7 @@ export function ErrorResponseHandler(error: AxiosError): ErrorResponse {
 		};
 	}
 	// anything else
-	console.error('ErrorResponseHandler: unclassified error');
+	console.error('any');
 	return {
 		statusCode: 500,
 		payload: null,

frontend/src/api/billing/getUsage.ts

@@ -0,0 +1,59 @@
+import axios from 'api';
+import { ErrorResponseHandler } from 'api/ErrorResponseHandler';
+import { AxiosError } from 'axios';
+import { ErrorResponse, SuccessResponse } from 'types/api';
+
+export interface DayBreakdownEntry {
+	timestamp: number;
+	total: number;
+	quantity: number;
+	count: number;
+	size: number;
+}
+
+export interface TierEntry {
+	quantity: number;
+	unitPrice: number;
+	tierCost: number;
+}
+
+export interface BreakdownEntry {
+	type: string;
+	unit: string;
+	dayWiseBreakdown: {
+		breakdown: DayBreakdownEntry[];
+	};
+	tiers?: TierEntry[];
+}
+
+export interface UsageResponsePayloadProps {
+	billingPeriodStart: number;
+	billingPeriodEnd: number;
+	details: {
+		total: number;
+		baseFee: number;
+		breakdown: BreakdownEntry[];
+		billTotal: number;
+	};
+	discount: number;
+	subscriptionStatus?: string;
+}
+
+const getUsage = async (
+	licenseKey: string,
+): Promise<SuccessResponse<UsageResponsePayloadProps> | ErrorResponse> => {
+	try {
+		const response = await axios.get(`/billing?licenseKey=${licenseKey}`);
+
+		return {
+			statusCode: 200,
+			error: null,
+			message: response.data.status,
+			payload: response.data.data,
+		};
+	} catch (error) {
+		return ErrorResponseHandler(error as AxiosError);
+	}
+};
+
+export default getUsage;

frontend/src/api/dashboard/public/createPublicDashboard.ts

@@ -0,0 +1,36 @@
+import axios from 'api';
+import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
+import { AxiosError } from 'axios';
+import { DEFAULT_TIME_RANGE } from 'container/TopNav/DateTimeSelectionV2/constants';
+import { ErrorV2Resp, 	 SuccessResponseV2 } from 'types/api';
+import { CreatePublicDashboardProps } from 'types/api/dashboard/public/create';
+
+/**
+ * @deprecated Use the generated `useCreatePublicDashboard` hook (or `createPublicDashboard` fetcher) from
+ * `api/generated/services/dashboard` instead. This hand-written client targets the
+ * same endpoint and will be removed once call sites migrate.
+ *
+ * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
+ */
+const createPublicDashboard = async (
+	props: CreatePublicDashboardProps,
+): Promise<SuccessResponseV2<CreatePublicDashboardProps>> => {
+
+    const { dashboardId, timeRangeEnabled = false, defaultTimeRange = DEFAULT_TIME_RANGE } = props;
+
+	try {
+		const response = await axios.post(
+			`/dashboards/${dashboardId}/public`,
+			{ timeRangeEnabled, defaultTimeRange },
+		);
+
+		return {
+			httpStatusCode: response.status,
+			data: response.data.data,
+		};
+	} catch (error) {
+		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
+	}
+};
+
+export default createPublicDashboard;

frontend/src/api/dashboard/public/getPublicDashboardData.ts

@@ -0,0 +1,27 @@
+import axios from 'api';
+import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
+import { AxiosError } from 'axios';
+import { ErrorV2Resp, SuccessResponseV2 } from 'types/api';
+import { GetPublicDashboardDataProps, PayloadProps,PublicDashboardDataProps } from 'types/api/dashboard/public/get';
+
+/**
+ * @deprecated Use the generated `useGetPublicDashboardData` hook (or `getPublicDashboardData` fetcher) from
+ * `api/generated/services/dashboard` instead. This hand-written client targets the
+ * same endpoint and will be removed once call sites migrate.
+ *
+ * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
+ */
+const getPublicDashboardData = async (props: GetPublicDashboardDataProps): Promise<SuccessResponseV2<PublicDashboardDataProps>> => {
+	try {
+		const response = await axios.get<PayloadProps>(`/public/dashboards/${props.id}`);
+        
+		return {
+			httpStatusCode: response.status,
+			data: response.data.data,
+		};
+	} catch (error) {
+		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
+	}
+};
+
+export default getPublicDashboardData;

frontend/src/api/dashboard/public/getPublicDashboardMeta.ts

@@ -0,0 +1,27 @@
+import axios from 'api';
+import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
+import { AxiosError } from 'axios';
+import { ErrorV2Resp, SuccessResponseV2 } from 'types/api';
+import { GetPublicDashboardMetaProps, PayloadProps,PublicDashboardMetaProps } from 'types/api/dashboard/public/getMeta';
+
+/**
+ * @deprecated Use the generated `useGetPublicDashboard` hook (or `getPublicDashboard` fetcher) from
+ * `api/generated/services/dashboard` instead. This hand-written client targets the
+ * same endpoint and will be removed once call sites migrate.
+ *
+ * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
+ */
+const getPublicDashboardMeta = async (props: GetPublicDashboardMetaProps): Promise<SuccessResponseV2<PublicDashboardMetaProps>> => {
+	try {
+		const response = await axios.get<PayloadProps>(`/dashboards/${props.id}/public`);
+        
+		return {
+			httpStatusCode: response.status,
+			data: response.data.data,
+		};
+	} catch (error) {
+		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
+	}
+};
+
+export default getPublicDashboardMeta;

frontend/src/api/dashboard/public/getPublicDashboardWidgetData.ts

@@ -0,0 +1,34 @@
+import axios from 'api';
+import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
+import { MetricRangePayloadV5 } from 'api/v5/v5';
+import { AxiosError } from 'axios';
+import { ErrorV2Resp, SuccessResponseV2 } from 'types/api';
+import { GetPublicDashboardWidgetDataProps } from 'types/api/dashboard/public/getWidgetData';
+
+
+/**
+ * @deprecated Use the generated `useGetPublicDashboardWidgetQueryRange` hook (or `getPublicDashboardWidgetQueryRange` fetcher) from
+ * `api/generated/services/dashboard` instead. This hand-written client targets the
+ * same endpoint and will be removed once call sites migrate.
+ *
+ * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
+ */
+const getPublicDashboardWidgetData = async (props: GetPublicDashboardWidgetDataProps): Promise<SuccessResponseV2<MetricRangePayloadV5>> => {
+	try {
+		const response = await axios.get(`/public/dashboards/${props.id}/widgets/${props.index}/query_range`, {
+			params: {
+				startTime: props.startTime,
+				endTime: props.endTime,
+			},
+		});
+        
+		return {
+			httpStatusCode: response.status,
+			data: response.data,
+		};
+	} catch (error) {
+		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
+	}
+};
+
+export default getPublicDashboardWidgetData;

frontend/src/api/dashboard/public/revokePublicDashboardAccess.ts

@@ -0,0 +1,29 @@
+import axios from 'api';
+import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
+import { AxiosError } from 'axios';
+import { ErrorV2Resp, SuccessResponseV2 } from 'types/api';
+import { PayloadProps,RevokePublicDashboardAccessProps } from 'types/api/dashboard/public/delete';
+
+/**
+ * @deprecated Use the generated `useDeletePublicDashboard` hook (or `deletePublicDashboard` fetcher) from
+ * `api/generated/services/dashboard` instead. This hand-written client targets the
+ * same endpoint and will be removed once call sites migrate.
+ *
+ * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
+ */
+const revokePublicDashboardAccess = async (
+	props: RevokePublicDashboardAccessProps,
+): Promise<SuccessResponseV2<PayloadProps>> => {
+	try {
+		const response = await axios.delete<PayloadProps>(`/dashboards/${props.id}/public`);
+
+		return {
+			httpStatusCode: response.status,
+			data: response.data,
+		};
+	} catch (error) {
+		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
+	}
+};
+
+export default revokePublicDashboardAccess;

frontend/src/api/dashboard/public/updatePublicDashboard.ts

@@ -0,0 +1,36 @@
+import axios from 'api';
+import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
+import { AxiosError } from 'axios';
+import { DEFAULT_TIME_RANGE } from 'container/TopNav/DateTimeSelectionV2/constants';
+import {  ErrorV2Resp, SuccessResponseV2 } from 'types/api';
+import { UpdatePublicDashboardProps } from 'types/api/dashboard/public/update';
+
+/**
+ * @deprecated Use the generated `useUpdatePublicDashboard` hook (or `updatePublicDashboard` fetcher) from
+ * `api/generated/services/dashboard` instead. This hand-written client targets the
+ * same endpoint and will be removed once call sites migrate.
+ *
+ * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
+ */
+const updatePublicDashboard = async (
+	props: UpdatePublicDashboardProps,
+): Promise<SuccessResponseV2<UpdatePublicDashboardProps>> => {
+
+    const { dashboardId, timeRangeEnabled = false, defaultTimeRange = DEFAULT_TIME_RANGE } = props;
+
+	try {
+		const response = await axios.put(
+			`/dashboards/${dashboardId}/public`,
+			{ timeRangeEnabled, defaultTimeRange },
+		);
+
+		return {
+			httpStatusCode: response.status,
+			data: response.data.data,
+		};
+	} catch (error) {
+		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
+	}
+};
+
+export default updatePublicDashboard;

frontend/src/api/generated/services/ai-observability/index.ts

@@ -1,236 +0,0 @@
-/**
- * ! Do not edit manually
- * * The file has been auto-generated using Orval for SigNoz
- * * regenerate with 'pnpm generate:api'
- * SigNoz
- */
-import { useQuery } from 'react-query';
-import type {
-	InvalidateOptions,
-	QueryClient,
-	QueryFunction,
-	QueryKey,
-	UseQueryOptions,
-	UseQueryResult,
-} from 'react-query';
-
-import type {
-	GetAIObservabilityFieldsKeys200,
-	GetAIObservabilityFieldsKeysParams,
-	GetAIObservabilityFieldsValues200,
-	GetAIObservabilityFieldsValuesParams,
-	RenderErrorResponseDTO,
-} from '../sigNoz.schemas';
-
-import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
-import type { ErrorType } from '../../../generatedAPIInstance';
-
-/**
- * This endpoint returns the field keys the AI observability explorer can filter on, including the computed per-trace aggregates
- * @summary Get AI observability field keys
- */
-export const getAIObservabilityFieldsKeys = (
-	params?: GetAIObservabilityFieldsKeysParams,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetAIObservabilityFieldsKeys200>({
-		url: `/api/v1/ai_observability/fields/keys`,
-		method: 'GET',
-		params,
-		signal,
-	});
-};
-
-export const getGetAIObservabilityFieldsKeysQueryKey = (
-	params?: GetAIObservabilityFieldsKeysParams,
-) => {
-	return [
-		`/api/v1/ai_observability/fields/keys`,
-		...(params ? [params] : []),
-	] as const;
-};
-
-export const getGetAIObservabilityFieldsKeysQueryOptions = <
-	TData = Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	params?: GetAIObservabilityFieldsKeysParams,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetAIObservabilityFieldsKeysQueryKey(params);
-
-	const queryFn: QueryFunction<
-		Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>
-	> = ({ signal }) => getAIObservabilityFieldsKeys(params, signal);
-
-	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
-		Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetAIObservabilityFieldsKeysQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>
->;
-export type GetAIObservabilityFieldsKeysQueryError =
-	ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Get AI observability field keys
- */
-
-export function useGetAIObservabilityFieldsKeys<
-	TData = Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	params?: GetAIObservabilityFieldsKeysParams,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetAIObservabilityFieldsKeysQueryOptions(
-		params,
-		options,
-	);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @summary Get AI observability field keys
- */
-export const invalidateGetAIObservabilityFieldsKeys = async (
-	queryClient: QueryClient,
-	params?: GetAIObservabilityFieldsKeysParams,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetAIObservabilityFieldsKeysQueryKey(params) },
-		options,
-	);
-
-	return queryClient;
-};
-
-/**
- * This endpoint returns the values the AI observability explorer can filter a field key on
- * @summary Get AI observability field values
- */
-export const getAIObservabilityFieldsValues = (
-	params?: GetAIObservabilityFieldsValuesParams,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetAIObservabilityFieldsValues200>({
-		url: `/api/v1/ai_observability/fields/values`,
-		method: 'GET',
-		params,
-		signal,
-	});
-};
-
-export const getGetAIObservabilityFieldsValuesQueryKey = (
-	params?: GetAIObservabilityFieldsValuesParams,
-) => {
-	return [
-		`/api/v1/ai_observability/fields/values`,
-		...(params ? [params] : []),
-	] as const;
-};
-
-export const getGetAIObservabilityFieldsValuesQueryOptions = <
-	TData = Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	params?: GetAIObservabilityFieldsValuesParams,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetAIObservabilityFieldsValuesQueryKey(params);
-
-	const queryFn: QueryFunction<
-		Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>
-	> = ({ signal }) => getAIObservabilityFieldsValues(params, signal);
-
-	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
-		Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetAIObservabilityFieldsValuesQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>
->;
-export type GetAIObservabilityFieldsValuesQueryError =
-	ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Get AI observability field values
- */
-
-export function useGetAIObservabilityFieldsValues<
-	TData = Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	params?: GetAIObservabilityFieldsValuesParams,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetAIObservabilityFieldsValuesQueryOptions(
-		params,
-		options,
-	);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @summary Get AI observability field values
- */
-export const invalidateGetAIObservabilityFieldsValues = async (
-	queryClient: QueryClient,
-	params?: GetAIObservabilityFieldsValuesParams,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetAIObservabilityFieldsValuesQueryKey(params) },
-		options,
-	);
-
-	return queryClient;
-};

frontend/src/api/generated/services/authdomains/index.ts

@@ -38,14 +38,14 @@ import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
  */
 export const listAuthDomains = (signal?: AbortSignal) => {
 	return GeneratedAPIInstance<ListAuthDomains200>({
-		url: `/api/v2/auth_domains`,
+		url: `/api/v1/domains`,
 		method: 'GET',
 		signal,
 	});
 };
 
 export const getListAuthDomainsQueryKey = () => {
-	return [`/api/v2/auth_domains`] as const;
+	return [`/api/v1/domains`] as const;
 };
 
 export const getListAuthDomainsQueryOptions = <
@@ -125,7 +125,7 @@ export const createAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<CreateAuthDomain201>({
-		url: `/api/v2/auth_domains`,
+		url: `/api/v1/domains`,
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
 		data: authtypesPostableAuthDomainDTO,
@@ -208,7 +208,7 @@ export const deleteAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<void>({
-		url: `/api/v2/auth_domains/${id}`,
+		url: `/api/v1/domains/${id}`,
 		method: 'DELETE',
 		signal,
 	});
@@ -287,7 +287,7 @@ export const getAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<GetAuthDomain200>({
-		url: `/api/v2/auth_domains/${id}`,
+		url: `/api/v1/domains/${id}`,
 		method: 'GET',
 		signal,
 	});
@@ -296,7 +296,7 @@ export const getAuthDomain = (
 export const getGetAuthDomainQueryKey = ({
 	id,
 }: GetAuthDomainPathParameters) => {
-	return [`/api/v2/auth_domains/${id}`] as const;
+	return [`/api/v1/domains/${id}`] as const;
 };
 
 export const getGetAuthDomainQueryOptions = <
@@ -389,7 +389,7 @@ export const updateAuthDomain = (
 	signal?: AbortSignal,
 ) => {
 	return GeneratedAPIInstance<void>({
-		url: `/api/v2/auth_domains/${id}`,
+		url: `/api/v1/domains/${id}`,
 		method: 'PUT',
 		headers: { 'Content-Type': 'application/json' },
 		data: authtypesUpdatableAuthDomainDTO,