feat(console2): models-first, docs-out, collapsible+filterable sidebar, cmd+K actions (v0.7.4)

The 'I don't see any models' wave + sidebar/command UX.

- Models is catalog-first: the default tab is the LIVE model list (~49 Zen
  models via the /ai proxy); routing policy moves to a secondary 'Routing' tab
  (/models/routing). Retires the duplicate empty-by-default 'Model Catalog' nav
  entry — one product, real models on the obvious click.
- Docs are EXTERNAL (brand docsUrl, new tab): a top sidebar 'Docs' entry, the
  header '?' icon, and a server /docs -> docs.<brand> redirect (no in-app 404).
  ComingSoon's API-docs link repointed off the 404-ing ${cloudUrl}/docs.
- Sidebar collapses/expands from the brand 'H' mark (icon-only <-> full),
  persisted to the account; the grid launcher stays. A filter box narrows the
  whole sidebar to find any product fast; Overview/Docs are fixed top links.
- cmd+K runs ACTIONS too (toggle theme, browse all apps, open settings, switch
  org, ask AI / search docs, sign out, per-org switch), ranked alongside catalog
  nav — no dead entries. Removed unused openMode.
- DRY: switchOrg() shared by the switcher + palette; pure match-core (resolveRoute
  + entryMatches) is unit-tested without the GUI tree. Default pins fixed
  (dead 'billing' -> 'models','chat'). tsc + 29 vitest + next build clean.

.codespellrc

@@ -1,4 +0,0 @@
-[codespell]
-skip = .git,*.pdf,*.svg,package-lock.json,*.prisma,pnpm-lock.yaml
-ignore-words-list = afterall,vertx,notIn
-

.dockerignore

@@ -1,8 +0,0 @@
-Dockerfile
-.dockerignore
-node_modules
-npm-debug.log
-README.md
-**/.next
-.git
-**/node_modules

.env.dev-azure.example

@@ -1,92 +0,0 @@
-# When adding additional environment variables, the schema in "/src/env.mjs"
-# should be updated accordingly.
-
-# Prisma
-# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
-DIRECT_URL="postgresql://postgres:postgres@localhost:5432/postgres"
-DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"
-
-# Clickhouse
-CLICKHOUSE_MIGRATION_URL="clickhouse://localhost:9000"
-CLICKHOUSE_URL="http://localhost:8123"
-CLICKHOUSE_USER="clickhouse"
-CLICKHOUSE_PASSWORD="clickhouse"
-CLICKHOUSE_MIGRATION_CLUSTER_DISABLED="true"
-
-# Next Auth
-# You can generate a new secret on the command line with:
-# openssl rand -base64 32
-# https://next-auth.js.org/configuration/options#secret
-# NEXTAUTH_SECRET=""
-NEXTAUTH_URL="http://localhost:3000"
-NEXTAUTH_SECRET="secret"
-
-# Langfuse Cloud Environment
-NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="DEV"
-
-# Langfuse experimental features
-LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES="true"
-
-# Salt for API key hashing
-SALT="salt"
-
-# Email
-EMAIL_FROM_ADDRESS=""  # Defines the email address to use as the from address.
-SMTP_CONNECTION_URL=""  # Defines the connection url for smtp server.
-
-# DON'T PANIC: The Azurite Secrets are well-known and meant to be hard-coded
-# S3 storage
-S3_ENDPOINT=http://localhost:10000/devstoreaccount1
-S3_ACCESS_KEY_ID=devstoreaccount1
-S3_SECRET_ACCESS_KEY=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==
-S3_BUCKET_NAME=langfuse
-S3_REGION=auto
-## Necessary for minio compatibility
-S3_FORCE_PATH_STYLE=true
-
-# S3 Media Upload LOCAL
-LANGFUSE_S3_MEDIA_UPLOAD_ENABLED=true
-LANGFUSE_S3_MEDIA_UPLOAD_BUCKET=langfuse
-LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID=devstoreaccount1
-LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==
-LANGFUSE_S3_MEDIA_UPLOAD_REGION=auto
-LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT=http://localhost:10000/devstoreaccount1
-## Necessary for minio compatibility
-LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE=true
-LANGFUSE_S3_MEDIA_UPLOAD_PREFIX=media/
-
-# S3 Event Bucket Upload
-## Set to true to test uploading all events to S3
-LANGFUSE_S3_EVENT_UPLOAD_ENABLED=true
-LANGFUSE_S3_EVENT_UPLOAD_BUCKET=langfuse
-LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=devstoreaccount1
-LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==
-LANGFUSE_S3_EVENT_UPLOAD_REGION=auto
-LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=http://localhost:10000/devstoreaccount1
-## Necessary for minio compatibility
-LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE=true
-LANGFUSE_S3_EVENT_UPLOAD_PREFIX=events/
-
-LANGFUSE_USE_AZURE_BLOB=true
-
-# Set during docker build of application
-# Used to disable environment verification at build time
-# DOCKER_BUILD=1
-
-REDIS_HOST="127.0.0.1"
-REDIS_PORT=6379
-REDIS_AUTH="myredissecret"
-
-# openssl rand -hex 32 used only here
-ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000 
-
-# speeds up local development by not executing init scripts on server startup
-NEXT_PUBLIC_LANGFUSE_RUN_NEXT_INIT="false"
-
-LANGFUSE_READ_FROM_POSTGRES_ONLY=false
-LANGFUSE_RETURN_FROM_CLICKHOUSE=true
-LANGFUSE_READ_DASHBOARDS_FROM_CLICKHOUSE=true
-LANGFUSE_READ_FROM_CLICKHOUSE_ONLY=true
-
-LANGFUSE_ASYNC_INGESTION_PROCESSING="true"
-LANGFUSE_ASYNC_CLICKHOUSE_INGESTION_PROCESSING="true"

.env.dev.example

@@ -1,89 +0,0 @@
-# When adding additional environment variables, the schema in "/src/env.mjs"
-# should be updated accordingly.
-
-# Prisma
-# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
-DIRECT_URL="postgresql://postgres:postgres@localhost:5432/postgres"
-DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"
-
-# Clickhouse
-CLICKHOUSE_MIGRATION_URL="clickhouse://localhost:9000"
-CLICKHOUSE_URL="http://localhost:8123"
-CLICKHOUSE_USER="clickhouse"
-CLICKHOUSE_PASSWORD="clickhouse"
-CLICKHOUSE_CLUSTER_DISABLED="true"
-
-# Next Auth
-# You can generate a new secret on the command line with:
-# openssl rand -base64 32
-# https://next-auth.js.org/configuration/options#secret
-# NEXTAUTH_SECRET=""
-NEXTAUTH_URL="http://localhost:3000"
-NEXTAUTH_SECRET="secret"
-
-# Langfuse Cloud Environment
-NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="DEV"
-
-# Langfuse experimental features
-LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES="true"
-
-# Salt for API key hashing
-SALT="salt"
-
-# Email
-EMAIL_FROM_ADDRESS=""  # Defines the email address to use as the from address.
-SMTP_CONNECTION_URL=""  # Defines the connection url for smtp server.
-
-# S3 storage
-S3_ENDPOINT=http://localhost:9090
-S3_ACCESS_KEY_ID=minio
-S3_SECRET_ACCESS_KEY=miniosecret
-S3_BUCKET_NAME=langfuse
-S3_REGION=us-east-1
-## Necessary for minio compatibility
-S3_FORCE_PATH_STYLE=true
-
-# S3 Media Upload LOCAL
-LANGFUSE_S3_MEDIA_UPLOAD_ENABLED=true
-LANGFUSE_S3_MEDIA_UPLOAD_BUCKET=langfuse
-LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID=minio
-LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=miniosecret
-LANGFUSE_S3_MEDIA_UPLOAD_REGION=us-east-1
-LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT=http://localhost:9090
-## Necessary for minio compatibility
-LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE=true
-LANGFUSE_S3_MEDIA_UPLOAD_PREFIX=media/
-
-# S3 Event Bucket Upload
-## Set to true to test uploading all events to S3
-LANGFUSE_S3_EVENT_UPLOAD_ENABLED=true
-LANGFUSE_S3_EVENT_UPLOAD_BUCKET=langfuse
-LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=minio
-LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=miniosecret
-LANGFUSE_S3_EVENT_UPLOAD_REGION=us-east-1
-LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=http://localhost:9090
-## Necessary for minio compatibility
-LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE=true
-LANGFUSE_S3_EVENT_UPLOAD_PREFIX=events/
-
-# Set during docker build of application
-# Used to disable environment verification at build time
-# DOCKER_BUILD=1
-
-REDIS_HOST="127.0.0.1"
-REDIS_PORT=6379
-REDIS_AUTH="myredissecret"
-
-# openssl rand -hex 32 used only here
-ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000 
-
-# speeds up local development by not executing init scripts on server startup
-NEXT_PUBLIC_LANGFUSE_RUN_NEXT_INIT="false"
-
-LANGFUSE_READ_FROM_POSTGRES_ONLY=false
-LANGFUSE_RETURN_FROM_CLICKHOUSE=true
-LANGFUSE_READ_DASHBOARDS_FROM_CLICKHOUSE=true
-LANGFUSE_READ_FROM_CLICKHOUSE_ONLY=true
-
-LANGFUSE_ASYNC_INGESTION_PROCESSING="true"
-LANGFUSE_ASYNC_CLICKHOUSE_INGESTION_PROCESSING="true"

.env.dev.legacy.example

@@ -1,81 +0,0 @@
-# When adding additional environment variables, the schema in "/src/env.mjs"
-# should be updated accordingly.
-
-# Prisma
-# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
-DIRECT_URL="postgresql://postgres:postgres@localhost:5432/postgres"
-DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"
-
-# Clickhouse
-CLICKHOUSE_MIGRATION_URL="clickhouse://localhost:9000"
-CLICKHOUSE_URL="http://localhost:8123"
-CLICKHOUSE_USER="clickhouse"
-CLICKHOUSE_PASSWORD="clickhouse"
-CLICKHOUSE_CLUSTER_ENABLED="false"
-
-# Next Auth
-# You can generate a new secret on the command line with:
-# openssl rand -base64 32
-# https://next-auth.js.org/configuration/options#secret
-# NEXTAUTH_SECRET=""
-NEXTAUTH_URL="http://localhost:3000"
-NEXTAUTH_SECRET="secret"
-
-# Langfuse Cloud Environment
-NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="DEV"
-
-# Langfuse experimental features
-LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES="true"
-
-# Salt for API key hashing
-SALT="salt"
-
-# Email
-EMAIL_FROM_ADDRESS=""  # Defines the email address to use as the from address.
-SMTP_CONNECTION_URL=""  # Defines the connection url for smtp server.
-
-# S3 storage
-S3_ENDPOINT=http://localhost:9090
-S3_ACCESS_KEY_ID=minio
-S3_SECRET_ACCESS_KEY=miniosecret
-S3_BUCKET_NAME=langfuse
-S3_REGION=us-east-1
-## Necessary for minio compatibility
-S3_FORCE_PATH_STYLE=true
-
-# # S3 Media Upload LOCAL
-LANGFUSE_S3_MEDIA_UPLOAD_ENABLED=true
-LANGFUSE_S3_MEDIA_UPLOAD_BUCKET=langfuse
-LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID=minio
-LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=miniosecret
-LANGFUSE_S3_MEDIA_UPLOAD_REGION=us-east-1
-LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT=http://localhost:9090
-## Necessary for minio compatibility
-LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE=true
-LANGFUSE_S3_MEDIA_UPLOAD_PREFIX=media/
-
-# S3 Event Bucket Upload
-## Set to true to test uploading all events to S3
-LANGFUSE_S3_EVENT_UPLOAD_ENABLED=true
-LANGFUSE_S3_EVENT_UPLOAD_BUCKET=langfuse
-LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=minio
-LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=miniosecret
-LANGFUSE_S3_EVENT_UPLOAD_REGION=us-east-1
-LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=http://localhost:9090
-## Necessary for minio compatibility
-LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE=true
-LANGFUSE_S3_EVENT_UPLOAD_PREFIX=events/
-
-# Set during docker build of application
-# Used to disable environment verification at build time
-# DOCKER_BUILD=1
-
-REDIS_HOST="127.0.0.1"
-REDIS_PORT=6379
-REDIS_AUTH="myredissecret"
-
-# openssl rand -hex 32 used only here
-ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000 
-
-# speeds up local development by not executing init scripts on server startup
-NEXT_PUBLIC_LANGFUSE_RUN_NEXT_INIT="false"

.env.example

@@ -0,0 +1,24 @@
+# Hanzo Cloud Console — environment.
+# Copy to .env.local and adjust. All values are public (NEXT_PUBLIC_*) since the
+# console is a browser app that talks to the unified /v1 backend with cookies.
+
+# Unified Hanzo Cloud backend (the casibase /v1 API). Default: production.
+# Local backend: http://localhost:14000
+NEXT_PUBLIC_CLOUD_URL=https://cloud.hanzo.ai
+
+# Hanzo PaaS (platform.hanzo.ai) — DOKS cluster control plane for the Clusters module.
+NEXT_PUBLIC_PLATFORM_URL=https://platform.hanzo.ai
+
+# Hanzo IAM (OIDC authority). Canonical issuer is https://hanzo.id — tokens are
+# minted with iss=https://hanzo.id, which the cloud /v1 backend validates against.
+# iam.hanzo.ai is the legacy zone (iss=https://iam.hanzo.ai) and MUST NOT be used
+# by the browser, or sign-in drops on iam.hanzo.ai with an issuer mismatch.
+NEXT_PUBLIC_IAM_URL=https://hanzo.id
+
+# IAM application console2 authenticates as. console2 is a front-end of the
+# shared Hanzo Cloud /v1 backend, which exchanges the OIDC code and validates the
+# token as app `hanzo-cloud` (aud=hanzo-cloud) — so the front-end presents the
+# same app/client_id. Must match the cloud-api binding, not a console-only app.
+NEXT_PUBLIC_IAM_APP_NAME=hanzo-cloud
+NEXT_PUBLIC_IAM_ORG_NAME=hanzo
+NEXT_PUBLIC_IAM_CLIENT_ID=hanzo-cloud

.env.local.example

@@ -1,22 +0,0 @@
-# When adding additional environment variables, the schema in "/src/env.mjs"
-# should be updated accordingly.
-
-# Prisma
-# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
-DIRECT_URL="postgresql://postgres:postgres@db:5432/postgres"
-DATABASE_URL="postgresql://postgres:postgres@db:5432/postgres"
-# Next Auth
-NEXTAUTH_SECRET="secret"
-NEXTAUTH_URL="http://localhost:3000"
-
-# feature flag to enable experimental features locally
-LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES="false"
-SALT="salt"
-
-# Redis
-REDIS_HOST="127.0.0.1"
-REDIS_PORT=6379
-REDIS_AUTH="myredissecret"
-
-# openssl rand -hex 32 used only here
-ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000

.env.prod.example

@@ -1,258 +0,0 @@
-# More information: https://langfuse.com/docs/deployment/self-host
-
-# When adding additional environment variables, the schema in "/src/env.mjs"
-# should be updated accordingly.
-
-# Prisma
-# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
-# DATABASE_URL supports pooled connections, but then you need to set DIRECT_URL
-DATABASE_URL="postgresql://postgres:postgres@db:5432/postgres"
-# DIRECT_URL="postgresql://postgres:postgres@db:5432/postgres"
-# SHADOW_DATABASE_URL=
-# optional, set to true to disable automated database migrations on Docker start
-# LANGFUSE_AUTO_POSTGRES_MIGRATION_DISABLED=
-
-# Next Auth
-# NEXTAUTH_URL does not need to be set when deploying on Vercel
-NEXTAUTH_URL="http://localhost:3000"
-
-# For each of these, you can generate a new secret on the command line with:
-# openssl rand -base64 32
-NEXTAUTH_SECRET="secret" # https://next-auth.js.org/configuration/options#secret
-SALT="salt" # salt used to hash api keys
-
-# API level encryption for sensitive data
-# Must be 256 bits, 64 string characters in hex format, generate via: openssl rand -hex 32
-ENCRYPTION_KEY="0000000000000000000000000000000000000000000000000000000000000000"
-
-# Use CSP headers to enforce HTTPS, optional
-# LANGFUSE_CSP_ENFORCE_HTTPS="true"
-
-# Configure base path for self-hosting, optional
-# Note: You need to build the docker image with the base path set and cannot use the pre-built docker image if you set this.
-# NEXT_PUBLIC_BASE_PATH="/app"
-
-# Docker only, optional
-# PORT=3000
-# HOSTNAME=localhost
-
-# Opentelemetry, optional
-OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4318"
-OTEL_SERVICE_NAME="langfuse"
-
-# Default role for users who sign up, optional, can be org or org+project
-# LANGFUSE_DEFAULT_ORG_ID=
-# LANGFUSE_DEFAULT_ORG_ROLE=
-# LANGFUSE_DEFAULT_PROJECT_ID=
-# LANGFUSE_DEFAULT_PROJECT_ROLE=
-
-# Logging, optional
-# LANGFUSE_LOG_LEVEL=info
-# LANGFUSE_LOG_FORMAT=text
-
-# Enable experimental features, optional
-# LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=true
-
-# Auth, optional configuration
-# AUTH_DOMAINS_WITH_SSO_ENFORCEMENT=domain1.com,domain2.com
-# AUTH_IGNORE_ACCOUNT_FIELDS=foo,bar
-# AUTH_DISABLE_USERNAME_PASSWORD=true
-# AUTH_DISABLE_SIGNUP=true
-# AUTH_SESSION_MAX_AGE=43200 # 30 days in minutes (default)
-
-# SSO, each group is optional
-# AUTH_GOOGLE_CLIENT_ID=
-# AUTH_GOOGLE_CLIENT_SECRET=
-# AUTH_GOOGLE_ALLOW_ACCOUNT_LINKING=false
-# AUTH_GOOGLE_ALLOWED_DOMAINS=langfuse.com,google.com # optional allowlist of workspace domains that can sign in via Google
-# AUTH_GITHUB_CLIENT_ID=
-# AUTH_GITHUB_CLIENT_SECRET=
-# AUTH_GITHUB_ALLOW_ACCOUNT_LINKING=false
-# AUTH_GITHUB_ENTERPRISE_CLIENT_ID=
-# AUTH_GITHUB_ENTERPRISE_CLIENT_SECRET=
-# AUTH_GITHUB_ENTERPRISE_BASE_URL=
-# AUTH_GITHUB_ENTERPRISE_ALLOW_ACCOUNT_LINKING=false
-# AUTH_GITLAB_CLIENT_ID=
-# AUTH_GITLAB_CLIENT_SECRET=
-# AUTH_GITLAB_ALLOW_ACCOUNT_LINKING=false
-# AUTH_GITLAB_ISSUER=
-# AUTH_AZURE_AD_CLIENT_ID=
-# AUTH_AZURE_AD_CLIENT_SECRET=
-# AUTH_AZURE_AD_TENANT_ID=
-# AUTH_AZURE_ALLOW_ACCOUNT_LINKING=false
-# AUTH_OKTA_CLIENT_ID=
-# AUTH_OKTA_CLIENT_SECRET=
-# AUTH_OKTA_ISSUER=
-# AUTH_OKTA_ALLOW_ACCOUNT_LINKING=false
-# AUTH_AUTH0_CLIENT_ID=
-# AUTH_AUTH0_CLIENT_SECRET=
-# AUTH_AUTH0_ISSUER=
-# AUTH_AUTH0_ALLOW_ACCOUNT_LINKING=false
-# AUTH_COGNITO_CLIENT_ID=
-# AUTH_COGNITO_CLIENT_SECRET=
-# AUTH_COGNITO_ISSUER=
-# AUTH_COGNITO_ALLOW_ACCOUNT_LINKING=false
-# AUTH_KEYCLOAK_CLIENT_ID=
-# AUTH_KEYCLOAK_CLIENT_SECRET=
-# AUTH_KEYCLOAK_ISSUER=
-# AUTH_KEYCLOAK_ALLOW_ACCOUNT_LINKING=false
-# AUTH_CUSTOM_CLIENT_ID=
-# AUTH_CUSTOM_CLIENT_SECRET=
-# AUTH_CUSTOM_ISSUER=
-# AUTH_CUSTOM_NAME=
-# AUTH_CUSTOM_SCOPE="openid email profile" # optional
-# AUTH_CUSTOM_ALLOW_ACCOUNT_LINKING=false
-# AUTH_CUSTOM_ID_TOKEN=false # optional, default is true
-
-# Transactional email, optional
-# Defines the email address to use as the from address.
-# EMAIL_FROM_ADDRESS=
-# Defines the connection url for smtp server. 
-# SMTP_CONNECTION_URL=
-
-# S3 storage, optional, used for exports from the UI
-# S3_ENDPOINT=
-# S3_ACCESS_KEY_ID=
-# S3_SECRET_ACCESS_KEY=
-# S3_BUCKET_NAME=
-# S3_REGION=
-# BATCH_EXPORT_DOWNLOAD_LINK_EXPIRATION_HOURS=
-
-# S3 storage for events, optional, used to persist all incoming events
-# LANGFUSE_S3_EVENT_UPLOAD_ENABLED="true"
-# LANGFUSE_S3_EVENT_UPLOAD_BUCKET=
-# Optional prefix to be used within the bucket. Must end with `/` if set
-# LANGFUSE_S3_EVENT_UPLOAD_PREFIX=events/
-# The following four options are optional and fallback to the normal SDK credential provider chain if omitted
-# See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html
-# LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT=
-# LANGFUSE_S3_EVENT_UPLOAD_REGION=
-# LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID=
-# LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=
-
-# Exports are streamed to S3 in pages to avoid memory issues
-# The page size can be adjusted if needed to optimize performance
-# DB_EXPORT_PAGE_SIZE=1000
-
-# Automated provisioning of default resources
-# LANGFUSE_INIT_ORG_ID=org-id
-# LANGFUSE_INIT_ORG_NAME=org-name
-# LANGFUSE_INIT_PROJECT_ID=project-id
-# LANGFUSE_INIT_PROJECT_NAME=project-name
-# LANGFUSE_INIT_PROJECT_PUBLIC_KEY=pk-1234567890
-# LANGFUSE_INIT_PROJECT_SECRET_KEY=sk-1234567890
-# LANGFUSE_INIT_USER_EMAIL=user@example.com
-# LANGFUSE_INIT_USER_NAME=User Name
-# LANGFUSE_INIT_USER_PASSWORD=password
-
-
-
-### START Enterprise Edition Configuration
-
-# Allowlisted users that can create new organizations, by default all users can create organizations
-# LANGFUSE_ALLOWED_ORGANIZATION_CREATORS=user1@langfuse.com,user2@langfuse.com
-
-# UI Customization Options
-# LANGFUSE_UI_API_HOST=https://api.example.com
-# LANGFUSE_UI_DOCUMENTATION_HREF=https://docs.example.com
-# LANGFUSE_UI_SUPPORT_HREF=https://support.example.com
-# LANGFUSE_UI_FEEDBACK_HREF=https://feedback.example.com
-# LANGFUSE_UI_LOGO_LIGHT_MODE_HREF=https://static.langfuse.com/langfuse-dev/example-logo-light-mode.png
-# LANGFUSE_UI_LOGO_DARK_MODE_HREF=https://static.langfuse.com/langfuse-dev/example-logo-dark-mode.png
-# LANGFUSE_UI_DEFAULT_MODEL_ADAPTER=Anthropic # OpenAI, Anthropic, Azure
-# LANGFUSE_UI_DEFAULT_BASE_URL_OPENAI=https://api.openai.com/v1
-# LANGFUSE_UI_DEFAULT_BASE_URL_ANTHROPIC=https://api.anthropic.com
-# LANGFUSE_UI_DEFAULT_BASE_URL_AZURE_OPENAI=https://{instanceName}.openai.azure.com/openai/deployments
-
-### END Enterprise Edition Configuration
-
-
-
-### START Envs to be deprecated in Langfuse v3.0
-
-# Disable the expensive analytics queries and related features
-# LANGFUSE_DISABLE_EXPENSIVE_POSTGRES_QUERIES="true"
-
-### END Envs to be deprecated in Langfuse v3.0
-
-
-
-
-### START Langfuse Cloud Config
-# Used for Langfuse Cloud deployments
-# Not recommended for self-hosted deployments as these are NOT COVERED BY SEMANTIC VERSIONING
-
-# NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="US"
-# NEXTAUTH_COOKIE_DOMAIN=".langfuse.com"
-
-# LANGFUSE_TEAM_SLACK_WEBHOOK=
-# LANGFUSE_NEW_USER_SIGNUP_WEBHOOK=
-
-# Posthog (optional for analytics of web ui)
-# NEXT_PUBLIC_POSTHOG_HOST=
-# NEXT_PUBLIC_POSTHOG_KEY=
-
-# Sentry
-# NEXT_PUBLIC_LANGFUSE_TRACING_SAMPLE_RATE
-# NEXT_PUBLIC_SENTRY_DSN=
-# NEXT_SENTRY_ORG=
-# NEXT_SENTRY_PROJECT=
-# SENTRY_AUTH_TOKEN=
-# SENTRY_CSP_REPORT_URI=
-
-
-# Cloudflare Turnstile
-# NEXT_PUBLIC_TURNSTILE_SITE_KEY=
-# TURNSTILE_SECRET_KEY=
-
-# Demo project that users can use to try the platform
-# NEXT_PUBLIC_DEMO_ORG_ID=
-# NEXT_PUBLIC_DEMO_PROJECT_ID=
-
-# Crisp chat
-# NEXT_PUBLIC_CRISP_WEBSITE_ID=
-
-# Admin API
-# ADMIN_API_KEY=
-
-# Redis
-# REDIS_HOST=
-# REDIS_PORT=
-# REDIS_AUTH=
-# REDIS_CONNECTION_STRING=
-# REDIS_ENABLE_AUTO_PIPELINING=
-
-# Cache configuration
-# LANGFUSE_CACHE_API_KEY_ENABLED=
-# LANGFUSE_CACHE_API_KEY_TTL_SECONDS=
-# LANGFUSE_CACHE_PROMPT_ENABLED=
-# LANGFUSE_CACHE_PROMPT_TTL_SECONDS=
-
-# Rate limiting
-# LANGFUSE_RATE_LIMITS_ENABLED=
-
-# Stripe
-# STRIPE_SECRET_KEY=
-# STRIPE_WEBHOOK_SIGNING_SECRET=
-
-### END Langfuse Cloud Config
-
-
-## START Langfuse V3 Ingestion 
-
-# Clickhouse
-# CLICKHOUSE_MIGRATION_URL=
-# CLICKHOUSE_URL=
-# CLICKHOUSE_USER=
-# CLICKHOUSE_PASSWORD=
-
-# Ingestion
-# LANGFUSE_INGESTION_QUEUE_DELAY_MS=
-# LANGFUSE_INGESTION_CLICKHOUSE_WRITE_BATCH_SIZE=
-# LANGFUSE_INGESTION_CLICKHOUSE_WRITE_INTERVAL_MS= 
-# LANGFUSE_INGESTION_CLICKHOUSE_MAX_ATTEMPTS=
-# LANGFUSE_LEGACY_INGESTION_WORKER_CONCURRENCY=
-# LANGFUSE_ASYNC_INGESTION_PROCESSING="true"
-# QUEUE_CONSUMER_LEGACY_INGESTION_QUEUE_IS_ENABLED="true"
-
-## END Langfuse V3 Ingestion

.eslintignore

@@ -1,4 +0,0 @@
-node_modules
-**/node_modules
-build
-coverage

.github/CODEOWNERS

@@ -1,2 +0,0 @@
-# Currently inactive
-# * @langfuse/maintainers

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -1,11 +0,0 @@
-body:
-  - type: textarea
-    attributes:
-      label: Describe the feature or potential improvement
-      description: Please describe the change as clear and concise as possible. Remember to add context as to why you believe this is needed.
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Additional information
-      description: Add any other information related to the change here. If your idea is related to any issues or discussions, link them here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,35 +0,0 @@
-name: 🐞 Bug Report
-description: Create a bug report to help us improve
-title: "bug: "
-labels: ["🐞❔ unconfirmed bug"]
-body:
-  - type: textarea
-    attributes:
-      label: Describe the bug
-      description: A clear and concise description of the bug, as well as what you expected to happen when encountering it.
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: To reproduce
-      description: Describe how to reproduce your bug. Please provide detailed steps, code snippets, reproduction repos etc.
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: SDK and container versions
-      description: If you're experiencing an issue with an integration or SDK, please ensure you're using the latest version. If you're self-hosting Langfuse, check that you're running the most recent version. If updating isn't an option, please provide the specific versions you're currently using.
-  - type: textarea
-    attributes:
-      label: Additional information
-      description: Add any other information related to the bug here, screenshots if applicable.
-  - type: dropdown
-    id: contribute
-    attributes:
-      label: Are you interested to contribute a fix for this bug?
-      description: If this is a confirmed bug, the maintainers are happy to support with guidance and review.
-      options:
-        - "No"
-        - "Yes"
-    validations:
-      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +0,0 @@
-contact_links:
-  - name: 💡 Feature Request
-    url: https://github.com/orgs/langfuse/discussions/new?category=ideas
-    about: Suggest any ideas you have using our discussion forums.
-  - name: 🤗 Get Help
-    url: https://github.com/orgs/langfuse/discussions/new?category=support
-    about: If you can’t get something to work the way you expect, open a question in our discussion forums.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,36 +0,0 @@
-## What does this PR do?
-
-<!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. -->
-
-Fixes # (issue)
-
-<!-- Please provide a loom video for visual changes to speed up reviews
- Loom Video: https://www.loom.com/
--->
-
-## Type of change
-
-<!-- Please delete bullets that are not relevant. -->
-
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] Chore (refactoring code, technical debt, workflow improvements)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] Refactor (does not change functionality, e.g. code style improvements, linting)
-- [ ] This change requires a documentation update
-
-## Mandatory Tasks
-
-- [ ] Make sure you have self-reviewed the code. A decent size PR without self-review might be rejected.
-
-## Checklist
-
-<!-- Remove bullet points below that don't apply to you -->
-
-- I haven't read the [contributing guide](https://github.com/langfuse/langfuse/blob/main/CONTRIBUTING.md)
-- My code doesn't follow the style guidelines of this project (`npm run prettier`)
-- I haven't commented my code, particularly in hard-to-understand areas
-- I haven't checked if my PR needs changes to the documentation
-- I haven't checked if my changes generate no new warnings (`npm run lint`)
-- I haven't added tests that prove my fix is effective or that my feature works
-- I haven't checked if new and existing unit tests pass locally with my changes

.github/dependabot.yml

@@ -1,48 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: "/" # Location of package manifests
-    rebase-strategy: "disabled" # use dependabot-rebase-stale
-    open-pull-requests-limit: 10
-    schedule:
-      interval: "daily"
-    versioning-strategy: "increase"
-    commit-message:
-      prefix: chore
-      prefix-development: chore
-      include: scope
-    ignore:
-      - dependency-name: "@types/node"
-      - dependency-name: "@trpc/*"
-    groups:
-      prisma:
-        patterns:
-          - "prisma"
-          - "@prisma/client"
-      next:
-        patterns:
-          - "eslint-config-next"
-          - "next"
-      lodash:
-        patterns:
-          - "lodash"
-          - "@types/lodash"
-      express:
-        patterns:
-          - "express"
-          - "@types/express"
-      observability:
-        patterns:
-          - "dd-trace"
-          - "@opentelemetry/*"
-          - "@appsignal/opentelemetry-instrumentation-bullmq"
-          - "@prisma/instrumentation"
-          - "@sentry/*"
-      radix-ui:
-        patterns:
-          - "@radix-ui/*"

.github/hero.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="640" viewBox="0 0 1280 640" role="img" aria-label="console2">
+<rect width="1280" height="640" fill="#0A0A0A"/>
+<svg x="96" y="215" width="210" height="210" viewBox="0 0 67 67"><path d="M22.21 67V44.6369H0V67H22.21Z" fill="#fff"/><path d="M66.7038 22.3184H22.2534L0.0878906 44.6367H44.4634L66.7038 22.3184Z" fill="#fff"/><path d="M22.21 0H0V22.3184H22.21V0Z" fill="#fff"/><path d="M66.7198 0H44.5098V22.3184H66.7198V0Z" fill="#fff"/><path d="M66.7198 67V44.6369H44.5098V67H66.7198Z" fill="#fff"/></svg>
+<text x="378" y="276" font-family="Inter,system-ui,-apple-system,sans-serif" font-size="78" font-weight="800" letter-spacing="-2" fill="#ffffff">console2</text>
+
+<rect x="378" y="338" width="806" height="3" rx="1.5" fill="#ffffff" opacity=".9"/>
+<text x="378" y="390" font-family="Inter,system-ui,sans-serif" font-size="24" font-weight="600" fill="#ffffff" opacity=".5">github.com/hanzoai</text>
+<text x="1184" y="390" text-anchor="end" font-family="Inter,system-ui,sans-serif" font-size="24" font-weight="600" fill="#ffffff" opacity=".5">hanzo.ai</text>
+</svg>

.github/workflows/_deploy_ecs_service.yml

@@ -1,75 +0,0 @@
-name: WorkflowCall - Deploy to ECS Service
-on:
-  workflow_call:
-    inputs:
-      environment:
-        type: string
-        description: Deployment environment
-        required: true
-      service:
-        type: string
-        description: Name of the service to be deployed, e.g. web-ingestion, web, or worker.
-        required: true
-jobs:
-  ecs-deploy:
-    runs-on: ubuntu-latest
-    environment: ${{ inputs.environment }}
-    steps:
-      - name: Get app name
-        uses: winterjung/split@v2
-        id: split
-        with:
-          msg: ${{ inputs.service }}
-          separator: "-"
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Authenticate with AWS
-        # GitHub/AWS recommend to use OIDC here: https://github.com/aws-actions/configure-aws-credentials?tab=readme-ov-file#oidc
-        # Probably more painful to configure, but would remove all long-lived credentials.
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ vars.AWS_REGION }}
-      - name: Login to AWS ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
-      - name: Build, tag, and push Docker image
-        env:
-          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          REPOSITORY: ${{ steps.split.outputs._0 }}
-          IMAGE_TAG: ${{ github.sha }}
-        run: |
-          docker build \
-            -t $REGISTRY/$REPOSITORY:$IMAGE_TAG \
-            -f ./${{ steps.split.outputs._0 }}/Dockerfile \
-            --build-arg NEXT_PUBLIC_LANGFUSE_CLOUD_REGION=${{ vars.NEXT_PUBLIC_LANGFUSE_CLOUD_REGION }} \
-            --build-arg NEXT_LANGFUSE_TRACING_SAMPLE_RATE=${{ vars.NEXT_LANGFUSE_TRACING_SAMPLE_RATE }} \
-            --build-arg NEXT_PUBLIC_SENTRY_ENVIRONMENT=${{ vars.NEXT_PUBLIC_SENTRY_ENVIRONMENT }} \
-            --build-arg NEXT_PUBLIC_DEMO_ORG_ID=${{ vars.NEXT_PUBLIC_DEMO_ORG_ID }} \
-            --build-arg NEXT_PUBLIC_DEMO_PROJECT_ID=${{ vars.NEXT_PUBLIC_DEMO_PROJECT_ID }} \
-            --build-arg NEXT_PUBLIC_SENTRY_DSN=${{ vars.NEXT_PUBLIC_SENTRY_DSN }} \
-            --build-arg NEXT_PUBLIC_BUILD_ID=${{ github.sha }} \
-            --build-arg NEXT_PUBLIC_POSTHOG_KEY=${{ vars.NEXT_PUBLIC_POSTHOG_KEY }} \
-            --build-arg NEXT_PUBLIC_POSTHOG_HOST=${{ vars.NEXT_PUBLIC_POSTHOG_HOST }} \
-            --build-arg NEXT_PUBLIC_CRISP_WEBSITE_ID=${{ vars.NEXT_PUBLIC_CRISP_WEBSITE_ID }} \
-            --build-arg SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }} \
-            --build-arg SENTRY_ORG=${{ vars.SENTRY_ORG }} \
-            --build-arg SENTRY_PROJECT=${{ vars.SENTRY_PROJECT }} \
-            .
-          docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG
-
-      - name: Render AWS ECS Task Definition
-        id: render-task-definition
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
-        with:
-          container-name: ${{ inputs.service }}
-          image: ${{ steps.login-ecr.outputs.registry }}/${{ steps.split.outputs._0 }}:${{ github.sha }}
-          task-definition-family: ${{ inputs.environment }}-${{ inputs.service }}
-      - name: Update AWS ECS Service
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
-        with:
-          task-definition: ${{ steps.render-task-definition.outputs.task-definition }}
-          service: ${{ inputs.environment }}-${{ inputs.service }}
-          cluster: ${{ inputs.environment }}-cluster
-          wait-for-service-stability: true

.github/workflows/build-image.yml

@@ -0,0 +1,55 @@
+name: Build Docker Image
+# Builds + pushes ghcr.io/hanzoai/console2 on the self-hosted ARC runner. ONE
+# brand-agnostic image serves every brand: console2 resolves the brand at RUNTIME
+# from the request hostname (console.hanzo.ai → hanzo, console.lux.cloud → lux,
+# console.zoo.cloud → zoo; src/config/index.ts), and /v1 is same-origin per host.
+# So NO NEXT_PUBLIC_* are baked — baking them would pin the image to one brand.
+# Tags: SEMVER ONLY (no sha, no :latest) — a `v*` git tag publishes that exact
+# version; a main push publishes `v<package.json version>` (bump to release).
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+concurrency:
+  group: docker-image-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  docker:
+    runs-on: [hanzo-build-linux-amd64]
+    steps:
+      - uses: actions/checkout@v4
+      - name: resolve semver tag
+        id: ver
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          else
+            # node is NOT on the ARC runner PATH — resolve the version with grep/sed
+            # (a missing `node` silently produced the tag `:v` and a 404 deploy).
+            ver=$(grep -m1 '"version"' package.json | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
+            [ -n "$ver" ] || { echo "could not resolve version from package.json"; exit 1; }
+            echo "tag=v${ver}" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: docker/setup-buildx-action@v3
+      - name: Log in to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          provenance: false
+          sbom: false
+          tags: |
+            ghcr.io/hanzoai/console2:${{ steps.ver.outputs.tag }}

.github/workflows/ci.yml.template

@@ -1,69 +0,0 @@
-name: CI
-
-on:
-  pull_request:
-    branches: ["*"]
-  push:
-    branches: ["main", "cloud"]
-
-# You can leverage Vercel Remote Caching with Turbo to speed up your builds
-# @link https://turborepo.org/docs/core-concepts/remote-caching#remote-caching-on-vercel-builds
-env:
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
-
-jobs:
-  build-lint:
-    env:
-      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
-      SHADOW_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
-      DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Start containers
-        run: docker compose -f "docker-compose.yml" up -d --build
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v2.2.4
-
-      - name: Setup Node 18
-        uses: actions/setup-node@v4
-        with:
-          node-version: 18
-
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v3
-        with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Install deps (with cache)
-        run: pnpm install
-
-      # Normally, this would be done as part of the turbo pipeline - however since the Expo app doesn't depend on `@acme/db` it doesn't care.
-      # TODO: Free for all to find a better solution here.
-      - name: Deploy db
-        run: pnpm turbo db:deploy
-
-      - name: Generate Prisma Client
-        run: pnpm turbo db:generate
-
-      - name: Build, lint and type-check
-        run: pnpm turbo build lint type-check
-        env:
-          SKIP_ENV_VALIDATION: true
-
-      # FIXME: Add this back once we have an Expo SDK supporting React 18.2
-      # - name: Check workspaces
-      #   run: pnpm manypkg check

.github/workflows/codeql.yml

@@ -1,92 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
-
-on:
-  push:
-    branches: ["main", "production", "v*"]
-  pull_request:
-    branches: ["main", "production", "v*"]
-  schedule:
-    - cron: "31 13 * * 0"
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: javascript-typescript
-            build-mode: none
-        # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
-        # Use `c-cpp` to analyze code written in C, C++ or both
-        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
-        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
-        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
-        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
-        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-
-          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-          # queries: security-extended,security-and-quality
-
-      # If the analyze step fails for one of the languages you are analyzing with
-      # "We were unable to automatically build your code", modify the matrix above
-      # to set the build mode to "manual" for that language. Then modify this step
-      # to build your code.
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-      - if: matrix.build-mode == 'manual'
-        shell: bash
-        run: |
-          echo 'If you are using a "manual" build mode for one or more of the' \
-            'languages you are analyzing, replace this with the commands to build' \
-            'your code, for example:'
-          echo '  make bootstrap'
-          echo '  make release'
-          exit 1
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{matrix.language}}"

.github/workflows/codespell.yml

@@ -1,27 +0,0 @@
----
-name: Codespell
-
-on:
-  push:
-    branches:
-      - "main"
-    tags:
-      - "v*"
-  pull_request:
-    branches:
-      - "**"
-  merge_group:
-
-permissions:
-  contents: read
-
-jobs:
-  codespell:
-    name: Check for spelling errors
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Codespell
-        uses: codespell-project/actions-codespell@v2

.github/workflows/dependabot-rebase-stale.yml

@@ -1,18 +0,0 @@
-name: Rebase Dependabot stale PRs
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-jobs:
-  rebase-dependabot:
-    runs-on: ubuntu-latest
-    environment: "protected branches"
-    steps:
-      - name: "Rebase open Dependabot PR"
-        uses: orange-buffalo/dependabot-auto-rebase@v1
-        with:
-          api-token: ${{ secrets.GH_ACCESS_TOKEN }}
-          repository: ${{ github.repository }}

.github/workflows/deploy.yml

@@ -1,105 +0,0 @@
-on:
-  push:
-    branches:
-      - main
-      - production
-  workflow_dispatch:
-    inputs:
-      service:
-        description: 'Service to be deployed'
-        type: choice
-        options:
-          - all
-          - web
-          - web-ingestion
-          - worker
-        required: true
-      environment:
-        description: 'Environment to deploy to'
-        type: choice
-        options:
-          - staging
-          - prod-eu
-          - prod-us
-        required: true
-
-concurrency:
-  # Support concurrent `push` and `workflow_dispatch`` actions
-  group: deploy-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
-name: Deploy to ECS
-jobs:
-  affected-services:
-    runs-on: ubuntu-latest
-    outputs:
-      services: ${{ steps.affected-services.outputs.result }}
-    steps:
-      - name: Get affected services
-        id: affected-services
-        uses: actions/github-script@v7
-        with:
-          script: |
-            if (context.eventName === "workflow_dispatch") {
-              if (context.payload.inputs.service === "all") {
-                return `["web", "web-ingestion", "worker"]`
-              }
-              return `["${context.payload.inputs.service}"]`
-            }
-            if (context.eventName === "push") {
-              return `["web", "web-ingestion", "worker"]`
-            }
-            return "[]"
-          result-encoding: string
-      - name: Print services to build
-        uses: actions/github-script@v7
-        env:
-          services: ${{ steps.affected-services.outputs.result }}
-        with:
-          result-encoding: string
-          script: |
-            console.log('Services', `${process.env.services}` ?? 'n/a');
-
-  affected-environments:
-    runs-on: ubuntu-latest
-    outputs:
-      environments: ${{ steps.affected-environments.outputs.result }}
-    steps:
-      - name: Get affected environments
-        id: affected-environments
-        uses: actions/github-script@v7
-        with:
-          script: |
-            if (context.eventName === "workflow_dispatch") {
-              return `["${context.payload.inputs.environment}"]`
-            }
-            if (context.eventName === "push") {
-              if (context.ref === "refs/heads/main") {
-                return `["staging"]`
-              }
-              if (context.ref === "refs/heads/production") {
-                return `["prod-eu", "prod-us"]`
-              }
-            }
-            return "[]"
-          result-encoding: string
-      - name: Print environments to build
-        uses: actions/github-script@v7
-        env:
-          environments: ${{ steps.affected-environments.outputs.result }}
-        with:
-          result-encoding: string
-          script: |
-            console.log('Environments', `${process.env.environments}` ?? 'n/a');
-
-  ecs-deploy:
-    uses: ./.github/workflows/_deploy_ecs_service.yml
-    needs: [affected-services, affected-environments]
-    secrets: inherit
-    strategy:
-      matrix:
-        service: ${{ fromJson(needs.affected-services.outputs.services) }}
-        environment: ${{ fromJson(needs.affected-environments.outputs.environments) }}
-    with:
-      service: ${{ matrix.service }}
-      environment: ${{ matrix.environment }}

.github/workflows/licencecheck.yml

@@ -1,49 +0,0 @@
-name: License Compliance Check
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "main"
-  merge_group:
-  pull_request:
-    branches:
-      - "main"
-
-jobs:
-  license_check:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 18
-
-      - name: Install license-checker
-        run: npm install -g license-checker
-
-      - name: Install yui-lint
-        run: npm install yui-lint
-
-      - name: Generate license-checker CSV file
-        run: license-checker --production --csv > npm-license-checker.csv
-
-      - name: Check license-checker CSV file without headers
-        id: license_check_report
-        uses: pilosus/action-pip-license-checker@v2
-        with:
-          external: "npm-license-checker.csv"
-          external-format: "csv"
-          external-options: "{:skip-header true}"
-          fail: "WeakCopyleft,StrongCopyleft,NetworkCopyleft"
-          fails-only: true
-          totals: true
-          verbose: 1
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Echo error
-        if: failure()
-        run: echo "::error::${{ steps.license_check_report.outputs.report }}"
-      - name: Delete license-checker CSV file
-        run: rm npm-license-checker.csv

.github/workflows/pipeline.yml

@@ -1,489 +0,0 @@
-name: CI/CD
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "main"
-    tags:
-      - "v*"
-  merge_group:
-  pull_request:
-    branches:
-      - "*"
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 9.5.0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: "pnpm"
-          cache-dependency-path: "pnpm-lock.yaml"
-      - name: install dependencies
-        run: |
-          pnpm i
-      - name: Load default env
-        run: |
-          cp .env.dev.example .env
-      - name: lint web
-        run: pnpm run lint
-
-  test-docker-build:
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME_READ }}
-          password: ${{ secrets.DOCKERHUB_TOKEN_READ }}
-      - name: Set NEXT_PUBLIC_BUILD_ID
-        run: echo "NEXT_PUBLIC_BUILD_ID=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
-      - name: Build and run both images from compose
-        run: |
-          docker compose -f docker-compose.build.yml up -d
-          sleep 5 # Wait for PostgreSQL to accept connections
-      - name: Ensure no unhealthy status
-        run: |
-          if docker-compose ps | grep "(unhealthy)"; then
-            echo "One or more services are unhealthy"
-            exit 1
-          else
-            echo "All services are healthy"
-          fi
-      - name: Check worker health
-        run: |
-          timeout 10 bash -c 'until curl -f http://localhost:3030/api/health; do sleep 2; done'
-      - name: Check server health
-        run: |
-          timeout 10 bash -c 'until curl -f http://localhost:3000/api/public/health; do sleep 2; done'
-
-  tests-web-sync:
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
-    name: tests-web-sync (node${{ matrix.node-version }}, pg${{ matrix.postgres-version }})
-    strategy:
-      matrix:
-        node-version: [20]
-        postgres-version: [12, 15]
-    steps:
-      - name: Set Swap Space
-        uses: pierotofy/set-swap-space@master
-        with:
-          swap-size-gb: 10
-      - uses: actions/checkout@v4
-      - name: Install golang-migrate for Clickhouse migrations
-        run: |
-          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.18.2/migrate.linux-amd64.tar.gz | tar xvz
-          sudo mv migrate /usr/bin/migrate
-          which migrate
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 9.5.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME_READ }}
-          password: ${{ secrets.DOCKERHUB_TOKEN_READ }}
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "pnpm"
-          cache-dependency-path: "pnpm-lock.yaml"
-      - name: install dependencies
-        run: |
-          pnpm install
-      - name: Load default env
-        run: |
-          cp .env.dev.example .env
-          grep -v -e '^S3_BUCKET_NAME=' -e '^REDIS_HOST=' -e '^NEXT_PUBLIC_LANGFUSE_RUN_NEXT_INIT=' .env.dev.legacy.example > .env
-      - name: Run + migrate
-        run: |
-          docker compose -f docker-compose.dev.yml up -d
-          sleep 5 # Wait for PostgreSQL to accept connections
-          docker compose ps
-        env:
-          POSTGRES_VERSION: ${{ matrix.postgres-version }}
-      - name: Seed DB
-        run: |
-          pnpm run db:migrate
-          pnpm --filter=shared ch:up
-      - name: Build
-        run: pnpm run build
-      - name: Start Langfuse
-        run: (pnpm run start&)
-        env:
-          LANGFUSE_INIT_ORG_ID: "seed-org-id"
-          LANGFUSE_INIT_ORG_NAME: "Seed Org"
-          LANGFUSE_INIT_PROJECT_ID: "7a88fb47-b4e2-43b8-a06c-a5ce950dc53a"
-          LANGFUSE_INIT_PROJECT_NAME: "Seed Project"
-          LANGFUSE_INIT_PROJECT_PUBLIC_KEY: "pk-lf-1234567890"
-          LANGFUSE_INIT_PROJECT_SECRET_KEY: "sk-lf-1234567890"
-          LANGFUSE_INIT_USER_EMAIL: "demo@langfuse.com"
-          LANGFUSE_INIT_USER_NAME: "Demo User"
-          LANGFUSE_INIT_USER_PASSWORD: "password"
-      - name: run test-sync
-        run: pnpm --filter=web run test-sync
-
-  tests-web-async:
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
-    name: tests-web-async (node${{ matrix.node-version }}, pg${{ matrix.postgres-version }}, mode${{ matrix.blob-provider }})
-    strategy:
-      matrix:
-        node-version: [20]
-        postgres-version: [12, 15]
-        blob-provider: ["", "-azure"]
-    steps:
-      - name: Set Swap Space
-        uses: pierotofy/set-swap-space@master
-        with:
-          swap-size-gb: 10
-      - uses: actions/checkout@v4
-      - name: Install golang-migrate for Clickhouse migrations
-        run: |
-          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.18.2/migrate.linux-amd64.tar.gz | tar xvz
-          sudo mv migrate /usr/bin/migrate
-          which migrate
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 9.5.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME_READ }}
-          password: ${{ secrets.DOCKERHUB_TOKEN_READ }}
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "pnpm"
-          cache-dependency-path: "pnpm-lock.yaml"
-      - name: install dependencies
-        run: |
-          pnpm install
-      - name: Load default env
-        run: |
-          cp .env.dev${{ matrix.blob-provider }}.example .env
-          grep -v -e '^S3_BUCKET_NAME=' -e '^REDIS_HOST=' -e '^NEXT_PUBLIC_LANGFUSE_RUN_NEXT_INIT=' .env.dev${{ matrix.blob-provider }}.example > .env
-      - name: Run + migrate
-        run: |
-          docker compose -f docker-compose.dev${{ matrix.blob-provider }}.yml up -d
-          sleep 5 # Wait for PostgreSQL to accept connections
-          docker compose ps
-        env:
-          POSTGRES_VERSION: ${{ matrix.postgres-version }}
-      - name: Seed DB
-        run: |
-          pnpm run db:migrate
-          pnpm --filter=shared ch:up
-      - name: Build
-        run: pnpm run build
-      - name: Start Langfuse
-        run: (pnpm run start&)
-        env:
-          LANGFUSE_INIT_ORG_ID: "seed-org-id"
-          LANGFUSE_INIT_ORG_NAME: "Seed Org"
-          LANGFUSE_INIT_PROJECT_ID: "7a88fb47-b4e2-43b8-a06c-a5ce950dc53a"
-          LANGFUSE_INIT_PROJECT_NAME: "Seed Project"
-          LANGFUSE_INIT_PROJECT_PUBLIC_KEY: "pk-lf-1234567890"
-          LANGFUSE_INIT_PROJECT_SECRET_KEY: "sk-lf-1234567890"
-          LANGFUSE_INIT_USER_EMAIL: "demo@langfuse.com"
-          LANGFUSE_INIT_USER_NAME: "Demo User"
-          LANGFUSE_INIT_USER_PASSWORD: "password"
-      - name: run tests
-        run: pnpm --filter=web run test
-
-  tests-worker:
-    timeout-minutes: 20
-    runs-on: ubuntu-latest
-    name: tests-worker (node${{ matrix.node-version }}, pg${{ matrix.postgres-version }}, mode${{ matrix.blob-provider }})
-    strategy:
-      matrix:
-        node-version: [20]
-        postgres-version: [12, 15]
-        blob-provider: ["", "-azure"]
-    steps:
-      - name: Set Swap Space
-        uses: pierotofy/set-swap-space@master
-        with:
-          swap-size-gb: 10
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 9.5.0
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME_READ }}
-          password: ${{ secrets.DOCKERHUB_TOKEN_READ }}
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "pnpm"
-          cache-dependency-path: "pnpm-lock.yaml"
-      - name: install dependencies
-        run: |
-          pnpm install
-      - name: Install golang-migrate for Clickhouse migrations
-        run: |
-          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.18.2/migrate.linux-amd64.tar.gz | tar xvz
-          sudo mv migrate /usr/bin/migrate
-          which migrate
-      - name: Load default env
-        run: |
-          cp .env.dev${{ matrix.blob-provider }}.example .env
-          cp .env.dev${{ matrix.blob-provider }}.example web/.env
-          cp .env.dev${{ matrix.blob-provider }}.example worker/.env
-      - name: Run + migrate
-        run: |
-          docker compose -f docker-compose.dev${{ matrix.blob-provider }}.yml up -d
-          sleep 5 # Wait for PostgreSQL to accept connections
-          docker compose ps
-      - name: Ensure no unhealthy status
-        run: |
-          if docker compose ps | grep "(unhealthy)"; then
-            echo "One or more services are unhealthy"
-            exit 1
-          else
-            echo "All services are healthy"
-          fi
-      - name: Seed DB
-        run: |
-          pnpm run db:migrate
-          pnpm run db:seed
-          pnpm run --filter=shared ch:up
-      - name: Build
-        run: pnpm --filter=worker... run build
-      - name: run tests
-        run: pnpm --filter=worker run test
-
-  e2e-tests:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 9.5.0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: "pnpm"
-          cache-dependency-path: "pnpm-lock.yaml"
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME_READ }}
-          password: ${{ secrets.DOCKERHUB_TOKEN_READ }}
-      - name: install dependencies
-        run: |
-          pnpm install
-      - name: Load default env
-        run: |
-          cp .env.dev.example .env
-          cp .env.dev.example web/.env
-      - name: Run + migrate
-        run: |
-          docker compose -f docker-compose.dev.yml up -d
-          docker compose ps
-          sleep 5 # Wait for PostgreSQL to accept connections
-      - name: Seed DB
-        run: |
-          pnpm run db:migrate
-          pnpm run db:seed
-      - name: Build
-        run: pnpm run build
-      - name: Install playwright
-        run: pnpm --filter=web exec playwright install --with-deps
-      - name: Run e2e tests
-        run: pnpm --filter=web run test:e2e
-
-  e2e-server-tests:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME_READ }}
-          password: ${{ secrets.DOCKERHUB_TOKEN_READ }}
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 9.5.0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: "pnpm"
-          cache-dependency-path: "pnpm-lock.yaml"
-      - name: install dependencies
-        run: |
-          pnpm install
-      - name: Install golang-migrate for Clickhouse migrations
-        run: |
-          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.18.2/migrate.linux-amd64.tar.gz | tar xvz
-          sudo mv migrate /usr/bin/migrate
-          which migrate
-      - name: Load default env
-        run: |
-          cp .env.dev.example .env
-          echo "LANGFUSE_ASYNC_CLICKHOUSE_INGESTION_PROCESSING=true" >> .env
-          echo "LANGFUSE_ASYNC_INGESTION_PROCESSING=true" >> .env
-          echo "LANGFUSE_CACHE_API_KEY_ENABLED=true" >> .env
-          echo "LANGFUSE_CACHE_PROMPT_ENABLED=true" >> .env
-      - name: Run + migrate
-        run: |
-          docker compose -f docker-compose.dev.yml up -d
-          docker compose ps
-          sleep 5 # Wait for PostgreSQL to accept connections
-      - name: Ensure Docker dependencies are healthy
-        run: |
-          if docker-compose ps | grep "(unhealthy)"; then
-            echo "One or more services are unhealthy"
-            exit 1
-          else
-            echo "All services are healthy"
-          fi
-      - name: Seed DB
-        run: |
-          pnpm run db:migrate
-          pnpm --filter=shared run ch:up
-          pnpm run db:seed:examples
-      - name: Build
-        run: pnpm run build
-      - name: Run server
-        run: (pnpm run start&)
-      - name: Check worker health
-        run: |
-          timeout 10 bash -c 'until curl -f http://localhost:3030/api/health; do sleep 2; done'
-      - name: Check server health
-        run: |
-          timeout 10 bash -c 'until curl -f http://localhost:3000/api/public/health; do sleep 2; done'
-      - name: Run e2e tests
-        run: pnpm --filter=web run test:e2e:server
-
-  all-ci-passed:
-    # This allows us to have a branch protection rule for tests and deploys with matrix
-    runs-on: ubuntu-latest
-    needs:
-      [
-        lint,
-        tests-web-sync,
-        tests-worker,
-        e2e-tests,
-        test-docker-build,
-        e2e-server-tests,
-        tests-web-async,
-      ]
-    if: always()
-    steps:
-      - name: Successful deploy
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        run: exit 0
-        working-directory: .
-      - name: Failing deploy
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
-        working-directory: .
-
-  push-docker-image:
-    needs: all-ci-passed
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
-    environment: "protected branches"
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-      contents: read
-
-    steps:
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 9.5.0
-      - name: Setup node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache-dependency-path: "pnpm-lock.yaml"
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set NEXT_PUBLIC_BUILD_ID
-        run: echo "NEXT_PUBLIC_BUILD_ID=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
-      - name: Log in to the GitHub Container registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta-web
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            ghcr.io/langfuse/langfuse # GitHub
-            langfuse/langfuse # Docker Hub
-          flavor: |
-            latest=false
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=sha
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v3') }}
-      - name: Build and push Docker image (web)
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          file: ./web/Dockerfile
-          push: true
-          tags: ${{ steps.meta-web.outputs.tags }}
-          labels: ${{ steps.meta-web.outputs.labels }}
-          platforms: |
-            linux/amd64
-            ${{ startsWith(github.ref, 'refs/tags/') && 'linux/arm64' || '' }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta-worker
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            ghcr.io/langfuse/langfuse-worker # GitHub
-            langfuse/langfuse-worker # Docker Hub
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=sha
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-      - name: Build and push Docker image (worker)
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          file: ./worker/Dockerfile
-          push: true
-          tags: ${{ steps.meta-worker.outputs.tags }}
-          labels: ${{ steps.meta-worker.outputs.labels }}
-          platforms: |
-            linux/amd64
-            ${{ startsWith(github.ref, 'refs/tags/') && 'linux/arm64' || '' }}

.github/workflows/release.yml

@@ -1,19 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    # Pattern matched against refs/tags
-    tags:
-      - "v3.[0-9]+.[0-9]+" # Semantic version tags
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    environment: "protected branches"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: main # Always checkout main even for tagged releases
-          fetch-depth: 0
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
-      - name: Push to production
-        run: git push origin +main:production

.github/workflows/snyk.yml

@@ -1,46 +0,0 @@
-name: Snyk Container
-on:
-  pull_request:
-    branches:
-      - "**"
-  push:
-    branches:
-      - main
-
-jobs:
-  snyk:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Build a Docker image
-        run: docker compose -f docker-compose.build.yml up -d
-
-      - name: Run Snyk to check Docker image for vulnerabilities (langfuse-server)
-        continue-on-error: true
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: langfuse-server
-          args: --file=web/Dockerfile
-
-      - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: snyk.sarif
-          category: web
-
-      - name: Run Snyk to check Docker image for vulnerabilities (langfuse-worker)
-        continue-on-error: true
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: langfuse-worker
-          args: --file=worker/Dockerfile
-
-      - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: snyk.sarif
-          category: worker

.gitignore

@@ -1,66 +1,17 @@
-# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+node_modules/
+.next/
+out/
+dist/
 
-# dependencies
-/node_modules
-/.pnp
-.pnp.js
-
-# testing
-/coverage
-
-# database
-/prisma/db.sqlite
-/prisma/db.sqlite-journal
-
-# next.js
-/.next/
-/out/
+# build artifacts
+*.tsbuildinfo
 next-env.d.ts
 
-# production
-/build
+# env
+.env*.local
 
-# idea
-.idea
-
-# misc
+# editor / os
 .DS_Store
-*.pem
-
-# debug
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-.pnpm-debug.log*
-
-# local env files
-# do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables
-.env*
-!.env.dev.example
-!.env.dev-azure.example
-!.env.local.example
-!.env.prod.example
-!.env.dev.legacy.example
-
-# vercel
-.vercel
-
-# typescript
-*.tsbuildinfo
-
-/generated/typescript-server
-
-# openapi spec that is copied during build
-/public/openapi*.yml
-
-
-# vscode
-.devcontainer
-
-node_modules
-**/node_modules
-**/dist
-**/.next/*
-**/.turbo/*
-.yarn
-.turbo
+.vscode/
+.idea/
+*.log

.husky/pre-commit

@@ -1,22 +0,0 @@
-#!/bin/sh
-
-# Get the current branch
-current_branch=$(git rev-parse --abbrev-ref HEAD)
-
-# Define the protected branch
-protected_branch="main"
-
-# Check if the current branch is the protected branch
-if [ "$current_branch" = "$protected_branch" ]; then
-    echo "🚨 You are about to commit to the $protected_branch branch. Are you sure? (y/n)"
-    read -r answer < /dev/tty
-    if [ "$answer" != "${answer#[Yy]}" ]; then
-        exit 0 # Commit will proceed
-    else
-        echo "Commit to $protected_branch branch has been canceled."
-        exit 1 # Commit will be blocked
-    fi
-fi
-
-# If not the protected branch, proceed with the commit
-exit 0

.husky/pre-push

@@ -1,22 +0,0 @@
-#!/bin/sh
-
-# Get the current branch
-current_branch=$(git rev-parse --abbrev-ref HEAD)
-
-# Define the protected branch
-protected_branch="main"
-
-# Check if the current branch is the protected branch
-if [ "$current_branch" = "$protected_branch" ]; then
-    echo "🚨 You are about to push to the $protected_branch branch. Are you sure? (y/n)"
-    read -r answer < /dev/tty
-    if [ "$answer" != "${answer#[Yy]}" ]; then
-        exit 0 # Push will proceed
-    else
-        echo "Push to $protected_branch branch has been canceled."
-        exit 1 # Push will be blocked
-    fi
-fi
-
-# If not the protected branch, proceed with the push
-exit 0

.npmrc

@@ -1 +0,0 @@
-public-hoist-pattern[]=*prisma*

.nvmrc

@@ -1 +0,0 @@
-v20

.vscode/extensions.json

@@ -1,10 +0,0 @@
-{
-  "recommendations": [
-    "esbenp.prettier-vscode",
-    "dbaeumer.vscode-eslint",
-    "bradlc.vscode-tailwindcss",
-    "unifiedjs.vscode-mdx",
-    "yoavbls.pretty-ts-errors",
-    "Prisma.prisma"
-  ]
-}

.vscode/launch.json

@@ -1,28 +0,0 @@
-{
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "name": "Web and Worker: server side",
-      "type": "node-terminal",
-      "request": "launch",
-      "command": "pnpm run dev"
-    },
-    {
-      "name": "Next.js: debug client-side",
-      "type": "chrome",
-      "request": "launch",
-      "url": "http://localhost:3000"
-    },
-    {
-      "name": "Next.js: debug full stack",
-      "type": "node-terminal",
-      "request": "launch",
-      "command": "npm run dev",
-      "serverReadyAction": {
-        "pattern": "- Local:.+(https?://.+)",
-        "uriFormat": "%s",
-        "action": "debugWithChrome"
-      }
-    }
-  ]
-}

.vscode/settings.json

@@ -1,32 +0,0 @@
-{
-  "editor.codeActionsOnSave": {
-    "source.fixAll.eslint": "explicit"
-  },
-  "editor.defaultFormatter": "esbenp.prettier-vscode",
-  "editor.formatOnSave": true,
-  "editor.rulers": [100],
-  "editor.tabSize": 2,
-
-  "eslint.validate": [
-    "javascript",
-    "javascriptreact",
-    "astro",
-    "typescript",
-    "typescriptreact"
-  ],
-
-  "eslint.rules.customizations": [{ "rule": "*", "severity": "warn" }],
-  "typescript.tsdk": "node_modules/typescript/lib",
-  "prettier.documentSelectors": [
-    "**/*.{cjs,mjs,ts,tsx,astro,md,mdx,json,yaml,yml}"
-  ],
-  "prettier.trailingComma": "all",
-  "mdx.experimentalLanguageServer": true,
-  "typescript.preferences.importModuleSpecifier": "non-relative",
-  "docwriter.style": "JSDoc",
-  "[prisma]": {
-    "editor.defaultFormatter": "Prisma.prisma"
-  },
-  "eslint.lintTask.enable": true,
-  "eslint.workingDirectories": ["./web", "./worker"]
-}

AGENTS.md

@@ -0,0 +1,23 @@
+# AGENTS — console2
+
+Read [LLM.md](./LLM.md) first; it is the canonical design doc. Highlights for
+agents working here:
+
+- **Stack:** Next.js 15 (app router) + @hanzo/gui (npm), consumed at runtime via
+  `transpilePackages` (the `@hanzogui/next-plugin` is broken on npm). Next 15
+  (not 14) because @hanzo/gui needs React 19. Pin patch versions; never lazily
+  major-bump.
+- **Gui style props:** the v5 config is `onlyShorthandStyleProps` — use
+  shorthands (`p`, `px`, `bg`, `items`, `justify`, `self`, `rounded`, `minH`),
+  never longhands (`padding`, `backgroundColor`, …). Keep `tsc` clean.
+- **One way:** all backend calls go through `src/lib/api` (never raw `fetch`);
+  all selects/inputs through `src/components/ui/Field.tsx`; all nav/routing
+  through the registry in `src/lib/products`.
+- **Extensibility:** add a cloud product by appending a `ProductModule` to
+  `src/lib/products/registry.tsx` and writing its module component — do not add
+  per-product routes or touch the shell.
+- **Auth:** Hanzo IAM (OIDC) via `@hanzo/iam-js-sdk`; session cookie minted by
+  the backend at `/v1/signin`. Never store credentials client-side.
+- **Boundaries:** frontend only. No DB. No Docker builds locally (CI/CD builds
+  images). No secrets in the repo — config is `NEXT_PUBLIC_*` only.
+- **Verify:** `npm run typecheck` and `npm run build` must pass. Show output.

CLAUDE.md

@@ -0,0 +1 @@
+LLM.md

CONTRIBUTING.md

@@ -1,453 +0,0 @@
-![Langfuse GitHub Banner](https://github.com/langfuse/langfuse/assets/121163007/6035f0f3-d691-4963-b5d0-10cf506e9d42)
-
-# Contributing to Langfuse
-
-First off, thanks for taking the time to contribute! ❤️
-
-The best ways to contribute to Langfuse:
-
-- Submit and vote on [Ideas](https://github.com/orgs/langfuse/discussions/categories/ideas)
-- Create and comment on [Issues](https://github.com/langfuse/langfuse/issues)
-- Open a PR.
-
-We welcome contributions through GitHub pull requests. This document outlines our conventions regarding development workflow, commit message formatting, contact points, and other resources. Our goal is to simplify the process and ensure that your contributions are easily accepted.
-
-We gratefully welcome improvements to documentation ([docs repo](https://github.com/langfuse/langfuse-docs)), the core application (this repo) and the SDKs ([Python](https://github.com/langfuse/langfuse-python), [JS](https://github.com/langfuse/langfuse-js)).
-
-The maintainers are available on [Discord](https://langfuse.com/discord) in case you have any questions.
-
-> And if you like the project, but just don't have time to contribute code, that's fine. There are other easy ways to support the project and show your appreciation, which we would also be very happy about:
->
-> - Star the project;
-> - Tweet about it;
-> - Refer to this project in your project's readme;
-> - Submit and vote on [Ideas](https://github.com/orgs/langfuse/discussions/categories/ideas);
-> - Create and comment on [Issues](https://github.com/langfuse/langfuse/issues);
-> - Mention the project at local meetups and tell your friends/colleagues.
-
-## Making a change
-
-_Before making any significant changes, please [open an issue](https://github.com/langfuse/langfuse/issues)._ Discussing your proposed changes ahead of time will make the contribution process smooth for everyone. Large changes that were not discussed in an issue may be rejected.
-
-Once we've discussed your changes and you've got your code ready, make sure that tests are passing and open your pull request.
-
-A good first step is to search for open [issues](https://github.com/langfuse/langfuse/issues). Issues are labeled, and some good issues to start with are labeled: [good first issue](https://github.com/langfuse/langfuse/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22).
-
-## Project Overview
-
-### Technologies we use
-
-- Application (this repository)
-  - NextJS 14, pages router
-  - NextAuth.js / Auth.js
-  - tRPC: Frontend APIs
-  - Prisma ORM
-  - Zod
-  - Tailwind CSS
-  - shadcn/ui tailwind components (using Radix and tanstack)
-  - Fern: generate OpenAPI spec and Pydantic models
-- JS SDK ([langfuse/langfuse-js](https://github.com/langfuse/langfuse-js))
-  - openapi-typescript to generated types based on OpenAPI spec
-- Python SDK ([langfuse/langfuse-python](https://github.com/langfuse/langfuse-python))
-  - Pydantic for input validation, models generated by fern
-
-### Architecture Overview
-
-**Langfuse v2**
-
-```mermaid
-flowchart TB
-    subgraph s4["Clients"]
-        subgraph s2["langfuse/langfuse-python"]
-            Python["Python low-level SDK"]
-            Decorator["observe() decorator"] -->|extends| Python
-            OAI["OpenAI drop-in replacement"] -->|extends| Python
-            Llamaindex["LlamaIndex Integration"] -->|extends| Python
-            LCPYTHON["Langchain Python Integration"] -->|extends| Python
-            Langflow -->|uses| LCPYTHON
-            LiteLLM -->|uses| Python
-        end
-        subgraph s3["langfuse/langfuse-js"]
-            JS["JS SDK"]
-            LCJS["Langchain JS Integration"]  -->|extends| JS
-            Flowise -->|uses| LCJS
-        end
-    end
-
-    DB[Postgres Database]
-    Redis[Redis]
-
-    subgraph s1["Application (langfuse/langfuse/web)"]
-        API[Public HTTP API]
-        G[TRPC API]
-        I[NextAuth]
-        H[React Frontend]
-        Prisma[Prisma ORM]
-        H --> G
-        H --> I
-        G --> I
-        G --- Prisma
-        API --- Prisma
-        I --- Prisma
-    end
-
-    Prisma --- DB
-    JS --- API
-    Python --- API
-```
-
-**Langfuse v3 (work in progress, not released yet)**
-
-> [!NOTE]
-> Infrastructure will change in Langfuse version 3.0. More in the [GitHub Discussions](https://github.com/orgs/langfuse/discussions/1902).
-> `langfuse/langfuse/worker` is under active development and not recommended for production use in Langfuse 2.x.
-
-```mermaid
-flowchart TB
-    subgraph s4["Clients"]
-        subgraph s2["langfuse/langfuse-python"]
-            Python["Python low-level SDK"]
-            Decorator["observe() decorator"] -->|extends| Python
-            OAI["OpenAI drop-in replacement"] -->|extends| Python
-            Llamaindex["LlamaIndex Integration"] -->|extends| Python
-            LCPYTHON["Langchain Python Integration"] -->|extends| Python
-            Langflow -->|uses| LCPYTHON
-            LiteLLM -->|uses| Python
-        end
-        subgraph s3["langfuse/langfuse-js"]
-            JS["JS SDK"]
-            LCJS["Langchain JS Integration"]  -->|extends| JS
-            Flowise -->|uses| LCJS
-        end
-    end
-
-    DB[Postgres Database]
-    Redis[Redis Cache/Queue]
-    Clickhouse[Clickhouse Database]
-
-    subgraph s1["Application (langfuse/langfuse/web)"]
-        API[Public HTTP API]
-        G[TRPC API]
-        I[NextAuth]
-        H[React Frontend]
-        ORM
-        H --> G
-        H --> I
-        G --> I
-        G --- ORM
-        API --- ORM
-        I --- ORM
-    end
-
-    subgraph s5["Application (langfuse/langfuse/worker)"]
-        Worker
-    end
-
-    Worker --- DB
-    Worker --- Redis
-    Worker --- Clickhouse
-
-    ORM --- DB
-    ORM --- Redis
-    ORM --- Clickhouse
-
-    JS --- API
-    Python --- API
-```
-
-### Network Overview
-
-> [!NOTE]
-> This will change in Langfuse version 3.0. More in the [GitHub Discussions](https://github.com/orgs/langfuse/discussions/1902).
-
-```mermaid
-flowchart LR
-   Browser ---|Web UI & TRPC API| App
-   Integrations/SDKs ---|Public HTTP API| App
-   subgraph i1["Application Network"]
-      App["Langfuse Application"]
-   end
-   subgraph i2["Database Network"]
-      DB["Postgres Database"]
-   end
-   App --- DB
-```
-
-### Database Overview
-
-The diagram below may not show all relationships if the foreign key is not defined in the database schema. For instance, `trace_id` in the `observation` table is not defined as a foreign key to the `trace` table to allow unordered ingestion of these objects, but it is still a foreign key in the application code.
-
-Full database schema: [packages/shared/prisma/schema.prisma](packages/shared/prisma/schema.prisma)
-
-<img src="./packages/shared/prisma/database.svg">
-
-## Repository Structure
-
-We built a monorepo using [pnpm](https://pnpm.io/motivation) and [turbo](https://turbo.build/repo/docs) to manage the dependencies and build process. The monorepo contains the following packages:
-
-- `web`: is the main application package providing Frontend and Backend APIs for Langfuse.
-- `worker` (no production yet): contains an application for asynchronous processing of tasks. This package is not yet used in production.
-- `packages`:
-  - `shared`: contains shared code between the above packages.
-  - `config-eslint`: contains eslint configurations which are shared between the above packages.
-  - `config-typescript`: contains typescript configurations which are shared between the above packages.
-- `ee`: contains all enterprise features. See [EE README](ee/README.md) for more details.
-
-## Development Setup
-
-Requirements
-
-- Node.js 20 as specified in the [.nvmrc](.nvmrc)
-- Pnpm v.9.5.0
-- Docker to run the database locally
-
-**Note:** You can also simply run Langfuse in a **GitHub Codespace** via the provided devcontainer. To do this, click on the green "Code" button in the top right corner of the repository and select "Open with Codespaces".
-
-**Steps**
-
-1. Fork the repository and clone it locally
-2. Run the development database
-
-   ```bash
-   pnpm run infra:dev:up
-   ```
-
-3. Create an env file
-
-   ```bash
-    cp .env.dev.example .env
-   ```
-
-4. Install dependencies
-
-   ```bash
-   pnpm install
-   ```
-
-5. Run the migrations
-
-   All database migrations and configs are in the `shared` package.
-
-   ```bash
-   pnpm --filter=shared run db:migrate
-
-   # Optional: seed the database
-   # pnpm run db:seed
-   # pnpm run db:seed:examples
-   # pnpm --filter=shared run db:seed:load
-   ```
-
-6. Start the development server
-
-   ```bash
-    pnpm run dev
-   ```
-
-7. Open the web app in the browser:
-
-   http://localhost:3000
-
-8. Log in as a test user (after you ran `db:seed` command):
-
-   Username: demo@langfuse.com
-
-   Password: password
-
-## Monorepo quickstart
-
-- Available packages and their dependencies
-
-  Packages are included in the monorepo according to the `pnpm-workspace.yaml` file. Each package maintains its own dependencies defined in the `package.json`. Internal dependencies can be added as well by adding them to the package dependencies: `"@langfuse/shared": "workspace:*"`.
-
-- Executing commands
-
-  You can run commands in all packages at once. For example, to install all dependencies in all packages, you can execute:
-
-  ```bash
-  pnpm install
-  pnpm run dev
-  pnpm --filter=web run dev # execute command only in one package
-  ```
-
-  In the root `package.json`, you can find scripts which are executed with turbo e.g. `turbo run dev`. These scripts are executed with the help of Turbo. Turbo executes the commands in all packages taking care of the correct order of execution. Task definitions can be found in the `turbo.config.js` file.
-
-- Run migrations
-
-  To run migrations, you can execute the following command.
-
-  ```bash
-  pnpm run db:migrate -- --name <name of the migration>
-  ```
-
-> [!NOTE]
-> If you frequently switch branches, use `pnpm run dx` instead of `pnpm run dev`. This command will install dependencies, reset the database (wipe and apply all migrations), and run the database seeder with example data before starting the development server.
-
-> [!NOTE]
-> If you find yourself stuck and want to clean the repo, execute `pnpm run nuke`. It will remove all node_modules and build files.
-
-## System behavior
-
-### Ingestion API `(/public/api/ingestion)`
-
-- the ingestion API takes different event types (creation and updates of traces, generations, spans, events)
-- The API loops through each event and:
-  - validates the event
-  - stores the event raw in the events table
-  - calculates tokens for `generations`
-  - matches models from the `models` table to model for `generations` events
-  - upserts the event in the `traces` or `observations` table
-- returns a `207` HTTP status code with a list of errors if any event failed to be ingested
-
-## Commit messages
-
-On the main branch, we adhere to the best practices of [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/). All pull requests and branches are squash-merged to maintain a clean and readable history. This approach ensures the addition of a conventional commit message when merging contributions.
-
-## Test the public API
-
-The API is tested using Jest. With the development server running, you can run the tests with:
-
-Run all
-
-```bash
-npm run test
-```
-
-Run interactively in watch mode
-
-```bash
-npm run test:watch
-```
-
-These tests are also run in CI.
-
-## CI/CD
-
-We use GitHub Actions for CI/CD, the configuration is in [`.github/workflows/pipeline.yml`](.github/workflows/pipeline.yml)
-
-CI on `main` and `pull_request`
-
-- Check Linting
-- E2E test of API using Jest
-- E2E tests of UI using Playwright
-
-CD on `main`
-
-- Publish Docker image to GitHub Packages if CI passes. Done on every push to `main` branch. Only released versions are tagged with `latest`.
-
-## Staging environment
-
-We run a staging environment at [https://staging.langfuse.com](https://staging.langfuse.com) that is automatically deployed on every push to `main` branch.
-
-The same environment is also used for preview deployments of pull requests. Limitations:
-
-- SSO is not available as dynamic domains are not supported by most SSO providers.
-- When making changes to the database, migrations to the staging database need to be applied manually by a maintainer. If you want to interactively test database changes in the staging environment, please reach out.
-
-You can use the staging environment end-to-end with the Langfuse integrations or SDKs (host: `https://staging.langfuse.com`). However, please note that the staging environment is not intended for production use and may be reset at any time.
-
-## Production environment
-
-When a new release is tagged on the `main` branch (excluding prereleases), it triggers a production deployment. The deployment process consists of two steps:
-
-1. The Docker image is published to GitHub Packages with the version number and `latest` tag.
-2. The deployment is carried out on Langfuse Cloud. This is done by force pushing the `main` branch to the `production` branch during every release, using the [`release.yml`](.github/workflows/release.yml) GitHub Action.
-
-## Theming
-
-At Langfuse, we utilize CSS variables to manage our theme settings across the platform.
-
-Our approach leverages separate CSS variables for backgrounds (--background) and foregrounds (--foreground), fully adhering to the [shadcn/ui](https://ui.shadcn.com/docs/theming) color conventions. The background suffix can be omitted if the variable is used for the background color of the component. We recommend using HSL values for these colors to enhance consistency and customization. There is no need to manually handle dark mode styling with "dark:" prefixes, as next-themes automatically manages the theme switching.
-
-Given the following CSS variables:
-
-```
---primary: 222.2 47.4% 11.2%; // e.g. background-color
---primary-foreground: 210 40% 98%; // e.g. text-color
-```
-
-The background color of the following component will be `hsl(var(--primary))` and the foreground color will be `hsl(var(--primary-foreground))`.
-
-```
-<div class="bg-primary text-primary-foreground">Hello</div>
-```
-
-### Color Variables
-
-| Variable                 | Description                                                        | Examples                         |
-| ------------------------ | ------------------------------------------------------------------ | -------------------------------- |
-| --background             | Background color                                                   | Default background color of body |
-| --foreground             | Foreground color                                                   | Default text color of body       |
-| --muted                  | Muted background color                                             | TabsList, Skeleton and Switch    |
-| --muted-foreground       | Muted foreground color                                             |                                  |
-| --popover                | Popover background color                                           | DropdownMenu, HoverCard, Popover |
-| --popover-foreground     | Popover foreground color                                           |                                  |
-| --card                   | Card background color                                              | Card                             |
-| --card-foreground        | Card foreground color                                              |                                  |
-| --border                 | Border color                                                       | Default border color             |
-| --input                  | Input field border color                                           | Input, Select, Textarea          |
-| --primary                | Primary button background colors                                   | Button variant="primary"         |
-| --primary-foreground     | Primary button foreground color                                    |                                  |
-| --secondary              | Secondary button background color                                  | Button variant="secondary"       |
-| --secondary-foreground   | Secondary button foreground color                                  |                                  |
-| --accent                 | Used for accents such as hover effects                             | DropdownMenuItem, SelectItem     |
-| --accent-foreground      | Used for texts on hover effects                                    | DropdownMenuItem, SelectItem     |
-| --destructive            | Destructive action color for background                            | Button variant="destructive"     |
-| --destructive-foreground | Destructive action color for text                                  |                                  |
-| --ring                   | Focus ring color                                                   | MultiSelect                      |
-| --primary-accent         | Primary accent color used for branding                             | Layout                           |
-| --hover-primary-accent   | Primary accent color used for hover effects for links              | SignIn and AuthCloudRegionSwitch |
-| --muted-green            | Muted green for Event label                                        | ObservationTree                  |
-| --muted-orange           | Muted orange for Generation label                                  | ObservationTree                  |
-| --muted-blue             | Muted blue for Span label                                          | ObservationTree                  |
-| --muted-gray             | Muted gray for disabled status badges                              | StatusBadge                      |
-| --accent-light-green     | Light green accent for background of output and assistant messages | IOPreview, Generations, Traces   |
-| --accent-dark-green      | Dark green accent for border of output and assistant messages      | CodeJsonViewer and IOPReview     |
-| --light-red              | Light red for error background                                     | level-color and StatusBadge      |
-| --dark-red               | Dark red for error text and error badge dot color                  | level-color and ErrorPage        |
-| --light-yellow           | Light yellow for warning background                                | LevelColor                       |
-| --dark-yellow            | Dark yellow for warning text                                       | LevelColor                       |
-| --light-green            | Light green for success status badge background                    | StatusBadge                      |
-| --dark-green             | Dark green for success status badge text and dot                   | StatusBadge                      |
-| --light-blue             | Light blue for background of Staging label                         | LangfuseLogo                     |
-| --dark-blue              | Dark blue for text and border of Staging label                     | LangfuseLogo                     |
-| --accent-light-blue      | Light blue accent for table link hover effect                      | TableLink                        |
-| --accent-dark-blue       | Dark blue accent for table link text                               | TableLink                        |
-
-### Adding New Colors
-
-1. Global Definitions: Add new CSS variable definitions in the global.css file.
-2. Tailwind Configuration: Reflect these new colors in the tailwind.config.js to maintain alignment with Tailwind's utility classes.
-
-By following these guidelines, you can ensure that any contributions to our theme are consistent, maintainable, and aligned with our design system.
-
-## Maintainers
-
-### Using secrets stored in 1Password
-
-When applying changes to non-local environments, you may need to use secrets stored in 1Password. We use the 1Password CLI for this purpose.
-
-Example:
-
-```bash
-op run --env-file="./.env" -- pnpm --filter=shared run db:deploy
-```
-
-### Editing default models and prices
-
-You can update the default AI models and prices by adding or updating an entry in `worker/src/constants/default-model-prices.json`.
-
-Please note that
-
-- prices are in USD
-- the list is ordered by ID, so make sure to keep this order
-- the `updated_at` field must be updated with the current date in ISO 8601 format. Otherwise, the change will be ignored.
-
-### Transition period until V3 release
-
-Until the V3 release, both the JSON record must be updated **and** a migration must be created to continue supporting self-hosted users. Note that the migration must updated both the `models` as well as the `prices` table accordingly.
-
-## License
-
-Langfuse is MIT licensed, except for `ee/` folder. See [LICENSE](LICENSE) and [docs](https://langfuse.com/docs/open-source) for more details.
-
-When contributing to the Langfuse codebase, you need to agree to the [Contributor License Agreement](https://cla-assistant.io/langfuse/langfuse). You only need to do this once and the CLA bot will remind you if you haven't signed it yet.

Dockerfile

@@ -0,0 +1,40 @@
+# console2 — Hanzo Cloud Console (Next.js 15 + @hanzo/gui). BSD-3-Clause.
+# NEXT_PUBLIC_* are inlined at build time (browser config), so they are build args.
+FROM node:22-alpine AS deps
+WORKDIR /app
+COPY package.json package-lock.json* ./
+# npm install (not ci): @hanzo/gui pulls a react-native dep tree whose
+# platform/optional packages (e.g. react-native-worklets) resolve differently
+# across npm versions, so a lockfile generated by one npm fails `npm ci` under
+# another (EUSAGE "Missing: react-native-worklets@... from lock file"). install
+# reconciles the tree deterministically for the build platform.
+RUN npm install --no-audit --no-fund
+
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+# public/ may be empty (git doesn't track empty dirs) — ensure it exists for the runner COPY.
+RUN mkdir -p public
+# ONE brand-agnostic image: brand (IAM org/issuer/app + wordmark) is resolved at
+# RUNTIME from the request hostname (src/config/index.ts), and /v1 is same-origin
+# per host. Baking NEXT_PUBLIC_* here would inline a single brand and break that —
+# so nothing brand-specific is baked.
+# Next 15 + @hanzo/gui (large RN dep tree) overflows Node's default heap on the
+# build node → OOMKill (exit 137). Cap the heap generously, as every other Hanzo
+# Next build does (chat uses 4096).
+ENV NEXT_TELEMETRY_DISABLED=1 NODE_OPTIONS=--max-old-space-size=6144
+RUN npm run build
+
+FROM node:22-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=4000
+RUN addgroup -S app && adduser -S app -G app
+COPY --from=build /app/.next ./.next
+COPY --from=build /app/public ./public
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/package.json ./package.json
+COPY --from=build /app/next.config.mjs ./next.config.mjs
+USER app
+EXPOSE 4000
+CMD ["npm", "run", "start"]

LICENSE

@@ -1,25 +1,42 @@
-Copyright (c) 2023--2024 Langfuse GmbH
+BSD 3-Clause License
 
-Portions of this software are licensed as follows:
+Copyright (c) 2026-present, Hanzo AI, Inc.
 
-- All content that resides under the "ee/" and/or "web/src/ee" directories of this repository, if these directories exist, is licensed under the license defined in "ee/LICENSE".
-- All third party components incorporated into the Finto Technologies Software are licensed under the original license provided by the owner of the applicable component.
-- Content outside of the above mentioned directories or restrictions above is available under the "MIT Expat" license as defined below.
+Portions of this software are derived from upstream code originally licensed under
+the MIT License, with the following copyright notices retained per its terms:
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+  Copyright (c) 2020 Nate Wienert
+  Copyright (c) 2015-present, Nicolas Gallagher.
+  Copyright (c) 2015-present, Facebook, Inc.
+  Copyright (c) 2021 Radix
+  Copyright (c) 2017 Carmelo Pullara
+  Copyright (c) 2018 Framer B.V.
+  Copyright (c) 2022 WorkOS
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+All rights reserved.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

LLM.md

@@ -0,0 +1,353 @@
+# console2 — Hanzo Cloud Console
+
+Unified admin console for **Hanzo Cloud** and all cloud products. Our code,
+BSD-3-Clause, built on **@hanzo/gui** (the Tamagui-based cross-platform UI).
+NOT a Langfuse fork, NOT casibase — it is a clean client over the unified `/v1`
+backend (`hanzoai/cloud`, the casibase API at https://cloud.hanzo.ai/v1/*).
+
+## Base: Next.js 15 (app router) + @hanzo/gui
+
+The @hanzo/gui `expo-router` template was evaluated first and **rejected for a
+standalone repo**: it declares `workspace:*` dependencies (`hanzogui`,
+`@hanzogui/config`, `@hanzogui/babel-plugin`, …) that only resolve inside the gui
+bun monorepo — `npm install` of a copy fails with
+`EUNSUPPORTEDPROTOCOL "workspace:"`. It is also native-first with no real
+typecheck (`"test": "true"`), a poor fit for a data-heavy web admin.
+
+So the base is **Next.js + @hanzo/gui (npm)**. Gui is consumed at **runtime**:
+Next's built-in `transpilePackages` transpiles the Gui ESM packages (discovered
+from `node_modules/@hanzogui`, not hardcoded) and `GuiProvider` injects CSS at
+runtime. Gui is designed to work this way — the optimizing compiler is an
+optimization, not a requirement.
+
+The canonical `@hanzogui/next-plugin@7.3.0` is **broken on npm**: it depends on
+`hanzogui-loader@7.3.0` (unpublished — only `2.x`/`102.x` fork tags exist), and
+that fork renames the export the plugin imports (`GuiPlugin` → `HanzoguiPlugin`).
+Pinning the fork via overrides surfaces the rename at build time. So the plugin
+is unusable standalone; `transpilePackages` is the clean, supported path.
+
+**v5 config uses `onlyShorthandStyleProps`** — components use Gui shorthand style
+props (`p`, `px`, `bg`, `items`, `justify`, `self`, `rounded`, `minH`, …), not
+longhands. With shorthands, `tsc --noEmit` (strict) passes clean and the build
+type-checks with no suppression.
+
+**Next 15, not 14:** @hanzo/gui requires `react>=19`. Next 14 ships React 18 and
+cannot run React 19 (App Router server components are version-locked to the
+bundled React). Next 15.5.x is the current stable that natively supports React
+19 — so 15 is the correct, non-degrading choice. The task's "Next 14" is
+impossible without downgrading Gui or breaking the peer tree.
+
+## Layout
+
+```
+app/                         Next.js app router
+  layout.tsx                 html shell, dark default, mounts <Provider>
+  globals.css                base resets (Gui CSS injected via plugin)
+  signin/page.tsx            sign-in (delegates to IAM)
+  auth/callback/page.tsx     OIDC callback -> /v1/signin -> session
+  (dashboard)/
+    layout.tsx               AuthGate + DashboardShell
+    page.tsx                 product overview cards
+    [...slug]/page.tsx       catch-all: resolves a module+route from the registry
+src/
+  config/index.ts            single env reader (NEXT_PUBLIC_*), branding
+  lib/
+    api/                     typed /v1 client (ours)
+      client.ts              core request: cookies, envelope unwrap, ApiError
+      types.ts               Provider, ModelRoute, Application, Store, Chat, Account
+      providers|model-routes|applications|stores|chats|account.ts
+      index.ts               barrel
+    auth/
+      iam.ts                 @hanzo/iam-js-sdk wrapper (browser-only), getSigninUrl
+      session.tsx            SessionProvider/useSession (account, signIn, signOut)
+    products/
+      registry.tsx           ProductModule[] — the extensibility backbone
+      match.ts               slug -> {module, route, params}
+  components/
+    Provider.tsx             GuiProvider + next-theme + SessionProvider (dark)
+    DashboardShell.tsx       sidebar (from registry) + topbar (adapts dashboard-shell recipe)
+    AuthGate.tsx             gate authenticated routes
+    SignInForm.tsx           adapts sign-in-form recipe; IAM redirect
+    ui/                      PageHeader, DataTable, Field*
+    products/
+      ProvidersModule.tsx    FULL surface: list + view/edit
+      providers/             logic.ts (pure cascade/visibility), List/Edit views
+      ModelsModule.tsx       routes list <-> new/edit
+      models/                logic.ts (newModelRoute), ModelRoute List/Edit views
+      ApplicationsModule.tsx routes list <-> edit
+      applications/          logic.ts (newApplication), List/Edit (deploy/undeploy)
+      StoresModule.tsx       routes list <-> edit
+      stores/                logic.ts (newStore), List (refresh-vectors)/Edit views
+      ChatModule.tsx         routes list <-> read-only chat view
+      chat/                  ChatListView + ChatView (message thread)
+```
+
+Each product module mirrors Providers: a router module (`<X>Module.tsx`), a
+list view + an edit/view, and a pure `logic.ts` (new-record templates / option
+lists). Every module declares a `''` (list) and `:name` (edit/view) route in the
+registry; Models also handles `:name === 'new'` for create (model routes are
+keyed by `owner/modelName`, so modelName is form-entered, not generated).
+
+## /v1 backend client
+
+One `request()` in `lib/api/client.ts`: always `credentials: 'include'` (the
+backend sets a session cookie at `/v1/signin`), forwards `Accept-Language`,
+unwraps the casibase `{ status, msg, data, data2 }` envelope, throws typed
+`ApiError` (401/403 carry status). Base URL = `config.cloudUrl` (default
+`https://cloud.hanzo.ai`, override `NEXT_PUBLIC_CLOUD_URL`).
+
+Endpoint surface ported from `hanzoai/ai` `web/src/backend/*.js`
+(see `docs/endpoints.md`):
+- **ProviderApi** — get-global-providers, get-providers, get-provider,
+  add/update/delete-provider, refresh-mcp-tools
+- **ModelRouteApi** — get(-model-routes|-route), add/update/delete-model-route
+- **ApplicationApi** — get(-applications|-application), add/update/delete,
+  deploy/undeploy-application
+- **StoreApi** — get-global-stores, get-stores, get-store, get-store-names,
+  add/update/delete-store, refresh-store-vectors
+- **ChatApi** — get-global-chats, get-chats, get-chat, add/update/delete-chat
+- **AccountApi** — get-account, signin, signout
+
+## Auth (Hanzo IAM)
+
+`@hanzo/iam-js-sdk` against **`hanzo.id`** — the canonical OIDC issuer
+(`iss=https://hanzo.id`), the one the cloud `/v1` backend validates. `getSigninUrl()`
+builds the authorize URL (`https://hanzo.id/login/oauth/authorize?...redirect_uri=
+<origin>/auth/callback`). IAM returns `?code&state`; the callback posts them to
+`/v1/signin`, which the cloud backend exchanges and mints the session cookie;
+`useSession` then loads `/v1/get-account`.
+
+App/client is **`hanzo-cloud`**, org `hanzo` — NOT a console-specific app. console2
+is a front-end OF the shared cloud `/v1` backend, which exchanges the code and
+validates the token as app `hanzo-cloud` (`aud=hanzo-cloud`), so the browser MUST
+present the same `client_id`. (The `hanzo-cloud` IAM app already whitelists
+`https://console2.hanzo.ai/auth/callback`.)
+
+**Build-time gotcha (the 2026-06 sign-in bug):** every `NEXT_PUBLIC_IAM_*` is
+inlined at BUILD time (browser config), so the *image* — not runtime env — decides
+the issuer. The mainnet image MUST bake `NEXT_PUBLIC_IAM_URL=https://hanzo.id`.
+Baking `iam.hanzo.ai` (the legacy zone, `iss=https://iam.hanzo.ai`) dropped the user
+on iam.hanzo.ai with an issuer mismatch. Fixed in `src/config/index.ts` (default),
+`.env.example`, the `Dockerfile` ARG default, and the mainnet `iam_url` build-arg in
+`.github/workflows/build-image.yml`.
+
+## Product-module registry (extensibility)
+
+`lib/products/registry.tsx` is the single source of nav + routing truth. Each
+cloud product is a `ProductModule { id, label, icon, description, routes }`. The
+sidebar, overview, and the catch-all route all render from it. **Adding a cloud
+product = appending one entry + its module component(s); no shell or route
+edits.** A module owns its routes and components and knows nothing about
+siblings (orthogonal).
+
+## Dev
+
+```bash
+npm install
+cp .env.example .env.local   # set NEXT_PUBLIC_IAM_CLIENT_ID for live auth
+npm run typecheck            # tsc --noEmit (strict) — clean
+npm run build                # next build (type-checks; Gui CSS injected at runtime)
+npm run dev                  # http://localhost:4000
+```
+
+Data layer is the unified `/v1` backend — this repo is frontend only. Do NOT
+add Postgres/Mongo/etc. Do NOT build Docker images locally (CI/CD does that).
+
+## Cloud console — 10-category CLOUD AXIS + embedded PaaS (feat/cloud-taxonomy-10cat)
+
+The catalog (`src/lib/products/registry.tsx`) is reorganized from 6 ad-hoc
+categories to the canonical **10-category cloud axis** (the same taxonomy as the
+hanzo.ai product surface, `/tmp/hanzo-cloud-taxonomy.md`), so console2 reads like
+a cloud console (GCP/AWS) — resources grouped by cloud primitive, two rows of
+five:
+
+```
+AI        Compute     Data        Network     Security
+Dev       Deploy      Observe     Chain       Apps
+```
+
+**Three entry kinds, zero dead links, zero fakes** (`CatalogEntry.kind` +
+`status`):
+- `module`  — in-console admin surface (Providers/Models/Chat/Stores=Vector/
+  Applications, + the embedded PaaS).
+- `external`— a REAL Hanzo product on its own domain (Inference→api.hanzo.ai,
+  Search→search.hanzo.ai, Bot→hanzo.bot, IAM→iam, KMS→kms, Observe/Traces/
+  Dashboards→console.hanzo.ai, Analytics, Cost→billing, Object Storage→s3,
+  Edge, Flow, Sign, Crawl, Studio).
+- `soon`    — a real cloud primitive without a UI yet (GPUs, VPC, HSM, Settlement,
+  …). Renders an HONEST in-console "coming soon" overview (`ComingSoon.tsx`,
+  resolved by id from the path) that points at the API/CLI — **never a 404 and
+  never a fabricated product card**. A `soon` entry is a `module` under the hood
+  (single route → `ComingSoon`), so routing is unchanged.
+
+The nav shell, catalog home, favorites, and router still render from the one
+`catalog` list. `status: 'soon'` shows a "Coming soon" badge + affordance.
+
+### Job 3 — PaaS embedded natively under Deploy (NOT an iframe)
+
+`PlatformModule.tsx` is the embedded PaaS, wired to the REAL platform.hanzo.ai
+control plane. The browser calls console2's OWN origin under `/paas/*`; the
+server route `app/paas/[...path]/route.ts` forwards to `platform.hanzo.ai/v1/*`
+with the service token from **server-only** env `PAAS_SERVICE_TOKEN` (sourced via
+KMS — never `NEXT_PUBLIC_`, never in the browser bundle, no CORS). It lists real
+apps across clusters with **declared vs running tag + drift** and a real
+health-gated **redeploy** (`POST /v1/apps/<id>/redeploy`). The six Deploy
+sub-pages (Projects/Environments/Builds/Registry/Releases/Pipelines) are tabs
+over the same real inventory. States are honest: loading, **not-configured (501
+when `PAAS_SERVICE_TOKEN` is unset)**, error, empty — it never invents rows.
+To light up real data in prod: add `PAAS_SERVICE_TOKEN` (+ optional
+`PLATFORM_URL`) to the console2 deployment env via a KMSSecret.
+
+### Job 4 — no fake/placeholder/stub data
+
+The catalog is honest by construction (every leaf → real module, real product
+domain, or honest `soon` overview). The PaaS embed shows only real control-plane
+data with honest empty/not-configured states. No lorem stats, no demo projects,
+no placeholder cards.
+
+Build: arcd self-hosted CI (`.github/workflows/build-image.yml`, push to `main` →
+`ghcr.io/hanzoai/console2:v<package.json version>`, SEMVER only). The
+`hanzo-build-linux-amd64` ARC runner pool is the builder (online; not GHA-hosted).
+
+Deploy: console2 IS an operator `Service` CR now (`hanzo.ai/v1`, `hsvc console2`,
+ns `hanzo`) — declared in `universe/infra/k8s/operator/crs/console2-v1.yaml`.
+Bump `spec.image.tag`, `kubectl apply`, the operator reconciles. Verify live with
+headless Playwright on console2.hanzo.ai.
+
+## Live verification + backend wiring (v0.1.8)
+
+> v0.1.7 was a parallel CTO branch (`fix/paas-live-data`) that wired only
+> Clusters/Kubernetes/Status to the platform `/v1` surface; it is integrated here
+> (`-s ours`) and superseded — v0.1.8 is the cumulative release with the full set
+> below.
+
+Every embedded module was Playwright-verified live against the real `/v1` backend
+(authenticated hanzo-org admin). The backend topology console2 actually talks to:
+the same-origin `/v1` ingress routes to **cloud-api** directly (NOT the full
+api.hanzo.ai gateway), and `/paas/*` is console2's own server route → platform.
+
+Findings + fixes (all in console2; honest states everywhere, no fakes):
+- **X-Org-Id (the big one).** The provisioning sub-service (vector/sql/kv/s3/
+  datastore/docdb/search) requires an `X-Org-Id` header and 403s `"X-Org-Id
+  required"` without it — cloud-api on the direct path does NOT inject it from the
+  session. Fix: `lib/api/client.ts` now stamps `X-Org-Id: config.iamOrgName`
+  (brand org, the user's own) on every cloud call (`baseHeaders`). All 7 data
+  modules now return real data / honest empty `[]`.
+- **PaaS token was wrong.** The CR wired `PAAS_SERVICE_TOKEN` to
+  `hanzo-paas/MASTERTOKEN` (`hanzo-master-token`), which platform.hanzo.ai
+  **rejects (401)**. The correct token is in secret **`paas-console-token`** key
+  `PAAS_SERVICE_TOKEN` (== `platform-service-token`). CR repointed there.
+- **Platform contract was wrong.** The real platform serves `GET /v1/apps` (the
+  apps inventory: declared/running/latest tag + drift + health + cluster +
+  namespace, ~100 services) and `GET|POST /v1/org/{org}/cluster` — NOT
+  `/v1/clusters` and NOT any `/k8s/{kind}` passthrough (those 401/404). `lib/api/
+  platform.ts` reworked to `PlatformApi.apps()` + org-scoped `listClusters`/
+  `provisionCluster`; dead `KubernetesApi`/`CLUSTER_ROUTES` removed.
+  - **Status** now reads `/v1/apps` → REAL health board (Services/Healthy/Clusters).
+  - **Kubernetes** now reads `/v1/apps` → REAL workloads per cluster (picker from
+    the clusters that actually appear).
+  - **Clusters** lists real dedicated DOKS via `/v1/org/{org}/cluster` (honest
+    empty; provision form wired to the real endpoint). Attach-by-kubeconfig dropped
+    (no backend).
+  - `interpretPlatformError` maps upstream 401/403 → honest "not configured".
+- **Bot** `/v1/bot/health` 404s on cloud-api (bot-gateway runs behind
+  api.hanzo.ai/hanzo.bot, not this host) → honest "not routed on this host" state
+  (was a red error).
+- **Wallet** cloud-credit `/v1/billing/balance` 404s here (billing ships
+  separately) → honest "not available on this deployment" (was a scary error).
+  HUSD balance/top-up already honest "coming" (token unconfigured).
+- **Providers was broken** — `ProviderListView`/`ProviderEditView` imported the
+  ZAP twin (`~/lib/zap`), but the cloud `/zap` WS face is NOT served (the edge
+  returns SPA HTML, 200 not a WS upgrade — documented in `lib/zap/client.ts`), so
+  the module showed "Failed to load providers". Switched both back to the working
+  REST `~/lib/api` (identical surface). The ZAP twin stays as the proof-of-pattern
+  until `/zap` is bound. Providers now shows real/empty over REST like every module.
+- Already-correct honest states (unchanged): IAM/Audit + KMS/Secrets (`/v1/iam`,
+  `/v1/kms` 404 → "not available on this deployment"); Observability (`/v1/o11y`
+  503 → "runtime not initialized"). Plans/Embeddings show real data; Models/
+  Providers/Applications/Chat honest-empty.
+
+`StatusTag` now also understands platform health verdicts (green/yellow/red).
+
+## Working AI + API keys + chrome polish (v0.6.0)
+
+The investor-demo wave. ROOT CAUSE of "chats/playground don't work": the gateway
+chat endpoints REQUIRE `Authorization: Bearer` — a session cookie alone is
+rejected ("Invalid API key format"). The browser sent cookie-only, so every AI
+call (chat, playground, cmd+K `>`/`?`) failed. Fixed with two server routes that
+keep all credentials server-side (the browser only ever sends its session cookie):
+
+- **`app/ai/[...path]/route.ts`** — keyless AI proxy. Resolves the user from the
+  session cookie (cloud `/v1/get-account`), mints a SHORT-LIVED user-bound IAM
+  token (`/v1/iam/issue-user-token`, cached per-user until ~60s pre-expiry) as the
+  confidential `hanzo-console` client, and forwards to `AI_GATEWAY_URL/v1/<path>`
+  with `Bearer <token>`. Allow-listed to `v1/models|chat|chat/completions|
+  embeddings|rerank` (not a general tunnel). `playground.ts` now points at this
+  proxy (`<origin>/ai`), so Models/Playground/Chat/cmd+K all work with no key in
+  the browser and no rotation on a chat turn.
+- **`app/keys/route.ts`** — per-user `hk-` Cloud API key. POST mint/rotate, DELETE
+  revoke, GET status (no secret). Same app-on-behalf pattern via
+  `/v1/iam/mint-user-keys` + `/v1/iam/revoke-user-keys`. The `hk-` secret is shown
+  ONCE (POST). `ApiKeysModule` is now create/copy/rotate/revoke.
+- Shared trust boundary: `src/lib/server/identity.ts` (server-only) — `resolveUser`
+  + `mintUserKey`/`revokeUserKey`/`issueUserToken`. The `hanzo-console` client is
+  allow-listed in IAM `IAM_KEY_MINT_ALLOWED_APPS`; verified end-to-end that a
+  minted `hk-` key and an issued user JWT both 200 on `api.hanzo.ai/v1/chat/
+  completions`.
+- **Chat is interactive** (`chat/ChatConversation.tsx`): a real multi-turn
+  conversation over `AiApi.chat` (→ the `/ai` proxy), with a Zen default model,
+  honest 402 "add credits" state, and a "History" toggle to the old session list.
+- **Chrome**: the sidebar/header show the Hanzo **H mark + "Console"**
+  (`ui/HanzoMark.tsx` + `ui/BrandLogo.tsx`; `BrandLogo` shows the org's IAM logo
+  when set, else the H). A fullscreen **app launcher** (`components/AppLauncher.tsx`,
+  Launchpad-style grid + filter) opens from the header "Apps" button, the sidebar
+  grid icon, and the command palette's "Browse all apps". cmd+K stays the palette.
+
+Server-only env the routes need (added to `console2-v1.yaml`, never `NEXT_PUBLIC_`):
+`IAM_URL`, `CLOUD_API_URL` (in-cluster cloud-api), `AI_GATEWAY_URL` (api.hanzo.ai),
+and `IAM_MINT_CLIENT_ID`/`IAM_MINT_CLIENT_SECRET` from secret `hanzo-console-iam-creds`.
+
+## Admin console live data + org switching (v0.7.0)
+
+The "models empty" + "org switcher broken" wave. ONE root cause: `/v1/iam`,
+`/v1/kms`, `/v1/models` 404 (or 401 cookie-only) on the console host, so the
+catalog, switcher, IAM, and KMS modules rendered honest-empty. Fix = route every
+privileged call through console2's OWN server proxies (which add the user bearer +
+the admin gate), and make org scope a first-class, switchable value.
+
+- **Model catalog (the "models missing" bug).** `CloudModelApi.list()` hit cloud
+  `/v1/models` with a cookie only → 401 → empty. Repointed at the `/ai` proxy via
+  the shared `aiV1Url('models')` (`lib/api/client.ts` now owns `aiBase`/`aiV1Url` —
+  ONE place defines the proxy origin; `playground.ts` uses it too). The proxy mints
+  a short-lived user token, so the catalog populates with the live Zen models.
+  Pricing stays best-effort on the cloud origin (degrades to "—", never fabricated).
+- **Org scope is a value, not a place** (`lib/org-scope.ts`). `currentOrg()` /
+  `setCurrentOrg()` / `isScopedAway()` / `filterOrgs()`. Default = the brand org;
+  a global admin (z@hanzo.ai) can switch to ANY org. Brand identity (host wordmark/
+  logo) is orthogonal and unchanged — only the DATA scope moves. `client.ts`
+  `baseHeaders` now stamps `X-Org-Id: currentOrg()` (was the fixed brand org), so
+  every cloud-data module re-scopes on switch.
+- **OrgSwitcher** lists ALL visible orgs (`IamAdminApi.organizations()` via the
+  `/admin/iam` proxy → global admin sees every org), adds a **filter** box
+  (`filterOrgs`), and **switches in place**: `setCurrentOrg` + reload refetches
+  every module under the new `X-Org-Id`. The IAM/KMS proxies authorize a global
+  admin for any org and pin a brand admin to their own, so the re-scope is safe.
+- **IAM module** (`AdminModule.tsx` `IamModule`/`AuditModule`) reads users/roles/
+  records for `currentOrg()` (the org list itself is unscoped — what powers the
+  switcher). **KMS module** (`KmsModule.tsx`) was a dead cloud-path probe; now a
+  names-only inventory over `KmsAdminApi.list({ org })` (the `/admin/kms` proxy +
+  kmsd's metadata-list endpoint, v0.159.4+). Values are NEVER fetched/rendered;
+  honest states: loading, operator-access-required (403), listing-unavailable (404),
+  empty.
+- **Decomplected gate** (`lib/server/admin-policy.ts`, pure, tested). `gateAllows`
+  (`@<adminDomain>` email AND IAM admin), `ownerAllowed`, `orgFor` — extracted from
+  `getAdminGate` + the IAM/KMS routes so the SAME predicate that ships is the one
+  unit-tested. A brand admin can never `orgFor` to another org's KMS (no secret
+  leak across orgs).
+- **Tests** (vitest, `npm test`): `admin-policy.test.ts` (gate allow/deny + tenant
+  scoping), `org-scope.test.ts` (default→switch→reset + filter), `models-catalog.
+  test.ts` (catalog fetches `<origin>/ai/v1/models`, never the cookie-only cloud
+  path). RED→GREEN, 22 tests. `tsc --noEmit` + `next build` clean.
+- The console2 CR already carries the env the proxies need (`IAM_URL`,
+  `CLOUD_API_URL`, `AI_GATEWAY_URL`, `IAM_MINT_CLIENT_*`); `KMS_URL` defaults to
+  `http://kms.hanzo.svc`. `admin.hanzo.ai` added to the CR ingress hosts.

README.md

@@ -1,193 +1,51 @@
-![Langfuse GitHub Banner](https://github.com/langfuse/langfuse/assets/121163007/6035f0f3-d691-4963-b5d0-10cf506e9d42)
+<p align="center"><img src=".github/hero.svg" alt="console2" width="880"></p>
 
-<div align="center"><h1>Langfuse: Open Source LLM Engineering Platform</h1></div>
-<div align="center"><h4>LLM Observability, Prompt Management, LLM Evaluations,<br/>Datasets, LLM Metrics, and Prompt Playground</h4></div>
+# Hanzo Cloud Console
 
-<div align="center">
-   <div>
-      <h3>
-         <a href="https://cloud.langfuse.com">
-            <strong>Sign up</strong>
-         </a> · 
-         <a href="https://langfuse.com/docs/deployment/self-host">
-            <strong>Self Host</strong>
-         </a> · 
-         <a href="https://langfuse.com/demo">
-            <strong>Demo (live data)</strong>
-         </a>
-      </h3>
-   </div>
-   <div>
-      <a href="https://langfuse.com/docs"><strong>Docs</strong></a> ·
-      <a href="https://langfuse.com/issues"><strong>Report Bug</strong></a> ·
-      <a href="https://langfuse.com/ideas"><strong>Feature Request</strong></a> ·
-      <a href="https://langfuse.com/changelog"><strong>Changelog</strong></a> ·
-      <a href="https://langfuse.com/roadmap"><strong>Roadmap</strong></a> ·
-      <a href="https://langfuse.com/discord"><strong>Discord</strong></a> 
-   </div>
-   <span>Langfuse uses <a href="https://github.com/orgs/langfuse/discussions"><strong>Github Discussions</strong></a>  for Support and Feature Requests.</span>
-   <br/>
-   <span>We're hiring. <a href="https://langfuse.com/careers"><strong>Join us</strong></a> in Product Engineering and Developer Relations.</span>
-   <br/>
-   <br/>
-   <div>
-      <a href="https://github.com/langfuse/langfuse/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-red.svg?style=flat-square" alt="MIT License"></a>
-      <a href="https://www.ycombinator.com/companies/langfuse"><img src="https://img.shields.io/badge/Y%20Combinator-W23-orange?style=flat-square" alt="Y Combinator W23"></a>
-      <a href="https://github.com/langfuse/langfuse/pkgs/container/langfuse"><img alt="Docker Image" src="https://img.shields.io/badge/docker-langfuse-blue?logo=Docker&logoColor=white&style=flat-square"></a>
-      <a href="https://pypi.python.org/pypi/langfuse"><img src="https://img.shields.io/pypi/dm/langfuse?style=flat-square&logo=python&logoColor=white&label=pypi%20langfuse&color=blue" alt="langfuse Python package on PyPi"></a>
-      <a href="https://www.npmjs.com/package/langfuse"><img src="https://img.shields.io/npm/dm/langfuse?style=flat-square&logo=npm&logoColor=white&label=npm%20langfuse&color=blue" alt="langfuse npm package"></a>
-   </div>
-</div>
-</br>
+Unified admin console for **Hanzo Cloud** and all Hanzo cloud products. Built on
+[@hanzo/gui](https://gui.hanzo.ai) (cross-platform UI) over the unified `/v1`
+backend (`hanzoai/cloud`). Dark theme, OIDC sign-in via Hanzo IAM.
 
-## Langfuse Overview
+Manages: **Providers · Models · Applications · Stores · Chat** — with an
+extensible product-module registry so every cloud product can be added as a
+module.
 
-_Unmute video for voice-over_
-
-https://github.com/langfuse/langfuse/assets/2834609/a94062e9-c782-4ee9-af59-dee6370149a8
-
-### Develop
-
-- **LLM Observability:** Instrument your app and start ingesting traces to Langfuse ([Quickstart](https://langfuse.com/docs/get-started), [Integrations](https://langfuse.com/docs/integrations) [Tracing](https://langfuse.com/docs/tracing))
-- **Langfuse UI:** Inspect and debug complex logs ([Demo](https://langfuse.com/docs/demo), [Tracing](https://langfuse.com/docs/tracing))
-- **Prompt Management:** Manage, version and deploy prompts from within Langfuse ([Prompt Management](https://langfuse.com/docs/prompts/get-started))
-- **Prompt Engineering:** Test and iterate on your prompts with the [LLM Playground](https://langfuse.com/docs/playground)
-
-### Monitor
-
-- **LLM Analytics:** Track metrics (cost, latency, quality) and gain insights from dashboards & data exports ([Analytics](https://langfuse.com/docs/analytics))
-- **LLM Evaluations:** Collect and calculate scores for your LLM completions ([Scores & Evaluations](https://langfuse.com/docs/scores))
-  - Run ([Model-based evaluations](https://langfuse.com/docs/scores/model-based-evals)) and LLM-as-a-Judge within Langfuse
-  - Collect user feedback ([User Feedback](https://langfuse.com/docs/scores/user-feedback))
-  - Manually score LLM outputs in Langfuse ([Manual Scores](https://langfuse.com/docs/scores/manually))
-
-### Test
-
-- **Experiments:** Track and test app behaviour before deploying a new version
-  - Datasets let you test expected in and output pairs and benchmark performance before deploying ([Datasets](https://langfuse.com/docs/datasets))
-  - Track versions and releases in your application ([Experimentation](https://langfuse.com/docs/experimentation), [Prompt Management](https://langfuse.com/docs/prompts))
-
-## Get started
-
-### Langfuse Cloud
-
-Managed deployment by the Langfuse team, generous free-tier (hobby plan), no credit card required.
-
-**[» Langfuse Cloud](https://cloud.langfuse.com)**
-
-## Self-Hosting Open Source LLM Observability with Langfuse
-
-### Localhost (docker)
+## Quick start
 
 ```bash
-# Clone repository
-git clone https://github.com/langfuse/langfuse.git
-cd langfuse
-
-# Run server and database
-docker compose up -d
+npm install
+cp .env.example .env.local
+# set NEXT_PUBLIC_IAM_CLIENT_ID for live sign-in; defaults point at production.
+npm run dev          # http://localhost:4000
 ```
 
-[→ Learn more about deploying locally](https://langfuse.com/docs/deployment/local)
+## Scripts
 
-### Self-host (docker)
+| Script | What |
+| --- | --- |
+| `npm run dev` | Dev server on :4000 |
+| `npm run build` | Production build (type-checks; Gui CSS injected at runtime) |
+| `npm run start` | Serve the production build |
+| `npm run typecheck` | `tsc --noEmit` (strict) |
 
-Langfuse is simple to self-host and keep updated. It currently requires only a single docker container and a postgres database.
-[→ Self Hosting Instructions](https://langfuse.com/docs/deployment/self-host)
+## Configuration
 
-Templated deployments: [Railway, GCP, AWS, Azure, Kubernetes and others](https://langfuse.com/docs/deployment/self-host#platform-specific-information)
+All config is `NEXT_PUBLIC_*` (browser app, cookie auth). See `.env.example`.
 
-## Get Started
+| Var | Default | Meaning |
+| --- | --- | --- |
+| `NEXT_PUBLIC_CLOUD_URL` | `https://cloud.hanzo.ai` | Unified `/v1` backend base URL |
+| `NEXT_PUBLIC_IAM_URL` | `https://iam.hanzo.ai` | Hanzo IAM OIDC authority |
+| `NEXT_PUBLIC_IAM_APP_NAME` | `hanzo-console` | IAM application (`<org>-<app>`) |
+| `NEXT_PUBLIC_IAM_ORG_NAME` | `hanzo` | IAM organization |
+| `NEXT_PUBLIC_IAM_CLIENT_ID` | — | OAuth client id |
 
-### API Keys
+## Architecture
 
-You need a Langfuse public and secret key to get started. Sign up [here](https://cloud.langfuse.com) and find them in your project settings.
-
-### Ingesting Data · Instrumenting Your Application · LLM Observability with Langfuse
-
-Note: We recommend using our fully async, typed [SDKs](https://langfuse.com/docs/sdk) that allow you to instrument any LLM application with any underlying model. They are available in [Python (Decorators)](https://langfuse.com/docs/sdk/python) & [JS/TS](https://langfuse.com/docs/sdk/typescript). The SDKs will always be the most fully featured and stable way to ingest data into Langfuse.
-
-See the [→ Quickstart](https://langfuse.com/docs/get-started) to integrate Langfuse.
-
-### LLM Observability Integrations
-
-| Integration                                                                  | Supports                   | Description                                                                                                                                      |
-| ---------------------------------------------------------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| [SDK](https://langfuse.com/docs/sdk)                                         | Python, JS/TS              | Manual instrumentation using the SDKs for full flexibility.                                                                                      |
-| [OpenAI](https://langfuse.com/docs/integrations/openai)                      | Python, JS/TS              | Automated instrumentation using drop-in replacement of OpenAI SDK.                                                                               |
-| [Langchain](https://langfuse.com/docs/integrations/langchain)                | Python, JS/TS              | Automated instrumentation by passing callback handler to Langchain application.                                                                  |
-| [LlamaIndex](https://langfuse.com/docs/integrations/llama-index/get-started) | Python                     | Automated instrumentation via LlamaIndex callback system.                                                                                        |
-| [Haystack](https://langfuse.com/docs/integrations/haystack)                  | Python                     | Automated instrumentation via Haystack content tracing system.                                                                                   |
-| [LiteLLM](https://langfuse.com/docs/integrations/litellm)                    | Python, JS/TS (proxy only) | Use any LLM as a drop in replacement for GPT. Use Azure, OpenAI, Cohere, Anthropic, Ollama, VLLM, Sagemaker, HuggingFace, Replicate (100+ LLMs). |
-| [Vercel AI SDK](https://langfuse.com/docs/integrations/vercel-ai-sdk)        | JS/TS                      | TypeScript toolkit designed to help developers build AI-powered applications with React, Next.js, Vue, Svelte, Node.js.                          |
-| [API](https://langfuse.com/docs/api)                                         |                            | Directly call the public API. OpenAPI spec available.                                                                                            |
-
-Packages integrated with Langfuse:
-
-| Name                                                            | Description                                                                                                             |
-| --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
-| [Instructor](https://langfuse.com/docs/integrations/instructor) | Library to get structured LLM outputs (JSON, Pydantic)                                                                  |
-| [Dify](https://langfuse.com/docs/integrations/dify)             | Open source LLM app development platform with no-code builder.                                                          |
-| [Ollama](https://langfuse.com/docs/integrations/ollama)         | Easily run open source LLMs on your own machine.                                                                        |
-| [Mirascope](https://langfuse.com/docs/integrations/mirascope)   | Python toolkit for building LLM applications.                                                                           |
-| [Flowise](https://langfuse.com/docs/integrations/flowise)       | JS/TS no-code builder for customized LLM flows.                                                                         |
-| [Langflow](https://langfuse.com/docs/integrations/langflow)     | Python-based UI for LangChain, designed with react-flow to provide an effortless way to experiment and prototype flows. |
-
-## Questions and feedback
-
-### Ideas and roadmap
-
-- [Roadmap](https://langfuse.com/roadmap)
-- [GitHub Discussions](https://github.com/orgs/langfuse/discussions)
-- [Feature Requests](https://langfuse.com/ideas)
-
-### Support and feedback
-
-In order of preference the best way to communicate with us:
-
-- [GitHub Discussions](https://github.com/orgs/langfuse/discussions) (preferred): Contribute [ideas](https://langfuse.com/ideas), [support requests](https://langfuse.com/gh-support) and [report bugs](https://langfuse.com/issues)
-- [Discord](https://langfuse.com/discord): community support
-- Privately: contact at langfuse dot com
-
-## Contributing to Langfuse
-
-- Vote on [Ideas](https://github.com/orgs/langfuse/discussions/categories/ideas)
-- Raise and comment on [Issues](https://github.com/langfuse/langfuse/issues)
-- Open a PR - see [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to setup a development environment.
+See [LLM.md](./LLM.md) for the full design (base choice, /v1 client, auth flow,
+the product-module registry, and the Providers surface). Endpoint reference in
+[docs/endpoints.md](./docs/endpoints.md).
 
 ## License
 
-This repository is MIT licensed, except for the `ee` folders. See [LICENSE](LICENSE) and [docs](https://langfuse.com/docs/open-source) for more details.
-
-## Misc
-
-### GET API to export your data
-
-[**GET routes**](https://langfuse.com/docs/integrations/api) to use data in downstream applications (e.g. embedded analytics). You can also access them conveniently via the SDKs ([docs](https://langfuse.com/docs/query-traces)).
-
-### Security & Privacy
-
-We take data security and privacy seriously. Please refer to our [Security and Privacy](https://langfuse.com/security) page for more information.
-
-### Telemetry
-
-By default, Langfuse automatically reports basic usage statistics of self-hosted instances to a centralized server (PostHog).
-
-This helps us to:
-
-1. Understand how Langfuse is used and improve the most relevant features.
-2. Track overall usage for internal and external (e.g. fundraising) reporting.
-
-None of the data is shared with third parties and does not include any sensitive information. We want to be super transparent about this and you can find the exact data we collect [here](/web/src/features/telemetry/index.ts).
-
-You can opt-out by setting `TELEMETRY_ENABLED=false`.
-
-### Star History
-
-<a href="https://star-history.com/#langfuse/langfuse&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=langfuse/langfuse&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=langfuse/langfuse&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=langfuse/langfuse&type=Date" />
- </picture>
-</a>
+BSD-3-Clause. Copyright (c) 2026-present, Hanzo AI, Inc.

SECURITY.md

@@ -1,4 +0,0 @@
-## Security Policy
-We strongly recommend using the latest version of Langfuse to receive all security updates.
-
-For more information, please refer to the [Data Security & Privacy](https://langfuse.com/docs/data-security-privacy) page in the documentation or contact security@langfuse.com.

app/(dashboard)/[...slug]/page.tsx

@@ -0,0 +1,20 @@
+'use client'
+
+import { use } from 'react'
+import { notFound } from 'next/navigation'
+
+import { matchRoute } from '~/lib/products/match'
+
+/**
+ * Catch-all product route. Resolves the module + route from the registry and
+ * renders its component. Adding a product anywhere in the registry makes its
+ * routes live here — no per-product page files.
+ */
+export default function ProductPage({ params }: { params: Promise<{ slug: string[] }> }) {
+  const { slug } = use(params)
+  const matched = matchRoute(slug)
+  if (!matched) notFound()
+
+  const Component = matched.route.component
+  return <Component params={matched.params} />
+}

app/(dashboard)/discover/[id]/page.tsx

@@ -0,0 +1,15 @@
+'use client'
+
+import { use } from 'react'
+
+import { ProductInterstitial } from '~/components/products/ProductInterstitial'
+
+/**
+ * Product discover screen — `/discover/<id>` renders the interstitial for one
+ * catalog entry (docs, OSS source, revenue share, open/get-started). A dedicated
+ * route (more specific than the `[...slug]` product catch-all) so it's shareable.
+ */
+export default function DiscoverPage({ params }: { params: Promise<{ id: string }> }) {
+  const { id } = use(params)
+  return <ProductInterstitial id={id} />
+}

app/(dashboard)/layout.tsx

@@ -0,0 +1,28 @@
+import type { ReactNode } from 'react'
+
+import { AuthGate } from '~/components/AuthGate'
+import { OrgGate } from '~/components/OrgGate'
+import { DashboardShell } from '~/components/DashboardShell'
+import { PreferencesProvider } from '~/lib/products/preferences'
+import { ToastProvider } from '~/components/ui/Toast'
+import { CommandPaletteProvider } from '~/components/CommandPalette'
+import { AppLauncherProvider } from '~/components/AppLauncher'
+
+export default function DashboardLayout({ children }: { children: ReactNode }) {
+  return (
+    <AuthGate>
+      <OrgGate>
+        <PreferencesProvider>
+        <ToastProvider>
+          {/* AppLauncher wraps the palette so the palette can open the launcher. */}
+          <AppLauncherProvider>
+            <CommandPaletteProvider>
+              <DashboardShell>{children}</DashboardShell>
+            </CommandPaletteProvider>
+          </AppLauncherProvider>
+        </ToastProvider>
+        </PreferencesProvider>
+      </OrgGate>
+    </AuthGate>
+  )
+}

app/(dashboard)/page.tsx

@@ -0,0 +1,140 @@
+'use client'
+
+/**
+ * Product catalog — the unified console home. Every Hanzo product, grouped by
+ * the ten canonical categories, with its enablement state and Google Cloud
+ * equivalent. `enabled` and `external` products open straight in (in-console or
+ * a new tab); `soon` products link to their discover screen. Each card can be
+ * pinned to the sidebar (persisted to the account). Rendered entirely from the
+ * catalog registry.
+ */
+import { useRouter } from 'next/navigation'
+import { Button, Card, Text, XStack, YStack } from '@hanzo/gui'
+import { Star, Lock, ExternalLink, ArrowRight, Info } from '@hanzogui/lucide-icons-2'
+
+import { config } from '~/config'
+import { catalogByCategory, type CatalogEntry } from '~/lib/products/registry'
+import { openProduct } from '~/lib/products/open'
+import { useFavorites } from '~/lib/products/favorites'
+import { PageHeader } from '~/components/ui/PageHeader'
+
+const STATUS_LABEL = { enabled: 'Enabled', external: 'External', soon: 'Soon' } as const
+const STATUS_BG = { enabled: '$color5', external: '$color3', soon: '$color4' } as const
+
+function StatusBadge({ entry }: { entry: CatalogEntry }) {
+  return (
+    <XStack bg={STATUS_BG[entry.status]} px="$2" py="$1" rounded="$10" items="center" gap="$1">
+      {entry.admin ? <Lock size={11} opacity={0.6} /> : null}
+      <Text fontSize="$1" color={entry.status === 'enabled' ? '$color12' : '$color11'} fontWeight="600">
+        {STATUS_LABEL[entry.status]}
+      </Text>
+    </XStack>
+  )
+}
+
+function ProductCard({
+  entry,
+  pinned,
+  onOpen,
+  onToggle,
+  onLearnMore,
+}: {
+  entry: CatalogEntry
+  pinned: boolean
+  onOpen: () => void
+  onToggle: () => void
+  onLearnMore: () => void
+}) {
+  const Icon = entry.icon
+  const openable = entry.status === 'enabled' || entry.status === 'external'
+  return (
+    <Card borderWidth={1} borderColor="$borderColor" p="$4" gap="$3" width={272}>
+      <XStack justify="space-between" items="flex-start">
+        <XStack gap="$2" items="center" flex={1}>
+          <Icon size={20} />
+          <YStack flex={1}>
+            <Text fontSize="$5" fontWeight="700">
+              {entry.label}
+            </Text>
+            {entry.gcp ? (
+              <Text fontSize="$1" color="$color10">
+                {entry.gcp}
+              </Text>
+            ) : null}
+          </YStack>
+        </XStack>
+        <XStack gap="$1" items="center">
+          <Button
+            size="$2"
+            chromeless
+            opacity={0.4}
+            icon={<Info size={15} />}
+            onPress={onLearnMore}
+            aria-label={`Learn about ${entry.label}`}
+          />
+          <Button
+            size="$2"
+            chromeless
+            opacity={pinned ? 1 : 0.3}
+            icon={<Star size={15} />}
+            onPress={onToggle}
+            aria-label={pinned ? `Unpin ${entry.label}` : `Pin ${entry.label}`}
+          />
+        </XStack>
+      </XStack>
+
+      <Text fontSize="$3" color="$color11" minH={40}>
+        {entry.description}
+      </Text>
+
+      <XStack justify="space-between" items="center">
+        <StatusBadge entry={entry} />
+        <Button
+          size="$2"
+          bg={openable ? '$color5' : 'transparent'}
+          borderWidth={1}
+          borderColor="$borderColor"
+          onPress={openable ? onOpen : onLearnMore}
+          iconAfter={entry.kind === 'external' ? <ExternalLink size={14} /> : <ArrowRight size={14} />}
+        >
+          {openable ? 'Open' : 'Learn more'}
+        </Button>
+      </XStack>
+    </Card>
+  )
+}
+
+export default function DashboardHome() {
+  const router = useRouter()
+  const { toggle, isPinned } = useFavorites()
+  const push = (path: string) => router.push(path)
+  const groups = catalogByCategory()
+
+  return (
+    <>
+      <PageHeader
+        title={config.brandName}
+        subtitle={`See, enable, and manage every ${config.brandName} product from one place.`}
+      />
+      {groups.map((group) => (
+        <YStack key={group.category} gap="$3">
+          <Text fontSize="$5" fontWeight="800" color="$color12">
+            {group.category}
+          </Text>
+          <XStack flexWrap="wrap" gap="$3">
+            {group.entries.map((entry) => (
+              <ProductCard
+                key={entry.id}
+                entry={entry}
+                pinned={isPinned(entry.id)}
+                onOpen={() => openProduct(entry, push)}
+                onToggle={() => toggle(entry.id)}
+                onLearnMore={() => push(`/discover/${entry.id}`)}
+              />
+            ))}
+          </XStack>
+        </YStack>
+      ))}
+    </>
+  )
+}

app/admin/iam/[...path]/route.ts

@@ -0,0 +1,131 @@
+/**
+ * Server-gated IAM admin proxy — the ONLY way the browser reaches IAM admin ops.
+ *
+ * The browser holds no IAM credential and never calls IAM directly. It calls this
+ * SAME-ORIGIN route with just its session cookie; the handler resolves the user,
+ * enforces the brand-admin gate (`getAdminGate`: verified @<adminDomain> email AND
+ * IAM admin), then forwards to `${IAM_URL}/v1/iam/<segment>` as the user (a
+ * short-lived user-bound bearer) so IAM enforces tenant isolation from the
+ * verified `owner` claim. The IAM `{status,msg,data,data2}` envelope is returned
+ * verbatim with its status code.
+ *
+ * Least privilege: only an explicit allow-list of admin segments is reachable
+ * (GET reads / POST mutations), and a non-global admin may reference ONLY their
+ * own org — closing the casdoor `GetUsers(owner)` cross-tenant read gap, which is
+ * NOT scoped by the caller server-side.
+ */
+import { type NextRequest, NextResponse } from 'next/server'
+
+import { getAdminGate, adminBearer, iamBaseUrl, type AdminGate } from '~/lib/server/identity'
+import { ownerAllowed as policyOwnerAllowed } from '~/lib/server/admin-policy'
+
+export const runtime = 'nodejs'
+
+/** Read segments — reachable via GET only. */
+const GET_SEGMENTS = new Set([
+  'get-organizations',
+  'get-organization',
+  'get-users',
+  'get-user',
+  'get-applications',
+  'get-application',
+  'get-providers',
+  'get-provider',
+  'get-roles',
+  'get-records',
+])
+
+/** Mutation segments — reachable via POST only (JSON body forwarded). */
+const POST_SEGMENTS = new Set([
+  'add-user',
+  'update-user',
+  'delete-user',
+  'add-application',
+  'update-application',
+  'delete-application',
+  'add-provider',
+  'update-provider',
+  'delete-provider',
+])
+
+/**
+ * Organization objects are owned by casdoor's built-in `admin`, and the org
+ * list/get endpoints scope results to the caller's org server-side — so `admin`
+ * is an acceptable owner THERE. It is never acceptable for tenant data (users,
+ * roles, ...), where the owner must be the caller's own org.
+ */
+const ORG_ENDPOINTS = new Set(['get-organizations', 'get-organization'])
+
+const forbidden = () => NextResponse.json({ error: 'forbidden' }, { status: 403 })
+const notFound = () => NextResponse.json({ error: 'not found' }, { status: 404 })
+
+/** The `<owner>` in an `<owner>/<name>` id, or null. */
+function idOwner(id: string | null): string | null {
+  if (!id) return null
+  const slash = id.indexOf('/')
+  return slash > 0 ? id.slice(0, slash) : id
+}
+
+/**
+ * A non-global admin may reference ONLY their own org. casdoor's read endpoints
+ * (GetUsers/GetUser) do not enforce this, so the proxy must. The decision is the
+ * pure `admin-policy` predicate (tested in admin-policy.test.ts); this wrapper
+ * just supplies the per-segment org-metadata exception (`ORG_ENDPOINTS`).
+ */
+function ownerAllowed(segment: string, owner: string | null, gate: AdminGate): boolean {
+  return policyOwnerAllowed(owner, {
+    isGlobalAdmin: gate.user.isGlobalAdmin,
+    orgScope: gate.orgScope,
+    orgMetadataOk: ORG_ENDPOINTS.has(segment),
+  })
+}
+
+async function forward(req: NextRequest, segment: string, allowed: Set<string>): Promise<NextResponse> {
+  const gate = await getAdminGate(req)
+  if (!gate) return forbidden()
+  if (!allowed.has(segment)) return notFound()
+
+  const url = req.nextUrl
+  if (!ownerAllowed(segment, url.searchParams.get('owner'), gate)) return forbidden()
+  if (!ownerAllowed(segment, idOwner(url.searchParams.get('id')), gate)) return forbidden()
+
+  let bearer: string
+  try {
+    bearer = await adminBearer(gate.user)
+  } catch (e) {
+    return NextResponse.json(
+      { status: 'error', msg: `Could not authorize the request: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+
+  const headers: Record<string, string> = { Authorization: `Bearer ${bearer}`, Accept: 'application/json' }
+  const init: RequestInit = { method: req.method, headers, cache: 'no-store' }
+  if (req.method === 'POST') {
+    headers['Content-Type'] = 'application/json'
+    init.body = await req.text()
+  }
+
+  try {
+    const res = await fetch(`${iamBaseUrl()}/v1/iam/${segment}${url.search}`, init)
+    const text = await res.text()
+    return new NextResponse(text, {
+      status: res.status,
+      headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' },
+    })
+  } catch (e) {
+    return NextResponse.json(
+      { status: 'error', msg: `IAM unreachable: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+}
+
+type Ctx = { params: Promise<{ path: string[] }> }
+
+export async function GET(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path.join('/'), GET_SEGMENTS)
+}
+export async function POST(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path.join('/'), POST_SEGMENTS)
+}

app/admin/kms/[...path]/route.ts

@@ -0,0 +1,135 @@
+/**
+ * Server-gated KMS admin proxy — the ONLY way the browser reaches Hanzo KMS.
+ *
+ * Same trust boundary as the IAM proxy: the browser sends only its session
+ * cookie, this handler enforces the brand-admin gate, then forwards to kmsd as
+ * the user (short-lived user-bound bearer) so KMS enforces org isolation from the
+ * verified `owner` claim (`canActOnOrg`). Secrets are scoped to the brand org by
+ * default; a global admin may target another org with `?org=`.
+ *
+ * Zero-knowledge discipline: this route NEVER logs a secret value or any request
+ * body, and never derives or stores key material — it is a faithful pass-through
+ * of kmsd's JSON + status code. One resource path (`/admin/kms/secrets`); the
+ * verb + query select the operation:
+ *   GET   ?path=&name=&env=   → reveal one value      → GET    .../secrets/<path>/<name>?env=
+ *   GET   ?prefix=&env=       → list metadata          → GET    .../secrets?prefix=&env=
+ *   POST  {path,name,env,value} → create/upsert        → POST   .../secrets
+ *   PATCH ?path=&name= {value,version,env} → rotate    → PATCH  .../secrets/<path>/<name>
+ *   DELETE ?path=&name=&env=  → delete                 → DELETE .../secrets/<path>/<name>?env=
+ *
+ * kmsd has no list endpoint yet — the list GET returns 404, which the KMS module
+ * renders as an honest "listing requires kmsd ≥ next release" state.
+ */
+import { type NextRequest, NextResponse } from 'next/server'
+
+import { getAdminGate, adminBearer, kmsBaseUrl, type AdminGate } from '~/lib/server/identity'
+import { orgFor as policyOrgFor } from '~/lib/server/admin-policy'
+
+export const runtime = 'nodejs'
+
+const forbidden = () => NextResponse.json({ error: 'forbidden' }, { status: 403 })
+const notFound = () => NextResponse.json({ error: 'not found' }, { status: 404 })
+
+/** `<path>/<name>` for the kmsd route, each segment encoded, slashes preserved. */
+function secretRest(path: string, name: string): string {
+  return [...path.split('/').filter(Boolean), name].map(encodeURIComponent).join('/')
+}
+
+/** Org the operator acts on — the brand org, unless a global admin passes ?org=
+ *  (the pure `admin-policy` predicate, tested in admin-policy.test.ts). */
+function orgFor(gate: AdminGate, req: NextRequest): string {
+  return policyOrgFor(
+    { isGlobalAdmin: gate.user.isGlobalAdmin, orgScope: gate.orgScope },
+    req.nextUrl.searchParams.get('org'),
+  )
+}
+
+async function handle(req: NextRequest, segments: string[]): Promise<NextResponse> {
+  const gate = await getAdminGate(req)
+  if (!gate) return forbidden()
+  if (segments.length !== 1 || segments[0] !== 'secrets') return notFound()
+
+  const org = orgFor(gate, req)
+  const base = `${kmsBaseUrl()}/v1/kms/orgs/${encodeURIComponent(org)}/secrets`
+  const q = req.nextUrl.searchParams
+  const name = q.get('name') ?? ''
+  const path = q.get('path') ?? ''
+  const env = q.get('env') ?? ''
+
+  let target: string
+  let body: string | undefined
+  if (req.method === 'GET') {
+    if (name) {
+      const params = new URLSearchParams()
+      if (env) params.set('env', env)
+      target = `${base}/${secretRest(path, name)}${params.toString() ? `?${params}` : ''}`
+    } else {
+      const params = new URLSearchParams()
+      const prefix = q.get('prefix')
+      if (prefix) params.set('prefix', prefix)
+      if (env) params.set('env', env)
+      target = `${base}${params.toString() ? `?${params}` : ''}`
+    }
+  } else if (req.method === 'POST') {
+    target = base
+    body = await req.text() // {path,name,env,value} — forwarded verbatim, never logged
+  } else if (req.method === 'PATCH') {
+    if (!name) return notFound()
+    target = `${base}/${secretRest(path, name)}`
+    body = await req.text() // {value,version,env} — forwarded verbatim, never logged
+  } else if (req.method === 'DELETE') {
+    if (!name) return notFound()
+    const params = new URLSearchParams()
+    if (env) params.set('env', env)
+    target = `${base}/${secretRest(path, name)}${params.toString() ? `?${params}` : ''}`
+  } else {
+    return notFound()
+  }
+
+  let bearer: string
+  try {
+    bearer = await adminBearer(gate.user)
+  } catch (e) {
+    return NextResponse.json(
+      { message: `Could not authorize the request: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+
+  const headers: Record<string, string> = { Authorization: `Bearer ${bearer}`, Accept: 'application/json' }
+  const init: RequestInit = { method: req.method, headers, cache: 'no-store' }
+  if (body !== undefined) {
+    headers['Content-Type'] = 'application/json'
+    init.body = body
+  }
+
+  try {
+    const res = await fetch(target, init)
+    const text = await res.text()
+    return new NextResponse(text, {
+      status: res.status,
+      headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' },
+    })
+  } catch (e) {
+    // Surface only the transport failure — never the request body/value.
+    return NextResponse.json(
+      { message: `KMS unreachable: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+}
+
+type Ctx = { params: Promise<{ path: string[] }> }
+
+export async function GET(req: NextRequest, ctx: Ctx) {
+  return handle(req, (await ctx.params).path)
+}
+export async function POST(req: NextRequest, ctx: Ctx) {
+  return handle(req, (await ctx.params).path)
+}
+export async function PATCH(req: NextRequest, ctx: Ctx) {
+  return handle(req, (await ctx.params).path)
+}
+export async function DELETE(req: NextRequest, ctx: Ctx) {
+  return handle(req, (await ctx.params).path)
+}

app/ai/[...path]/route.ts

@@ -0,0 +1,114 @@
+/**
+ * Keyless AI proxy — the ONE path the console uses to reach the model gateway.
+ *
+ * `/v1/chat/completions` (and friends) REQUIRE an `Authorization: Bearer` token;
+ * a browser session cookie alone is rejected. Rather than ship the user's durable
+ * `hk-` key to the browser, the console calls its OWN origin (`/ai/v1/...`) with
+ * just the session cookie; this server handler resolves the user, mints a
+ * SHORT-LIVED, user-bound IAM token (issue-user-token, cached until just before
+ * expiry), and forwards to the gateway with that token. No key in the browser, no
+ * rotation on a chat turn, and every call is billed to the user's own org.
+ *
+ * Least privilege: only the read/inference AI endpoints are proxied; anything
+ * else 404s, so this is not a general gateway tunnel.
+ */
+import { type NextRequest, NextResponse } from 'next/server'
+
+import { resolveUser, issueUserToken, type SessionUser } from '~/lib/server/identity'
+
+export const runtime = 'nodejs'
+
+const trim = (s: string) => s.replace(/\/+$/, '')
+/** Gateway the proxied AI calls are forwarded to (gated/priced api.hanzo.ai). */
+const AI_GATEWAY_URL = trim(process.env.AI_GATEWAY_URL ?? 'https://api.hanzo.ai')
+
+/** The exact `/v1/<...>` endpoints the console is allowed to reach. */
+const ALLOWED = new Set([
+  'v1/models',
+  'v1/chat',
+  'v1/chat/completions',
+  'v1/embeddings',
+  'v1/rerank',
+])
+
+// ── Short-lived user-token cache ─────────────────────────────────────────────
+// issue-user-token is an IAM round-trip; cache the JWT per user until ~60s before
+// it expires so a chat session reuses one token instead of issuing per turn.
+type CachedToken = { token: string; expMs: number }
+const tokenCache = new Map<string, CachedToken>()
+const SKEW_MS = 60_000
+const FALLBACK_TTL_MS = 5 * 60_000
+
+async function tokenFor(user: SessionUser): Promise<string> {
+  const hit = tokenCache.get(user.id)
+  if (hit && hit.expMs > Date.now()) return hit.token
+  const { accessToken, expiresIn } = await issueUserToken(user)
+  const ttl = expiresIn > 0 ? expiresIn * 1000 : FALLBACK_TTL_MS
+  tokenCache.set(user.id, { token: accessToken, expMs: Date.now() + ttl - SKEW_MS })
+  return accessToken
+}
+
+async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
+  const rel = path.join('/')
+  if (!ALLOWED.has(rel)) {
+    return NextResponse.json({ error: { message: 'Not found', type: 'not_found' } }, { status: 404 })
+  }
+
+  const user = await resolveUser(req)
+  if (!user) {
+    return NextResponse.json(
+      { error: { message: 'Sign in to use AI.', type: 'auth_error', code: 'unauthenticated' } },
+      { status: 401 },
+    )
+  }
+
+  let token: string
+  try {
+    token = await tokenFor(user)
+  } catch (e) {
+    return NextResponse.json(
+      { error: { message: `Could not authorize the request: ${e instanceof Error ? e.message : String(e)}`, type: 'auth_error' } },
+      { status: 502 },
+    )
+  }
+
+  const url = `${AI_GATEWAY_URL}/${rel}${req.nextUrl.search}`
+  const init: RequestInit = {
+    method: req.method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+      // The gateway derives org/user from the JWT; pass the resolved org too so a
+      // pooled-org backend scopes correctly either way (it strips client headers).
+      'X-Org-Id': user.owner,
+    },
+    cache: 'no-store',
+  }
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    init.body = await req.text()
+  }
+
+  try {
+    const res = await fetch(url, init)
+    const text = await res.text()
+    return new NextResponse(text, {
+      status: res.status,
+      headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' },
+    })
+  } catch (e) {
+    return NextResponse.json(
+      { error: { message: `AI gateway unreachable: ${e instanceof Error ? e.message : String(e)}`, type: 'upstream_error' } },
+      { status: 502 },
+    )
+  }
+}
+
+type Ctx = { params: Promise<{ path: string[] }> }
+
+export async function GET(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path)
+}
+export async function POST(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path)
+}

app/auth/callback/page.tsx

@@ -0,0 +1,53 @@
+'use client'
+
+/**
+ * IAM OAuth callback. IAM redirects here with `?code&state`; we exchange them
+ * for a backend session (`/v1/signin`) and land on the dashboard. On failure we
+ * surface the error and offer a retry.
+ */
+import { Suspense, useEffect, useState } from 'react'
+import { useRouter, useSearchParams } from 'next/navigation'
+import { Button, Text, YStack } from '@hanzo/gui'
+
+import { ApiError } from '~/lib/api'
+import { Loader } from '~/components/ui/Loader'
+import { useSession } from '~/lib/auth/session'
+
+function Callback() {
+  const params = useSearchParams()
+  const router = useRouter()
+  const { completeSignIn } = useSession()
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => {
+    const code = params.get('code')
+    const state = params.get('state')
+    if (!code || !state) {
+      setError('Missing authorization code.')
+      return
+    }
+    completeSignIn(code, state)
+      .then(() => router.replace('/'))
+      .catch((e: unknown) => setError(e instanceof ApiError ? e.message : 'Sign-in failed.'))
+  }, [params, completeSignIn, router])
+
+  if (error) {
+    return (
+      <YStack flex={1} minH="100vh" items="center" justify="center" gap="$3">
+        <Text color="$color12" fontWeight="600">
+          {error}
+        </Text>
+        <Button onPress={() => router.replace('/signin')}>Back to sign in</Button>
+      </YStack>
+    )
+  }
+  return <Loader label="Completing sign-in…" />
+}
+
+export default function CallbackPage() {
+  return (
+    <Suspense fallback={null}>
+      <Callback />
+    </Suspense>
+  )
+}

app/billing/topup/wallet/route.ts

@@ -0,0 +1,167 @@
+/**
+ * Wallet HUSD top-up — verify on-chain, then record to commerce (server route).
+ *
+ * Why this lives in console2 and not billing: billing.hanzo.ai is a Next static
+ * export (`output: 'export'`) and cannot host a runtime POST handler, and the
+ * commerce backend is owned elsewhere. So the verify-and-record seam lives here
+ * as a same-origin server route — the same pattern as `app/paas/[...path]`: the
+ * browser calls the console's OWN origin, the server does the privileged work,
+ * and config comes from server-only env (sourced via KMS, never `NEXT_PUBLIC`).
+ *
+ * Flow: the client sends an HUSD ERC-20 transfer to the treasury and posts the
+ * tx hash here. We read the receipt from the Hanzo EVM, confirm it is a mined,
+ * successful HUSD `Transfer(from → treasury, value)`, derive USD cents from the
+ * (18-decimal, USD-pegged) value, then record it to commerce as a `husd` crypto
+ * payment and return the credited amount + the new balance. The on-chain amount
+ * — never a client-supplied number — is what gets credited.
+ *
+ * Honest failure: if HUSD/treasury are unconfigured (greenfield — HUSD not yet
+ * deployed) we return 501 so the UI shows a truthful "coming" state; if the tx
+ * is missing/failed/not an HUSD-to-treasury transfer we return 400; if the chain
+ * or commerce is unreachable we return 502. Never a fabricated credit.
+ */
+import { type NextRequest, NextResponse } from 'next/server'
+import { ethers } from 'ethers'
+
+export const runtime = 'nodejs'
+
+const RPC_URL = (process.env.HANZO_RPC_URL ?? 'https://rpc.hanzo.network').replace(/\/+$/, '')
+const HUSD_ADDRESS = (process.env.HANZO_HUSD_ADDRESS ?? '').trim()
+const TREASURY = (process.env.HANZO_HUSD_TREASURY ?? '').trim()
+const COMMERCE_URL = (process.env.COMMERCE_URL ?? 'https://api.hanzo.ai').replace(/\/+$/, '')
+const CHAIN_ID = Number(process.env.HANZO_CHAIN_ID ?? '36900')
+
+const ERC20_TRANSFER_ABI = ['event Transfer(address indexed from, address indexed to, uint256 value)']
+const isAddr = (a: string): boolean => /^0x[0-9a-fA-F]{40}$/.test(a)
+
+/** Forward the caller's identity (session cookie / bearer) to commerce. */
+function authHeaders(req: NextRequest): Record<string, string> {
+  const h: Record<string, string> = { 'Content-Type': 'application/json', Accept: 'application/json' }
+  const cookie = req.headers.get('cookie')
+  if (cookie) h.Cookie = cookie
+  const auth = req.headers.get('authorization')
+  if (auth) h.Authorization = auth
+  return h
+}
+
+export async function POST(req: NextRequest): Promise<NextResponse> {
+  // Greenfield gate: no HUSD contract / treasury ⇒ honest "not configured".
+  if (!isAddr(HUSD_ADDRESS) || !isAddr(TREASURY)) {
+    return NextResponse.json(
+      { error: 'HUSD top-up is not configured yet (HUSD is not deployed on Hanzo Mainnet).' },
+      { status: 501 },
+    )
+  }
+
+  let body: { txHash?: string; fromAddress?: string; userId?: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ error: 'Invalid JSON body.' }, { status: 400 })
+  }
+
+  const txHash = (body.txHash ?? '').trim()
+  const fromAddress = (body.fromAddress ?? '').trim()
+  if (!/^0x[0-9a-fA-F]{64}$/.test(txHash)) {
+    return NextResponse.json({ error: 'A valid transaction hash is required.' }, { status: 400 })
+  }
+
+  // ── 1. Verify the HUSD transfer on-chain ────────────────────────────────────
+  let creditedCents: number
+  let verifiedFrom: string
+  try {
+    const provider = new ethers.JsonRpcProvider(RPC_URL, CHAIN_ID)
+    const receipt = await provider.getTransactionReceipt(txHash)
+    if (!receipt) {
+      return NextResponse.json({ error: 'Transaction not found or not yet mined.' }, { status: 400 })
+    }
+    if (receipt.status !== 1) {
+      return NextResponse.json({ error: 'Transaction failed on-chain.' }, { status: 400 })
+    }
+
+    const iface = new ethers.Interface(ERC20_TRANSFER_ABI)
+    const husd = HUSD_ADDRESS.toLowerCase()
+    const treasury = TREASURY.toLowerCase()
+    let value: bigint | null = null
+    for (const log of receipt.logs) {
+      if (log.address.toLowerCase() !== husd) continue
+      let parsed: ethers.LogDescription | null = null
+      try {
+        parsed = iface.parseLog({ topics: [...log.topics], data: log.data })
+      } catch {
+        continue
+      }
+      if (parsed?.name !== 'Transfer') continue
+      if (String(parsed.args.to).toLowerCase() !== treasury) continue
+      value = parsed.args.value as bigint
+      verifiedFrom = ethers.getAddress(String(parsed.args.from))
+      break
+    }
+    if (value === null) {
+      return NextResponse.json(
+        { error: 'No HUSD transfer to the treasury was found in this transaction.' },
+        { status: 400 },
+      )
+    }
+    if (fromAddress && isAddr(fromAddress) && verifiedFrom!.toLowerCase() !== fromAddress.toLowerCase()) {
+      return NextResponse.json({ error: 'Transfer sender does not match the connected wallet.' }, { status: 400 })
+    }
+    // HUSD is an 18-decimal, USD-pegged stablecoin → 1e16 base units = 1 cent.
+    creditedCents = Number(value / 10n ** 16n)
+    if (creditedCents <= 0) {
+      return NextResponse.json({ error: 'Transferred amount is below the minimum (1 cent).' }, { status: 400 })
+    }
+  } catch (e) {
+    return NextResponse.json(
+      { error: `Could not verify the transaction on Hanzo Mainnet: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+
+  // ── 2. Record to commerce as an HUSD crypto payment ─────────────────────────
+  try {
+    const recordRes = await fetch(`${COMMERCE_URL}/v1/billing/payment`, {
+      method: 'POST',
+      headers: authHeaders(req),
+      cache: 'no-store',
+      body: JSON.stringify({
+        method: 'crypto',
+        network: 'hanzo',
+        chainId: CHAIN_ID,
+        currency: 'husd',
+        amount: creditedCents,
+        txHash,
+        fromAddress: verifiedFrom!,
+        toAddress: TREASURY,
+        userId: body.userId,
+      }),
+    })
+    if (!recordRes.ok) {
+      const text = await recordRes.text().catch(() => '')
+      return NextResponse.json(
+        { error: `Commerce rejected the payment (HTTP ${recordRes.status}): ${text}`.trim() },
+        { status: 502 },
+      )
+    }
+    const payment = (await recordRes.json().catch(() => ({}))) as { status?: string }
+
+    // New balance (USD ledger) — best-effort; the credit already landed.
+    let balance = 0
+    try {
+      const balRes = await fetch(
+        `${COMMERCE_URL}/v1/billing/balance?user=${encodeURIComponent(body.userId ?? '')}&currency=usd`,
+        { headers: authHeaders(req), cache: 'no-store' },
+      )
+      if (balRes.ok) balance = ((await balRes.json()) as { balance?: number }).balance ?? 0
+    } catch {
+      /* balance is informational; the credit is recorded */
+    }
+
+    return NextResponse.json({ creditedCents, balance, txHash, status: payment.status ?? 'recorded' })
+  } catch (e) {
+    return NextResponse.json(
+      { error: `Could not reach commerce to record the payment: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+}

app/docs/route.ts

@@ -0,0 +1,20 @@
+/**
+ * `/docs` → the brand documentation site (new origin), server-side redirect.
+ *
+ * Docs are an EXTERNAL product on their own domain (docs.hanzo.ai / docs.lux.network
+ * / …), never an in-app route — so a typed or bookmarked `console.<brand>/docs`
+ * must land on the real docs, not the catch-all `notFound()` (the old 404). The
+ * brand is resolved from the request Host so a lux/zoo console redirects to ITS
+ * docs. The sidebar "Docs" entry and the header "?" open the same URL in a new tab;
+ * this handler only covers the direct-navigation case.
+ */
+import { type NextRequest, NextResponse } from 'next/server'
+
+import { resolveConfig } from '~/config'
+
+export const runtime = 'nodejs'
+
+export function GET(req: NextRequest) {
+  const host = req.headers.get('host')
+  return NextResponse.redirect(resolveConfig(host ?? undefined).docsUrl, 308)
+}

app/globals.css

@@ -0,0 +1,17 @@
+html,
+body,
+#__next {
+  height: 100%;
+}
+
+body {
+  margin: 0;
+  background-color: var(--background, #070b13);
+  color: var(--color, #f2f2f2);
+  font-family:
+    -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+}
+
+* {
+  box-sizing: border-box;
+}

app/icon.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 67 67" role="img" aria-label="Hanzo">
+<style>path{fill:#000}@media (prefers-color-scheme:dark){path{fill:#fff}}</style>
+<path d="M22.21 67V44.6369H0V67H22.21Z"/>
+<path d="M66.7038 22.3184H22.2534L0.0878906 44.6367H44.4634L66.7038 22.3184Z"/>
+<path d="M22.21 0H0V22.3184H22.21V0Z"/>
+<path d="M66.7198 0H44.5098V22.3184H66.7198V0Z"/>
+<path d="M66.7198 67V44.6369H44.5098V67H66.7198Z"/>
+</svg>

app/keys/route.ts

@@ -0,0 +1,70 @@
+/**
+ * Cloud API key management — the per-user `hk-` credential, minted server-side.
+ *
+ * Same-origin (`/keys`): the browser sends only its first-party session cookie;
+ * this server handler resolves the user from that cookie and calls IAM as the
+ * confidential `hanzo-console` client on the user's behalf. The `hk-` secret is
+ * returned to the browser ONLY at creation (POST) — standard show-once handling —
+ * and is otherwise never echoed. Authorization is the user's own session: a
+ * caller can only ever mint/revoke their OWN key (IAM binds the id to the
+ * resolved session), never another tenant's.
+ *
+ *   POST   /keys  → mint (or rotate) the key; returns { accessKey } once.
+ *   DELETE /keys  → revoke the key (the old key stops working).
+ *   GET    /keys  → whether a key exists (no secret material).
+ */
+import { type NextRequest, NextResponse } from 'next/server'
+
+import { resolveUser, mintUserKey, revokeUserKey, mintConfigured } from '~/lib/server/identity'
+
+export const runtime = 'nodejs'
+
+const unauthorized = () =>
+  NextResponse.json({ error: 'Sign in to manage API keys.' }, { status: 401 })
+
+const notConfigured = () =>
+  NextResponse.json(
+    { error: 'API key minting is not configured on this deployment (IAM client unset).' },
+    { status: 501 },
+  )
+
+export async function GET(req: NextRequest): Promise<NextResponse> {
+  const user = await resolveUser(req)
+  if (!user) return unauthorized()
+  // No secret material on GET — only whether a key exists and its public prefix.
+  const hasKey = Boolean(user.accessKey)
+  return NextResponse.json({
+    hasKey,
+    keyPrefix: hasKey ? user.accessKey.slice(0, 11) : '',
+  })
+}
+
+export async function POST(req: NextRequest): Promise<NextResponse> {
+  const user = await resolveUser(req)
+  if (!user) return unauthorized()
+  if (!mintConfigured()) return notConfigured()
+  try {
+    const accessKey = await mintUserKey(user)
+    return NextResponse.json({ accessKey })
+  } catch (e) {
+    return NextResponse.json(
+      { error: `Could not mint an API key: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+}
+
+export async function DELETE(req: NextRequest): Promise<NextResponse> {
+  const user = await resolveUser(req)
+  if (!user) return unauthorized()
+  if (!mintConfigured()) return notConfigured()
+  try {
+    await revokeUserKey(user)
+    return NextResponse.json({ ok: true })
+  } catch (e) {
+    return NextResponse.json(
+      { error: `Could not revoke the API key: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+}

app/layout.tsx

@@ -0,0 +1,27 @@
+import '@hanzogui/core/reset.css'
+import './globals.css'
+
+import type { Metadata, Viewport } from 'next'
+import type { ReactNode } from 'react'
+
+import { Provider } from '~/components/Provider'
+import { branding } from '~/config'
+
+export const metadata: Metadata = {
+  title: branding.name,
+  description: 'Unified admin console for Hanzo Cloud and all cloud products.',
+}
+
+export const viewport: Viewport = {
+  themeColor: '#000000',
+}
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en" className="t_dark" style={{ backgroundColor: '#070b13', colorScheme: 'dark' }} suppressHydrationWarning>
+      <body style={{ margin: 0 }}>
+        <Provider>{children}</Provider>
+      </body>
+    </html>
+  )
+}

app/paas/[...path]/route.ts

@@ -0,0 +1,81 @@
+/**
+ * Same-origin proxy to the platform.hanzo.ai control plane (Job 3 — embedded
+ * PaaS). The browser calls console2's OWN origin (`/paas/...`); this server-side
+ * handler forwards to `platform.hanzo.ai/v1/...`, injecting the service token
+ * from server-only env (sourced via KMS — never `NEXT_PUBLIC_`, never in the
+ * browser bundle). This is the real control-plane API, not an iframe stub.
+ *
+ * SECURITY: the forwarded token is a PLATFORM SERVICE token — full control-plane
+ * authority, NOT tenant-scoped. So this route is gated to brand admins exactly
+ * like the IAM/KMS admin proxies: `getAdminGate` resolves the caller from their
+ * own session and requires a verified brand-admin (no gate → 403). Without this,
+ * any authenticated browser could drive the whole control plane through the
+ * service token. The gate is the control, NOT a deploy-time env toggle.
+ *
+ * When `PAAS_SERVICE_TOKEN` is unset the proxy returns an honest 501 so the UI
+ * can show a truthful "not configured" state — it never fabricates apps/deploys.
+ */
+import { type NextRequest, NextResponse } from 'next/server'
+
+import { getAdminGate } from '~/lib/server/identity'
+
+export const runtime = 'nodejs'
+
+const PLATFORM_URL = (process.env.PLATFORM_URL ?? 'https://platform.hanzo.ai').replace(/\/+$/, '')
+const TOKEN = process.env.PAAS_SERVICE_TOKEN ?? ''
+
+async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
+  // Brand-admin gate FIRST — the service token below is control-plane god-mode.
+  if (!(await getAdminGate(req))) {
+    return NextResponse.json({ error: 'forbidden' }, { status: 403 })
+  }
+  if (!TOKEN) {
+    return NextResponse.json(
+      { error: 'PaaS control plane is not configured (PAAS_SERVICE_TOKEN missing).' },
+      { status: 501 },
+    )
+  }
+  const search = req.nextUrl.search
+  const url = `${PLATFORM_URL}/v1/${path.join('/')}${search}`
+  const init: RequestInit = {
+    method: req.method,
+    headers: {
+      Authorization: `Bearer ${TOKEN}`,
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+    },
+    // Never cache control-plane reads.
+    cache: 'no-store',
+  }
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    init.body = await req.text()
+  }
+  try {
+    const res = await fetch(url, init)
+    const text = await res.text()
+    return new NextResponse(text, {
+      status: res.status,
+      headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' },
+    })
+  } catch (e) {
+    return NextResponse.json(
+      { error: `PaaS upstream unreachable: ${e instanceof Error ? e.message : String(e)}` },
+      { status: 502 },
+    )
+  }
+}
+
+type Ctx = { params: Promise<{ path: string[] }> }
+
+export async function GET(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path)
+}
+export async function POST(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path)
+}
+export async function PATCH(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path)
+}
+export async function DELETE(req: NextRequest, ctx: Ctx) {
+  return forward(req, (await ctx.params).path)
+}

app/signin/page.tsx

@@ -0,0 +1,18 @@
+'use client'
+
+import { useEffect } from 'react'
+import { useRouter } from 'next/navigation'
+
+import { SignInForm } from '~/components/SignInForm'
+import { useSession } from '~/lib/auth/session'
+
+export default function SignInPage() {
+  const { account, loading } = useSession()
+  const router = useRouter()
+
+  useEffect(() => {
+    if (!loading && account) router.replace('/')
+  }, [loading, account, router])
+
+  return <SignInForm />
+}

careers

@@ -1,13 +0,0 @@
-_We are Hiring_
-Join us in scaling Langfuse in Berlin, Germany. We are an open source company, we hire in person, we are only hiring technical talent.
-
-_Open Roles_
-
-- Product Engineer, 70-130k EUR, 0.25-0.75% Equity, https://www.ycombinator.com/companies/langfuse/jobs/aAvmoFB-product-engineer
-- Developer Advocate, 60-110k EUR, 0.25-0.5% Equity, https://www.ycombinator.com/companies/langfuse/jobs/uHysbKH-developer-advocate-devrel
-
-_More Info_
-
-- https://langfuse.com/careers
-- https://langfuse.com/docs
-- https://langfuse.com/changelog

docker-compose.build.yml

@@ -1,88 +0,0 @@
-version: "3.5"
-
-services:
-  server:
-    build:
-      dockerfile: ./web/Dockerfile
-      context: .
-      args:
-        - NEXT_PUBLIC_LANGFUSE_CLOUD_REGION=${NEXT_PUBLIC_LANGFUSE_CLOUD_REGION}
-    depends_on:
-      - db
-      - redis
-    ports:
-      - "3000:3000"
-    environment:
-      - DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
-      - NEXTAUTH_SECRET=mysecret
-      - SALT=mysalt
-      - ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000 # generate via `openssl rand -hex 32`
-      - NEXTAUTH_URL=http://localhost:3000
-      - TELEMETRY_ENABLED=${TELEMETRY_ENABLED:-true}
-      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-false}
-      - LANGFUSE_INIT_ORG_ID=${LANGFUSE_INIT_ORG_ID:-}
-      - LANGFUSE_INIT_ORG_NAME=${LANGFUSE_INIT_ORG_NAME:-}
-      - LANGFUSE_INIT_PROJECT_ID=${LANGFUSE_INIT_PROJECT_ID:-}
-      - LANGFUSE_INIT_PROJECT_NAME=${LANGFUSE_INIT_PROJECT_NAME:-}
-      - LANGFUSE_INIT_PROJECT_PUBLIC_KEY=${LANGFUSE_INIT_PROJECT_PUBLIC_KEY:-}
-      - LANGFUSE_INIT_PROJECT_SECRET_KEY=${LANGFUSE_INIT_PROJECT_SECRET_KEY:-}
-      - LANGFUSE_INIT_USER_EMAIL=${LANGFUSE_INIT_USER_EMAIL:-}
-      - LANGFUSE_INIT_USER_NAME=${LANGFUSE_INIT_USER_NAME:-}
-      - LANGFUSE_INIT_USER_PASSWORD=${LANGFUSE_INIT_USER_PASSWORD:-}
-    restart: always
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3000/api/public/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  worker:
-    build:
-      dockerfile: ./worker/Dockerfile
-      context: .
-      args:
-        - NEXT_PUBLIC_LANGFUSE_CLOUD_REGION=${NEXT_PUBLIC_LANGFUSE_CLOUD_REGION}
-    depends_on:
-      - db
-      - redis
-    ports:
-      - "3030:3030"
-    environment:
-      - DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
-      - NEXTAUTH_SECRET=mysecret
-      - TELEMETRY_ENABLED=${TELEMETRY_ENABLED:-true}
-      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-false}
-      - PORT=${PORT:-3030}
-      - REDIS_HOST=${REDIS_HOST:-redis}
-      - REDIS_PORT=${REDIS_PORT:-6379}
-      - REDIS_AUTH=${REDIS_AUTH:-myredissecret}
-    restart: always
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3030/api/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-
-  redis:
-    image: redis:7.2.4
-    command: >
-      --requirepass ${REDIS_AUTH:-myredissecret}
-    restart: always
-    ports:
-      - 6379:6379
-
-  db:
-    image: postgres
-    restart: always
-    environment:
-      - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=postgres
-      - POSTGRES_DB=postgres
-    ports:
-      - 5432:5432
-    volumes:
-      - database_data:/var/lib/postgresql/data
-
-volumes:
-  database_data:
-    driver: local

docker-compose.dev-azure.yml

@@ -1,63 +0,0 @@
-services:
-  clickhouse:
-    image: clickhouse/clickhouse-server
-    user: "101:101"
-    container_name: clickhouse
-    hostname: clickhouse
-    environment:
-      CLICKHOUSE_DB: default
-      CLICKHOUSE_USER: clickhouse
-      CLICKHOUSE_PASSWORD: clickhouse
-    volumes:
-      - langfuse_clickhouse_data:/var/lib/clickhouse
-      - langfuse_clickhouse_logs:/var/log/clickhouse-server
-    ports:
-      - "8123:8123"
-      - "9000:9000"
-    depends_on:
-      - postgres
-
-  azurite:
-    image: mcr.microsoft.com/azure-storage/azurite
-    container_name: azurite
-    command: azurite-blob --blobHost 0.0.0.0
-    ports:
-      - "10000:10000"
-    volumes:
-      - langfuse_azurite_data:/data
-
-  redis:
-    image: redis:7.2.4
-    restart: always
-    command: >
-      --requirepass ${REDIS_AUTH:-myredissecret}
-    ports:
-      - 6379:6379
-
-  postgres:
-    image: postgres:${POSTGRES_VERSION:-latest}
-    restart: always
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 3s
-      timeout: 3s
-      retries: 10
-    command: ["postgres", "-c", "log_statement=all"]
-    environment:
-      - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=postgres
-      - POSTGRES_DB=postgres
-    ports:
-      - 5432:5432
-    volumes:
-      - langfuse_postgres_data:/var/lib/postgresql/data
-
-volumes:
-  langfuse_postgres_data:
-    driver: local
-  langfuse_clickhouse_data:
-    driver: local
-  langfuse_clickhouse_logs:
-    driver: local
-  langfuse_azurite_data:
-    driver: local

docker-compose.dev.yml

@@ -1,75 +0,0 @@
-services:
-  clickhouse:
-    image: clickhouse/clickhouse-server
-    user: "101:101"
-    container_name: clickhouse
-    hostname: clickhouse
-    environment:
-      CLICKHOUSE_DB: default
-      CLICKHOUSE_USER: clickhouse
-      CLICKHOUSE_PASSWORD: clickhouse
-    volumes:
-      - langfuse_clickhouse_data:/var/lib/clickhouse
-      - langfuse_clickhouse_logs:/var/log/clickhouse-server
-    ports:
-      - "8123:8123"
-      - "9000:9000"
-    depends_on:
-      - postgres
-
-  minio:
-    image: minio/minio
-    container_name: minio
-    entrypoint: sh
-    # create the 'langfuse' bucket before starting the service
-    command: -c 'mkdir -p /data/langfuse && minio server --address ":9000" --console-address ":9001" /data'
-    environment:
-      MINIO_ACCESS_KEY: minio
-      MINIO_SECRET_KEY: miniosecret
-    ports:
-      - "9090:9000"
-      - "9091:9001"
-    volumes:
-      - langfuse_minio_data:/data
-    healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
-      interval: 1s
-      timeout: 5s
-      retries: 5
-      start_period: 1s
-
-  redis:
-    image: redis:7.2.4
-    restart: always
-    command: >
-      --requirepass ${REDIS_AUTH:-myredissecret}
-    ports:
-      - 6379:6379
-
-  postgres:
-    image: postgres:${POSTGRES_VERSION:-latest}
-    restart: always
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 3s
-      timeout: 3s
-      retries: 10
-    command: ["postgres", "-c", "log_statement=all"]
-    environment:
-      - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=postgres
-      - POSTGRES_DB=postgres
-    ports:
-      - 5432:5432
-    volumes:
-      - langfuse_postgres_data:/var/lib/postgresql/data
-
-volumes:
-  langfuse_postgres_data:
-    driver: local
-  langfuse_clickhouse_data:
-    driver: local
-  langfuse_clickhouse_logs:
-    driver: local
-  langfuse_minio_data:
-    driver: local

docker-compose.v3preview.yml

@@ -1,145 +0,0 @@
-services:
-  langfuse-worker:
-    image: langfuse/langfuse-worker:latest
-    depends_on: &langfuse-depends-on
-      postgres:
-        condition: service_healthy
-      minio:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    ports:
-      - "3030:3030"
-    environment: &langfuse-worker-env
-      DATABASE_URL: postgresql://postgres:postgres@postgres:5432/postgres
-      SALT: "mysalt"
-      ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000" # generate via `openssl rand -hex 32`
-      TELEMETRY_ENABLED: ${TELEMETRY_ENABLED:-true}
-      LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES: ${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-true}
-      LANGFUSE_ASYNC_INGESTION_PROCESSING: ${LANGFUSE_ASYNC_INGESTION_PROCESSING:-true}
-      LANGFUSE_ASYNC_CLICKHOUSE_INGESTION_PROCESSING: ${LANGFUSE_ASYNC_CLICKHOUSE_INGESTION_PROCESSING:-true}
-      LANGFUSE_READ_DASHBOARDS_FROM_CLICKHOUSE: ${LANGFUSE_READ_DASHBOARDS_FROM_CLICKHOUSE:-true}
-      LANGFUSE_READ_FROM_POSTGRES_ONLY: ${LANGFUSE_READ_FROM_POSTGRES_ONLY:-false}
-      LANGFUSE_RETURN_FROM_CLICKHOUSE: ${LANGFUSE_RETURN_FROM_CLICKHOUSE:-true}
-      CLICKHOUSE_MIGRATION_URL: ${CLICKHOUSE_MIGRATION_URL:-clickhouse://clickhouse:9000}
-      CLICKHOUSE_URL: ${CLICKHOUSE_URL:-http://clickhouse:8123}
-      CLICKHOUSE_USER: ${CLICKHOUSE_USER:-clickhouse}
-      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-clickhouse}
-      CLICKHOUSE_CLUSTER_ENABLED: ${CLICKHOUSE_CLUSTER_ENABLED:-false}
-      LANGFUSE_S3_EVENT_UPLOAD_ENABLED: ${LANGFUSE_S3_EVENT_UPLOAD_ENABLED:-true}
-      LANGFUSE_S3_EVENT_UPLOAD_BUCKET: ${LANGFUSE_S3_EVENT_UPLOAD_BUCKET:-langfuse}
-      LANGFUSE_S3_EVENT_UPLOAD_REGION: ${LANGFUSE_S3_EVENT_UPLOAD_REGION:-us-east-1}
-      LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID: ${LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID:-minio}
-      LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY: ${LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY:-miniosecret}
-      LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT: ${LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT:-http://minio:9000}
-      LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE: ${LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE:-true}
-      LANGFUSE_S3_EVENT_UPLOAD_PREFIX: ${LANGFUSE_S3_EVENT_UPLOAD_PREFIX:-events/}
-      LANGFUSE_S3_MEDIA_UPLOAD_ENABLED: ${LANGFUSE_S3_MEDIA_UPLOAD_ENABLED:-true}
-      LANGFUSE_S3_MEDIA_UPLOAD_BUCKET: ${LANGFUSE_S3_MEDIA_UPLOAD_BUCKET:-langfuse}
-      LANGFUSE_S3_MEDIA_UPLOAD_REGION: ${LANGFUSE_S3_MEDIA_UPLOAD_REGION:-us-east-1}
-      LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID: ${LANGFUSE_S3_MEDIA_UPLOAD_ACCESS_KEY_ID:-minio}
-      LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY: ${LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY:-miniosecret}
-      LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT: ${LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT:-http://minio:9000}
-      LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE: ${LANGFUSE_S3_MEDIA_UPLOAD_FORCE_PATH_STYLE:-true}
-      LANGFUSE_S3_MEDIA_UPLOAD_PREFIX: ${LANGFUSE_S3_MEDIA_UPLOAD_PREFIX:-media/}
-      REDIS_HOST: ${REDIS_HOST:-redis}
-      REDIS_PORT: ${REDIS_PORT:-6379}
-      REDIS_AUTH: ${REDIS_AUTH:-myredissecret}
-
-  langfuse-web:
-    image: langfuse/langfuse:latest
-    depends_on: *langfuse-depends-on
-    ports:
-      - "3000:3000"
-    environment:
-      <<: *langfuse-worker-env
-      NEXTAUTH_URL: http://localhost:3000
-      NEXTAUTH_SECRET: mysecret
-      LANGFUSE_INIT_ORG_ID: ${LANGFUSE_INIT_ORG_ID:-}
-      LANGFUSE_INIT_ORG_NAME: ${LANGFUSE_INIT_ORG_NAME:-}
-      LANGFUSE_INIT_PROJECT_ID: ${LANGFUSE_INIT_PROJECT_ID:-}
-      LANGFUSE_INIT_PROJECT_NAME: ${LANGFUSE_INIT_PROJECT_NAME:-}
-      LANGFUSE_INIT_PROJECT_PUBLIC_KEY: ${LANGFUSE_INIT_PROJECT_PUBLIC_KEY:-}
-      LANGFUSE_INIT_PROJECT_SECRET_KEY: ${LANGFUSE_INIT_PROJECT_SECRET_KEY:-}
-      LANGFUSE_INIT_USER_EMAIL: ${LANGFUSE_INIT_USER_EMAIL:-}
-      LANGFUSE_INIT_USER_NAME: ${LANGFUSE_INIT_USER_NAME:-}
-      LANGFUSE_INIT_USER_PASSWORD: ${LANGFUSE_INIT_USER_PASSWORD:-}
-
-  clickhouse:
-    image: clickhouse/clickhouse-server
-    user: "101:101"
-    container_name: clickhouse
-    hostname: clickhouse
-    environment:
-      CLICKHOUSE_DB: default
-      CLICKHOUSE_USER: clickhouse
-      CLICKHOUSE_PASSWORD: clickhouse
-    volumes:
-      - langfuse_clickhouse_data:/var/lib/clickhouse
-      - langfuse_clickhouse_logs:/var/log/clickhouse-server
-    ports:
-      - "8123:8123"
-      - "9000:9000"
-    depends_on:
-      - postgres
-
-  minio:
-    image: minio/minio
-    container_name: minio
-    entrypoint: sh
-    # create the 'langfuse' bucket before starting the service
-    command: -c 'mkdir -p /data/langfuse && minio server --address ":9000" --console-address ":9001" /data'
-    environment:
-      MINIO_ROOT_USER: minio
-      MINIO_ROOT_PASSWORD: miniosecret
-    ports:
-      - "9090:9000"
-      - "9091:9001"
-    volumes:
-      - langfuse_minio_data:/data
-    healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
-      interval: 1s
-      timeout: 5s
-      retries: 5
-      start_period: 1s
-
-  redis:
-    image: redis:7
-    restart: always
-    command: >
-      --requirepass ${REDIS_AUTH:-myredissecret}
-    ports:
-      - 6379:6379
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 3s
-      timeout: 10s
-      retries: 10
-
-  postgres:
-    image: postgres:${POSTGRES_VERSION:-latest}
-    restart: always
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 3s
-      timeout: 3s
-      retries: 10
-    environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
-      POSTGRES_DB: postgres
-    ports:
-      - 5432:5432
-    volumes:
-      - langfuse_postgres_data:/var/lib/postgresql/data
-
-volumes:
-  langfuse_postgres_data:
-    driver: local
-  langfuse_clickhouse_data:
-    driver: local
-  langfuse_clickhouse_logs:
-    driver: local
-  langfuse_minio_data:
-    driver: local

docker-compose.yml

@@ -1,46 +0,0 @@
-services:
-  langfuse-server:
-    image: langfuse/langfuse:2
-    depends_on:
-      db:
-        condition: service_healthy
-    ports:
-      - "3000:3000"
-    environment:
-      - DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
-      - NEXTAUTH_SECRET=mysecret
-      - SALT=mysalt
-      - ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000 # generate via `openssl rand -hex 32`
-      - NEXTAUTH_URL=http://localhost:3000
-      - TELEMETRY_ENABLED=${TELEMETRY_ENABLED:-true}
-      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-false}
-      - LANGFUSE_INIT_ORG_ID=${LANGFUSE_INIT_ORG_ID:-}
-      - LANGFUSE_INIT_ORG_NAME=${LANGFUSE_INIT_ORG_NAME:-}
-      - LANGFUSE_INIT_PROJECT_ID=${LANGFUSE_INIT_PROJECT_ID:-}
-      - LANGFUSE_INIT_PROJECT_NAME=${LANGFUSE_INIT_PROJECT_NAME:-}
-      - LANGFUSE_INIT_PROJECT_PUBLIC_KEY=${LANGFUSE_INIT_PROJECT_PUBLIC_KEY:-}
-      - LANGFUSE_INIT_PROJECT_SECRET_KEY=${LANGFUSE_INIT_PROJECT_SECRET_KEY:-}
-      - LANGFUSE_INIT_USER_EMAIL=${LANGFUSE_INIT_USER_EMAIL:-}
-      - LANGFUSE_INIT_USER_NAME=${LANGFUSE_INIT_USER_NAME:-}
-      - LANGFUSE_INIT_USER_PASSWORD=${LANGFUSE_INIT_USER_PASSWORD:-}
-
-  db:
-    image: postgres
-    restart: always
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
-      interval: 3s
-      timeout: 3s
-      retries: 10
-    environment:
-      - POSTGRES_USER=postgres
-      - POSTGRES_PASSWORD=postgres
-      - POSTGRES_DB=postgres
-    ports:
-      - 5432:5432
-    volumes:
-      - database_data:/var/lib/postgresql/data
-
-volumes:
-  database_data:
-    driver: local

docs/endpoints.md

@@ -0,0 +1,74 @@
+# Unified `/v1` backend endpoints
+
+The console talks to the unified Hanzo Cloud backend (`hanzoai/cloud`, the
+casibase API). Base URL: `${NEXT_PUBLIC_CLOUD_URL}/v1`. All requests send cookie
+credentials; responses are the envelope `{ status, msg, data, data2 }` (`data2`
+is the total row count on list endpoints).
+
+Client modules live in `src/lib/api/`.
+
+## Account / session — `AccountApi`
+
+| Method | Endpoint |
+| --- | --- |
+| `current()` | `GET /get-account` |
+| `signin(code, state)` | `POST /signin?code&state` |
+| `signout()` | `POST /signout` |
+
+## Providers — `ProviderApi`
+
+| Method | Endpoint |
+| --- | --- |
+| `listGlobal()` | `GET /get-global-providers` |
+| `list({ owner, store, p, pageSize, … })` | `GET /get-providers` |
+| `get(owner, name)` | `GET /get-provider?id=owner/name` |
+| `add(p)` | `POST /add-provider` |
+| `update(owner, name, p)` | `POST /update-provider?id=owner/name` |
+| `remove(p)` | `POST /delete-provider` |
+| `refreshMcpTools(p)` | `POST /refresh-mcp-tools` |
+
+## Model routes — `ModelRouteApi`
+
+| Method | Endpoint |
+| --- | --- |
+| `list({ owner, … })` | `GET /get-model-routes` |
+| `get(owner, modelName)` | `GET /get-model-route?owner&modelName` |
+| `add(r)` | `POST /add-model-route` |
+| `update(owner, modelName, r)` | `POST /update-model-route?owner&modelName` |
+| `remove(r)` | `POST /delete-model-route` |
+
+## Applications — `ApplicationApi`
+
+| Method | Endpoint |
+| --- | --- |
+| `list({ owner, … })` | `GET /get-applications` |
+| `get(owner, name)` | `GET /get-application?id=owner/name` |
+| `add(a)` | `POST /add-application` |
+| `update(owner, name, a)` | `POST /update-application?id=owner/name` |
+| `remove(a)` | `POST /delete-application` |
+| `deploy(a)` | `POST /deploy-application?id=owner/name` |
+| `undeploy(owner, name)` | `POST /undeploy-application?id=owner/name` |
+
+## Stores — `StoreApi`
+
+| Method | Endpoint |
+| --- | --- |
+| `listGlobal()` | `GET /get-global-stores` |
+| `list(owner)` | `GET /get-stores?owner` |
+| `get(owner, name)` | `GET /get-store?id=owner/name` |
+| `names(owner)` | `GET /get-store-names?owner` |
+| `add(s)` | `POST /add-store` |
+| `update(owner, name, s)` | `POST /update-store?id=owner/name` |
+| `remove(s)` | `POST /delete-store` |
+| `refreshVectors(s)` | `POST /refresh-store-vectors` |
+
+## Chat — `ChatApi`
+
+| Method | Endpoint |
+| --- | --- |
+| `listGlobal({ … })` | `GET /get-global-chats` |
+| `list({ user, store, selectedUser, … })` | `GET /get-chats` |
+| `get(owner, name)` | `GET /get-chat?id=owner/name` |
+| `add(c)` | `POST /add-chat` |
+| `update(owner, name, c)` | `POST /update-chat?id=owner/name` |
+| `remove(c)` | `POST /delete-chat` |

ee/.eslintrc.js

@@ -1,8 +0,0 @@
-/** @type {import("eslint").Linter.Config} */
-module.exports = {
-  extends: ["@repo/eslint-config/library.js"],
-  parser: "@typescript-eslint/parser",
-  parserOptions: {
-    project: true,
-  },
-};

ee/LICENSE

@@ -1,37 +0,0 @@
-Langfuse Enterprise License (the “Enterprise License”)
-Copyright (c) 2024 Langfuse GmbH ('Langfuse')
-
-With regard to the Langfuse Software:
-This software and associated documentation files (the "Software") may only be
-used in production, if you (and any entity that you represent) have agreed to,
-and are in compliance with, the Langfuse Terms of Service, available
-at https://langfuse.com/terms (the “Enterprise Terms”), or other
-agreement governing the use of the Software, as agreed by you and Langfuse,
-and otherwise have a valid Langfuse Enterprise license.
-
-Subject to the foregoing sentence, you are free to
-modify this Software and publish patches to the Software. You agree that Langfuse
-and/or its licensors (as applicable) retain all right, title and interest in and
-to all such modifications and/or patches, and all such modifications and/or
-patches may only be used, copied, modified, displayed, distributed, or otherwise
-exploited with a valid Langfuse Enterprise license.
-
-Notwithstanding the foregoing, you may copy and modify
-the Software for development and testing purposes, without requiring a
-subscription. You agree that Langfuse and/or its licensors (as applicable) retain
-all right, title and interest in and to all such modifications. You are not
-granted any other rights beyond what is expressly stated herein. Subject to the
-foregoing, it is forbidden to copy, merge, publish, distribute, sublicense,
-and/or sell the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-For all third party components incorporated into the Langfuse Software, those
-components are licensed under the original license provided by the owner of the 
-applicable component.

ee/Readme.md

@@ -1,5 +0,0 @@
-# Enterprise Edition
-
-This folder includes features that are only available in the Enterprise Edition of Langfuse and on Langfuse Cloud.
-
-See [LICENSE](../LICENSE) and [docs](https://langfuse.com/docs/open-source) for more details.

ee/package.json

@@ -1,54 +0,0 @@
-{
-  "name": "@langfuse/ee",
-  "version": "1.0.0",
-  "private": true,
-  "main": "./dist/src/index.js",
-  "types": "./dist/src/index.d.ts",
-  "exports": {
-    ".": {
-      "import": "./dist/src/index.js",
-      "require": "./dist/src/index.js"
-    },
-    "./sso": {
-      "import": "./dist/src/sso/index.js",
-      "require": "./dist/src/sso/index.js"
-    }
-  },
-  "engines": {
-    "node": "20"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "lint": "eslint . --ext .js,.jsx,.ts,.tsx --max-warnings 0",
-    "lint:fix": "eslint . --ext .js,.jsx,.ts,.tsx --fix"
-  },
-  "dependencies": {
-    "@langfuse/shared": "workspace:*",
-    "@opentelemetry/api": ">=1.0.0 <1.10.0",
-    "axios": "^1.7.7",
-    "https-proxy-agent": "^7.0.6",
-    "next": "^14.2.21",
-    "next-auth": "^4.24.11",
-    "zod": "^3.23.8"
-  },
-  "devDependencies": {
-    "@repo/eslint-config": "workspace:*",
-    "@repo/typescript-config": "workspace:*",
-    "@types/node": "^20.11.29",
-    "@typescript-eslint/parser": "^7.12.0",
-    "eslint": "^8.57.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-prettier": "^5.1.3",
-    "prettier": "^3.3.3",
-    "ts-node": "^10.9.2",
-    "tsc-watch": "^6.2.0",
-    "typescript": "^5.4.5"
-  },
-  "pnpm": {
-    "overrides": {
-      "jsonpath-plus": "10.2.0"
-    }
-  }
-}

ee/src/ee-license-check/index.ts

@@ -1,5 +0,0 @@
-import { env } from "../env";
-
-export const isEeAvailable: boolean =
-  env.NEXT_PUBLIC_LANGFUSE_CLOUD_REGION !== undefined ||
-  env.LANGFUSE_EE_LICENSE_KEY !== undefined;

ee/src/env.ts

@@ -1,12 +0,0 @@
-import { z } from "zod";
-import { env as sharedEnv, removeEmptyEnvVariables } from "@langfuse/shared";
-
-const EnvSchema = z.object({
-  NEXT_PUBLIC_LANGFUSE_CLOUD_REGION: z.string().optional(),
-  LANGFUSE_EE_LICENSE_KEY: z.string().optional(),
-});
-
-export const env = {
-  ...sharedEnv,
-  ...EnvSchema.parse(removeEmptyEnvVariables(process.env)),
-};

ee/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "extends": "@repo/typescript-config/base.json",
-  "compilerOptions": {
-    "moduleResolution": "NodeNext",
-    "module": "NodeNext",
-    "lib": ["ES2020"],
-    "outDir": "./dist",
-    "types": ["node"],
-    "target": "ES2020",
-    "rootDir": "."
-  },
-  "include": ["."],
-  "exclude": ["node_modules", "dist"]
-}

fern/apis/client/definition/api.yml

@@ -1,11 +0,0 @@
-name: langfuse
-error-discrimination:
-  strategy: status-code
-auth: bearer
-imports:
-  commons: commons.yml
-errors:
-  - commons.Error
-  - commons.UnauthorizedError
-  - commons.AccessDeniedError
-  - commons.MethodNotAllowedError

fern/apis/client/definition/commons.yml

@@ -1,13 +0,0 @@
-errors:
-  Error:
-    status-code: 400
-    type: string
-  UnauthorizedError:
-    status-code: 401
-    type: string
-  AccessDeniedError:
-    status-code: 403
-    type: string
-  MethodNotAllowedError:
-    status-code: 405
-    type: string

fern/apis/client/definition/score.yml

@@ -1,134 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    create:
-      docs: Add a score to the database, upserts on id
-      method: POST
-      path: /scores
-      request: CreateScoreRequest
-
-types:
-  CreateScoreRequest:
-    properties:
-      id: optional<string>
-      traceId: string
-      name: string
-      value:
-        type: CreateScoreValue
-        docs: The value of the score. Must be passed as string for categorical scores, and numeric for boolean and numeric scores. Boolean score values must equal either 1 or 0 (true or false)
-      observationId: optional<string>
-      comment: optional<string>
-      dataType:
-        type: optional<ScoreDataType>
-        docs: When set, must match the score value's type. If not set, will be inferred from the score value or config
-      configId:
-        type: optional<string>
-        docs: Reference a score config on a score. When set, the score name must equal the config name and scores must comply with the config's range and data type. For categorical scores, the value must map to a config category. Numeric scores might be constrained by the score config's max and min values
-    examples:
-      - value:
-          name: "novelty"
-          value: 0.9
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "consistency"
-          value: 1.2
-          dataType: "NUMERIC"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "accuracy"
-          value: 0.9
-          dataType: "NUMERIC"
-          configId: "9203-4567-89ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "toxicity"
-          value: "not toxic"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "correctness"
-          value: "partially correct"
-          dataType: "CATEGORICAL"
-          configId: "1234-5678-90ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "hallucination"
-          value: 0
-          dataType: "BOOLEAN"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "helpfulness"
-          value: 1
-          dataType: "BOOLEAN"
-          configId: "1234-5678-90ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-  BaseScore:
-    properties:
-      id: string
-      traceId: string
-      name: string
-      source: ScoreSource
-      observationId: optional<string>
-      timestamp: datetime
-      createdAt: datetime
-      updatedAt: datetime
-      authorUserId: optional<string>
-      comment: optional<string>
-      configId:
-        type: optional<string>
-        docs: Reference a score config on a score. When set, config and score name must be equal and value must comply to optionally defined numerical range
-  NumericScore:
-    extends: BaseScore
-    properties:
-      value:
-        type: double
-        docs: The numeric value of the score
-  BooleanScore:
-    extends: BaseScore
-    properties:
-      value:
-        type: double
-        docs: The numeric value of the score. Equals 1 for "True" and 0 for "False"
-      stringValue:
-        type: string
-        docs: The string representation of the score value. Is inferred from the numeric value and equals "True" or "False"
-  CategoricalScore:
-    extends: BaseScore
-    properties:
-      value:
-        type: optional<double>
-        docs: Only defined if a config is linked. Represents the numeric category mapping of the stringValue
-      stringValue:
-        type: string
-        docs: The string representation of the score value. If no config is linked, can be any string. Otherwise, must map to a config category
-  Score:
-    discriminant: "dataType"
-    union:
-      NUMERIC:
-        type: NumericScore
-        docs: "Score with NUMERIC data type"
-      CATEGORICAL:
-        type: CategoricalScore
-        docs: "Score with CATEGORICAL data type"
-      BOOLEAN:
-        type: BooleanScore
-        docs: "Score with BOOLEAN data type"
-  ScoreSource:
-    enum:
-      - ANNOTATION
-      - API
-      - EVAL
-  ScoreDataType:
-    enum:
-      - NUMERIC
-      - CATEGORICAL
-      - BOOLEAN
-
-  CreateScoreValue:
-    discriminated: false
-    union:
-      - double
-      - string
-    docs: The value of the score. Must be passed as string for categorical scores, and numeric for boolean and numeric scores

fern/apis/client/generators.yml

@@ -1,21 +0,0 @@
-default-group: local
-groups:
-  local:
-    generators:
-      # - name: fernapi/fern-typescript-browser-sdk
-      #   version: 0.7.1
-      #   output:
-      #     location: npm
-      #     url: npm.buildwithfern.com
-      #     package-name: "@finto-fern/react-client"
-      #   config:
-      #     namespaceExport: Langfuse
-      #     allowCustomFetcher: true
-      - name: fernapi/fern-openapi
-        version: 0.0.26
-        output:
-          location: local-file-system
-          path: ../../../web/public/generated/api-client
-        config:
-          namespaceExport: Langfuse
-          allowCustomFetcher: true

fern/apis/server/definition/api.yml

@@ -1,29 +0,0 @@
-name: langfuse
-docs: |
-  ## Authentication
-
-  Authenticate with the API using [Basic Auth](https://en.wikipedia.org/wiki/Basic_access_authentication), get API keys in the project settings:
-
-  - username: Langfuse Public Key
-  - password: Langfuse Secret Key
-
-  ## Exports
-
-  - OpenAPI spec: https://cloud.langfuse.com/generated/api/openapi.yml
-  - Postman collection: https://cloud.langfuse.com/generated/postman/collection.json
-
-error-discrimination:
-  strategy: status-code
-auth: basic
-imports:
-  commons: commons.yml
-errors:
-  - commons.Error
-  - commons.UnauthorizedError
-  - commons.AccessDeniedError
-  - commons.MethodNotAllowedError
-  - commons.NotFoundError
-headers:
-  X-Langfuse-Sdk-Name: optional<string>
-  X-Langfuse-Sdk-Version: optional<string>
-  X-Langfuse-Public-Key: optional<string>

fern/apis/server/definition/comments.yml

@@ -1,73 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  pagination: ./utils/pagination.yml
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    create:
-      docs: Create a comment. Comments may be attached to different object types (trace, observation, session, prompt).
-      method: POST
-      path: /comments
-      request: CreateCommentRequest
-      response: CreateCommentResponse
-    get:
-      docs: Get all comments
-      method: GET
-      path: /comments
-      request:
-        name: GetCommentsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: Page number, starts at 1.
-          limit:
-            type: optional<integer>
-            docs: Limit of items per page. If you encounter api issues due to too large page sizes, try to reduce the limit
-          objectType:
-            type: optional<string>
-            docs: Filter comments by object type (trace, observation, session, prompt).
-          objectId:
-            type: optional<string>
-            docs: Filter comments by object id. If objectType is not provided, an error will be thrown.
-          authorUserId:
-            type: optional<string>
-            docs: Filter comments by author user id.
-      response: GetCommentsResponse
-    get-by-id:
-      docs: Get a comment by id
-      method: GET
-      path: /comments/{commentId}
-      path-parameters:
-        commentId:
-          type: string
-          docs: The unique langfuse identifier of a comment
-      response: commons.Comment
-types:
-  CreateCommentRequest:
-    properties:
-      projectId:
-        type: string
-        docs: The id of the project to attach the comment to.
-      objectType:
-        type: string
-        docs: The type of the object to attach the comment to (trace, observation, session, prompt).
-      objectId:
-        type: string
-        docs: The id of the object to attach the comment to. If this does not reference a valid existing object, an error will be thrown.
-      content:
-        type: string
-        docs: The content of the comment. May include markdown. Currently limited to 500 characters.
-      authorUserId:
-        type: optional<string>
-        docs: The id of the user who created the comment.
-  CreateCommentResponse:
-    properties:
-      id:
-        type: string
-        docs: The id of the created object in Langfuse
-  GetCommentsResponse:
-    properties:
-      data: list<commons.Comment>
-      meta: pagination.MetaResponse

fern/apis/server/definition/commons.yml

@@ -1,456 +0,0 @@
-types:
-  # Objects
-  Trace:
-    properties:
-      id:
-        type: string
-        docs: The unique identifier of a trace
-      timestamp:
-        type: datetime
-        docs: The timestamp when the trace was created
-      name:
-        type: optional<string>
-        docs: The name of the trace
-      input:
-        type: optional<unknown>
-        docs: The input data of the trace. Can be any JSON.
-      output:
-        type: optional<unknown>
-        docs: The output data of the trace. Can be any JSON.
-      sessionId:
-        type: optional<string>
-        docs: The session identifier associated with the trace
-      release:
-        type: optional<string>
-        docs: The release version of the application when the trace was created
-      version:
-        type: optional<string>
-        docs: The version of the trace
-      userId:
-        type: optional<string>
-        docs: The user identifier associated with the trace
-      metadata:
-        type: optional<unknown>
-        docs: The metadata associated with the trace. Can be any JSON.
-      tags:
-        type: optional<list<string>>
-        docs: The tags associated with the trace. Can be an array of strings or null.
-      public:
-        type: optional<boolean>
-        docs: Public traces are accessible via url without login
-  TraceWithDetails: # GET /traces
-    extends: Trace
-    properties:
-      htmlPath:
-        type: string
-        docs: Path of trace in Langfuse UI
-      latency:
-        type: double
-        docs: Latency of trace in seconds
-      totalCost:
-        type: double
-        docs: Cost of trace in USD
-      observations:
-        type: list<string>
-        docs: List of observation ids
-      scores:
-        type: list<string>
-        docs: List of score ids
-  TraceWithFullDetails: # GET traces/[traceID]
-    extends: Trace
-    properties:
-      htmlPath:
-        type: string
-        docs: Path of trace in Langfuse UI
-      latency:
-        type: double
-        docs: Latency of trace in seconds
-      totalCost:
-        type: double
-        docs: Cost of trace in USD
-      observations:
-        type: list<ObservationsView>
-        docs: List of observations
-      scores:
-        type: list<Score>
-        docs: List of scores
-  Session:
-    properties:
-      id: string
-      createdAt: datetime
-      projectId: string
-  SessionWithTraces:
-    extends: Session
-    properties:
-      traces: list<Trace>
-  Observation:
-    properties:
-      id:
-        type: string
-        docs: The unique identifier of the observation
-      traceId:
-        type: optional<string>
-        docs: The trace ID associated with the observation
-      type:
-        type: string
-        docs: The type of the observation
-      name:
-        type: optional<string>
-        docs: The name of the observation
-      startTime:
-        type: datetime
-        docs: The start time of the observation
-      endTime:
-        type: optional<datetime>
-        docs: The end time of the observation.
-      completionStartTime:
-        type: optional<datetime>
-        docs: The completion start time of the observation
-      model:
-        type: optional<string>
-        docs: The model used for the observation
-      modelParameters:
-        type: optional<map<string, MapValue>>
-        docs: The parameters of the model used for the observation
-      input:
-        type: optional<unknown>
-        docs: The input data of the observation
-      version:
-        type: optional<string>
-        docs: The version of the observation
-      metadata:
-        type: optional<unknown>
-        docs: Additional metadata of the observation
-      output:
-        type: optional<unknown>
-        docs: The output data of the observation
-      usage:
-        type: optional<Usage>
-        docs: The usage data of the observation
-      level:
-        type: ObservationLevel
-        docs: The level of the observation
-      statusMessage:
-        type: optional<string>
-        docs: The status message of the observation
-      parentObservationId:
-        type: optional<string>
-        docs: The parent observation ID
-      promptId:
-        type: optional<string>
-        docs: The prompt ID associated with the observation
-
-  ObservationsView:
-    extends: Observation
-    properties:
-      promptName:
-        type: optional<string>
-        docs: The name of the prompt associated with the observation
-      promptVersion:
-        type: optional<integer>
-        docs: The version of the prompt associated with the observation
-      modelId:
-        type: optional<string>
-        docs: The unique identifier of the model
-      inputPrice:
-        type: optional<double>
-        docs: The price of the input in USD
-      outputPrice:
-        type: optional<double>
-        docs: The price of the output in USD.
-      totalPrice:
-        type: optional<double>
-        docs: The total price in USD.
-      calculatedInputCost:
-        type: optional<double>
-        docs: The calculated cost of the input in USD
-      calculatedOutputCost:
-        type: optional<double>
-        docs: The calculated cost of the output in USD
-      calculatedTotalCost:
-        type: optional<double>
-        docs: The calculated total cost in USD
-      latency:
-        type: optional<double>
-        docs: The latency in seconds.
-      timeToFirstToken:
-        type: optional<double>
-        docs: The time to the first token in seconds
-
-  Usage:
-    docs: Standard interface for usage and cost
-    properties:
-      input:
-        docs: Number of input units (e.g. tokens)
-        type: optional<integer>
-      output:
-        docs: Number of output units (e.g. tokens)
-        type: optional<integer>
-      total:
-        docs: Defaults to input+output if not set
-        type: optional<integer>
-      unit: optional<ModelUsageUnit>
-      inputCost:
-        docs: USD input cost
-        type: optional<double>
-      outputCost:
-        docs: USD output cost
-        type: optional<double>
-      totalCost:
-        docs: USD total cost, defaults to input+output
-        type: optional<double>
-  ScoreConfig:
-    docs: Configuration for a score
-    properties:
-      id: string
-      name: string
-      createdAt: datetime
-      updatedAt: datetime
-      projectId: string
-      dataType: ScoreDataType
-      isArchived:
-        type: boolean
-        docs: Whether the score config is archived. Defaults to false
-      minValue:
-        type: optional<double>
-        docs: Sets minimum value for numerical scores. If not set, the minimum value defaults to -∞
-      maxValue:
-        type: optional<double>
-        docs: Sets maximum value for numerical scores. If not set, the maximum value defaults to +∞
-      categories:
-        type: optional<list<ConfigCategory>>
-        docs: Configures custom categories for categorical scores
-      description: optional<string>
-  ConfigCategory:
-    properties:
-      value: double
-      label: string
-  BaseScore:
-    properties:
-      id: string
-      traceId: string
-      name: string
-      source: ScoreSource
-      observationId: optional<string>
-      timestamp: datetime
-      createdAt: datetime
-      updatedAt: datetime
-      authorUserId: optional<string>
-      comment: optional<string>
-      configId:
-        type: optional<string>
-        docs: Reference a score config on a score. When set, config and score name must be equal and value must comply to optionally defined numerical range
-      queueId:
-        type: optional<string>
-        docs: Reference an annotation queue on a score. Populated if the score was initially created in an annotation queue.
-  NumericScore:
-    extends: BaseScore
-    properties:
-      value:
-        type: double
-        docs: The numeric value of the score
-  BooleanScore:
-    extends: BaseScore
-    properties:
-      value:
-        type: double
-        docs: The numeric value of the score. Equals 1 for "True" and 0 for "False"
-      stringValue:
-        type: string
-        docs: The string representation of the score value. Is inferred from the numeric value and equals "True" or "False"
-  CategoricalScore:
-    extends: BaseScore
-    properties:
-      value:
-        type: optional<double>
-        docs: Only defined if a config is linked. Represents the numeric category mapping of the stringValue
-      stringValue:
-        type: string
-        docs: The string representation of the score value. If no config is linked, can be any string. Otherwise, must map to a config category
-  Score:
-    discriminant: "dataType"
-    union:
-      NUMERIC:
-        type: NumericScore
-        docs: "Score with NUMERIC data type"
-      CATEGORICAL:
-        type: CategoricalScore
-        docs: "Score with CATEGORICAL data type"
-      BOOLEAN:
-        type: BooleanScore
-        docs: "Score with BOOLEAN data type"
-
-  CreateScoreValue:
-    discriminated: false
-    union:
-      - double
-      - string
-    docs: The value of the score. Must be passed as string for categorical scores, and numeric for boolean and numeric scores
-
-  Comment:
-    properties:
-      id: string
-      projectId: string
-      createdAt: datetime
-      updatedAt: datetime
-      objectType: CommentObjectType
-      objectId: string
-      content: string
-      authorUserId: optional<string>
-
-  Dataset:
-    properties:
-      id: string
-      name: string
-      description: optional<string>
-      metadata: optional<unknown>
-      projectId: string
-      createdAt: datetime
-      updatedAt: datetime
-  DatasetItem:
-    properties:
-      id: string
-      status: DatasetStatus
-      input: optional<unknown>
-      expectedOutput: optional<unknown>
-      metadata: optional<unknown>
-      sourceTraceId: optional<string>
-      sourceObservationId: optional<string>
-      datasetId: string
-      datasetName: string
-      createdAt: datetime
-      updatedAt: datetime
-  DatasetRunItem:
-    properties:
-      id: string
-      datasetRunId: string
-      datasetRunName: string
-      datasetItemId: string
-      traceId: string
-      observationId: optional<string>
-      createdAt: datetime
-      updatedAt: datetime
-  DatasetRun:
-    properties:
-      id:
-        type: string
-        docs: Unique identifier of the dataset run
-      name:
-        type: string
-        docs: Name of the dataset run
-      description:
-        type: optional<string>
-        docs: Description of the run
-      metadata:
-        type: optional<unknown>
-        docs: Metadata of the dataset run
-      datasetId:
-        type: string
-        docs: Id of the associated dataset
-      datasetName:
-        type: string
-        docs: Name of the associated dataset
-      createdAt:
-        type: datetime
-        docs: The date and time when the dataset run was created
-      updatedAt:
-        type: datetime
-        docs: The date and time when the dataset run was last updated
-  DatasetRunWithItems:
-    extends: DatasetRun
-    properties:
-      datasetRunItems: list<DatasetRunItem>
-  Model:
-    docs: Model definition used for transforming usage into USD cost and/or tokenization.
-    properties:
-      id: string
-      modelName:
-        docs: "Name of the model definition. If multiple with the same name exist, they are applied in the following order: (1) custom over built-in, (2) newest according to startTime where model.startTime<observation.startTime"
-        type: string
-      matchPattern:
-        docs: "Regex pattern which matches this model definition to generation.model. Useful in case of fine-tuned models. If you want to exact match, use `(?i)^modelname$`"
-        type: string
-      startDate:
-        docs: Apply only to generations which are newer than this ISO date.
-        type: optional<date>
-      unit:
-        docs: Unit used by this model.
-        type: ModelUsageUnit
-      inputPrice:
-        docs: Price (USD) per input unit
-        type: optional<double>
-      outputPrice:
-        docs: Price (USD) per output unit
-        type: optional<double>
-      totalPrice:
-        docs: Price (USD) per total unit. Cannot be set if input or output price is set.
-        type: optional<double>
-      tokenizerId:
-        docs: Optional. Tokenizer to be applied to observations which match to this model. See docs for more details.
-        type: optional<string>
-      tokenizerConfig:
-        docs: Optional. Configuration for the selected tokenizer. Needs to be JSON. See docs for more details.
-        type: optional<unknown>
-      isLangfuseManaged:
-        type: boolean
-
-  # Utilities
-  ModelUsageUnit:
-    docs: Unit of usage in Langfuse
-    enum:
-      - CHARACTERS
-      - TOKENS
-      - MILLISECONDS
-      - SECONDS
-      - IMAGES
-      - REQUESTS
-  ObservationLevel:
-    enum:
-      - DEBUG
-      - DEFAULT
-      - WARNING
-      - ERROR
-  MapValue:
-    discriminated: false
-    union:
-      - optional<string>
-      - optional<integer>
-      - optional<boolean>
-      - optional<list<string>>
-  CommentObjectType:
-    enum:
-      - TRACE
-      - OBSERVATION
-      - SESSION
-      - PROMPT
-  DatasetStatus:
-    enum:
-      - ACTIVE
-      - ARCHIVED
-  ScoreSource:
-    enum:
-      - ANNOTATION
-      - API
-      - EVAL
-  ScoreDataType:
-    enum:
-      - NUMERIC
-      - BOOLEAN
-      - CATEGORICAL
-
-errors:
-  Error:
-    status-code: 400
-    type: unknown
-  UnauthorizedError:
-    status-code: 401
-    type: unknown
-  AccessDeniedError:
-    status-code: 403
-    type: unknown
-  NotFoundError:
-    status-code: 404
-    type: unknown
-  MethodNotAllowedError:
-    status-code: 405
-    type: unknown

fern/apis/server/definition/dataset-items.yml

@@ -1,59 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-  pagination: ./utils/pagination.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    create:
-      method: POST
-      docs: Create a dataset item
-      path: /dataset-items
-      request: CreateDatasetItemRequest
-      response: commons.DatasetItem
-    get:
-      docs: Get a dataset item
-      method: GET
-      path: /dataset-items/{id}
-      path-parameters:
-        id:
-          type: string
-      response: commons.DatasetItem
-    list:
-      docs: Get dataset items
-      method: GET
-      path: /dataset-items
-      request:
-        name: GetDatasetItemsRequest
-        query-parameters:
-          datasetName: optional<string>
-          sourceTraceId: optional<string>
-          sourceObservationId: optional<string>
-          page:
-            type: optional<integer>
-            docs: page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: limit of items per page
-      response: PaginatedDatasetItems
-
-types:
-  CreateDatasetItemRequest:
-    properties:
-      datasetName: string
-      input: optional<unknown>
-      expectedOutput: optional<unknown>
-      metadata: optional<unknown>
-      sourceTraceId: optional<string>
-      sourceObservationId: optional<string>
-      id:
-        type: optional<string>
-        docs: Dataset items are upserted on their id. Id needs to be unique (project-level) and cannot be reused across datasets.
-      status:
-        type: optional<commons.DatasetStatus>
-        docs: Defaults to ACTIVE for newly created items
-  PaginatedDatasetItems:
-    properties:
-      data: list<commons.DatasetItem>
-      meta: pagination.MetaResponse

fern/apis/server/definition/dataset-run-items.yml

@@ -1,28 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    create:
-      method: POST
-      docs: Create a dataset run item
-      path: /dataset-run-items
-      request: CreateDatasetRunItemRequest
-      response: commons.DatasetRunItem
-types:
-  CreateDatasetRunItemRequest:
-    properties:
-      runName: string
-      runDescription:
-        type: optional<string>
-        docs: Description of the run. If run exists, description will be updated.
-      metadata:
-        type: optional<unknown>
-        docs: Metadata of the dataset run, updates run if run already exists
-      datasetItemId: string
-      observationId: optional<string>
-      traceId:
-        type: optional<string>
-        docs: traceId should always be provided. For compatibility with older SDK versions it can also be inferred from the provided observationId.

fern/apis/server/definition/datasets.yml

@@ -1,74 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-  pagination: ./utils/pagination.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    list:
-      method: GET
-      docs: Get all datasets
-      path: /v2/datasets
-      request:
-        name: GetDatasetsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: limit of items per page
-      response: PaginatedDatasets
-    get:
-      method: GET
-      docs: Get a dataset
-      path: /v2/datasets/{datasetName}
-      path-parameters:
-        datasetName: string
-      response: commons.Dataset
-    create:
-      method: POST
-      docs: Create a dataset
-      path: /v2/datasets
-      request: CreateDatasetRequest
-      response: commons.Dataset
-    getRun:
-      method: GET
-      docs: Get a dataset run and its items
-      path: /datasets/{datasetName}/runs/{runName}
-      path-parameters:
-        datasetName: string
-        runName: string
-      response: commons.DatasetRunWithItems
-    getRuns:
-      method: GET
-      docs: Get dataset runs
-      path: /datasets/{datasetName}/runs
-      path-parameters:
-        datasetName: string
-      request:
-        name: GetDatasetRunsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: limit of items per page
-      response: PaginatedDatasetRuns
-
-types:
-  PaginatedDatasets:
-    properties:
-      data: list<commons.Dataset>
-      meta: pagination.MetaResponse
-  CreateDatasetRequest:
-    properties:
-      name: string
-      description: optional<string>
-      metadata: optional<unknown>
-  PaginatedDatasetRuns:
-    properties:
-      data: list<commons.DatasetRun>
-      meta: pagination.MetaResponse

fern/apis/server/definition/health.yml

@@ -1,28 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-service:
-  auth: false
-  base-path: /api/public
-  endpoints:
-    health:
-      docs: Check health of API and database
-      method: GET
-      path: /health
-      response: HealthResponse
-      errors:
-        - ServiceUnavailableError
-
-types:
-  HealthResponse:
-    properties:
-      version:
-        type: string
-        docs: Langfuse server version
-      status: string
-    examples:
-      - value:
-          version: 1.25.0
-          status: OK
-
-errors:
-  ServiceUnavailableError:
-    status-code: 503

fern/apis/server/definition/ingestion.yml

@@ -1,314 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  pagination: ./utils/pagination.yml
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    batch:
-      docs: |
-        Batched ingestion for Langfuse Tracing. If you want to use tracing via the API, such as to build your own Langfuse client implementation, this is the only API route you need to implement.
-
-        Notes:
-        - Batch sizes are limited to 3.5 MB in total. You need to adjust the number of events per batch accordingly.
-        - The API does not return a 4xx status code for input errors. Instead, it responds with a 207 status code, which includes a list of the encountered errors.
-      method: POST
-      path: /ingestion
-      request:
-        name: IngestionRequest
-        body:
-          properties:
-            batch:
-              type: list<IngestionEvent>
-              docs: "Batch of tracing events to be ingested. Discriminated by attribute `type`."
-            metadata:
-              type: optional<unknown>
-              docs: Optional. Metadata field used by the Langfuse SDKs for debugging.
-      response:
-        type: IngestionResponse
-        status-code: 207
-
-types:
-  IngestionEvent:
-    discriminant: "type"
-    union:
-      trace-create:
-        type: TraceEvent
-        docs: Creates a new trace. Upserts on id for updates if trace with id exists.
-      score-create:
-        type: ScoreEvent
-        docs: Creates a new score. Upserts on id for updates if score with id exists.
-      span-create:
-        type: CreateSpanEvent
-        docs: Creates a new span.
-      span-update:
-        type: UpdateSpanEvent
-        docs: Updates span based on id.
-      generation-create:
-        type: CreateGenerationEvent
-        docs: Creates a new generation.
-      generation-update:
-        type: UpdateGenerationEvent
-        docs: Updates a generation based on id.
-      event-create:
-        type: CreateEventEvent
-        docs: Creates an event.
-
-      sdk-log:
-        type: SDKLogEvent
-        docs: Langfuse SDKs only, used for debugging purposes.
-
-      # both are legacy
-      observation-create:
-        type: CreateObservationEvent
-        docs: Deprecated event type
-      observation-update:
-        type: UpdateObservationEvent
-        docs: Deprecated event type
-
-  ObservationType:
-    enum:
-      - SPAN
-      - GENERATION
-      - EVENT
-
-  IngestionUsage:
-    discriminated: false
-    union:
-      - commons.Usage
-      - OpenAIUsage
-
-  OpenAIUsage:
-    docs: Usage interface of OpenAI for improved compatibility.
-    properties:
-      promptTokens: optional<integer>
-      completionTokens: optional<integer>
-      totalTokens: optional<integer>
-
-  OptionalObservationBody:
-    properties:
-      traceId: optional<string>
-      name: optional<string>
-      startTime: optional<datetime>
-      metadata: optional<unknown>
-      input: optional<unknown>
-      output: optional<unknown>
-      level: optional<commons.ObservationLevel>
-      statusMessage: optional<string>
-      parentObservationId: optional<string>
-      version: optional<string>
-
-  CreateEventBody:
-    extends: OptionalObservationBody
-    properties:
-      id: optional<string>
-
-  UpdateEventBody:
-    extends: OptionalObservationBody
-    properties:
-      id: string
-
-  CreateSpanBody:
-    extends: CreateEventBody
-    properties:
-      endTime: optional<datetime>
-
-  UpdateSpanBody:
-    extends: UpdateEventBody
-    properties:
-      endTime: optional<datetime>
-
-  CreateGenerationBody:
-    extends: CreateSpanBody
-    properties:
-      completionStartTime: optional<datetime>
-      model: optional<string>
-      modelParameters: optional<map<string, commons.MapValue>>
-      usage: optional<IngestionUsage>
-      promptName: optional<string>
-      promptVersion: optional<integer>
-
-  UpdateGenerationBody:
-    extends: UpdateSpanBody
-    properties:
-      completionStartTime: optional<datetime>
-      model: optional<string>
-      modelParameters: optional<map<string, commons.MapValue>>
-      usage: optional<IngestionUsage>
-      promptName: optional<string>
-      promptVersion: optional<integer>
-
-  ObservationBody:
-    properties:
-      id: optional<string>
-      traceId: optional<string>
-      type: ObservationType
-      name: optional<string>
-      startTime: optional<datetime>
-      endTime: optional<datetime>
-      completionStartTime: optional<datetime>
-      model: optional<string>
-      modelParameters: optional<map<string, commons.MapValue>>
-      input: optional<unknown>
-      version: optional<string>
-      metadata: optional<unknown>
-      output: optional<unknown>
-      usage: optional<commons.Usage>
-      level: optional<commons.ObservationLevel>
-      statusMessage: optional<string>
-      parentObservationId: optional<string>
-
-  TraceBody:
-    properties:
-      id: optional<string>
-      timestamp: optional<datetime>
-      name: optional<string>
-      userId: optional<string>
-      input: optional<unknown>
-      output: optional<unknown>
-      sessionId: optional<string>
-      release: optional<string>
-      version: optional<string>
-      metadata: optional<unknown>
-      tags: optional<list<string>>
-      public:
-        type: optional<boolean>
-        docs: Make trace publicly accessible via url
-
-  SDKLogBody:
-    properties:
-      log: unknown
-
-  ScoreBody:
-    properties:
-      id: optional<string>
-      traceId: string
-      name: string
-      value:
-        type: commons.CreateScoreValue
-        docs: The value of the score. Must be passed as string for categorical scores, and numeric for boolean and numeric scores. Boolean score values must equal either 1 or 0 (true or false)
-      observationId: optional<string>
-      comment: optional<string>
-      dataType:
-        type: optional<commons.ScoreDataType>
-        docs: When set, must match the score value's type. If not set, will be inferred from the score value or config
-      configId:
-        type: optional<string>
-        docs: Reference a score config on a score. When set, the score name must equal the config name and scores must comply with the config's range and data type. For categorical scores, the value must map to a config category. Numeric scores might be constrained by the score config's max and min values
-    examples:
-      - value:
-          name: "novelty"
-          value: 0.9
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "consistency"
-          value: 1.2
-          dataType: "NUMERIC"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "accuracy"
-          value: 0.9
-          dataType: "NUMERIC"
-          configId: "9203-4567-89ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "toxicity"
-          value: "not toxic"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "correctness"
-          value: "partially correct"
-          dataType: "CATEGORICAL"
-          configId: "1234-5678-90ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "hallucination"
-          value: 0
-          dataType: "BOOLEAN"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "helpfulness"
-          value: 1
-          dataType: "BOOLEAN"
-          configId: "1234-5678-90ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-
-  BaseEvent:
-    properties:
-      id:
-        type: string
-        docs: UUID v4 that identifies the event
-      timestamp:
-        type: string
-        docs: "Datetime (ISO 8601) of event creation in client. Should be as close to actual event creation in client as possible, this timestamp will be used for ordering of events in future release. Resolution: milliseconds (required), microseconds (optimal)."
-      metadata:
-        type: optional<unknown>
-        docs: Optional. Metadata field used by the Langfuse SDKs for debugging.
-
-  TraceEvent:
-    extends: BaseEvent
-    properties:
-      body: TraceBody
-
-  CreateObservationEvent:
-    extends: BaseEvent
-    properties:
-      body: ObservationBody
-
-  UpdateObservationEvent:
-    extends: BaseEvent
-    properties:
-      body: ObservationBody
-
-  ScoreEvent:
-    extends: BaseEvent
-    properties:
-      body: ScoreBody
-
-  SDKLogEvent:
-    extends: BaseEvent
-    properties:
-      body: SDKLogBody
-
-  CreateGenerationEvent:
-    extends: BaseEvent
-    properties:
-      body: CreateGenerationBody
-
-  UpdateGenerationEvent:
-    extends: BaseEvent
-    properties:
-      body: UpdateGenerationBody
-
-  CreateSpanEvent:
-    extends: BaseEvent
-    properties:
-      body: CreateSpanBody
-
-  UpdateSpanEvent:
-    extends: BaseEvent
-    properties:
-      body: UpdateSpanBody
-
-  CreateEventEvent:
-    extends: BaseEvent
-    properties:
-      body: CreateEventBody
-
-  IngestionSuccess:
-    properties:
-      id: string
-      status: integer
-
-  IngestionError:
-    properties:
-      id: string
-      status: integer
-      message: optional<string>
-      error: optional<unknown>
-
-  IngestionResponse:
-    properties:
-      successes: list<IngestionSuccess>
-      errors: list<IngestionError>

fern/apis/server/definition/media.yml

@@ -1,103 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    get:
-      docs: Get a media record
-      method: GET
-      path: /media/{mediaId}
-      path-parameters:
-        mediaId:
-          type: string
-          docs: The unique langfuse identifier of a media record
-      response: GetMediaResponse
-
-    patch:
-      docs: Patch a media record
-      method: PATCH
-      path: /media/{mediaId}
-      path-parameters:
-        mediaId:
-          type: string
-          docs: The unique langfuse identifier of a media record
-      request: PatchMediaBody
-
-    getUploadUrl:
-      docs: Get a presigned upload URL for a media record
-      method: POST
-      path: /media
-      request: GetMediaUploadUrlRequest
-      response: GetMediaUploadUrlResponse
-
-types:
-  GetMediaResponse:
-    properties:
-      mediaId:
-        type: string
-        docs: The unique langfuse identifier of a media record
-      contentType:
-        type: string
-        docs: The MIME type of the media record
-      contentLength:
-        type: integer
-        docs: The size of the media record in bytes
-      uploadedAt:
-        type: datetime
-        docs: The date and time when the media record was uploaded
-      url:
-        type: string
-        docs: The download URL of the media record
-      urlExpiry:
-        type: string
-        docs: The expiry date and time of the media record download URL
-
-  PatchMediaBody:
-    properties:
-      uploadedAt:
-        type: datetime
-        docs: The date and time when the media record was uploaded
-      uploadHttpStatus:
-        type: integer
-        docs: The HTTP status code of the upload
-      uploadHttpError:
-        type: optional<string>
-        docs: The HTTP error message of the upload
-      uploadTimeMs:
-        type: optional<integer>
-        docs: The time in milliseconds it took to upload the media record
-
-  GetMediaUploadUrlRequest:
-    properties:
-      traceId:
-        type: string
-        docs: The trace ID associated with the media record
-      observationId:
-        type: optional<string>
-        docs: The observation ID associated with the media record. If the media record is associated directly with a trace, this will be null.
-      contentType: MediaContentType
-      contentLength:
-        type: integer
-        docs: The size of the media record in bytes
-      sha256Hash:
-        type: string
-        docs: The SHA-256 hash of the media record
-      field:
-        type: string
-        docs: The trace / observation field the media record is associated with. This can be one of `input`, `output`, `metadata`
-
-  GetMediaUploadUrlResponse:
-    properties:
-      uploadUrl:
-        type: optional<string>
-        docs: The presigned upload URL. If the asset is already uploaded, this will be null
-      mediaId:
-        type: string
-        docs: The unique langfuse identifier of a media record
-
-  MediaContentType:
-    type: literal<"image/png","image/jpeg","image/jpg","image/webp","audio/mpeg","audio/mp3","audio/wav","text/plain","application/pdf">
-    docs: The MIME type of the media record

fern/apis/server/definition/metrics.yml

@@ -1,72 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  pagination: ./utils/pagination.yml
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    daily:
-      docs: Get daily metrics of the Langfuse project
-      method: GET
-      path: /metrics/daily
-      request:
-        name: GetDailyMetricsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: limit of items per page
-          traceName:
-            type: optional<string>
-            docs: Optional filter by the name of the trace
-          userId:
-            type: optional<string>
-            docs: Optional filter by the userId associated with the trace
-          tags:
-            type: optional<string>
-            allow-multiple: true
-            docs: Optional filter for metrics where traces include all of these tags
-          fromTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include traces and observations on or after a certain datetime (ISO 8601)
-          toTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include traces and observations before a certain datetime (ISO 8601)
-      response: DailyMetrics
-types:
-  DailyMetrics:
-    properties:
-      data:
-        type: list<DailyMetricsDetails>
-        docs: A list of daily metrics, only days with ingested data are included.
-      meta: pagination.MetaResponse
-  DailyMetricsDetails:
-    properties:
-      date: date
-      countTraces: integer
-      countObservations: integer
-      totalCost:
-        type: double
-        docs: Total model cost in USD
-      usage: list<UsageByModel>
-  UsageByModel:
-    docs: Daily usage of a given model. Usage corresponds to the unit set for the specific model (e.g. tokens).
-    properties:
-      model: optional<string>
-      inputUsage:
-        type: integer
-        docs: Total number of generation input units (e.g. tokens)
-      outputUsage:
-        type: integer
-        docs: Total number of generation output units (e.g. tokens)
-      totalUsage:
-        type: integer
-        docs: Total number of generation total units (e.g. tokens)
-      countTraces: integer
-      countObservations: integer
-      totalCost:
-        type: double
-        docs: Total model cost in USD

fern/apis/server/definition/models.yml

@@ -1,76 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-  pagination: ./utils/pagination.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    create:
-      method: POST
-      docs: Create a model
-      path: /models
-      request: CreateModelRequest
-      response: commons.Model
-    list:
-      method: GET
-      docs: Get all models
-      path: /models
-      request:
-        name: GetModelsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: limit of items per page
-      response: PaginatedModels
-    get:
-      method: GET
-      docs: Get a model
-      path: /models/{id}
-      path-parameters:
-        id: string
-      response: commons.Model
-    delete:
-      method: DELETE
-      docs: Delete a model. Cannot delete models managed by Langfuse. You can create your own definition with the same modelName to override the definition though.
-      path: /models/{id}
-      path-parameters:
-        id: string
-
-types:
-  PaginatedModels:
-    properties:
-      data: list<commons.Model>
-      meta: pagination.MetaResponse
-  CreateModelRequest:
-    properties:
-      modelName:
-        docs: "Name of the model definition. If multiple with the same name exist, they are applied in the following order: (1) custom over built-in, (2) newest according to startTime where model.startTime<observation.startTime"
-        type: string
-      matchPattern:
-        docs: "Regex pattern which matches this model definition to generation.model. Useful in case of fine-tuned models. If you want to exact match, use `(?i)^modelname$`"
-        type: string
-      startDate:
-        docs: Apply only to generations which are newer than this ISO date.
-        type: optional<datetime>
-      unit:
-        docs: Unit used by this model.
-        type: commons.ModelUsageUnit
-      inputPrice:
-        docs: Price (USD) per input unit
-        type: optional<double>
-      outputPrice:
-        docs: Price (USD) per output unit
-        type: optional<double>
-      totalPrice:
-        docs: Price (USD) per total units. Cannot be set if input or output price is set.
-        type: optional<double>
-      tokenizerId:
-        docs: Optional. Tokenizer to be applied to observations which match to this model. See docs for more details.
-        type: optional<string>
-      tokenizerConfig:
-        docs: Optional. Configuration for the selected tokenizer. Needs to be JSON. See docs for more details.
-        type: optional<unknown>

fern/apis/server/definition/observations.yml

@@ -1,56 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-  pagination: ./utils/pagination.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    get:
-      docs: Get a observation
-      method: GET
-      path: /observations/{observationId}
-      path-parameters:
-        observationId:
-          type: string
-          docs: The unique langfuse identifier of an observation, can be an event, span or generation
-      response: commons.ObservationsView
-    getMany:
-      docs: Get a list of observations
-      method: GET
-      path: /observations
-      request:
-        name: GetObservationsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: Page number, starts at 1.
-          limit:
-            type: optional<integer>
-            docs: Limit of items per page. If you encounter api issues due to too large page sizes, try to reduce the limit.
-          name: optional<string>
-          userId: optional<string>
-          type: optional<string>
-          traceId: optional<string>
-          parentObservationId: optional<string>
-          fromStartTime:
-            type: optional<datetime>
-            docs: Retrieve only observations with a start_time or or after this datetime (ISO 8601).
-          toStartTime:
-            type: optional<datetime>
-            docs: Retrieve only observations with a start_time before this datetime (ISO 8601).
-          version:
-            type: optional<string>
-            docs: Optional filter to only include observations with a certain version.
-      response: ObservationsViews
-
-types:
-  Observations:
-    properties:
-      data: list<commons.Observation>
-      meta: pagination.MetaResponse
-
-  ObservationsViews:
-    properties:
-      data: list<commons.ObservationsView>
-      meta: pagination.MetaResponse

fern/apis/server/definition/projects.yml

@@ -1,23 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-  pagination: ./utils/pagination.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    get:
-      docs: Get Project associated with API key
-      method: GET
-      path: /projects
-      response: Projects
-
-types:
-  Projects:
-    properties:
-      data: list<Project>
-
-  Project:
-    properties:
-      id: string
-      name: string

fern/apis/server/definition/prompts.yml

@@ -1,138 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  commons: ./commons.yml
-  pagination: ./utils/pagination.yml
-service:
-  auth: true
-  base-path: /api/public/v2
-  endpoints:
-    get:
-      docs: Get a prompt
-      method: GET
-      path: /prompts/{promptName}
-      path-parameters:
-        promptName:
-          type: string
-          docs: The name of the prompt
-      request:
-        name: GetPromptRequest
-        query-parameters:
-          version:
-            type: optional<integer>
-            docs: Version of the prompt to be retrieved.
-          label:
-            type: optional<string>
-            docs: Label of the prompt to be retrieved. Defaults to "production" if no label or version is set.
-      response: Prompt
-
-    list:
-      docs: Get a list of prompt names with versions and labels
-      method: GET
-      path: /prompts
-      request:
-        name: ListPromptsMetaRequest
-        query-parameters:
-          name: optional<string>
-          label: optional<string>
-          tag: optional<string>
-          page:
-            type: optional<integer>
-            docs: page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: limit of items per page
-          fromUpdatedAt:
-            type: optional<datetime>
-            docs: Optional filter to only include prompt versions created/updated on or after a certain datetime (ISO 8601)
-          toUpdatedAt:
-            type: optional<datetime>
-            docs: Optional filter to only include prompt versions created/updated before a certain datetime (ISO 8601)
-
-      response: PromptMetaListResponse
-
-    create:
-      docs: Create a new version for the prompt with the given `name`
-      method: POST
-      path: /prompts
-      request: CreatePromptRequest
-      response: Prompt
-
-types:
-  PromptMetaListResponse:
-    properties:
-      data: list<PromptMeta>
-      meta: pagination.MetaResponse
-
-  PromptMeta:
-    properties:
-      name: string
-      versions: list<integer>
-      labels: list<string>
-      tags: list<string>
-      lastUpdatedAt: datetime
-      lastConfig:
-        type: unknown
-        docs: Config object of the most recent prompt version that matches the filters (if any are provided)
-
-  CreatePromptRequest:
-    union:
-      chat: CreateChatPromptRequest
-      text: CreateTextPromptRequest
-
-  CreateChatPromptRequest:
-    properties:
-      name: string
-      prompt: list<ChatMessage>
-      config: optional<unknown>
-      labels:
-        type: optional<list<string>>
-        docs: List of deployment labels of this prompt version.
-      tags:
-        type: optional<list<string>>
-        docs: List of tags to apply to all versions of this prompt.
-
-  CreateTextPromptRequest:
-    properties:
-      name: string
-      prompt: string
-      config: optional<unknown>
-      labels:
-        type: optional<list<string>>
-        docs: List of deployment labels of this prompt version.
-      tags:
-        type: optional<list<string>>
-        docs: List of tags to apply to all versions of this prompt.
-
-  Prompt:
-    union:
-      chat: ChatPrompt
-      text: TextPrompt
-
-  BasePrompt:
-    properties:
-      name: string
-      version: integer
-      config: unknown
-      labels:
-        type: list<string>
-        docs: List of deployment labels of this prompt version.
-      tags:
-        type: list<string>
-        docs: List of tags. Used to filter via UI and API. The same across versions of a prompt.
-
-  ChatMessage:
-    properties:
-      role:
-        type: string
-      content:
-        type: string
-
-  TextPrompt:
-    extends: BasePrompt
-    properties:
-      prompt: string
-
-  ChatPrompt:
-    extends: BasePrompt
-    properties:
-      prompt: list<ChatMessage>

fern/apis/server/definition/score-configs.yml

@@ -1,58 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  pagination: ./utils/pagination.yml
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    create:
-      docs: Create a score configuration (config). Score configs are used to define the structure of scores
-      method: POST
-      path: /score-configs
-      request: CreateScoreConfigRequest
-      response: commons.ScoreConfig
-    get:
-      docs: Get all score configs
-      method: GET
-      path: /score-configs
-      request:
-        name: GetScoreConfigsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: Page number, starts at 1.
-          limit:
-            type: optional<integer>
-            docs: Limit of items per page. If you encounter api issues due to too large page sizes, try to reduce the limit
-      response: ScoreConfigs
-    get-by-id:
-      docs: Get a score config
-      method: GET
-      path: /score-configs/{configId}
-      path-parameters:
-        configId:
-          type: string
-          docs: The unique langfuse identifier of a score config
-      response: commons.ScoreConfig
-types:
-  ScoreConfigs:
-    properties:
-      data: list<commons.ScoreConfig>
-      meta: pagination.MetaResponse
-  CreateScoreConfigRequest:
-    properties:
-      name: string
-      dataType: commons.ScoreDataType
-      categories:
-        type: optional<list<commons.ConfigCategory>>
-        docs: Configure custom categories for categorical scores. Pass a list of objects with `label` and `value` properties. Categories are autogenerated for boolean configs and cannot be passed
-      minValue:
-        type: optional<double>
-        docs: Configure a minimum value for numerical scores. If not set, the minimum value defaults to -∞
-      maxValue:
-        type: optional<double>
-        docs: Configure a maximum value for numerical scores. If not set, the maximum value defaults to +∞
-      description:
-        type: optional<string>
-        docs: Description is shown across the Langfuse UI and can be used to e.g. explain the config categories in detail, why a numeric range was set, or provide additional context on config name or usage

fern/apis/server/definition/score.yml

@@ -1,176 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  pagination: ./utils/pagination.yml
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    create:
-      docs: Create a score
-      method: POST
-      path: /scores
-      request: CreateScoreRequest
-      response: CreateScoreResponse
-    get:
-      docs: Get a list of scores
-      method: GET
-      path: /scores
-      request:
-        name: GetScoresRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: Page number, starts at 1.
-          limit:
-            type: optional<integer>
-            docs: Limit of items per page. If you encounter api issues due to too large page sizes, try to reduce the limit.
-          userId:
-            type: optional<string>
-            docs: Retrieve only scores with this userId associated to the trace.
-          name:
-            type: optional<string>
-            docs: Retrieve only scores with this name.
-          fromTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include scores created on or after a certain datetime (ISO 8601)
-          toTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include scores created before a certain datetime (ISO 8601)
-          source:
-            type: optional<commons.ScoreSource>
-            docs: Retrieve only scores from a specific source.
-          operator:
-            type: optional<string>
-            docs: Retrieve only scores with <operator> value.
-          value:
-            type: optional<double>
-            docs: Retrieve only scores with <operator> value.
-          scoreIds:
-            type: optional<string>
-            docs: Comma-separated list of score IDs to limit the results to.
-          configId:
-            type: optional<string>
-            docs: Retrieve only scores with a specific configId.
-          queueId:
-            type: optional<string>
-            docs: Retrieve only scores with a specific annotation queueId.
-          dataType:
-            type: optional<commons.ScoreDataType>
-            docs: Retrieve only scores with a specific dataType.
-          traceTags:
-            type: optional<list<string>>
-            allow-multiple: true
-            docs: Only scores linked to traces that include all of these tags will be returned.
-      response: GetScoresResponse
-    get-by-id:
-      docs: Get a score
-      method: GET
-      path: /scores/{scoreId}
-      path-parameters:
-        scoreId:
-          type: string
-          docs: The unique langfuse identifier of a score
-      response: commons.Score
-    delete:
-      docs: Delete a score
-      method: DELETE
-      path: /scores/{scoreId}
-      path-parameters:
-        scoreId:
-          type: string
-          docs: The unique langfuse identifier of a score
-types:
-  CreateScoreRequest:
-    properties:
-      id: optional<string>
-      traceId: string
-      name: string
-      value:
-        type: commons.CreateScoreValue
-        docs: The value of the score. Must be passed as string for categorical scores, and numeric for boolean and numeric scores. Boolean score values must equal either 1 or 0 (true or false)
-      observationId: optional<string>
-      comment: optional<string>
-      dataType:
-        type: optional<commons.ScoreDataType>
-        docs: The data type of the score. When passing a configId this field is inferred. Otherwise, this field must be passed or will default to numeric.
-      configId:
-        type: optional<string>
-        docs: Reference a score config on a score. The unique langfuse identifier of a score config. When passing this field, the dataType and stringValue fields are automatically populated.
-    examples:
-      - value:
-          name: "novelty"
-          value: 0.9
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "consistency"
-          value: 1.2
-          dataType: "NUMERIC"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "accuracy"
-          value: 0.9
-          dataType: "NUMERIC"
-          configId: "9203-4567-89ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "toxicity"
-          value: "not toxic"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "correctness"
-          value: "partially correct"
-          dataType: "CATEGORICAL"
-          configId: "1234-5678-90ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "hallucination"
-          value: 0
-          dataType: "BOOLEAN"
-          traceId: "cdef-1234-5678-90ab"
-      - value:
-          name: "helpfulness"
-          value: 1
-          dataType: "BOOLEAN"
-          configId: "1234-5678-90ab-cdef"
-          traceId: "cdef-1234-5678-90ab"
-  CreateScoreResponse:
-    properties:
-      id:
-        type: string
-        docs: The id of the created object in Langfuse
-  GetScoresResponseTraceData:
-    properties:
-      userId:
-        type: optional<string>
-        docs: The user ID associated with the trace referenced by score
-      tags:
-        type: optional<list<string>>
-        docs: A list of tags associated with the trace referenced by score
-
-  GetScoresResponseDataNumeric:
-    extends: commons.NumericScore
-    properties:
-      trace: GetScoresResponseTraceData
-
-  GetScoresResponseDataCategorical:
-    extends: commons.CategoricalScore
-    properties:
-      trace: GetScoresResponseTraceData
-
-  GetScoresResponseDataBoolean:
-    extends: commons.BooleanScore
-    properties:
-      trace: GetScoresResponseTraceData
-
-  GetScoresResponseData:
-    discriminant: dataType
-    union:
-      NUMERIC: GetScoresResponseDataNumeric
-      CATEGORICAL: GetScoresResponseDataCategorical
-      BOOLEAN: GetScoresResponseDataBoolean
-
-  GetScoresResponse:
-    properties:
-      data: list<GetScoresResponseData>
-      meta: pagination.MetaResponse

fern/apis/server/definition/sessions.yml

@@ -1,42 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  pagination: ./utils/pagination.yml
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    list:
-      docs: Get sessions
-      method: GET
-      path: /sessions
-      request:
-        name: GetSessionsRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: Page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: Limit of items per page. If you encounter api issues due to too large page sizes, try to reduce the limit.
-          fromTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include sessions created on or after a certain datetime (ISO 8601)
-          toTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include sessions created before a certain datetime (ISO 8601)
-      response: PaginatedSessions
-    get:
-      docs: Get a session. Please note that `traces` on this endpoint are not paginated, if you plan to fetch large sessions, consider `GET /api/public/traces?sessionId=<sessionId>`
-      method: GET
-      path: /sessions/{sessionId}
-      path-parameters:
-        sessionId:
-          type: string
-          docs: The unique id of a session
-      response: commons.SessionWithTraces
-types:
-  PaginatedSessions:
-    properties:
-      data: list<commons.Session>
-      meta: pagination.MetaResponse

fern/apis/server/definition/trace.yml

@@ -1,62 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
-imports:
-  pagination: ./utils/pagination.yml
-  commons: ./commons.yml
-service:
-  auth: true
-  base-path: /api/public
-  endpoints:
-    get:
-      docs: Get a specific trace
-      method: GET
-      path: /traces/{traceId}
-      path-parameters:
-        traceId:
-          type: string
-          docs: The unique langfuse identifier of a trace
-      response: commons.TraceWithFullDetails
-    list:
-      docs: Get list of traces
-      method: GET
-      path: /traces
-      request:
-        name: GetTracesRequest
-        query-parameters:
-          page:
-            type: optional<integer>
-            docs: Page number, starts at 1
-          limit:
-            type: optional<integer>
-            docs: Limit of items per page. If you encounter api issues due to too large page sizes, try to reduce the limit.
-          userId: optional<string>
-          name: optional<string>
-          sessionId: optional<string>
-          fromTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include traces with a trace.timestamp on or after a certain datetime (ISO 8601)
-          toTimestamp:
-            type: optional<datetime>
-            docs: Optional filter to only include traces with a trace.timestamp before a certain datetime (ISO 8601)
-          orderBy:
-            type: optional<string>
-            docs: "Format of the string [field].[asc/desc]. Fields: id, timestamp, name, userId, release, version, public, bookmarked, sessionId. Example: timestamp.asc"
-          tags:
-            type: optional<string>
-            allow-multiple: true
-            docs: Only traces that include all of these tags will be returned.
-          version:
-            type: optional<string>
-            docs: Optional filter to only include traces with a certain version.
-          release:
-            type: optional<string>
-            docs: Optional filter to only include traces with a certain release.
-      response: Traces
-
-types:
-  Traces:
-    properties:
-      data: list<commons.TraceWithDetails>
-      meta: pagination.MetaResponse
-  Sort:
-    properties:
-      id: string

fern/apis/server/definition/utils/pagination.yml

@@ -1,24 +0,0 @@
-types:
-  # to be used as copy/paste template for query strings
-  # PaginationRequest:
-  #   properties:
-  #     page:
-  #       type: optional<integer>
-  #       docs: page number, starts at 1
-  #     limit:
-  #       type: optional<integer>
-  #       docs: limit of items per page
-  MetaResponse:
-    properties:
-      page:
-        type: integer
-        docs: current page number
-      limit:
-        type: integer
-        docs: number of items per page
-      totalItems:
-        type: integer
-        docs: number of total items given the current filters/selection (if any)
-      totalPages:
-        type: integer
-        docs: number of total pages given the current limit