chore: release v2.43.2

---------

Co-authored-by: Marlies Mayerhofer <74332854+marliessophie@users.noreply.github.com>

.codespellrc

@@ -0,0 +1,4 @@
+[codespell]
+skip = .git,*.pdf,*.svg,package-lock.json,*.prisma,pnpm-lock.yaml
+ignore-words-list = afterall,vertx
+

.dockerignore

@@ -0,0 +1,8 @@
+Dockerfile
+.dockerignore
+node_modules
+npm-debug.log
+README.md
+.next
+.git
+**/node_modules

.env.dev.example

@@ -0,0 +1,51 @@
+# When adding additional environment variables, the schema in "/src/env.mjs"
+# should be updated accordingly.
+
+# Prisma
+# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
+DIRECT_URL="postgresql://postgres:postgres@localhost:5432/postgres"
+DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"
+
+# Next Auth
+# You can generate a new secret on the command line with:
+# openssl rand -base64 32
+# https://next-auth.js.org/configuration/options#secret
+# NEXTAUTH_SECRET=""
+NEXTAUTH_URL="http://localhost:3000"
+NEXTAUTH_SECRET="secret"
+
+# Langfuse Cloud Environment
+NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="DEV"
+
+# Langfuse experimental features
+LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES="true"
+
+# Salt for API key hashing
+SALT="salt"
+
+# Email
+EMAIL_FROM_ADDRESS=""  # Defines the email address to use as the from address.
+SMTP_CONNECTION_URL=""  # Defines the connection url for smtp server.
+
+# S3 storage
+S3_ENDPOINT=
+S3_ACCESS_KEY_ID=
+S3_SECRET_ACCESS_KEY=
+S3_BUCKET_NAME=
+S3_REGION=
+
+# Prompt playground
+OPENAI_API_KEY=""
+ANTHROPIC_API_KEY=""
+
+# Set during docker build of application
+# Used to disable environment verification at build time
+# DOCKER_BUILD=1
+
+REDIS_HOST="127.0.0.1"
+REDIS_PORT=6379
+REDIS_AUTH="myredissecret"
+
+LANGFUSE_WORKER_PASSWORD=mybasicauthsecret
+# openssl rand -base64 32 used only here
+ENCRYPTION_KEY=6c16874e5c0f0cc74ddec00425fa99fbe9ffbe412b7d5d906a4b00005df91403 

.env.example

@@ -1,28 +0,0 @@
-# Hanzo Cloud Console — environment.
-# Copy to .env.local and adjust. All values are public (NEXT_PUBLIC_*) since the
-# console is a browser app that talks to the unified /v1 backend with cookies.
-
-# Unified Hanzo Cloud backend (the casibase /v1 API). Default: production.
-# Local backend: http://localhost:14000
-NEXT_PUBLIC_CLOUD_URL=https://cloud.hanzo.ai
-
-# Hanzo PaaS (platform.hanzo.ai) — DOKS cluster control plane for the Clusters module.
-NEXT_PUBLIC_PLATFORM_URL=https://platform.hanzo.ai
-
-# hanzo.app builder — target of the Templates gallery "Open in builder" deep-link
-# (fork a starter → customize by prompt in the builder). Default: production.
-NEXT_PUBLIC_APP_URL=https://hanzo.app
-
-# Hanzo IAM (OIDC authority). Canonical issuer is https://hanzo.id — tokens are
-# minted with iss=https://hanzo.id, which the cloud /v1 backend validates against.
-# iam.hanzo.ai is the legacy zone (iss=https://iam.hanzo.ai) and MUST NOT be used
-# by the browser, or sign-in drops on iam.hanzo.ai with an issuer mismatch.
-NEXT_PUBLIC_IAM_URL=https://hanzo.id
-
-# IAM application console2 authenticates as. console2 is a front-end of the
-# shared Hanzo Cloud /v1 backend, which exchanges the OIDC code and validates the
-# token as app `hanzo-cloud` (aud=hanzo-cloud) — so the front-end presents the
-# same app/client_id. Must match the cloud-api binding, not a console-only app.
-NEXT_PUBLIC_IAM_APP_NAME=hanzo-cloud
-NEXT_PUBLIC_IAM_ORG_NAME=hanzo
-NEXT_PUBLIC_IAM_CLIENT_ID=hanzo-cloud

.env.local.example

@@ -0,0 +1,26 @@
+# When adding additional environment variables, the schema in "/src/env.mjs"
+# should be updated accordingly.
+
+# Prisma
+# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
+DIRECT_URL="postgresql://postgres:postgres@db:5432/postgres"
+DATABASE_URL="postgresql://postgres:postgres@db:5432/postgres"
+# Next Auth
+NEXTAUTH_SECRET="secret"
+NEXTAUTH_URL="http://localhost:3000"
+
+# feature flag to enable experimental features locally
+LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES="false"
+SALT="salt"
+
+
+# Prompt playground
+OPENAI_API_KEY=""
+ANTHROPIC_API_KEY=""
+
+# Redis
+REDIS_HOST="127.0.0.1"
+REDIS_PORT=6379
+REDIS_AUTH="myredissecret"
+
+LANGFUSE_WORKER_PASSWORD=myworkerpassword

.env.prod.example

@@ -0,0 +1,140 @@
+# More information: https://langfuse.com/docs/deployment/self-host
+
+# When adding additional environment variables, the schema in "/src/env.mjs"
+# should be updated accordingly.
+
+# Prisma
+# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
+# DATABASE_URL supports pooled connections, but then you need to set DIRECT_URL
+DATABASE_URL="postgresql://postgres:postgres@db:5432/postgres"
+# DIRECT_URL="postgresql://postgres:postgres@db:5432/postgres"
+# SHADOW_DATABASE_URL=
+
+# Next Auth
+# NEXTAUTH_URL does not need to be set when deploying on Vercel
+NEXTAUTH_URL="http://localhost:3000"
+
+# You can generate a new secret on the command line with:
+# openssl rand -base64 32
+# https://next-auth.js.org/configuration/options#secret
+NEXTAUTH_SECRET="secret"
+SALT="salt"
+
+# Use CSP headers to enforce HTTPS, optional
+LANGFUSE_CSP_ENFORCE_HTTPS="true"
+
+# Docker only, optional
+# PORT=3000
+# HOSTNAME=localhost
+
+# Default project, optional
+# LANGFUSE_DEFAULT_PROJECT_ID=
+# LANGFUSE_DEFAULT_PROJECT_ROLE=
+
+# Enable experimental features, optional
+# LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=true
+
+# Auth, optional configuration
+# AUTH_DOMAINS_WITH_SSO_ENFORCEMENT=domain1.com,domain2.com
+# AUTH_DISABLE_USERNAME_PASSWORD=true
+# AUTH_DISABLE_SIGNUP=true
+
+# SSO, each group is optional
+# AUTH_GOOGLE_CLIENT_ID=
+# AUTH_GOOGLE_CLIENT_SECRET=
+# AUTH_GOOGLE_ALLOW_ACCOUNT_LINKING=false
+# AUTH_GITHUB_CLIENT_ID=
+# AUTH_GITHUB_CLIENT_SECRET=
+# AUTH_GITHUB_ALLOW_ACCOUNT_LINKING=false
+# AUTH_AZURE_AD_CLIENT_ID=
+# AUTH_AZURE_AD_CLIENT_SECRET=
+# AUTH_AZURE_AD_TENANT_ID=
+# AUTH_AZURE_ALLOW_ACCOUNT_LINKING=false
+# AUTH_OKTA_CLIENT_ID=
+# AUTH_OKTA_CLIENT_SECRET=
+# AUTH_OKTA_ISSUER=
+# AUTH_OKTA_ALLOW_ACCOUNT_LINKING=false
+# AUTH_AUTH0_CLIENT_ID=
+# AUTH_AUTH0_CLIENT_SECRET=
+# AUTH_AUTH0_ISSUER=
+# AUTH_AUTH0_ALLOW_ACCOUNT_LINKING=false
+
+# Transactional email, optional
+# Defines the email address to use as the from address.
+# EMAIL_FROM_ADDRESS=
+# Defines the connection url for smtp server. 
+# SMTP_CONNECTION_URL=
+
+# S3 storage, optional, used for exports from the UI
+# S3_ENDPOINT=
+# S3_ACCESS_KEY_ID=
+# S3_SECRET_ACCESS_KEY=
+# S3_BUCKET_NAME=
+# S3_REGION=
+
+# Exports are streamed to S3 in pages to avoid memory issues
+# The page size can be adjusted if needed to optimize performance
+# DB_EXPORT_PAGE_SIZE=1000
+
+# Disable logging to `events` table in db
+# ENABLE_EVENT_LOG=false
+
+
+
+### START Envs to be deprecated in Langfuse v3.0
+
+# Disable the expensive analytics queries and related features
+# LANGFUSE_DISABLE_EXPENSIVE_POSTGRES_QUERIES="true"
+
+# Customize the default datetime offset filter used in for the UI tables
+# LANGFUSE_DEFAULT_TABLE_DATETIME_OFFSET="7" # int (days)
+
+### END Envs to be deprecated in Langfuse v3.0
+
+
+
+
+### START Langfuse Cloud Config
+# Used for Langfuse Cloud deployments
+# Not recommended for self-hosted deployments as these are NOT COVERED BY SEMVER
+
+# NEXT_PUBLIC_LANGFUSE_CLOUD_REGION="US"
+# NEXTAUTH_COOKIE_DOMAIN=".langfuse.com"
+
+# LANGFUSE_TEAM_SLACK_WEBHOOK=
+# LANGFUSE_NEW_USER_SIGNUP_WEBHOOK=
+
+# Posthog (optional for analytics of web ui)
+# NEXT_PUBLIC_POSTHOG_HOST=
+# NEXT_PUBLIC_POSTHOG_KEY=
+
+# Sentry
+# NEXT_PUBLIC_SENTRY_DSN=
+# NEXT_SENTRY_ORG=
+# NEXT_SENTRY_PROJECT=
+# SENTRY_AUTH_TOKEN=
+
+# Cloudflare Turnstile
+# NEXT_PUBLIC_TURNSTILE_SITE_KEY=
+# TURNSTILE_SECRET_KEY=
+
+# Prompt playground
+# OPENAI_API_KEY=""
+# ANTHROPIC_API_KEY=""
+
+# Betterstack
+# LANGFUSE_TEAM_BETTERSTACK_TOKEN=
+
+# Demo project that users can use to try the platform
+# NEXT_PUBLIC_DEMO_PROJECT_ID=
+
+# Crisp chat
+# NEXT_PUBLIC_CRISP_WEBSITE_ID=
+
+# Encryption
+# ENCRYPTION_KEY=
+
+# Admin API
+# ADMIN_API_KEY=
+
+### END Langfuse Cloud Config

.eslintignore

@@ -0,0 +1,4 @@
+node_modules
+**/node_modules
+build
+coverage

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Currently inactive
+# * @langfuse/maintainers

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -0,0 +1,11 @@
+body:
+  - type: textarea
+    attributes:
+      label: Describe the feature or potential improvement
+      description: Please describe the change as clear and concise as possible. Remember to add context as to why you believe this is needed.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Additional information
+      description: Add any other information related to the change here. If your idea is related to any issues or discussions, link them here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,35 @@
+name: 🐞 Bug Report
+description: Create a bug report to help us improve
+title: "bug: "
+labels: ["🐞❔ unconfirmed bug"]
+body:
+  - type: textarea
+    attributes:
+      label: Describe the bug
+      description: A clear and concise description of the bug, as well as what you expected to happen when encountering it.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: To reproduce
+      description: Describe how to reproduce your bug. Please provide detailed steps, code snippets, reproduction repos etc.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: SDK and container versions
+      description: If you're experiencing an issue with an integration or SDK, please ensure you're using the latest version. If you're self-hosting Langfuse, check that you're running the most recent version. If updating isn't an option, please provide the specific versions you're currently using.
+  - type: textarea
+    attributes:
+      label: Additional information
+      description: Add any other information related to the bug here, screenshots if applicable.
+  - type: dropdown
+    id: contribute
+    attributes:
+      label: Are you interested to contribute a fix for this bug?
+      description: If this is a confirmed bug, the maintainers are happy to support with guidance and review.
+      options:
+        - "No"
+        - "Yes"
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,7 @@
+contact_links:
+  - name: 💡 Feature Request
+    url: https://github.com/orgs/langfuse/discussions/new?category=ideas
+    about: Suggest any ideas you have using our discussion forums.
+  - name: 🤗 Get Help
+    url: https://github.com/orgs/langfuse/discussions/new?category=support
+    about: If you can’t get something to work the way you expect, open a question in our discussion forums.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,36 @@
+## What does this PR do?
+
+<!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. -->
+
+Fixes # (issue)
+
+<!-- Please provide a loom video for visual changes to speed up reviews
+ Loom Video: https://www.loom.com/
+-->
+
+## Type of change
+
+<!-- Please delete bullets that are not relevant. -->
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] Chore (refactoring code, technical debt, workflow improvements)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Refactor (does not change functionality, e.g. code style improvements, linting)
+- [ ] This change requires a documentation update
+
+## Mandatory Tasks
+
+- [ ] Make sure you have self-reviewed the code. A decent size PR without self-review might be rejected.
+
+## Checklist
+
+<!-- Remove bullet points below that don't apply to you -->
+
+- I haven't read the [contributing guide](https://github.com/langfuse/langfuse/blob/main/CONTRIBUTING.md)
+- My code doesn't follow the style guidelines of this project (`npm run prettier`)
+- I haven't commented my code, particularly in hard-to-understand areas
+- I haven't checked if my PR needs changes to the documentation
+- I haven't checked if my changes generate no new warnings (`npm run lint`)
+- I haven't added tests that prove my fix is effective or that my feature works
+- I haven't checked if new and existing unit tests pass locally with my changes

.github/dependabot.yml

@@ -0,0 +1,35 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/" # Location of package manifests
+    rebase-strategy: "disabled" # use dependabot-rebase-stale
+    schedule:
+      interval: "daily"
+    versioning-strategy: "increase"
+    commit-message:
+      prefix: chore
+      prefix-development: chore
+      include: scope
+    ignore:
+      - dependency-name: "@types/node"
+      - dependency-name: "@trpc/*"
+    groups:
+      sentry:
+        patterns:
+          - "@sentry/*"
+      prisma:
+        patterns:
+          - "prisma"
+          - "@prisma/*"
+      next:
+        patterns:
+          - "eslint-config-next"
+          - "next"
+      patches:
+        update-types:
+          - "patch"

.github/hero.svg

@@ -1,9 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="640" viewBox="0 0 1280 640" role="img" aria-label="console2">
-<rect width="1280" height="640" fill="#0A0A0A"/>
-<svg x="96" y="215" width="210" height="210" viewBox="0 0 67 67"><path d="M22.21 67V44.6369H0V67H22.21Z" fill="#fff"/><path d="M66.7038 22.3184H22.2534L0.0878906 44.6367H44.4634L66.7038 22.3184Z" fill="#fff"/><path d="M22.21 0H0V22.3184H22.21V0Z" fill="#fff"/><path d="M66.7198 0H44.5098V22.3184H66.7198V0Z" fill="#fff"/><path d="M66.7198 67V44.6369H44.5098V67H66.7198Z" fill="#fff"/></svg>
-<text x="378" y="276" font-family="Inter,system-ui,-apple-system,sans-serif" font-size="78" font-weight="800" letter-spacing="-2" fill="#ffffff">console2</text>
-
-<rect x="378" y="338" width="806" height="3" rx="1.5" fill="#ffffff" opacity=".9"/>
-<text x="378" y="390" font-family="Inter,system-ui,sans-serif" font-size="24" font-weight="600" fill="#ffffff" opacity=".5">github.com/hanzoai</text>
-<text x="1184" y="390" text-anchor="end" font-family="Inter,system-ui,sans-serif" font-size="24" font-weight="600" fill="#ffffff" opacity=".5">hanzo.ai</text>
-</svg>

.github/workflows/build-image.yml

@@ -1,78 +0,0 @@
-name: Build Docker Image
-# Builds + pushes ghcr.io/hanzoai/console on the self-hosted ARC runner. ONE
-# brand-agnostic image serves every brand: console resolves the brand at RUNTIME
-# from the request hostname (console.hanzo.ai → hanzo, console.lux.cloud → lux,
-# console.zoo.cloud → zoo; src/config/index.ts), and /v1 is same-origin per host.
-# So NO NEXT_PUBLIC_* are baked — baking them would pin the image to one brand.
-# Tags: SEMVER ONLY (no sha, no :latest) — a `v*` git tag publishes that exact
-# version; a main push publishes `v<package.json version>` (bump to release).
-#
-# Build muscle: RAW `docker buildx build` on the host builder — the canonical
-# hanzoai/ci pattern. We deliberately do NOT use docker/setup-buildx-action +
-# docker/build-push-action: that pair spins up an EPHEMERAL buildkit container
-# that cannot see the host's image cache, so it re-pulled `node:22-alpine` from
-# Docker Hub every run and tripped the unauthenticated 429 pull-rate limit (and
-# its build-summary artifact upload hit the Actions storage quota). The host
-# builder reuses the cached base layer instead — no re-pull, no artifact upload.
-# The Dockerfile uses the ECR Public Docker-library mirror for the Node base image
-# so a cold runner does not depend on Docker Hub's unauthenticated pull budget.
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  workflow_dispatch:
-
-concurrency:
-  group: docker-image-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  docker:
-    runs-on: [hanzo-build-linux-amd64]
-    steps:
-      - uses: actions/checkout@v4
-      - name: resolve semver tag
-        id: ver
-        run: |
-          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
-            echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
-          else
-            # node is NOT on the ARC runner PATH — resolve the version with grep/sed
-            # (a missing `node` silently produced the tag `:v` and a 404 deploy).
-            ver=$(grep -m1 '"version"' package.json | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
-            [ -n "$ver" ] || { echo "could not resolve version from package.json"; exit 1; }
-            echo "tag=v${ver}" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Log in to ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
-      - name: Ensure base image (reuse host cache)
-        # No-op on a warm runner (the host builder reuses the cached base). Only a
-        # cold runner pulls. Use the same ECR Public Docker-library mirror as the
-        # Dockerfile to avoid Docker Hub's unauthenticated pull-rate limits.
-        run: |
-          set -u
-          base=public.ecr.aws/docker/library/node:24-alpine
-          if docker image inspect "$base" >/dev/null 2>&1; then
-            echo "base $base already cached on runner"; exit 0
-          fi
-          for i in 1 2 3 4 5; do
-            if docker pull "$base"; then exit 0; fi
-            echo "pull failed (attempt $i/5) — backing off"; sleep $((i * 30))
-          done
-          echo "could not pull $base after retries"; exit 1
-      - name: Build & push (host builder — reuses base cache, no artifact upload)
-        run: |
-          set -euo pipefail
-          docker buildx build \
-            --platform linux/amd64 \
-            --push \
-            -t ghcr.io/hanzoai/console:${{ steps.ver.outputs.tag }} \
-            -f Dockerfile .

.github/workflows/ci.yml.template

@@ -0,0 +1,69 @@
+name: CI
+
+on:
+  pull_request:
+    branches: ["*"]
+  push:
+    branches: ["main", "cloud"]
+
+# You can leverage Vercel Remote Caching with Turbo to speed up your builds
+# @link https://turborepo.org/docs/core-concepts/remote-caching#remote-caching-on-vercel-builds
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+
+jobs:
+  build-lint:
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+      SHADOW_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+      DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+
+      - name: Start containers
+        run: docker compose -f "docker-compose.yml" up -d --build
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v2.2.4
+
+      - name: Setup Node 18
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: |
+          echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v3
+        with:
+          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: Install deps (with cache)
+        run: pnpm install
+
+      # Normally, this would be done as part of the turbo pipeline - however since the Expo app doesn't depend on `@acme/db` it doesn't care.
+      # TODO: Free for all to find a better solution here.
+      - name: Deploy db
+        run: pnpm turbo db:deploy
+
+      - name: Generate Prisma Client
+        run: pnpm turbo db:generate
+
+      - name: Build, lint and type-check
+        run: pnpm turbo build lint type-check
+        env:
+          SKIP_ENV_VALIDATION: true
+
+      # FIXME: Add this back once we have an Expo SDK supporting React 18.2
+      # - name: Check workspaces
+      #   run: pnpm manypkg check

.github/workflows/codespell.yml

@@ -0,0 +1,22 @@
+---
+name: Codespell
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  codespell:
+    name: Check for spelling errors
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Codespell
+        uses: codespell-project/actions-codespell@v2

.github/workflows/dependabot-rebase-stale.yml

@@ -0,0 +1,18 @@
+name: Rebase Dependabot stale PRs
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  rebase-dependabot:
+    runs-on: ubuntu-latest
+    environment: "protected branches"
+    steps:
+      - name: "Rebase open Dependabot PR"
+        uses: orange-buffalo/dependabot-auto-rebase@v1
+        with:
+          api-token: ${{ secrets.GH_ACCESS_TOKEN }}
+          repository: ${{ github.repository }}

.github/workflows/licencecheck.yml

@@ -0,0 +1,49 @@
+name: License Compliance Check
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+  merge_group:
+  pull_request:
+    branches:
+      - "main"
+
+jobs:
+  license_check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Setup node
+        uses: actions/setup-node@v2
+        with:
+          node-version: 18
+
+      - name: Install license-checker
+        run: npm install -g license-checker
+
+      - name: Install yui-lint
+        run: npm install yui-lint
+
+      - name: Generate license-checker CSV file
+        run: license-checker --production --csv > npm-license-checker.csv
+
+      - name: Check license-checker CSV file without headers
+        id: license_check_report
+        uses: pilosus/action-pip-license-checker@v2
+        with:
+          external: "npm-license-checker.csv"
+          external-format: "csv"
+          external-options: "{:skip-header true}"
+          fail: "WeakCopyleft,StrongCopyleft,NetworkCopyleft"
+          fails-only: true
+          totals: true
+          verbose: 1
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Echo error
+        if: failure()
+        run: echo "::error::${{ steps.license_check_report.outputs.report }}"
+      - name: Delete license-checker CSV file
+        run: rm npm-license-checker.csv

.github/workflows/pipeline.yml

@@ -0,0 +1,291 @@
+name: CI/CD
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+  merge_group:
+  pull_request:
+    branches:
+      - "*"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 8.15.5
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache: "pnpm"
+          cache-dependency-path: "pnpm-lock.yaml"
+      - name: install dependencies
+        run: |
+          pnpm i
+      - name: Load default env
+        run: |
+          cp .env.dev.example .env
+      - name: lint web
+        run: pnpm run lint
+
+  test-docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Build Web Docker image
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./web/Dockerfile
+          push: false
+
+      - name: Build Worker Docker image
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./worker/Dockerfile
+          push: false
+
+  tests-web:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20]
+    steps:
+      - name: Set Swap Space
+        uses: pierotofy/set-swap-space@master
+        with:
+          swap-size-gb: 10
+
+      - uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 8.15.5
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: "pnpm"
+          cache-dependency-path: "pnpm-lock.yaml"
+
+      - name: install dependencies
+        run: |
+          pnpm install
+
+      - name: Load default env
+        run: |
+          cp .env.dev.example .env
+          cp .env.dev.example web/.env
+
+      - name: Run + migrate
+        run: |
+          docker compose -f docker-compose.dev.yml up -d
+          sleep 5 # Wait for PostgreSQL to accept connections
+
+      - name: Seed DB
+        run: |
+          pnpm run db:migrate
+          pnpm run db:seed
+
+      - name: Build
+        run: pnpm run build
+
+      - name: Start Langfuse
+        run: (pnpm run start&)
+
+      - name: run tests
+        run: pnpm --filter=web run test
+
+  tests-worker:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20]
+    steps:
+      - name: Set Swap Space
+        uses: pierotofy/set-swap-space@master
+        with:
+          swap-size-gb: 10
+
+      - uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 8.15.5
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: "pnpm"
+          cache-dependency-path: "pnpm-lock.yaml"
+
+      - name: install dependencies
+        run: |
+          pnpm install
+
+      - name: Load default env
+        run: |
+          cp .env.dev.example .env
+          cp .env.dev.example web/.env
+
+      - name: Run + migrate
+        run: |
+          docker compose -f docker-compose.dev.yml up -d
+          sleep 5 # Wait for PostgreSQL to accept connections
+
+      - name: Seed DB
+        run: |
+          pnpm run db:migrate
+          pnpm run db:seed
+
+      - name: Build
+        run: pnpm --filter=worker... run build
+
+      - name: run tests
+        run: pnpm --filter=worker run test
+
+  e2e-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 8.15.5
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache: "pnpm"
+          cache-dependency-path: "pnpm-lock.yaml"
+
+      - name: install dependencies
+        run: |
+          pnpm install
+
+      - name: Load default env
+        run: |
+          cp .env.dev.example .env
+          cp .env.dev.example web/.env
+
+      - name: Run + migrate
+        run: |
+          docker compose -f docker-compose.dev.yml up -d
+          sleep 5 # Wait for PostgreSQL to accept connections
+
+      - name: Seed DB
+        run: |
+          pnpm run db:migrate
+          pnpm run db:seed
+
+      - name: Build
+        run: pnpm run build
+
+      - name: Install playwright
+        run: pnpm --filter=web exec playwright install --with-deps
+
+      - name: Run e2e tests
+        run: pnpm --filter=web run test:e2e
+
+  all-ci-passed:
+    # This allows us to have a branch protection rule for tests and deploys with matrix
+    runs-on: ubuntu-latest
+    needs: [lint, tests-web, tests-worker, e2e-tests, test-docker-build]
+    if: always()
+    steps:
+      - name: Successful deploy
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+        working-directory: .
+      - name: Failing deploy
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1
+        working-directory: .
+
+  push-docker-image:
+    needs: all-ci-passed
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))
+    environment: "protected branches"
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+
+    steps:
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 8.15.5
+      - name: Setup node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20
+          cache-dependency-path: "pnpm-lock.yaml"
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Log in to the GitHub Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta-web
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ghcr.io/langfuse/langfuse # GitHub
+            langfuse/langfuse # Docker Hub
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=sha
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+
+      - name: Build and push Docker image (web)
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./web/Dockerfile
+          push: true
+          tags: ${{ steps.meta-web.outputs.tags }}
+          labels: ${{ steps.meta-web.outputs.labels }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta-worker
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ghcr.io/langfuse/langfuse-worker # GitHub
+            langfuse/langfuse-worker # Docker Hub
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=sha
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+
+      - name: Build and push Docker image (worker)
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./worker/Dockerfile
+          push: true
+          tags: ${{ steps.meta-worker.outputs.tags }}
+          labels: ${{ steps.meta-worker.outputs.labels }}

.github/workflows/release.yml

@@ -0,0 +1,19 @@
+on:
+  workflow_dispatch:
+  push:
+    # Pattern matched against refs/tags
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+" # Semantic version tags
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: "protected branches"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main # Always checkout main even for tagged releases
+          fetch-depth: 0
+          token: ${{ secrets.GH_ACCESS_TOKEN }}
+      - name: Push to production
+        run: git push origin +main:production

.gitignore

@@ -1,22 +1,63 @@
-node_modules/
-.next/
-out/
-dist/
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
 
-# build artifacts
-*.tsbuildinfo
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+
+# testing
+/coverage
+
+# database
+/prisma/db.sqlite
+/prisma/db.sqlite-journal
+
+# next.js
+/.next/
+/out/
 next-env.d.ts
 
-# env
+# production
+/build
+
+# idea
+.idea
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# local env files
+# do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables
+.env
+.env.local
 .env*.local
 
-# editor / os
-.DS_Store
-.vscode/
-.idea/
-*.log
-e2e/screenshots/
-e2e-shots/
-test-results/
-playwright-report/
-.claude/
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+
+/generated/typescript-server
+
+# openapi spec that is copied during build
+/public/openapi*.yml
+
+
+# vscode
+.devcontainer
+
+node_modules
+**/node_modules
+**/dist
+**/.next/*
+**/.turbo/*
+.yarn
+.turbo

.npmrc

@@ -0,0 +1 @@
+public-hoist-pattern[]=*prisma*

.nvmrc

@@ -0,0 +1 @@
+v20

.vscode/extensions.json

@@ -0,0 +1,10 @@
+{
+  "recommendations": [
+    "esbenp.prettier-vscode",
+    "dbaeumer.vscode-eslint",
+    "bradlc.vscode-tailwindcss",
+    "unifiedjs.vscode-mdx",
+    "yoavbls.pretty-ts-errors",
+    "Prisma.prisma"
+  ]
+}

.vscode/launch.json

@@ -0,0 +1,28 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Next.js: debug server-side",
+      "type": "node-terminal",
+      "request": "launch",
+      "command": "npm run dev"
+    },
+    {
+      "name": "Next.js: debug client-side",
+      "type": "chrome",
+      "request": "launch",
+      "url": "http://localhost:3000"
+    },
+    {
+      "name": "Next.js: debug full stack",
+      "type": "node-terminal",
+      "request": "launch",
+      "command": "npm run dev",
+      "serverReadyAction": {
+        "pattern": "- Local:.+(https?://.+)",
+        "uriFormat": "%s",
+        "action": "debugWithChrome"
+      }
+    }
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,31 @@
+{
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.formatOnSave": true,
+  "editor.rulers": [100],
+  "editor.tabSize": 2,
+
+  "eslint.validate": [
+    "javascript",
+    "javascriptreact",
+    "astro",
+    "typescript",
+    "typescriptreact"
+  ],
+
+  "eslint.rules.customizations": [{ "rule": "*", "severity": "warn" }],
+  "typescript.tsdk": "node_modules/typescript/lib",
+  "prettier.documentSelectors": [
+    "**/*.{cjs,mjs,ts,tsx,astro,md,mdx,json,yaml,yml}"
+  ],
+  "mdx.experimentalLanguageServer": true,
+  "typescript.preferences.importModuleSpecifier": "non-relative",
+  "docwriter.style": "JSDoc",
+  "[prisma]": {
+    "editor.defaultFormatter": "Prisma.prisma"
+  },
+  "eslint.lintTask.enable": true,
+  "eslint.workingDirectories": ["./web", "./worker"]
+}

AGENTS.md

@@ -1 +0,0 @@
-LLM.md

CLAUDE.md

@@ -1 +0,0 @@
-LLM.md

CONTRIBUTING.md

@@ -0,0 +1,307 @@
+![Langfuse GitHub Banner](https://github.com/langfuse/langfuse/assets/121163007/6035f0f3-d691-4963-b5d0-10cf506e9d42)
+
+# Contributing to Langfuse
+
+First off, thanks for taking the time to contribute! ❤️
+
+The best ways to contribute to Langfuse:
+
+- Submit and vote on [Ideas](https://github.com/orgs/langfuse/discussions/categories/ideas)
+- Create and comment on [Issues](https://github.com/langfuse/langfuse/issues)
+- Open a PR.
+
+We welcome contributions through GitHub pull requests. This document outlines our conventions regarding development workflow, commit message formatting, contact points, and other resources. Our goal is to simplify the process and ensure that your contributions are easily accepted.
+
+We gratefully welcome improvements to documentation ([docs repo](https://github.com/langfuse/langfuse-docs)), the core application (this repo) and the SDKs ([Python](https://github.com/langfuse/langfuse-python), [JS](https://github.com/langfuse/langfuse-js)).
+
+The maintainers are available on [Discord](https://langfuse.com/discord) in case you have any questions.
+
+> And if you like the project, but just don't have time to contribute code, that's fine. There are other easy ways to support the project and show your appreciation, which we would also be very happy about:
+>
+> - Star the project;
+> - Tweet about it;
+> - Refer to this project in your project's readme;
+> - Submit and vote on [Ideas](https://github.com/orgs/langfuse/discussions/categories/ideas);
+> - Create and comment on [Issues](https://github.com/langfuse/langfuse/issues);
+> - Mention the project at local meetups and tell your friends/colleagues.
+
+## Making a change
+
+_Before making any significant changes, please [open an issue](https://github.com/langfuse/langfuse/issues)._ Discussing your proposed changes ahead of time will make the contribution process smooth for everyone. Large changes that were not discussed in an issue may be rejected.
+
+Once we've discussed your changes and you've got your code ready, make sure that tests are passing and open your pull request.
+
+A good first step is to search for open [issues](https://github.com/langfuse/langfuse/issues). Issues are labeled, and some good issues to start with are labeled: [good first issue](https://github.com/langfuse/langfuse/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22).
+
+## Project Overview
+
+### Technologies we use
+
+- Application (this repository)
+  - NextJS 14, pages router
+  - NextAuth.js / Auth.js
+  - tRPC: Frontend APIs
+  - Prisma ORM
+  - Zod
+  - Tailwind CSS
+  - shadcn/ui tailwind components (using Radix and tanstack)
+  - Fern: generate OpenAPI spec and Pydantic models
+- JS SDK ([langfuse/langfuse-js](https://github.com/langfuse/langfuse-js))
+  - openapi-typescript to generated types based on OpenAPI spec
+- Python SDK ([langfuse/langfuse-python](https://github.com/langfuse/langfuse-python))
+  - Pydantic for input validation, models generated by fern
+
+### Architecture Overview
+
+> [!NOTE]
+> Infrastructure will change in Langfuse version 3.0. More in the [GitHub Discussions](https://github.com/orgs/langfuse/discussions/1902).
+> `langfuse/langfuse/worker` is under active development and not recommended for production use in Langfuse 2.x
+
+```mermaid
+flowchart TB
+    subgraph s4["Clients"]
+        subgraph s2["langfuse/langfuse-python"]
+            Python["Python low-level SDK"]
+            Decorator["observe() decorator"] -->|extends| Python
+            OAI["OpenAI drop-in replacement"] -->|extends| Python
+            Llamaindex["LlamaIndex Integration"] -->|extends| Python
+            LCPYTHON["Langchain Python Integration"] -->|extends| Python
+            Langflow -->|uses| LCPYTHON
+            LiteLLM -->|uses| Python
+        end
+        subgraph s3["langfuse/langfuse-js"]
+            JS["JS SDK"]
+            LCJS["Langchain JS Integration"]  -->|extends| JS
+            Flowise -->|uses| LCJS
+        end
+    end
+
+    DB[Postgres Database]
+    Redis[Redis]
+
+    subgraph s1["Application (langfuse/langfuse/web)"]
+        API[Public HTTP API]
+        G[TRPC API]
+        I[NextAuth]
+        H[React Frontend]
+        Prisma[Prisma ORM]
+        H --> G
+        H --> I
+        G --> I
+        G --- Prisma
+        API --- Prisma
+        I --- Prisma
+    end
+
+    subgraph s5["Application (langfuse/langfuse/worker)"]
+        Worker_API[Public HTTP API]
+    end
+
+    API --> Worker_API
+    Worker_API --- DB
+    Worker_API --- Redis
+
+    Prisma --- DB
+    JS --- API
+    Python --- API
+```
+
+### Network Overview
+
+> [!NOTE]
+> This will change in Langfuse version 3.0. More in the [GitHub Discussions](https://github.com/orgs/langfuse/discussions/1902).
+
+```mermaid
+flowchart LR
+   Browser ---|Web UI & TRPC API| App
+   Integrations/SDKs ---|Public HTTP API| App
+   subgraph i1["Application Network"]
+      App["Langfuse Application (Docker or Serverless)"]
+   end
+   subgraph i2["Database Network"]
+      DB["Postgres Database"]
+   end
+   App --- DB
+```
+
+### Database Overview
+
+The diagram below may not show all relationships if the foreign key is not defined in the database schema. For instance, `trace_id` in the `observation` table is not defined as a foreign key to the `trace` table to allow unordered ingestion of these objects, but it is still a foreign key in the application code.
+
+Full database schema: [packages/shared/prisma/schema.prisma](packages/shared/prisma/schema.prisma)
+
+<img src="./packages/shared/prisma/database.svg">
+
+## Repository Structure
+
+We built a monorepo using [pnpm](https://pnpm.io/motivation) and [turbo](https://turbo.build/repo/docs) to manage the dependencies and build process. The monorepo contains the following packages:
+
+- `web`: is the main application package providing Frontend and Backend APIs for Langfuse.
+- `worker` (no production yet): contains an application for asynchronous processing of tasks. This package is not yet used in production.
+- `packages`:
+  - `shared`: contains shared code between the above packages.
+  - `config-eslint`: contains eslint configurations which are shared between the above packages.
+  - `config-typescript`: contains typescript configurations which are shared between the above packages.
+- `ee`: contains all enterprise features. See [EE README](ee/README.md) for more details.
+
+## Development Setup
+
+Requirements
+
+- Node.js 20 as specified in the [.nvmrc](.nvmrc)
+- Docker to run the database locally
+
+**Steps**
+
+1. Fork the repository and clone it locally
+2. Run the development database
+
+   ```bash
+   pnpm run infra:dev:up
+   ```
+
+3. Create an env file
+
+   ```bash
+    cp .env.dev.example .env
+   ```
+
+4. Install dependencies
+
+   ```bash
+   pnpm install
+   ```
+
+5. Run the migrations
+
+   All database migrations and configs are in the `shared` package.
+
+   ```bash
+   pnpm --filter=shared run db:migrate
+
+   # Optional: seed the database
+   # pnpm run db:seed
+   # pnpm run db:seed:examples
+   # pnpm --filter=shared run db:seed:load
+   ```
+
+6. Start the development server
+
+   ```bash
+    pnpm run dev
+   ```
+
+## Monorepo quickstart
+
+- Available packages and their dependencies
+
+  Packages are included in the monorepo according to the `pnpm-workspace.yaml` file. Each package maintains its own dependencies defined in the `package.json`. Internal dependencies can be added as well by adding them to the package dependencies: `"@langfuse/shared": "workspace:*"`.
+
+- Executing commands
+
+  You can run commands in all packages at once. For example, to install all dependencies in all packages, you can execute:
+
+  ```bash
+  pnpm install
+  pnpm run dev
+  pnpm --filter=web run dev # execute command only in one package
+  ```
+
+  In the root `package.json`, you can find scripts which are executed with turbo e.g. `turbo run dev`. These scripts are executed with the help of Turbo. Turbo executes the commands in all packages taking care of the correct order of execution. Task definitions can be found in the `turbo.config.js` file.
+
+- Run migrations
+
+  To run migrations, you can execute the following command.
+
+  ```bash
+  pnpm run db:migrate -- --name <name of the migration>
+  ```
+
+> [!NOTE]
+> If you frequently switch branches, use `pnpm run dx` instead of `pnpm run dev`. This command will install dependencies, reset the database (wipe and apply all migrations), and run the database seeder with example data before starting the development server.
+
+> [!NOTE]
+> If you find yourself stuck and want to clean the repo, execute `pnpm run nuke`. It will remove all node_modules and build files.
+
+## System behavior
+
+### Ingestion API `(/public/api/ingestion)`
+
+- the ingestion API takes different event types (creation and updates of traces, generations, spans, events)
+- The API loops through each event and:
+  - validates the event
+  - stores the event raw in the events table
+  - calculates tokens for `generations`
+  - matches models from the `models` table to model for `generations` events
+  - upserts the event in the `traces` or `observations` table
+- returns a `207` HTTP status code with a list of errors if any event failed to be ingested
+
+## Commit messages
+
+On the main branch, we adhere to the best practices of [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/). All pull requests and branches are squash-merged to maintain a clean and readable history. This approach ensures the addition of a conventional commit message when merging contributions.
+
+## Test the public API
+
+The API is tested using Jest. With the development server running, you can run the tests with:
+
+Run all
+
+```bash
+npm run test
+```
+
+Run interactively in watch mode
+
+```bash
+npm run test:watch
+```
+
+These tests are also run in CI.
+
+## CI/CD
+
+We use GitHub Actions for CI/CD, the configuration is in [`.github/workflows/pipeline.yml`](.github/workflows/pipeline.yml)
+
+CI on `main` and `pull_request`
+
+- Check Linting
+- E2E test of API using Jest
+- E2E tests of UI using Playwright
+
+CD on `main`
+
+- Publish Docker image to GitHub Packages if CI passes. Done on every push to `main` branch. Only released versions are tagged with `latest`.
+
+## Staging environment
+
+We run a staging environment at [https://staging.langfuse.com](https://staging.langfuse.com) that is automatically deployed on every push to `main` branch.
+
+The same environment is also used for preview deployments of pull requests. Limitations:
+
+- SSO is not available as dynamic domains are not supported by most SSO providers.
+- When making changes to the database, migrations to the staging database need to be applied manually by a maintainer. If you want to interactively test database changes in the staging environment, please reach out.
+
+You can use the staging environment end-to-end with the Langfuse integrations or SDKs (host: `https://staging.langfuse.com`). However, please note that the staging environment is not intended for production use and may be reset at any time.
+
+## Production environment
+
+When a new release is tagged on the `main` branch (excluding prereleases), it triggers a production deployment. The deployment process consists of two steps:
+
+1. The Docker image is published to GitHub Packages with the version number and `latest` tag.
+2. The deployment is carried out on Langfuse Cloud. This is done by force pushing the `main` branch to the `production` branch during every release, using the [`release.yml`](.github/workflows/release.yml) GitHub Action.
+
+## Using secrets stored in 1Password
+
+When applying changes to non-local environments, you may need to use secrets stored in 1Password. We use the 1Password CLI for this purpose.
+
+Example:
+
+```bash
+op run --env-file="./.env" -- pnpm --filter=shared run db:deploy
+```
+
+## License
+
+Langfuse is MIT licensed, except for `ee/` folder. See [LICENSE](LICENSE) and [docs](https://langfuse.com/docs/open-source) for more details.
+
+When contributing to the Langfuse codebase, you need to agree to the [Contributor License Agreement](https://cla-assistant.io/langfuse/langfuse). You only need to do this once and the CLA bot will remind you if you haven't signed it yet.

Dockerfile

@@ -1,38 +0,0 @@
-# console2 — Hanzo Cloud Console (Next.js 15 + @hanzo/gui). BSD-3-Clause.
-# NEXT_PUBLIC_* are inlined at build time (browser config), so they are build args.
-FROM public.ecr.aws/docker/library/node:24-alpine AS build
-WORKDIR /app
-# Copy ALL source FIRST, then install — order matters under Kaniko --single-snapshot:
-# a `COPY` that FOLLOWS `RUN npm install` in the same stage drops the RUN's freshly
-# created node_modules (the 'next not found' cause — the install's own `test -f next`
-# passed, then `COPY . .` wiped node_modules before the build RUN). Putting COPY
-# before install means node_modules is created by the LAST RUNs and nothing clobbers
-# it. (Layer-cache for deps is moot here — the on-cluster build runs --cache=false.)
-COPY . .
-# public/ may be empty (git doesn't track empty dirs) — ensure it exists for the runner COPY.
-RUN mkdir -p public
-# npm install (not ci): @hanzo/gui pulls a react-native dep tree whose platform/
-# optional packages resolve differently across npm versions, so a lockfile generated
-# by one npm fails `npm ci` under another. install reconciles the tree for the
-# build platform; retry-hardened against registry throttling.
-RUN npm install --no-audit --no-fund --fetch-retries=5 --fetch-retry-mintimeout=20000 --fetch-timeout=120000
-# ONE brand-agnostic image: brand (IAM org/issuer/app + wordmark) is resolved at
-# RUNTIME from the request hostname (src/config/index.ts), and /v1 is same-origin
-# per host. Baking NEXT_PUBLIC_* here would inline a single brand and break that.
-# Next 15 + @hanzo/gui (large RN dep tree) overflows Node's default heap → OOMKill
-# (exit 137); cap the heap generously (chat uses 4096).
-ENV NEXT_TELEMETRY_DISABLED=1 NODE_OPTIONS=--max-old-space-size=6144
-RUN npm run build
-
-FROM public.ecr.aws/docker/library/node:24-alpine AS runner
-WORKDIR /app
-ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=4000
-RUN addgroup -S app && adduser -S app -G app
-COPY --from=build /app/.next ./.next
-COPY --from=build /app/public ./public
-COPY --from=build /app/node_modules ./node_modules
-COPY --from=build /app/package.json ./package.json
-COPY --from=build /app/next.config.mjs ./next.config.mjs
-USER app
-EXPOSE 4000
-CMD ["node", "node_modules/next/dist/bin/next", "start", "-p", "4000"]

LICENSE

@@ -1,42 +1,25 @@
-BSD 3-Clause License
+Copyright (c) 2023--2024 Langfuse GmbH
 
-Copyright (c) 2026-present, Hanzo AI, Inc.
+Portions of this software are licensed as follows:
 
-Portions of this software are derived from upstream code originally licensed under
-the MIT License, with the following copyright notices retained per its terms:
+- All content that resides under the "ee/" and/or "web/src/ee" directories of this repository, if these directories exist, is licensed under the license defined in "ee/LICENSE".
+- All third party components incorporated into the Finto Technologies Software are licensed under the original license provided by the owner of the applicable component.
+- Content outside of the above mentioned directories or restrictions above is available under the "MIT Expat" license as defined below.
 
-  Copyright (c) 2020 Nate Wienert
-  Copyright (c) 2015-present, Nicolas Gallagher.
-  Copyright (c) 2015-present, Facebook, Inc.
-  Copyright (c) 2021 Radix
-  Copyright (c) 2017 Carmelo Pullara
-  Copyright (c) 2018 Framer B.V.
-  Copyright (c) 2022 WorkOS
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-All rights reserved.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-3. Neither the name of the copyright holder nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

NOTICE

@@ -1,41 +0,0 @@
-Hanzo Cloud Console (console2)
-Copyright (c) Hanzo AI, Inc. Licensed BSD-3-Clause (see LICENSE).
-
-------------------------------------------------------------------------
-Third-party attribution
-------------------------------------------------------------------------
-
-Observe surface — Langfuse (MIT License)
-
-The console's Observe screens (Traces, Trace detail with the span-tree /
-latency-waterfall, Observations, Sessions, Scores, Score Configs, Datasets,
-Dataset Items, Dataset Runs / Experiments, and the observability Dashboards /
-Metrics) reproduce the SCREEN LAYOUT AND USER FLOWS of Langfuse's observability
-product.
-
-This is a clean-room reimplementation in our own code (React + @hanzo/gui),
-wired to the native Hanzo Cloud /v1/evals contract. No Langfuse source code is
-copied. Only the MIT-licensed layout/flow concepts inform the design; the
-Langfuse EE / commercial ("ee") code is neither used nor referenced.
-
-  Langfuse — https://github.com/langfuse/langfuse
-  Copyright (c) Langfuse GmbH
-  Licensed under the MIT License.
-
-  Permission is hereby granted, free of charge, to any person obtaining a copy
-  of this software and associated documentation files (the "Software"), to deal
-  in the Software without restriction, including without limitation the rights
-  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-  copies of the Software, and to permit persons to whom the Software is
-  furnished to do so, subject to the following conditions:
-
-  The above copyright notice and this permission notice shall be included in all
-  copies or substantial portions of the Software.
-
-  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-  SOFTWARE.

README.md

@@ -1,51 +1,173 @@
-<p align="center"><img src=".github/hero.svg" alt="console2" width="880"></p>
+![Langfuse GitHub Banner](https://github.com/langfuse/langfuse/assets/121163007/6035f0f3-d691-4963-b5d0-10cf506e9d42)
 
-# Hanzo Cloud Console
+<div align="center">
+   <div>
+      <h3>
+         <a href="https://cloud.langfuse.com">
+            <strong>Sign up</strong>
+         </a> · 
+         <a href="https://langfuse.com/docs/deployment/self-host">
+            <strong>Self Host</strong>
+         </a> · 
+         <a href="https://langfuse.com/demo">
+            <strong>Demo (live data)</strong>
+         </a>
+      </h3>
+   </div>
+   <div>
+      <a href="https://langfuse.com/docs"><strong>Docs</strong></a> ·
+      <a href="https://langfuse.com/issues"><strong>Report Bug</strong></a> ·
+      <a href="https://langfuse.com/ideas"><strong>Feature Request</strong></a> ·
+      <a href="https://langfuse.com/changelog"><strong>Changelog</strong></a> ·
+      <a href="https://langfuse.com/roadmap"><strong>Roadmap</strong></a> ·
+      <a href="https://langfuse.com/discord"><strong>Discord</strong></a> 
+   </div>
+   <span>Langfuse uses <a href="https://github.com/orgs/langfuse/discussions"><strong>Github Discussions</strong></a>  for Support and Feature Requests.</span>
+   <br/>
+   <br/>
+   <div>
+      <a href="https://github.com/langfuse/langfuse/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-red.svg?style=flat-square" alt="MIT License"></a>
+      <a href="https://www.ycombinator.com/companies/langfuse"><img src="https://img.shields.io/badge/Y%20Combinator-W23-orange?style=flat-square" alt="Y Combinator W23"></a>
+      <a href="https://github.com/langfuse/langfuse/pkgs/container/langfuse"><img alt="Docker Image" src="https://img.shields.io/badge/docker-langfuse-blue?logo=Docker&logoColor=white&style=flat-square"></a>
+      <a href="https://www.npmjs.com/package/langfuse"><img src="https://img.shields.io/npm/v/langfuse?style=flat-square&label=npm+langfuse" alt="langfuse npm package"></a>
+      <a href="https://pypi.python.org/pypi/langfuse"><img src="https://img.shields.io/pypi/v/langfuse.svg?style=flat-square&label=pypi+langfuse" alt="langfuse Python package on PyPi"></a>
+   </div>
+</div>
+</br>
 
-Unified admin console for **Hanzo Cloud** and all Hanzo cloud products. Built on
-[@hanzo/gui](https://gui.hanzo.ai) (cross-platform UI) over the unified `/v1`
-backend (`hanzoai/cloud`). Dark theme, OIDC sign-in via Hanzo IAM.
+## Overview
 
-Manages: **Providers · Models · Applications · Stores · Chat** — with an
-extensible product-module registry so every cloud product can be added as a
-module.
+_Unmute video for voice-over_
 
-## Quick start
+https://github.com/langfuse/langfuse/assets/2834609/a94062e9-c782-4ee9-af59-dee6370149a8
+
+### Develop
+
+- **Observability:** Instrument your app and start ingesting traces to Langfuse ([Quickstart](https://langfuse.com/docs/get-started), [Integrations](https://langfuse.com/docs/integrations) [Tracing](https://langfuse.com/docs/tracing))
+- **Langfuse UI:** Inspect and debug complex logs ([Demo](https://langfuse.com/docs/demo), [Tracing](https://langfuse.com/docs/tracing))
+- **Prompt Management:** Manage, version and deploy prompts from within Langfuse ([Prompt Management](https://langfuse.com/docs/prompts/get-started))
+- **Prompt Engineering:** Test and iterate on your prompts with the [LLM Playground](https://langfuse.com/docs/playground)
+
+### Monitor
+
+- **Analytics:** Track metrics (cost, latency, quality) and gain insights from dashboards & data exports ([Analytics](https://langfuse.com/docs/analytics))
+- **Evals:** Collect and calculate scores for your LLM completions ([Scores & Evaluations](https://langfuse.com/docs/scores))
+  - Run model-based evaluations ([Model-based evaluations](https://langfuse.com/docs/scores/model-based-evals)) within Langfuse
+  - Collect user feedback ([User Feedback](https://langfuse.com/docs/scores/user-feedback))
+  - Manually score observations in Langfuse ([Manual Scores](https://langfuse.com/docs/scores/manually))
+
+### Test
+
+- **Experiments:** Track and test app behaviour before deploying a new version
+  - Datasets let you test expected in and output pairs and benchmark performance before deploying ([Datasets](https://langfuse.com/docs/datasets))
+  - Track versions and releases in your application ([Experimentation](https://langfuse.com/docs/experimentation), [Prompt Management](https://langfuse.com/docs/prompts))
+
+## Get started
+
+### Langfuse Cloud
+
+Managed deployment by the Langfuse team, generous free-tier (hobby plan), no credit card required.
+
+**[» Langfuse Cloud](https://cloud.langfuse.com)**
+
+### Localhost (docker)
 
 ```bash
-npm install
-cp .env.example .env.local
-# set NEXT_PUBLIC_IAM_CLIENT_ID for live sign-in; defaults point at production.
-npm run dev          # http://localhost:4000
+# Clone repository
+git clone https://github.com/langfuse/langfuse.git
+cd langfuse
+
+# Run server and database
+docker compose up -d
 ```
 
-## Scripts
+[→ Learn more about deploying locally](https://langfuse.com/docs/deployment/local)
 
-| Script | What |
-| --- | --- |
-| `npm run dev` | Dev server on :4000 |
-| `npm run build` | Production build (type-checks; Gui CSS injected at runtime) |
-| `npm run start` | Serve the production build |
-| `npm run typecheck` | `tsc --noEmit` (strict) |
+### Self-host (docker)
 
-## Configuration
+Langfuse is simple to self-host and keep updated. It currently requires only a single docker container.
+[→ Self Hosting Instructions](https://langfuse.com/docs/deployment/self-host)
 
-All config is `NEXT_PUBLIC_*` (browser app, cookie auth). See `.env.example`.
+Templated deployments: [Railway, GCP Cloud Run, AWS Fargate, Kubernetes and others](https://langfuse.com/docs/deployment/self-host#platform-specific-information)
 
-| Var | Default | Meaning |
-| --- | --- | --- |
-| `NEXT_PUBLIC_CLOUD_URL` | `https://cloud.hanzo.ai` | Unified `/v1` backend base URL |
-| `NEXT_PUBLIC_IAM_URL` | `https://iam.hanzo.ai` | Hanzo IAM OIDC authority |
-| `NEXT_PUBLIC_IAM_APP_NAME` | `hanzo-console` | IAM application (`<org>-<app>`) |
-| `NEXT_PUBLIC_IAM_ORG_NAME` | `hanzo` | IAM organization |
-| `NEXT_PUBLIC_IAM_CLIENT_ID` | — | OAuth client id |
+## Get Started
 
-## Architecture
+### API Keys
 
-See [LLM.md](./LLM.md) for the full design (base choice, /v1 client, auth flow,
-the product-module registry, and the Providers surface). Endpoint reference in
-[docs/endpoints.md](./docs/endpoints.md).
+You need a Langfuse public and secret key to get started. Sign up [here](https://cloud.langfuse.com) and find them in your project settings.
+
+### Ingesting Data · Instrumenting Your Application
+
+Note: We recommend using our fully async, typed [SDKs](https://langfuse.com/docs/sdk) that allow you to instrument any LLM application with any underlying model. They are available in [Python (Decorators)](https://langfuse.com/docs/sdk/python) & [JS/TS](https://langfuse.com/docs/sdk/typescript). The SDKs will always be the most fully featured and stable way to ingest data into Langfuse.
+
+You may want to use another integration to get started quickly or implement a use case that we do not yet support. However, we recommend to migrate to the Langfuse SDKs over time to ensure performance and stability.
+
+See the [→ Quickstart](https://langfuse.com/docs/get-started) to integrate Langfuse.
+
+### Integrations
+
+| Integration                                                      | Supports      | Description                                                 |
+| ---------------------------------------------------------------- | ------------- | ----------------------------------------------------------- |
+| [**SDK** - _recommended_](https://langfuse.com/docs/sdk)         | Python, JS/TS | Manual instrumentation using the SDKs for full flexibility. |
+| [OpenAI SDK](https://langfuse.com/docs/integrations/openai)      | Python, JS/TS | Automated instrumentation of OpenAI SDK.                    |
+| [Langchain](https://langfuse.com/docs/integrations/langchain)    | Python, JS/TS | Instrumentation via Langchain callbacks.                    |
+| [LlamaIndex](https://langfuse.com/docs/integrations/llama-index) | Python        | Automated instrumentation via LlamaIndex callback system.   |
+| [API](https://langfuse.com/docs/api)                             |               | Directly call the public API. OpenAPI spec available.       |
+
+External projects/packages that integrate with Langfuse:
+
+| Name                                                            | Description                                                                                                                                      |
+| --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| [LiteLLM](https://langfuse.com/docs/integrations/litellm)       | Use any LLM as a drop in replacement for GPT. Use Azure, OpenAI, Cohere, Anthropic, Ollama, VLLM, Sagemaker, HuggingFace, Replicate (100+ LLMs). |
+| [Flowise](https://langfuse.com/docs/integrations/flowise)       | JS/TS no-code builder for customized LLM flows.                                                                                                  |
+| [Langflow](https://langfuse.com/docs/integrations/langflow)     | Python-based UI for LangChain, designed with react-flow to provide an effortless way to experiment and prototype flows.                          |
+| [Superagent](https://langfuse.com/docs/integrations/superagent) | Open Source AI Assistant Framework & API for prototyping and deployment of agents.                                                               |
+
+## Questions and feedback
+
+### Ideas and roadmap
+
+- [GitHub Discussions](https://github.com/orgs/langfuse/discussions)
+- [Feature Requests](https://langfuse.com/idea)
+- [Roadmap](https://langfuse.com/roadmap)
+
+### Support and feedback
+
+In order of preference the best way to communicate with us:
+
+- [GitHub Discussions](https://github.com/orgs/langfuse/discussions): Contribute [ideas](https://langfuse.com/idea) [support requests](https://github.com/orgs/langfuse/discussions/categories/support) and [report bugs](https://github.com/langfuse/langfuse/issues/new?labels=%F0%9F%90%9E%E2%9D%94+unconfirmed+bug&projects=&template=bug_report.yml&title=bug%3A+) (preferred as we create a permanent, indexed artifact for other community members)
+- [Discord](https://langfuse.com/discord): community support
+- Privately: contact at langfuse dot com
+
+## Contributing to Langfuse
+
+- Vote on [Ideas](https://github.com/orgs/langfuse/discussions/categories/ideas)
+- Raise and comment on [Issues](https://github.com/langfuse/langfuse/issues)
+- Open a PR - see [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to setup a development environment.
 
 ## License
 
-BSD-3-Clause. Copyright (c) 2026-present, Hanzo AI, Inc.
+This repository is MIT licensed, except for the `ee` folders. See [LICENSE](LICENSE) and [docs](https://langfuse.com/docs/open-source) for more details.
+
+## Misc
+
+### GET API to export your data
+
+[**GET routes**](https://langfuse.com/docs/integrations/api) to use data in downstream applications (e.g. embedded analytics).
+
+### Security & Privacy
+
+We take data security and privacy seriously. Please refer to our [Security and Privacy](https://langfuse.com/security) page for more information.
+
+### Telemetry
+
+By default, Langfuse automatically reports basic usage statistics of self-hosted instances to a centralized server (PostHog).
+
+This helps us to:
+
+1. Understand how Langfuse is used and improve the most relevant features.
+2. Track overall usage for internal and external (e.g. fundraising) reporting.
+
+None of the data is shared with third parties and does not include any sensitive information. We want to be super transparent about this and you can find the exact data we collect [here](/web/src/features/telemetry/index.ts).
+
+You can opt-out by setting `TELEMETRY_ENABLED=false`.

SECURITY.md

@@ -0,0 +1,4 @@
+## Security Policy
+We strongly recommend using the latest version of Langfuse to receive all security updates.
+
+For more information, please refer to the [Data Security & Privacy](https://langfuse.com/docs/data-security-privacy) page in the documentation or contact security@langfuse.com.

app/(dashboard)/[...slug]/page.tsx

@@ -1,69 +0,0 @@
-'use client'
-
-import { use } from 'react'
-import { notFound } from 'next/navigation'
-
-import { resolveView, isAdminRoute } from '~/lib/products/match'
-import { findEntry } from '~/lib/products/registry'
-import { useIsGlobalAdmin } from '~/lib/auth/admin'
-import { ProductSubpageStub } from '~/components/products/ProductSubpageStub'
-import { ProductSubpageModule } from '~/components/products/subpage/ProductSubpageModule'
-import { AdminManagedNotice } from '~/components/products/AdminManagedNotice'
-import { ProductErrorBoundary } from '~/components/errors/ProductErrorBoundary'
-
-/**
- * Catch-all product route. Resolves the module + route from the registry and
- * renders its component. Adding a product anywhere in the registry makes its
- * routes live here — no per-product page files.
- *
- * Two honest gates on top of the resolver:
- * - A known product SUB-PAGE (a declared specific or a uniform base sub-page:
- *   Overview · Settings · Status · Logs · Metrics) with no backend route yet
- *   renders a placeholder stub — never a 404, never a fabricated surface.
- * - A CUSTOMER (non-global-admin) reaching an admin-only surface (cross-tenant
- *   IAM/KMS, provider + routing config) gets a graceful "managed by Hanzo" notice
- *   instead of the module's hostile 403 red error. Access is enforced
- *   server-side regardless.
- *
- * The resolved module renders inside `ProductErrorBoundary`: modules mount
- * client-only (the authed shell renders a loader during SSR), so a throw in one
- * module's first render had no boundary and white-screened the whole console
- * ("Application error: a client-side exception") on a direct load / refresh. The
- * boundary keeps the shell + nav and shows an honest, retryable card instead —
- * one place, every product route (DRY).
- */
-export default function ProductPage({ params }: { params: Promise<{ slug: string[] }> }) {
-  const { slug } = use(params)
-  const showAdmin = useIsGlobalAdmin()
-  const view = resolveView(slug)
-
-  if (view.kind === 'notfound') notFound()
-
-  if (!showAdmin && isAdminRoute(slug)) {
-    const entry = findEntry(slug[0])
-    if (entry && entry.kind === 'module') {
-      const seg = slug[1]
-      const subpage = seg ? (entry.subpages ?? []).find((s) => s.slug === seg && s.admin) : undefined
-      return <AdminManagedNotice entry={entry} subpage={subpage} />
-    }
-  }
-
-  if (view.kind === 'stub') return <ProductSubpageStub entry={view.entry} subpage={view.subpage} />
-
-  // A uniform base sub-page (Status/Logs/Metrics/Settings) → the shared per-product
-  // sub-page system (real feed or honest state), inside the same error boundary so
-  // a data fetch that throws shows the retryable card, never a white screen.
-  if (view.kind === 'subpage')
-    return (
-      <ProductErrorBoundary resetKey={slug.join('/')}>
-        <ProductSubpageModule entry={view.entry} subpage={view.subpage} />
-      </ProductErrorBoundary>
-    )
-
-  const Component = view.matched.route.component
-  return (
-    <ProductErrorBoundary resetKey={slug.join('/')}>
-      <Component params={view.matched.params} />
-    </ProductErrorBoundary>
-  )
-}

app/(dashboard)/discover/[id]/page.tsx

@@ -1,15 +0,0 @@
-'use client'
-
-import { use } from 'react'
-
-import { ProductInterstitial } from '~/components/products/ProductInterstitial'
-
-/**
- * Product discover screen — `/discover/<id>` renders the interstitial for one
- * catalog entry (docs, OSS source, revenue share, open/get-started). A dedicated
- * route (more specific than the `[...slug]` product catch-all) so it's shareable.
- */
-export default function DiscoverPage({ params }: { params: Promise<{ id: string }> }) {
-  const { id } = use(params)
-  return <ProductInterstitial id={id} />
-}

app/(dashboard)/error.tsx

@@ -1,75 +0,0 @@
-'use client'
-
-/**
- * Dashboard route error backstop (Next App Router).
- *
- * `ProductErrorBoundary` catches throws inside a resolved product module; this
- * catches anything above it in the dashboard page tree (the resolver itself, a
- * non-catch-all dashboard page). It renders in the layout's content slot, so the
- * shell + nav stay mounted — never a white-screened "Application error". Next's
- * `reset()` re-renders the segment; `notFound()`/`redirect()` are control flow and
- * do not reach here.
- */
-import { useEffect } from 'react'
-import { Button, Card, Text, XStack, YStack } from '@hanzo/gui'
-import { RefreshCw, TriangleAlert } from '@hanzogui/lucide-icons-2'
-
-import { isChunkLoadError, shouldReloadForChunk } from '~/components/errors/boundary-logic'
-
-/** Shared once-per-window guard key (same as ProductErrorBoundary — never double-reload). */
-const RELOAD_AT_KEY = 'hz.console.chunkReloadAt'
-
-export default function DashboardError({ error, reset }: { error: Error & { digest?: string }; reset: () => void }) {
-  const chunk = isChunkLoadError(error)
-
-  useEffect(() => {
-    console.error('[console] dashboard route error:', error)
-    // A chunk skew self-heals: reload ONCE per window to pull the fresh HTML +
-    // current chunks (same recovery the product boundary does), so a stale-deploy
-    // crash at the segment level auto-recovers instead of stranding a manual card.
-    if (!chunk || typeof window === 'undefined') return
-    try {
-      const raw = window.sessionStorage.getItem(RELOAD_AT_KEY)
-      const last = raw ? Number(raw) : null
-      if (shouldReloadForChunk(Date.now(), last)) {
-        window.sessionStorage.setItem(RELOAD_AT_KEY, String(Date.now()))
-        window.location.reload()
-      }
-    } catch {
-      /* sessionStorage blocked (private mode) — fall through to the manual card */
-    }
-  }, [error, chunk])
-
-  return (
-    <YStack p="$4">
-      <Card borderWidth={1} borderColor="$borderColor" p="$4" gap="$3" maxWidth={640} bg="$color1">
-        <XStack gap="$2" items="center">
-          <TriangleAlert size={16} />
-          <Text fontSize="$4" fontWeight="700">
-            {chunk ? 'Updating to the latest version' : 'This page hit an unexpected error'}
-          </Text>
-        </XStack>
-        <Text fontSize="$3" color="$color11">
-          {chunk
-            ? 'A newer version of the console just shipped. Reload to load the latest.'
-            : 'The rest of the console still works. Try again, or reload the page.'}
-        </Text>
-        <XStack gap="$2">
-          {!chunk ? (
-            <Button size="$2" icon={<RefreshCw size={14} />} onPress={() => reset()}>
-              Try again
-            </Button>
-          ) : null}
-          <Button
-            size="$2"
-            chromeless={!chunk}
-            icon={<RefreshCw size={14} />}
-            onPress={() => { if (typeof window !== 'undefined') window.location.reload() }}
-          >
-            Reload
-          </Button>
-        </XStack>
-      </Card>
-    </YStack>
-  )
-}

app/(dashboard)/layout.tsx

@@ -1,39 +0,0 @@
-import type { ReactNode } from 'react'
-
-import { AuthGate } from '~/components/AuthGate'
-import { OrgGate } from '~/components/OrgGate'
-import { DashboardShell } from '~/components/DashboardShell'
-import { PreferencesProvider } from '~/lib/products/preferences'
-import { ScopeProvider } from '~/lib/scope-context'
-import { ToastProvider } from '~/components/ui/Toast'
-import { CommandPaletteProvider } from '~/components/CommandPalette'
-import { AppLauncherProvider } from '~/components/AppLauncher'
-import { DetailPaneProvider } from '~/components/DetailPane'
-import { FloatingChatProvider } from '~/components/FloatingChat'
-
-export default function DashboardLayout({ children }: { children: ReactNode }) {
-  return (
-    <AuthGate>
-      <OrgGate>
-        <ScopeProvider>
-          <PreferencesProvider>
-            <ToastProvider>
-              {/* AppLauncher wraps the palette so the palette can open the launcher. */}
-              <AppLauncherProvider>
-                <CommandPaletteProvider>
-                  {/* FloatingChat floats the assistant bubble over every page. */}
-                  <FloatingChatProvider>
-                    {/* DetailPane hosts the ONE right-side item detail/edit pane. */}
-                    <DetailPaneProvider>
-                      <DashboardShell>{children}</DashboardShell>
-                    </DetailPaneProvider>
-                  </FloatingChatProvider>
-                </CommandPaletteProvider>
-              </AppLauncherProvider>
-            </ToastProvider>
-          </PreferencesProvider>
-        </ScopeProvider>
-      </OrgGate>
-    </AuthGate>
-  )
-}

app/(dashboard)/page.tsx

@@ -1,198 +0,0 @@
-'use client'
-
-/**
- * Product catalog — the unified console home. Every Hanzo product, grouped by the
- * ten canonical categories, with its Google Cloud equivalent. Every product is
- * open-for-all: each card opens straight into its native in-console surface and
- * carries a "Learn more" affordance to its docs — there is no enablement gate and
- * no external bounce. Each card can be pinned to the sidebar (persisted to the
- * account). Rendered entirely from the catalog registry.
- */
-import { useEffect } from 'react'
-import { useRouter } from 'next/navigation'
-import { Button, Card, Spinner, Text, XStack, YStack } from '@hanzo/gui'
-import { Star, Lock, ArrowRight, BookOpen, KeyRound } from '@hanzogui/lucide-icons-2'
-
-import { config } from '~/config'
-import { visibleCatalogByCategory, categorySlug, type CatalogEntry } from '~/lib/products/registry'
-import { openProduct } from '~/lib/products/open'
-import { useFavorites } from '~/lib/products/favorites'
-import { useIsGlobalAdmin } from '~/lib/auth/admin'
-import { PageHeader } from '~/components/ui/PageHeader'
-import { PrimaryButton } from '~/components/ui/PrimaryButton'
-import { FadeIn } from '~/components/ui/FadeIn'
-import { livingOverviewModule } from '~/components/products/overview/living/LivingOverviewModule'
-
-// The home centerpiece is the reusable LivingOverview (count-up KPIs, live
-// sparklines, streaming activity) — the SAME component every product overview uses.
-const OverviewDashboard = livingOverviewModule('overview')
-
-function ProductCard({
-  entry,
-  pinned,
-  onOpen,
-  onToggle,
-  onLearnMore,
-}: {
-  entry: CatalogEntry
-  pinned: boolean
-  onOpen: () => void
-  onToggle: () => void
-  onLearnMore: () => void
-}) {
-  const Icon = entry.icon
-  return (
-    <Card borderWidth={1} borderColor="$borderColor" p="$4" gap="$3" width={272}>
-      <XStack justify="space-between" items="flex-start">
-        <XStack gap="$2" items="center" flex={1}>
-          <Icon size={20} />
-          <YStack flex={1}>
-            <Text fontSize="$5" fontWeight="700">
-              {entry.label}
-            </Text>
-            {entry.gcp ? (
-              <Text fontSize="$1" color="$color10">
-                {entry.gcp}
-              </Text>
-            ) : null}
-          </YStack>
-        </XStack>
-        <XStack gap="$1" items="center">
-          {entry.admin ? <Lock size={13} opacity={0.45} /> : null}
-          <Button
-            size="$2"
-            chromeless
-            opacity={pinned ? 1 : 0.3}
-            icon={<Star size={15} />}
-            onPress={onToggle}
-            aria-label={pinned ? `Unpin ${entry.label}` : `Pin ${entry.label}`}
-          />
-        </XStack>
-      </XStack>
-
-      <Text fontSize="$3" color="$color11" minH={40}>
-        {entry.description}
-      </Text>
-
-      <XStack justify="space-between" items="center">
-        <Button
-          size="$2"
-          chromeless
-          icon={<BookOpen size={14} />}
-          onPress={onLearnMore}
-          aria-label={`Learn more about ${entry.label}`}
-        >
-          Learn more
-        </Button>
-        <Button
-          size="$2"
-          bg="$color5"
-          borderWidth={1}
-          borderColor="$borderColor"
-          onPress={onOpen}
-          iconAfter={<ArrowRight size={14} />}
-        >
-          Open
-        </Button>
-      </XStack>
-    </Card>
-  )
-}
-
-/**
- * Prominent, always-visible "Get API key" call-to-action at the top of the home.
- * A cold customer must reach "New key" in one obvious click from landing — the
- * api-keys page is otherwise buried in the collapsed Dev nav group. Routes to the
- * real ApiKeysModule (`/api-keys`), where the `hk-` key is created/copied/rotated.
- */
-function GetApiKeyCta({ onOpen }: { onOpen: () => void }) {
-  return (
-    <Card borderWidth={1} borderColor="$borderColor" bg="$color2" p="$4">
-      <XStack items="center" justify="space-between" gap="$4" flexWrap="wrap">
-        <XStack items="center" gap="$3" flex={1} minW={240}>
-          <YStack bg="$color5" rounded="$4" p="$2.5" items="center" justify="center">
-            <KeyRound size={20} />
-          </YStack>
-          <YStack flex={1} minW={180}>
-            <Text fontSize="$5" fontWeight="800">
-              Get your API key
-            </Text>
-            <Text fontSize="$3" color="$color11">
-              Call {config.brandName} models from your apps, SDKs, and CLI with a personal key.
-            </Text>
-          </YStack>
-        </XStack>
-        <PrimaryButton size="$4" iconAfter={<ArrowRight size={16} />} onPress={onOpen}>
-          Get API key
-        </PrimaryButton>
-      </XStack>
-    </Card>
-  )
-}
-
-export default function DashboardHome() {
-  const router = useRouter()
-  const { toggle, isPinned } = useFavorites()
-  const showAdmin = useIsGlobalAdmin()
-  const push = (path: string) => router.push(path)
-  const groups = visibleCatalogByCategory(showAdmin)
-
-  // Billing-only shell (billing.<brand> / NEXT_PUBLIC_BILLING_ONLY): the default
-  // route IS the Billing Center — redirect the catalog home to the billing overview
-  // so people who only ever see billing.hanzo.ai land straight on billing.
-  useEffect(() => {
-    if (config.billingOnly) router.replace('/billing')
-  }, [router])
-  if (config.billingOnly) {
-    return (
-      <XStack flex={1} justify="center" items="center" p="$8">
-        <Spinner size="large" color="$color11" />
-      </XStack>
-    )
-  }
-
-  return (
-    <YStack gap="$7">
-      <GetApiKeyCta onOpen={() => push('/api-keys')} />
-      <OverviewDashboard params={{}} />
-      <YStack gap="$4">
-        <PageHeader
-          title="Explore products"
-          subtitle={`Open and manage every ${config.brandName} product from one place.`}
-        />
-        {groups.map((group, i) => (
-        <FadeIn key={group.category} index={i} style={{ width: '100%' }}>
-          <YStack gap="$3">
-            <XStack
-              self="flex-start"
-              items="center"
-              gap="$2"
-              cursor="pointer"
-              hoverStyle={{ opacity: 0.75 }}
-              onPress={() => push(`/category/${categorySlug(group.category)}`)}
-              aria-label={`${group.category} overview`}
-            >
-              <Text fontSize="$5" fontWeight="800" color="$color12">
-                {group.category}
-              </Text>
-              <ArrowRight size={16} opacity={0.5} />
-            </XStack>
-            <XStack flexWrap="wrap" gap="$3">
-              {group.entries.map((entry) => (
-                <ProductCard
-                  key={entry.id}
-                  entry={entry}
-                  pinned={isPinned(entry.id)}
-                  onOpen={() => openProduct(entry, push)}
-                  onToggle={() => toggle(entry.id)}
-                  onLearnMore={() => push(`/discover/${entry.id}`)}
-                />
-              ))}
-            </XStack>
-          </YStack>
-        </FadeIn>
-        ))}
-      </YStack>
-    </YStack>
-  )
-}

app/admin/aggregate/[...path]/route.ts

@@ -1,106 +0,0 @@
-/**
- * Server-gated GLOBAL admin aggregate proxy — the cross-tenant business/platform
- * reads (`/v1/admin/{overview,usage,orgs,audit,products,finance,compute,providers}`)
- * AND the few GLOBAL-admin mutations that ride the same god-view gate
- * (`POST /v1/admin/providers/{toggle,primary}` — flip shared-gateway provider
- * routing that affects every org).
- *
- * The admin business board is an ALL-ORGS god view (`?org=all`) over IAM + commerce
- * + o11y. So — unlike the per-tenant `/cloud` proxy, which authorizes on the bearer
- * `owner` claim and is safe for any authenticated user — this MUST be gated to a
- * GLOBAL admin BEFORE anything is forwarded: a tenant customer (even one who is
- * `isAdmin` of their own org) must NOT read another org's revenue/spend/customers,
- * must NOT trigger the `org=all` aggregate at all, and must NOT flip a shared
- * provider's enabled/primary state.
- *
- * Defense in depth (RED H1 — the cloud-side gate for `/v1/admin/*` is a separate
- * backend contract we cannot see or test from this repo): `getAdminGate` enforces the
- * SAME policy the IAM/KMS admin proxies use — a VERIFIED `@<brand.adminDomain>` email
- * AND an IAM global-admin flag, fail-closed (→ 403) on any miss. Only then does the
- * shared `forwardWithUserBearer` mint a short-lived user bearer and forward to
- * cloud-api, applying the usual path-traversal + same-origin-CSRF hardening. On a
- * mutating method (POST), that CSRF gate (Sec-Fetch-Site ≠ cross-site AND Origin/
- * Referer host == Host, fail-closed 403 BEFORE resolving the user) means a
- * cross-site page can never flip a provider on the victim admin's behalf. The
- * browser holds no cloud credential and cannot reach this endpoint without passing
- * the gate; the client-side `admin: true` nav gate + `AdminManagedNotice` is UI-only
- * defense-in-depth, never the boundary.
- *
- * Least privilege: only the admin aggregate heads are reachable, NOT `iam`/`kms`
- * (those keep their own gated proxies with their own tenant-scoping semantics) — this
- * is not a general cloud-api tunnel. `allowAdminSurface` admits `v1/admin/<head>[/...]`
- * (the exact forwarded upstream shape), so `providers` covers the GET list and the
- * `providers/{toggle,primary}` POSTs and nothing else. `next.config.mjs` rewrites
- * `/v1/admin/<head>[/...]` here for BOTH GET and POST (dropping the `/v1/` into the
- * internal Next route path); this handler re-adds `v1/` for the upstream cloud call,
- * and the client calls the clean same-origin `/v1/admin/*` form (unchanged).
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { getAdminGate } from '~/lib/server/identity'
-import { forwardWithUserBearer } from '~/lib/server/bearer-proxy'
-import { allowAdminSurface } from '~/lib/server/admin-aggregate'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** The unified cloud backend (hanzoai/cloud). In-cluster ClusterIP — public egress is CF-403'd.
- *  `|| default` (not `??`) so an env reconciled to an EMPTY string still resolves the service. */
-const CLOUD_API_URL = trim(process.env.CLOUD_API_URL?.trim() || 'http://cloud-api.hanzo.svc.cluster.local:8000')
-
-const forbidden = () => NextResponse.json({ status: 'error', msg: 'forbidden' }, { status: 403 })
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-async function handle(req: NextRequest, ctx: Ctx): Promise<NextResponse> {
-  // AUTHORIZE FIRST — global-admin only, fail-closed. A non-global-admin (tenant
-  // customer, org-level isAdmin) gets a 403 and never triggers the org=all aggregate.
-  const gate = await getAdminGate(req)
-  if (!gate) return forbidden()
-
-  // The rewrite feeds the tail after `/v1/admin/` (e.g. `overview`, `audit`); rebuild
-  // the FULL cloud path, which is `/v1/admin/<head>` — cloud serves every admin route
-  // under `/v1/admin/*` (the beego `/v1/*` glob in hanzoai/ai + cloud's own
-  // `clients/admin` `app.Get("/v1/admin/…")`), and `forwardWithUserBearer` forwards to
-  // `target/path` VERBATIM (no `/v1` prepend), so the `v1/` MUST be part of the path
-  // here or the request lands on a non-existent bare `/admin/*` and 404s. The rewrite
-  // destination (`app/admin/aggregate/<head>`) is the internal Next route, not the
-  // upstream — it deliberately carries no `v1/`; this handler adds it.
-  // `forwardWithUserBearer` re-validates the exact forwarded path via `allow`
-  // (`allowAdminSurface`, keyed on the `v1/admin/<head>` shape) + `pathIsClean`.
-  const path = `v1/admin/${(await ctx.params).path.join('/')}`.replace(/\/+$/, '')
-  return forwardWithUserBearer(req, {
-    target: CLOUD_API_URL,
-    path,
-    allow: allowAdminSurface,
-    // The AdminApi client unwraps the casibase `{status,msg,data}` envelope, so this
-    // proxy's own 401/404 must speak the same shape (an honest state, never a throw).
-    errorShape: 'casibase',
-    unauthorizedMessage: 'Sign in as an administrator.',
-  })
-}
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-
-/**
- * POST — the GLOBAL-admin mutations that ride the same god-view gate
- * (`/v1/admin/providers/{toggle,primary}`). Identical path through `getAdminGate`
- * (fail-closed 403) → `forwardWithUserBearer`, which applies the same-origin CSRF
- * check to this mutating method BEFORE resolving the user, streams the JSON body
- * through, and re-validates the path against `allowAdminSurface` (so a POST can only
- * ever reach an allowed head — never `iam`/`kms`, never a traversal).
- */
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-
-/**
- * PUT — the GLOBAL-admin enablement set (`PUT /v1/admin/enablement`, flip an item
- * off|beta|ga + grant orgs). Same gate + same CSRF/traversal hardening as POST;
- * `allowAdminSurface` admits only `v1/admin/enablement`, nothing else.
- */
-export async function PUT(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}

app/admin/iam/[...path]/route.ts

@@ -1,85 +0,0 @@
-/**
- * Server-gated GLOBAL IAM admin proxy — cross-tenant IAM ops (any org).
- *
- * The browser holds no IAM credential. It calls this SAME-ORIGIN route with just
- * its session cookie; the handler enforces the GLOBAL admin gate (`getAdminGate`:
- * verified @<adminDomain> email AND a global-admin flag), then the shared
- * `forwardIam` applies the allow-list + tenant scoping (a global admin may act on
- * any org) and forwards to IAM as the user. A CUSTOMER managing their OWN org uses
- * `/org/iam` instead — this route is global-only.
- *
- * Least privilege: only an explicit allow-list of admin segments is reachable
- * (GET reads / POST mutations); every owner the request references — including
- * the mutation BODY owner — is validated by `forwardIam`.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { getAdminGate } from '~/lib/server/identity'
-import { forwardIam } from '~/lib/server/iam-proxy'
-
-export const runtime = 'nodejs'
-
-/** Read segments — reachable via GET only. */
-const GET_SEGMENTS = new Set([
-  'get-organizations',
-  'get-organization',
-  'get-users',
-  'get-user',
-  'get-applications',
-  'get-application',
-  'get-providers',
-  'get-provider',
-  'get-roles',
-  'get-records',
-])
-
-/** Mutation segments — reachable via POST only (JSON body forwarded). */
-const POST_SEGMENTS = new Set([
-  'add-user',
-  'update-user',
-  'delete-user',
-  'add-application',
-  'update-application',
-  'delete-application',
-  'add-provider',
-  'update-provider',
-  'delete-provider',
-  'add-role',
-  'update-role',
-  'delete-role',
-])
-
-/**
- * Organization objects are owned by IAM's built-in `admin`, and the org
- * list/get endpoints scope results to the caller's org server-side — so `admin`
- * is an acceptable owner THERE (never for tenant data like users/roles).
- */
-const ORG_ENDPOINTS = new Set(['get-organizations', 'get-organization'])
-
-const forbidden = () => NextResponse.json({ error: 'forbidden' }, { status: 403 })
-
-async function handle(req: NextRequest, path: string[], method: 'GET' | 'POST'): Promise<NextResponse> {
-  const gate = await getAdminGate(req)
-  if (!gate) return forbidden()
-  return forwardIam(
-    req,
-    { user: gate.user, isGlobalAdmin: gate.user.isGlobalAdmin, orgScope: gate.orgScope },
-    {
-      segment: path.join('/'),
-      method,
-      allowed: method === 'GET' ? GET_SEGMENTS : POST_SEGMENTS,
-      orgMetaSegments: ORG_ENDPOINTS,
-      // The gate is already global-only; global admins may write to any org.
-      requireAdminForWrite: false,
-    },
-  )
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path, 'GET')
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path, 'POST')
-}

app/admin/kms/[...path]/route.ts

@@ -1,144 +0,0 @@
-/**
- * Server-gated KMS admin proxy — the ONLY way the browser reaches Hanzo KMS.
- *
- * Same trust boundary as the IAM proxy: the browser sends only its session
- * cookie, this handler enforces the brand-admin gate, then forwards to kmsd as
- * the user (short-lived user-bound bearer) so KMS enforces org isolation from the
- * verified `owner` claim (`canActOnOrg`). Secrets are scoped to the brand org by
- * default; a global admin may target another org with `?org=`.
- *
- * Zero-knowledge discipline: this route NEVER logs a secret value or any request
- * body, and never derives or stores key material — it is a faithful pass-through
- * of kmsd's JSON + status code. One resource path (`/admin/kms/secrets`); the
- * verb + query select the operation:
- *   GET   ?path=&name=&env=   → reveal one value      → GET    .../secrets/<path>/<name>?env=
- *   GET   ?prefix=&env=       → list metadata          → GET    .../secrets?prefix=&env=
- *   POST  {path,name,env,value} → create/upsert        → POST   .../secrets
- *   PATCH ?path=&name= {value,version,env} → rotate    → PATCH  .../secrets/<path>/<name>
- *   DELETE ?path=&name=&env=  → delete                 → DELETE .../secrets/<path>/<name>?env=
- *
- * kmsd has no list endpoint yet — the list GET returns 404, which the KMS module
- * renders as an honest "listing requires kmsd ≥ next release" state.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { getAdminGate, adminBearer, kmsBaseUrl, type AdminGate } from '~/lib/server/identity'
-import { orgFor as policyOrgFor } from '~/lib/server/admin-policy'
-import { csrfRefusal } from '~/lib/server/bearer-proxy'
-import { fetchWithTimeout } from '~/lib/server/fetch-timeout'
-
-export const runtime = 'nodejs'
-
-const forbidden = () => NextResponse.json({ error: 'forbidden' }, { status: 403 })
-const notFound = () => NextResponse.json({ error: 'not found' }, { status: 404 })
-
-/** `<path>/<name>` for the kmsd route, each segment encoded, slashes preserved. */
-function secretRest(path: string, name: string): string {
-  return [...path.split('/').filter(Boolean), name].map(encodeURIComponent).join('/')
-}
-
-/** Org the operator acts on — the brand org, unless a global admin passes ?org=
- *  (the pure `admin-policy` predicate, tested in admin-policy.test.ts). */
-function orgFor(gate: AdminGate, req: NextRequest): string {
-  return policyOrgFor(
-    { isGlobalAdmin: gate.user.isGlobalAdmin, orgScope: gate.orgScope },
-    req.nextUrl.searchParams.get('org'),
-  )
-}
-
-async function handle(req: NextRequest, segments: string[]): Promise<NextResponse> {
-  // CSRF: a cross-site page carrying the admin's auto-sent cookie must never be able
-  // to create / rotate / delete a KMS secret. Refuse a cross-origin MUTATION before
-  // the admin gate or any body read (safe GET reveals pass). Defense in depth on top
-  // of the session cookie's own SameSite attribute.
-  const csrf = csrfRefusal(req)
-  if (csrf) return csrf
-
-  const gate = await getAdminGate(req)
-  if (!gate) return forbidden()
-  if (segments.length !== 1 || segments[0] !== 'secrets') return notFound()
-
-  const org = orgFor(gate, req)
-  const base = `${kmsBaseUrl()}/v1/kms/orgs/${encodeURIComponent(org)}/secrets`
-  const q = req.nextUrl.searchParams
-  const name = q.get('name') ?? ''
-  const path = q.get('path') ?? ''
-  const env = q.get('env') ?? ''
-
-  let target: string
-  let body: string | undefined
-  if (req.method === 'GET') {
-    if (name) {
-      const params = new URLSearchParams()
-      if (env) params.set('env', env)
-      target = `${base}/${secretRest(path, name)}${params.toString() ? `?${params}` : ''}`
-    } else {
-      const params = new URLSearchParams()
-      const prefix = q.get('prefix')
-      if (prefix) params.set('prefix', prefix)
-      if (env) params.set('env', env)
-      target = `${base}${params.toString() ? `?${params}` : ''}`
-    }
-  } else if (req.method === 'POST') {
-    target = base
-    body = await req.text() // {path,name,env,value} — forwarded verbatim, never logged
-  } else if (req.method === 'PATCH') {
-    if (!name) return notFound()
-    target = `${base}/${secretRest(path, name)}`
-    body = await req.text() // {value,version,env} — forwarded verbatim, never logged
-  } else if (req.method === 'DELETE') {
-    if (!name) return notFound()
-    const params = new URLSearchParams()
-    if (env) params.set('env', env)
-    target = `${base}/${secretRest(path, name)}${params.toString() ? `?${params}` : ''}`
-  } else {
-    return notFound()
-  }
-
-  let bearer: string
-  try {
-    bearer = await adminBearer(gate.user)
-  } catch (e) {
-    return NextResponse.json(
-      { message: `Could not authorize the request: ${e instanceof Error ? e.message : String(e)}` },
-      { status: 502 },
-    )
-  }
-
-  const headers: Record<string, string> = { Authorization: `Bearer ${bearer}`, Accept: 'application/json' }
-  const init: RequestInit = { method: req.method, headers, cache: 'no-store' }
-  if (body !== undefined) {
-    headers['Content-Type'] = 'application/json'
-    init.body = body
-  }
-
-  try {
-    const res = await fetchWithTimeout(target, init)
-    const text = await res.text()
-    return new NextResponse(text, {
-      status: res.status,
-      headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' },
-    })
-  } catch (e) {
-    // Surface only the transport failure — never the request body/value.
-    return NextResponse.json(
-      { message: `KMS unreachable: ${e instanceof Error ? e.message : String(e)}` },
-      { status: 502 },
-    )
-  }
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path)
-}
-export async function PATCH(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path)
-}
-export async function DELETE(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path)
-}

app/ai/[...path]/route.ts

@@ -1,66 +0,0 @@
-/**
- * Keyless AI proxy — the ONE path the console uses to reach the model gateway.
- *
- * `/v1/chat/completions` (and friends) REQUIRE an `Authorization: Bearer` token; a
- * browser session cookie alone is rejected. Rather than ship the user's durable
- * `hk-` key to the browser, the console calls its OWN origin (`/ai/v1/...`) with just
- * the session cookie; `forwardWithUserBearer` resolves the user, mints a SHORT-LIVED,
- * user-bound IAM token (shared per-user cache in identity.ts), and forwards to the
- * gateway with that token. No key in the browser, no rotation on a chat turn, and
- * every call is billed to the user's own org. The response STREAMS through, so
- * `chat/completions` SSE (and the multi-model TTFT measurement) is preserved.
- *
- * Least privilege: only the read/inference AI endpoints are proxied (the ALLOWED
- * allow-list); anything else 404s, so this is not a general gateway tunnel. The RAG
- * retrieval switch (`X-Retrieval`/`X-Retrieval-Store`) is the ONE client-header
- * passthrough (allow-listed in `ai-proxy`).
- */
-import { type NextRequest } from 'next/server'
-
-import { forwardWithUserBearer } from '~/lib/server/bearer-proxy'
-import { retrievalHeaders } from '~/lib/server/ai-proxy'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** Gateway the proxied AI calls are forwarded to (gated/priced api.hanzo.ai). */
-const AI_GATEWAY_URL = trim(process.env.AI_GATEWAY_URL ?? 'https://api.hanzo.ai')
-
-/** The exact `/v1/<...>` endpoints the console is allowed to reach. */
-const ALLOWED = new Set([
-  'v1/models',
-  'v1/pricing/models', // the rich model+provider catalog (context, pricing, specs, tier) for Models/Providers pages
-  'v1/plans', // the subscription tiers + entitlements (rpm/tpm/quota) for the catalog plan badges
-  'v1/chat',
-  'v1/chat/completions',
-  'v1/embeddings',
-  'v1/rerank',
-  'v1/audio/speech', // text-to-speech (JSON in → audio bytes out) for the Playground Audio tab
-  'v1/images/generations', // text-to-image (JSON in → image url/b64 out) for the Playground Image tab
-  'v1/videos/generations', // text-to-video (JSON in → base64 MP4 out) for the Playground Video tab
-])
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-function handle(req: NextRequest, ctx: Ctx) {
-  return (async () => {
-    const path = (await ctx.params).path.join('/')
-    return forwardWithUserBearer(req, {
-      target: AI_GATEWAY_URL,
-      path,
-      allow: (p) => ALLOWED.has(p),
-      // Forward the RAG retrieval switch when present; the store's org owner is still
-      // resolved server-side from the session (the bearer), never the browser.
-      extraHeaders: retrievalHeaders((h) => req.headers.get(h)),
-      errorShape: 'openai',
-      unauthorizedMessage: 'Sign in to use AI.',
-    })
-  })()
-}
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}

app/auth/callback/page.tsx

@@ -1,55 +0,0 @@
-'use client'
-
-/**
- * IAM OAuth callback. IAM redirects here with `?code&state`; we exchange them
- * for a backend session (`/v1/iam/signin`) and land on the dashboard. On failure we
- * surface the error and offer a retry.
- */
-import { Suspense, useEffect, useState } from 'react'
-import { useRouter, useSearchParams } from 'next/navigation'
-import { Button, Text, YStack } from '@hanzo/gui'
-
-import { ApiError } from '~/lib/api'
-import { Loader } from '~/components/ui/Loader'
-import { useSession } from '~/lib/auth/session'
-import { takeReturnTo } from '~/lib/auth/iam'
-
-function Callback() {
-  const params = useSearchParams()
-  const router = useRouter()
-  const { completeSignIn } = useSession()
-  const [error, setError] = useState<string | null>(null)
-
-  useEffect(() => {
-    const code = params.get('code')
-    const state = params.get('state')
-    if (!code || !state) {
-      setError('Missing authorization code.')
-      return
-    }
-    completeSignIn(code, state)
-      // Land the user back where a mid-task expiry interrupted them (default home).
-      .then(() => router.replace(takeReturnTo()))
-      .catch((e: unknown) => setError(e instanceof ApiError ? e.message : 'Sign-in failed.'))
-  }, [params, completeSignIn, router])
-
-  if (error) {
-    return (
-      <YStack flex={1} minH="100vh" items="center" justify="center" gap="$3">
-        <Text color="$color12" fontWeight="600">
-          {error}
-        </Text>
-        <Button onPress={() => router.replace('/signin')}>Back to sign in</Button>
-      </YStack>
-    )
-  }
-  return <Loader label="Completing sign-in…" />
-}
-
-export default function CallbackPage() {
-  return (
-    <Suspense fallback={null}>
-      <Callback />
-    </Suspense>
-  )
-}

app/auth/refresh/route.ts

@@ -1,69 +0,0 @@
-/**
- * /auth/refresh — silently renew the console session (server-side, BFF).
- *
- * The browser calls this with just its httpOnly cookies (no token in the body, none
- * in the URL). The route reassembles + reads the sealed refresh token, calls IAM with
- * `grant_type=refresh_token`, and re-seals the ROTATED token set (IAM issues a new
- * one-time-use refresh token every refresh — we always persist the NEW one). It
- * returns only the new lifetime, never a token.
- *
- * Called two ways, both single-flight on the client (`lib/auth/refresh`): proactively
- * on a timer at ~80% of the access lifetime, and reactively on a 401 from any cloud/BFF
- * call. On failure (the refresh token is truly expired/revoked, or a replay of a
- * rotated one) it 401s WITHOUT clearing the cookies (multi-tab rotating-token race
- * safety — a lost-race 401 must not nuke another tab's freshly-rotated cookie); the
- * client then re-reads the session (seeing a winner's fresh cookie if any) or falls
- * through to graceful re-auth. Only explicit sign-out clears the cookies.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { readRefreshToken, refreshGrant, sealSession, setCookies, SessionError, type CookieDirective } from '~/lib/server/session'
-import { csrfRefusal } from '~/lib/server/bearer-proxy'
-
-export const runtime = 'nodejs'
-
-function withCookies(res: NextResponse, dirs: CookieDirective[]): NextResponse {
-  for (const d of dirs) {
-    res.cookies.set(d.name, d.value, {
-      httpOnly: d.httpOnly,
-      secure: d.secure,
-      sameSite: d.sameSite,
-      path: d.path,
-      maxAge: d.maxAge,
-    })
-  }
-  return res
-}
-
-/** 401 WITHOUT clearing the cookies (see the multi-tab note above). */
-const fail = () => NextResponse.json({ error: 'refresh failed' }, { status: 401 })
-
-export async function POST(req: NextRequest): Promise<NextResponse> {
-  // CSRF: uniform same-origin gate on every mutating BFF route (the hz_rt cookie is
-  // already SameSite=lax + Path=/auth, so this is belt-and-suspenders).
-  const csrf = csrfRefusal(req)
-  if (csrf) return csrf
-
-  const rt = readRefreshToken(req)
-  if (!rt) return fail()
-
-  let tokens
-  try {
-    tokens = await refreshGrant(rt)
-  } catch (e) {
-    // A 502 (endpoint unreachable) is transient — surface it distinctly so the client
-    // can retry, and never touch the cookies.
-    if (e instanceof SessionError && e.status === 502) {
-      return NextResponse.json({ error: 'refresh unavailable' }, { status: 502 })
-    }
-    return fail()
-  }
-  // A rotated set with no new refresh token would strand us next cycle — require it
-  // (fail-closed: never persist a session we cannot refresh again).
-  if (!tokens.refreshToken) return fail()
-
-  const sealed = sealSession(tokens)
-  if (!sealed) return fail()
-  const res = NextResponse.json({ expiresIn: Math.floor(sealed.expiresInMs / 1000) })
-  return withCookies(res, setCookies(sealed.identity, sealed.refresh))
-}

app/auth/session/route.ts

@@ -1,149 +0,0 @@
-/**
- * /auth/session — the console's OWN durable, refreshable OAuth session (BFF).
- *
- *   POST   establish the console session for the SIGNED-IN user (first-party
- *          confidential-client password grant WITH offline_access → access +
- *          rotating refresh token, sealed into the httpOnly cookies).
- *   GET    the current account resolved from that session (what the AuthGate reads
- *          FIRST — durable + silently refreshed, so it survives the casibase
- *          session's own lifetime and never bounces the user mid-task).
- *   DELETE sign out — best-effort revoke the refresh token + clear the cookies.
- *
- * SECURITY. POST is GATED: it mints a console session ONLY for a caller who is
- * ALREADY authenticated (a valid casibase/console session — the full login incl. any
- * MFA), AND only when the password grant resolves to the SAME principal — so it can
- * never be driven standalone with a stolen password, and never bypasses MFA (an MFA
- * account never reaches this call). Tokens live only inside the sealed httpOnly
- * cookies — never returned to the browser, never logged, never in a URL.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { type Account } from '~/lib/api/types'
-import { csrfRefusal } from '~/lib/server/bearer-proxy'
-import { resolveUser } from '~/lib/server/identity'
-import {
-  clearCookies,
-  consoleSession,
-  passwordGrant,
-  readRefreshToken,
-  revokeRefreshToken,
-  sameSubject,
-  sealSession,
-  sessionConfigured,
-  setCookies,
-  SessionError,
-  type ConsoleClaims,
-  type CookieDirective,
-} from '~/lib/server/session'
-
-export const runtime = 'nodejs'
-
-/** Build the client-facing Account from console claims (display + admin fields only;
- *  never the secret material Casdoor also packs into the token). `isGlobalAdmin` is
- *  carried so the client nav/org gates (`isGlobalAdminAccount`) match the casibase
- *  path; `owner === 'admin'` also implies it. */
-function accountOf(c: ConsoleClaims): Account {
-  return {
-    owner: c.owner ?? '',
-    name: c.name ?? '',
-    type: c.type,
-    displayName: c.displayName,
-    email: c.email,
-    avatar: c.avatar,
-    isAdmin: c.isAdmin,
-    isGlobalAdmin: c.isGlobalAdmin || c.owner === 'admin',
-    properties: c.properties,
-  }
-}
-
-/** Apply cookie directives to a NextResponse. */
-function withCookies(res: NextResponse, dirs: CookieDirective[]): NextResponse {
-  for (const d of dirs) {
-    res.cookies.set(d.name, d.value, {
-      httpOnly: d.httpOnly,
-      secure: d.secure,
-      sameSite: d.sameSite,
-      path: d.path,
-      maxAge: d.maxAge,
-    })
-  }
-  return res
-}
-
-/** GET — the account + remaining access lifetime from the live console session, or
- *  401 when there is none (the client then falls back to the casibase session). */
-export async function GET(req: NextRequest): Promise<NextResponse> {
-  const sess = consoleSession(req)
-  if (!sess || !sess.claims.name) {
-    return NextResponse.json({ error: 'no session' }, { status: 401 })
-  }
-  return NextResponse.json({ account: accountOf(sess.claims), expiresIn: sess.expiresInSec })
-}
-
-/** POST { username, password } — establish the console session for the signed-in user. */
-export async function POST(req: NextRequest): Promise<NextResponse> {
-  // CSRF: refuse a cross-origin login (login-CSRF fixes the victim into an attacker's
-  // session) before touching credentials.
-  const csrf = csrfRefusal(req)
-  if (csrf) return csrf
-
-  if (!sessionConfigured()) {
-    // No confidential client wired: the console still runs on the casibase session;
-    // report "not configured" so the client silently skips the console session.
-    return NextResponse.json({ error: 'session not configured' }, { status: 501 })
-  }
-
-  let body: { username?: unknown; password?: unknown }
-  try {
-    body = (await req.json()) as typeof body
-  } catch {
-    return NextResponse.json({ error: 'bad request' }, { status: 400 })
-  }
-  const username = typeof body.username === 'string' ? body.username.trim() : ''
-  const password = typeof body.password === 'string' ? body.password : ''
-  if (!username || !password) {
-    return NextResponse.json({ error: 'missing credentials' }, { status: 400 })
-  }
-
-  // GATE: the caller must already be authenticated (they just completed the casibase
-  // login incl. any MFA). This binds the console session to a real, MFA-cleared
-  // session and blocks standalone password abuse.
-  const authed = await resolveUser(req)
-  if (!authed) {
-    return NextResponse.json({ error: 'not authenticated' }, { status: 401 })
-  }
-
-  let tokens
-  try {
-    tokens = await passwordGrant(username, password)
-  } catch (e) {
-    const status = e instanceof SessionError ? e.status : 502
-    return NextResponse.json({ error: 'grant failed' }, { status })
-  }
-
-  const sealed = sealSession(tokens)
-  // The grant MUST resolve to the same principal as the established session — the
-  // console session is for the already-authenticated user, never a third party.
-  const grantId =
-    sealed && sealed.claims.owner && sealed.claims.name ? `${sealed.claims.owner}/${sealed.claims.name}` : ''
-  if (!sealed || !grantId || !sameSubject(grantId, authed.id)) {
-    return NextResponse.json({ error: 'identity mismatch' }, { status: 401 })
-  }
-
-  const res = NextResponse.json({
-    account: accountOf(sealed.claims),
-    expiresIn: Math.floor(sealed.expiresInMs / 1000),
-  })
-  return withCookies(res, setCookies(sealed.identity, sealed.refresh))
-}
-
-/** DELETE — sign out: best-effort revoke the refresh token, then clear the cookies. */
-export async function DELETE(req: NextRequest): Promise<NextResponse> {
-  // CSRF: refuse a cross-origin forced sign-out.
-  const csrf = csrfRefusal(req)
-  if (csrf) return csrf
-
-  const rt = readRefreshToken(req)
-  if (rt) await revokeRefreshToken(rt)
-  return withCookies(NextResponse.json({ ok: true }), clearCookies())
-}

app/auth/signup/route.ts

@@ -1,93 +0,0 @@
-/**
- * Email self-serve signup (HIP-0111) — create a brand-new account + its own org.
- *
- * This is the ONE unauthenticated BFF route (the caller has no account yet). It
- * acts as the confidential `hanzo-console` client to mint, in one shot:
- *   1. a personal organization (owner=`admin`, password/locale cloned from the
- *      brand org so the account hashes with the brand's argon2id policy), and
- *   2. the user as that org's ADMIN (IAM hashes the password server-side).
- * The client then signs in with the same credentials and lands as admin — no
- * separate onboarding step (IAM users always belong to an org, so "create then
- * onboard" is not possible against casibase; the org is minted here).
- *
- * Email uniqueness without a global user-lookup endpoint: the org slug is a
- * DETERMINISTIC, injective function of the email (`personalOrgFromEmail`), so a
- * repeat signup with the same email resolves to the same slug and is caught by
- * `getOrganization` (409) — two different emails never false-collide.
- *
- * Honest states: 501 when the IAM client is unwired, 400 on bad input, 409 when
- * the account already exists, 502 on an IAM failure.
- *
- * NOTE (hardening, flagged not done here): this endpoint creates accounts from the
- * open internet. It validates input but has NO captcha / rate-limit / email-
- * verification gate yet — those are follow-ups (email verification especially
- * would add friction the go-live conversion goal explicitly avoids).
- */
-import { createHash } from 'node:crypto'
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { brandFromHost } from '~/config'
-import { BRANDS } from '~/lib/branding/brands'
-import { createOrganization, createUser, getOrganization, mintConfigured } from '~/lib/server/identity'
-import {
-  deriveUsername,
-  displayNameFromEmail,
-  personalOrgFromEmail,
-  validateSignup,
-} from '~/lib/server/onboarding'
-import { csrfRefusal } from '~/lib/server/bearer-proxy'
-
-export const runtime = 'nodejs'
-
-export async function POST(req: NextRequest): Promise<NextResponse> {
-  // Same-origin gate: this route creates accounts from the open internet with no
-  // captcha/rate-limit yet, so refuse cross-origin scripted signups (a mild anti-abuse
-  // measure; the console's own signup form is same-origin).
-  const csrf = csrfRefusal(req)
-  if (csrf) return csrf
-
-  if (!mintConfigured()) {
-    return NextResponse.json(
-      { error: 'Account creation is not configured on this deployment (IAM client unset).' },
-      { status: 501 },
-    )
-  }
-
-  const body = (await req.json().catch(() => ({}))) as { email?: string; password?: string }
-  const v = validateSignup(body.email ?? '', body.password ?? '')
-  if (!v.ok) return NextResponse.json({ error: v.error }, { status: 400 })
-
-  const brand = BRANDS[brandFromHost(req.headers.get('host'))]
-  const brandOrg = brand.id // hanzo/lux/zoo/pars — cloned for password/locale policy
-  const signupApplication = `${brand.id}-cloud` // hanzo-cloud, lux-cloud, …
-
-  const digest = createHash('sha256').update(v.email).digest('hex')
-  const orgSlug = personalOrgFromEmail(v.email, digest)
-
-  if (await getOrganization(orgSlug)) {
-    return NextResponse.json(
-      { error: 'An account with this email already exists. Sign in instead.' },
-      { status: 409 },
-    )
-  }
-
-  const displayName = displayNameFromEmail(v.email)
-  try {
-    await createOrganization({ name: orgSlug, displayName, personal: true, sourceOwner: brandOrg })
-    await createUser({
-      org: orgSlug,
-      username: deriveUsername(v.email),
-      email: v.email,
-      password: v.password,
-      displayName,
-      signupApplication,
-    })
-  } catch (e) {
-    return NextResponse.json(
-      { error: `Could not create your account: ${e instanceof Error ? e.message : String(e)}` },
-      { status: 502 },
-    )
-  }
-
-  return NextResponse.json({ ok: true, org: orgSlug })
-}

app/billing/v1/[...path]/route.ts

@@ -1,139 +0,0 @@
-/**
- * Per-tenant billing DATA proxy → commerce. The browser calls console2's OWN origin
- * (`/billing/v1/...`); this server handler forwards to commerce's `/v1/billing/...`,
- * injecting the commerce SERVICE token from server-only env (never `NEXT_PUBLIC_`,
- * never in the browser bundle) AND scoping every request to the caller's OWN org.
- *
- * Namespaced under `/billing/v1/` (NOT bare `/billing/`) so the data plane never
- * shadows the billing UI tab URLs (`/billing/reports`, `/billing/invoices`, …): a
- * route handler always wins over the catch-all page for a matching path segment, so
- * the tab slugs and the data endpoints must live in disjoint path space. The tab
- * URLs now fall through to the SPA (`app/(dashboard)/[...slug]`).
- *
- * Same trust boundary as the `/admin/iam` + `/admin/kms` proxies, but the authz is
- * PER-TENANT, not admin: any authenticated session may read/act on ITS OWN billing
- * (balance / usage / invoices / credit-grants / subscriptions / payment-methods).
- * The org is resolved server-side from the validated session (`resolveUser`) and
- * stamped as `X-Org-Id` (the header commerce's service-token path actually reads —
- * `commerce/middleware/accesstoken.go`), and the server-resolved billing subject is
- * pinned onto the FULL commerce subject-key set (`user`/`userId`/`customerId`, via
- * `scopedBillingSearch`) while `?org=` is dropped. The client CANNOT widen scope: a
- * forged `?userId=`/`?customerId=`/`?org=` is overwritten, and because EVERY subject
- * param is pinned, no billing endpoint is left unfiltered regardless of which one it
- * reads (subscriptions filter `userId`, payment-methods `customerId`). So commerce's
- * per-tenant isolation can never be crossed from the browser. No session → 401.
- *
- * Billing-subject mirrors `object.BillingSubject` (hanzoai/ai) + chat's
- * `billingSubject`: a member of a PERSONAL-billing org (default the shared `hanzo`
- * catch-all) bills per-user as `<org>/<name>`; a dedicated org (maxpower, …) bills
- * per-org as `<org>`. The SAME subject the gateway debits — so the console shows
- * the exact balance/usage that gets charged.
- *
- * `COMMERCE_TOKEN` unset → honest 501 (the UI shows a truthful "not configured"
- * state; it never fabricates a balance).
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { resolveUser } from '~/lib/server/identity'
-import { billingSubject, scopedBillingSearch, scopedBillingBody } from '~/lib/server/billing-scope'
-import { csrfRefusal } from '~/lib/server/bearer-proxy'
-import { fetchWithTimeout } from '~/lib/server/fetch-timeout'
-
-export const runtime = 'nodejs'
-
-const isSafeSegment = (s: string): boolean =>
-  s.length > 0 && s !== '.' && s !== '..' && !s.includes('/') && !s.includes('\\') && !s.includes('\0')
-
-function commerceBaseUrl(): string {
-  return (process.env.COMMERCE_URL ?? 'http://commerce.hanzo.svc:8001').replace(/\/+$/, '')
-}
-
-async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
-  // CSRF: a mutating billing write (spend-alert/budget) authenticates from the
-  // auto-sent cookie, so refuse a cross-origin one before any work (safe reads pass).
-  const csrf = csrfRefusal(req)
-  if (csrf) return csrf
-
-  // Per-tenant authz: any valid session may see ITS OWN billing (no admin gate).
-  const user = await resolveUser(req)
-  if (!user) {
-    return NextResponse.json({ error: 'Sign in to view billing.' }, { status: 401 })
-  }
-  if (!path.every(isSafeSegment)) {
-    return NextResponse.json({ error: 'Invalid billing path.' }, { status: 400 })
-  }
-
-  const token = process.env.COMMERCE_TOKEN ?? process.env.COMMERCE_SERVICE_TOKEN ?? ''
-  if (!token) {
-    return NextResponse.json(
-      { error: 'Billing is not configured (COMMERCE_TOKEN missing).' },
-      { status: 501 },
-    )
-  }
-
-  // Scope to the caller's OWN org — server-resolved, never client-supplied.
-  const org = user.owner.trim()
-  const subject = billingSubject(org, user.name)
-
-  // Pin the FULL billing-subject key set to the server-resolved subject, and
-  // strip `org`, so the browser can never read another tenant's ledger. Commerce
-  // filters each endpoint on a DIFFERENT param — subscriptions on `userId`,
-  // payment-methods on `customerId` (or `user`), usage on `user` — so pinning
-  // only ONE param leaves the others unfiltered (a cross-tenant read). This
-  // mirrors commerce's own edge-auth `billingSubjectKeys`
-  // (commerce/middleware/edgeauth.go: {"user","userId","customerId"}) exactly, so
-  // every billing endpoint is scoped no matter which param it reads.
-  const qs = scopedBillingSearch(req.nextUrl.search, subject)
-  const url = `${commerceBaseUrl()}/v1/billing/${path.join('/')}${qs ? `?${qs}` : ''}`
-
-  const init: RequestInit = {
-    method: req.method,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      // Commerce resolves the tenant namespace from `X-Org-Id` on the service-token
-      // path (commerce/middleware/accesstoken.go). It does NOT read `X-Hanzo-Org`,
-      // so sending that alone silently falls back to the service org — every tenant
-      // sharing one namespace. Send `X-Org-Id`, matching the `/ai` proxy.
-      'X-Org-Id': org,
-      'Content-Type': 'application/json',
-      Accept: 'application/json',
-    },
-    cache: 'no-store',
-  }
-  if (req.method !== 'GET' && req.method !== 'HEAD') {
-    // Scope the WRITE body to the caller's OWN subject too (not just the query):
-    // commerce reads the subject from the JSON body on writes like create-spend-alert
-    // (`userId`), so pin it server-side — the browser needn't know its subject and a
-    // forged body subject cannot widen scope. Mirrors `scopedBillingSearch`.
-    init.body = scopedBillingBody(await req.text(), subject)
-  }
-  try {
-    const res = await fetchWithTimeout(url, init)
-    const text = await res.text()
-    return new NextResponse(text, {
-      status: res.status,
-      headers: {
-        'Content-Type': res.headers.get('content-type') ?? 'application/json',
-        // A per-tenant money response (balance/usage/invoices) must NEVER be cached
-        // by the browser or any intermediary — otherwise the wallet shows a stale
-        // number after a completion or a top-up. The live-balance store still polls,
-        // but this guarantees each fetch hits commerce, not a cache.
-        'Cache-Control': 'no-store, must-revalidate',
-      },
-    })
-  } catch (e) {
-    return NextResponse.json(
-      { error: `Billing upstream unreachable: ${e instanceof Error ? e.message : String(e)}` },
-      { status: 502 },
-    )
-  }
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}

app/cloud/[...path]/route.ts

@@ -1,62 +0,0 @@
-/**
- * Same-origin user-bearer proxy to the unified cloud-api `/v1/*` — the ONE path the
- * browser uses to reach the cloud surfaces that authorize on a Bearer JWT.
- *
- * The managed data resources (vector/sql/kv/s3/docdb/datastore/search) and the
- * serverless / prompt / agent surfaces resolve the org from the token's `owner`
- * claim and 403 a cookie-only call ("X-Org-Id required"). So — exactly like the
- * `/ai` proxy — the browser calls this OWN-origin route with just its session
- * cookie; `forwardWithUserBearer` resolves the user, mints a short-lived user-bound
- * IAM token (shared per-user cache), and forwards to cloud-api with that Bearer. No
- * credential reaches the browser, org is server-authoritative (never the browser's
- * claim), and every read/write is billed + scoped to the user's own org.
- *
- * Least privilege: only the data + serverless HEADS are reachable (`allowCloudSurface`);
- * `v1/iam/*`, `v1/admin/*`, etc. 404 here — this is not a general cloud-api tunnel.
- */
-import { type NextRequest } from 'next/server'
-
-import { forwardWithUserBearer } from '~/lib/server/bearer-proxy'
-import { allowCloudSurface } from '~/lib/server/proxy-allow'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** The unified cloud backend (hanzoai/cloud). In-cluster ClusterIP — public egress is CF-403'd.
- *  `|| default` (not `??`) so an env accidentally reconciled to an EMPTY string still falls
- *  back to the in-cluster service (a blank CLOUD_API_URL would otherwise break every cloud page). */
-const CLOUD_API_URL = trim(process.env.CLOUD_API_URL?.trim() || 'http://cloud-api.hanzo.svc.cluster.local:8000')
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-function handle(req: NextRequest, ctx: Ctx) {
-  return (async () => {
-    const path = (await ctx.params).path.join('/')
-    return forwardWithUserBearer(req, {
-      target: CLOUD_API_URL,
-      path,
-      allow: allowCloudSurface,
-      // Org is authoritative (Bearer owner). Do NOT forward the browser-controlled
-      // X-Project-Id/X-Environment sub-scopes — the data/serverless resources are
-      // org-keyed, and forwarding an unvalidated project id is an attack surface
-      // (RED MEDIUM). A project-scoped feature must validate membership first.
-      unauthorizedMessage: 'Sign in to use Hanzo Cloud.',
-    })
-  })()
-}
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function PUT(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function PATCH(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function DELETE(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}

app/commerce/[...path]/route.ts

@@ -1,62 +0,0 @@
-/**
- * Same-origin user-bearer proxy to commerce (`commerce.hanzo.svc`) — the store /
- * merchant admin surface (products / orders / customers / collections / variants /
- * discounts / store settings). The browser calls this OWN-origin route
- * (`/commerce/v1/...`) with just its session cookie; `forwardWithUserBearer` resolves
- * the user, mints a short-lived user-bound IAM token, and forwards to commerce with
- * that Bearer. Commerce's EdgeAuth validates the JWT and resolves the org from its
- * `owner` claim (`middleware.TokenRequired` fast-paths IAM auth), so the store is
- * org-scoped SERVER-SIDE — a merchant only ever sees their OWN org's catalog/orders/
- * customers. No token reaches the browser, and the org is never browser-supplied.
- *
- * This is the TENANT store surface (any signed-in org member acts on their own org's
- * store), so it is user-scoped (`resolveUser`), NOT the `/paas` god-mode service-token
- * path. It is also DISTINCT from the `/billing` proxy: money (balance/usage/invoices/
- * Square) stays on `/billing` with its own per-tenant subject scoping — this proxy
- * carries only the store catalog/orders/customers. Least privilege on the path:
- * `allowCommerceSurface` admits only the merchant REST heads (product/order/user/…),
- * so `/v1/billing`, `/v1/checkout`, `/_/commerce/tenants` are NOT reachable here.
- */
-import { type NextRequest } from 'next/server'
-
-import { forwardWithUserBearer } from '~/lib/server/bearer-proxy'
-import { allowCommerceSurface } from '~/lib/server/proxy-allow'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** Commerce API (commerce.hanzo.ai). In-cluster ClusterIP on :8001; the CR already
- *  wires `COMMERCE_URL` (public egress is CF-gated). Override per-deploy with COMMERCE_URL. */
-const COMMERCE_URL = trim(process.env.COMMERCE_URL ?? 'http://commerce.hanzo.svc:8001')
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-function handle(req: NextRequest, ctx: Ctx) {
-  return (async () => {
-    const path = (await ctx.params).path.join('/')
-    return forwardWithUserBearer(req, {
-      target: COMMERCE_URL,
-      path,
-      allow: allowCommerceSurface,
-      // Org is authoritative (Bearer owner). Do NOT forward browser X-Project-Id/
-      // X-Environment — the store is org-keyed and commerce re-scopes on the token.
-      unauthorizedMessage: 'Sign in to manage your store.',
-    })
-  })()
-}
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function PUT(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function PATCH(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function DELETE(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}

app/docs/page.tsx

@@ -1,35 +0,0 @@
-'use client'
-
-/**
- * `/docs` → the brand documentation site (docs.hanzo.ai / docs.lux.network / …),
- * resolved CLIENT-side (task #41, "True 1-binary FE").
- *
- * Docs are an EXTERNAL product on their own domain, never an in-app route — so a
- * typed or bookmarked `<console-host>/docs` must land on the real docs, not the
- * catch-all not-found. The old app/docs/route.ts issued a server 308; in the
- * one-binary there is no Next runtime (the static export has no server, and a static
- * export cannot rewrite), so the redirect is resolved from the per-host brand
- * (`config.docsUrl`) in the browser — exactly what the sidebar "Docs" link and the
- * header "?" already open. One way, both topologies (embed + standalone).
- *
- * The target is set in an effect (not during render) so there is no SSR/CSR
- * hydration mismatch on the per-brand host between the build-time default and the
- * real browser host.
- */
-import { useEffect, useState } from 'react'
-
-import { config } from '~/config'
-
-export default function DocsRedirect() {
-  const [url, setUrl] = useState('')
-  useEffect(() => {
-    const target = config.docsUrl
-    setUrl(target)
-    window.location.replace(target)
-  }, [])
-  return (
-    <main style={{ padding: 24, fontFamily: 'system-ui, sans-serif' }}>
-      Opening documentation… {url ? <a href={url}>Continue</a> : null}
-    </main>
-  )
-}

app/economy/[...path]/route.ts

@@ -1,175 +0,0 @@
-/**
- * Per-user proxy to the Lux DEX indexer's `dex` subgraph — the Lux Economy /
- * Markets board's ONE transport. The browser calls console2's OWN origin
- * (`/economy/v1/overview`) with just the session cookie; this handler resolves the
- * caller, resolves the BRAND from the request host, and POSTs a FIXED, allowlisted
- * GraphQL query to the in-cluster graphd per brand-scoped network, returning the
- * NORMALIZED markets + fills + day-data. No graph host or GraphQL query ever reaches
- * the browser, and the browser can never compose one.
- *
- * Security (mirrors app/nodes/[...path]/route.ts):
- *  - Session-gated: an unauthenticated caller gets 401.
- *  - Org/brand-aware: the network set is scoped by `nodeNetworksForBrand(brand)`,
- *    brand resolved from the host — cloud.lux.cloud sees only Lux networks.
- *  - Least privilege: the ONLY path is `v1/overview`, and the ONLY GraphQL query is
- *    the fixed markets+fills+dayData read below — this is not a general GraphQL
- *    tunnel (no client-supplied query, no mutations, no arbitrary entity).
- *
- * Honest by construction: an unset/unreachable graph host yields a `not-reporting`
- * snapshot with the real error — never fabricated markets. The native DEX is a CLOB,
- * so the query asks only for the fields the `dex` subgraph really exposes.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { brandFromHost } from '~/config'
-import { resolveUser } from '~/lib/server/identity'
-import { nodeNetworksForBrand, type NodeNetworkId } from '~/lib/products/brand-scope'
-import { fetchWithTimeout } from '~/lib/server/fetch-timeout'
-import {
-  normalizeMarkets,
-  normalizeTrades,
-  normalizeDayData,
-  type EconomySnapshot,
-  type RawMarket,
-  type RawFill,
-  type RawMarketDayData,
-} from '~/lib/api/economy'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-
-/**
- * The `dex` subgraph GraphQL endpoint per network — the ONLY endpoint this proxy
- * will query. graphd serves the DEX subgraph at `<prefix>/graphql` (default prefix
- * `/v1/graph/cchain/dex`); each is overridable per-deploy. An unset/unreachable host
- * yields an honest `not-reporting` snapshot — never fake markets. (Cross-cluster
- * reach depends on network policy; when unreachable the board shows honest empty.)
- */
-const GRAPH_HOSTS: Partial<Record<NodeNetworkId, string>> = {
-  'lux-mainnet': trim(process.env.DEX_GRAPHQL_MAINNET ?? 'http://graph.lux-mainnet.svc:8080/v1/graph/cchain/dex/graphql'),
-  'lux-testnet': trim(process.env.DEX_GRAPHQL_TESTNET ?? 'http://graph.lux-testnet.svc:8080/v1/graph/cchain/dex/graphql'),
-  'lux-devnet': trim(process.env.DEX_GRAPHQL_DEVNET ?? 'http://graph.lux-devnet.svc:8080/v1/graph/cchain/dex/graphql'),
-}
-
-/** Per-query timeout (ms). */
-const TIMEOUT_MS = Number(process.env.ECONOMY_TIMEOUT_MS ?? 8000)
-
-/**
- * The ONE fixed GraphQL query — markets (book summary + accrued 24h aggregates),
- * recent fills (the trade feed), and day-data (the historical series, empty until a
- * MarketDayData producer emits). Only fields the `dex` subgraph really exposes.
- */
-const QUERY = `query LuxEconomy {
-  markets(first: 100) {
-    id
-    symbol
-    baseToken
-    quoteToken
-    assetsBound
-    openOrders
-    remaining
-    bestBid
-    bestAsk
-    volume24h
-    tradeCount
-    lastPrice
-    feeTier
-  }
-  fills(first: 40) {
-    id
-    symbol
-    price
-    size
-    side
-    timestamp
-  }
-  marketDayDatas(first: 90) {
-    id
-    date
-    symbol
-    volumeUSD
-    feesUSD
-    tvlUSD
-  }
-}`
-
-interface GraphResp {
-  data?: { markets?: RawMarket[]; fills?: RawFill[]; marketDayDatas?: RawMarketDayData[] }
-  errors?: { message?: string }[]
-}
-
-/** Query ONE network's `dex` subgraph → normalized snapshot. Honest not-reporting on failure. */
-async function probe(net: NodeNetworkId): Promise<EconomySnapshot> {
-  const base: EconomySnapshot = { network: net, status: 'not-reporting', markets: [], trades: [], dayData: [] }
-  const host = GRAPH_HOSTS[net]
-  if (!host) {
-    base.error = 'no DEX GraphQL host configured for this network'
-    return base
-  }
-  try {
-    const res = await fetchWithTimeout(
-      host,
-      {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', accept: 'application/json' },
-        body: JSON.stringify({ query: QUERY }),
-        cache: 'no-store',
-      },
-      { timeoutMs: TIMEOUT_MS },
-    )
-    if (!res.ok) {
-      base.error = `graphql ${res.status}`
-      return base
-    }
-    const json = (await res.json()) as GraphResp
-    if (json?.errors?.length) {
-      base.error = json.errors[0]?.message ?? 'graphql error'
-      return base
-    }
-    const d = json?.data ?? {}
-    return {
-      network: net,
-      status: 'reporting',
-      markets: normalizeMarkets(d.markets),
-      trades: normalizeTrades(d.fills),
-      dayData: normalizeDayData(d.marketDayDatas),
-    }
-  } catch (e) {
-    base.error = e instanceof Error ? e.message : String(e)
-    return base
-  }
-}
-
-async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
-  if (path.join('/') !== 'v1/overview') {
-    return NextResponse.json({ error: 'not found' }, { status: 404 })
-  }
-
-  const user = await resolveUser(req)
-  if (!user) {
-    return NextResponse.json({ error: 'Sign in to view the market economy.' }, { status: 401 })
-  }
-
-  const brand = brandFromHost(req.headers.get('host'))
-  let networks = nodeNetworksForBrand(brand)
-  const only = req.nextUrl.searchParams.get('network') as NodeNetworkId | null
-  if (only) networks = networks.filter((n) => n === only)
-
-  // Query the brand's networks and return the FIRST that reports markets (the live
-  // economy), else the first reporting network, else the first (honest not-reporting).
-  const snaps = await Promise.all(networks.map(probe))
-  const withMarkets = snaps.find((s) => s.status === 'reporting' && s.markets.length > 0)
-  const reporting = snaps.find((s) => s.status === 'reporting')
-  const chosen = withMarkets ?? reporting ?? snaps[0]
-  if (!chosen) {
-    return NextResponse.json({ network: null, status: 'not-reporting', markets: [], trades: [], dayData: [], error: 'no network in scope' })
-  }
-  return NextResponse.json(chosen)
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}

app/git/[...path]/route.ts

@@ -1,68 +0,0 @@
-/**
- * /git/* — the console's Git-import BFF (connected accounts + repositories).
- *
- * A `[...path]` catch-all route handler (the PROVEN top-level BFF shape used by
- * `/cloud`, `/ai`, `/paas`, `/cms`): a catch-all route handler wins over the
- * `(dashboard)/[...slug]` SPA page, whereas a STATIC route handler at the same depth
- * is shadowed by it. Served at TOP-LEVEL `/git/*` (NOT `/v1/*`) because
- * console.hanzo.ai's ingress routes `/v1/*` to hanzoai/gateway (bypassing Next), so
- * a `/v1/git/*` handler would 404 at the cloud binary.
- *
- * Two heads, one handler:
- *   - GET /git/accounts            → { connected, accounts }
- *   - GET /git/repos?account&q     → { repos }  (401 when not connected)
- *
- * The GitHub token is resolved from IAM server-side (the user's own session) and
- * used only here — it never reaches the browser. Per-user data ⇒ no-store.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { resolveGithubConnection, listAccounts, listRepos } from '~/lib/server/git'
-
-export const runtime = 'nodejs'
-
-const NO_STORE = { 'Cache-Control': 'no-store' } as const
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  const head = (await ctx.params).path?.[0] ?? ''
-  const conn = await resolveGithubConnection(req)
-
-  // /git/accounts — the signed-in user's connected Git accounts. Not connected ⇒
-  // honest `{ connected: false, accounts: [] }` (drives the "Connect GitHub" CTA).
-  if (head === 'accounts') {
-    if (!conn) return NextResponse.json({ connected: false, accounts: [] }, { headers: NO_STORE })
-    let accounts
-    try {
-      accounts = await listAccounts(conn)
-    } catch {
-      return NextResponse.json(
-        { connected: true, accounts: [], error: 'github unreachable' },
-        { status: 502, headers: NO_STORE },
-      )
-    }
-    // A 401 from GitHub (token revoked/expired) ⇒ treat as not connected.
-    if (accounts === null) return NextResponse.json({ connected: false, accounts: [] }, { headers: NO_STORE })
-    return NextResponse.json({ connected: true, accounts }, { headers: NO_STORE })
-  }
-
-  // /git/repos?account=<login>&q=<search> — repositories for one account, newest-push
-  // first, server-side filtered. No linked token ⇒ 401 (the client falls back to the
-  // "Connect GitHub" CTA) — never a service-token leak.
-  if (head === 'repos') {
-    if (!conn) return NextResponse.json({ repos: [], connected: false }, { status: 401, headers: NO_STORE })
-    const account = req.nextUrl.searchParams.get('account')?.trim() || ''
-    const q = req.nextUrl.searchParams.get('q')?.trim() || ''
-    let repos
-    try {
-      repos = await listRepos(conn, account, q)
-    } catch {
-      return NextResponse.json({ repos: [], error: 'github unreachable' }, { status: 502, headers: NO_STORE })
-    }
-    if (repos === null) return NextResponse.json({ repos: [], connected: false }, { status: 401, headers: NO_STORE })
-    return NextResponse.json({ repos, connected: true }, { headers: NO_STORE })
-  }
-
-  return NextResponse.json({ error: 'not found' }, { status: 404, headers: NO_STORE })
-}

app/globals.css

@@ -1,356 +0,0 @@
-/* Geist Mono — canonical Hanzo mono face (code/data). */
-@import url('https://cdn.jsdelivr.net/npm/geist@1.3.1/dist/fonts/geist-mono/style.css');
-
-/* Basel Grotesk — canonical Hanzo UI/body/display/heading face (self-hosted). */
-@font-face {
-  font-family: 'Basel';
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src:
-    url('/fonts/Basel-Grotesk-Book.woff2') format('woff2'),
-    url('/fonts/Basel-Grotesk-Book.woff') format('woff');
-}
-@font-face {
-  font-family: 'Basel';
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src:
-    url('/fonts/Basel-Grotesk-Medium.woff2') format('woff2'),
-    url('/fonts/Basel-Grotesk-Medium.woff') format('woff');
-}
-
-html,
-body,
-#__next {
-  height: 100%;
-}
-
-body {
-  margin: 0;
-  background-color: var(--background, #000000);
-  color: var(--color, #ededf1);
-  font-family:
-    'Basel', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
-  /* Calm type rendering — crisp, low-glare, comfortable rhythm for a full workday. */
-  -webkit-font-smoothing: antialiased;
-  -moz-osx-font-smoothing: grayscale;
-  text-rendering: optimizeLegibility;
-  line-height: 1.5;
-}
-
-code,
-pre,
-kbd,
-samp {
-  font-family: 'Geist Mono', ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-}
-
-/* Tabular numerals — metrics, prices, contexts and IDs align on a fixed advance
-   width so columns of numbers read cleanly (the dashboard-grade detail). */
-.hz-tnum {
-  font-variant-numeric: tabular-nums;
-  font-feature-settings: 'tnum' 1;
-}
-
-* {
-  box-sizing: border-box;
-}
-
-/* ── Console dark theme — TRUE-BLACK canvas + calm text/borders. The ONE place the
-   console's dark/light palette is set. Overrides the generated @hanzo/gui (Tamagui)
-   theme variables; the `html:root.t_*` selector is one step more specific than the
-   library's runtime `:root.t_*` block so it wins regardless of stylesheet insertion
-   order. DRY: every surface, border and text color in the app reads from these
-   tokens, so this one block sets the whole product.
-
-   Design intent (dark): a TRUE-BLACK #000 canvas (matches hanzo.ai marketing +
-   hanzo.chat OLED) with a Linear/Vercel-caliber surface-depth ladder above it —
-   resting panels #050505, the next surface #0a0a0a, interactive/elevated #171717 →
-   #1f1f1f — so cards read with real depth, never flat voids. Above the surface
-   ladder the CALM neutral scale (color5–12) gives premium, low-glare off-white text
-   and quiet hairline borders (never harsh pure #fff on pure #000). Neutral grey,
-   monochrome-first; text contrast stays WCAG-AA+ on every surface. */
-html:root.t_dark {
-  --background: #000000;
-  --backgroundStrong: #000000;
-  --backgroundHover: #171717;
-  --backgroundPress: #050505;
-  --backgroundFocus: #171717;
-
-  /* Surface depth ladder over the true-black canvas — panels/cards step up from
-     #050505 so they separate cleanly without heavy borders (Linear-grade depth). */
-  --color1: #050505;
-  --color2: #0a0a0a;
-  --color3: #171717;
-  --color4: #1f1f1f;
-  --color5: hsl(220 6% 16%);
-  --color6: hsl(220 6% 22%);
-  --color7: hsl(220 6% 30%);
-  --color8: hsl(219 6% 42%);
-  --color9: hsl(220 6% 55%);
-  --color10: hsl(219 7% 68%);
-  --color11: hsl(214 9% 83%);
-  --color12: hsl(210 12% 95%);
-  --color: hsl(210 12% 95%);
-
-  /* Gentle hairlines — present enough to define, quiet enough to disappear on black. */
-  --borderColor: hsl(220 8% 15%);
-  --borderColorHover: hsl(220 7% 23%);
-  --borderColorPress: hsl(220 8% 13%);
-  --borderColorFocus: hsl(220 7% 23%);
-}
-
-/* Light theme — the calm parallel: a warm off-white base (not stark #fff), soft
-   ink text (not pure black), and quiet hairlines. Lighter touch than dark, since
-   the console defaults to dark, but kept consistent for the theme toggle. */
-html:root.t_light {
-  --background: hsl(220 20% 99%);
-  --color1: hsl(220 24% 100%);
-  --color2: hsl(220 20% 98%);
-  --color3: hsl(220 18% 95.5%);
-  --color4: hsl(220 16% 92.5%);
-  --color5: hsl(220 15% 89%);
-  --color9: hsl(220 9% 46%);
-  --color10: hsl(220 10% 38%);
-  --color11: hsl(220 14% 22%);
-  --color12: hsl(220 22% 12%);
-  --color: hsl(220 22% 12%);
-  --borderColor: hsl(220 16% 90%);
-  --borderColorHover: hsl(220 14% 82%);
-}
-
-/* Motion — a single fade-up entrance (matches the hanzo.ai marketing feel:
-   ~0.4s ease-out, small upward travel, staggered by the consumer). One place
-   defines it; <FadeIn> applies the class + per-item delay. */
-@keyframes hz-fade-up {
-  from {
-    opacity: 0;
-    transform: translateY(10px);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-.hz-fade-up {
-  animation: hz-fade-up 0.4s cubic-bezier(0.16, 1, 0.3, 1) both;
-  will-change: transform, opacity;
-}
-
-/* Honor the user's reduced-motion preference — no entrance animation. */
-@media (prefers-reduced-motion: reduce) {
-  .hz-fade-up {
-    animation: none;
-  }
-}
-
-/* Shell chrome motion — the sidebar collapse (width) and the Linear-style
-   two-level nav slide (transform). One place defines the easing; the shell
-   applies the class. `className` forwards to the underlying DOM node on web, so
-   the browser transitions the Gui-driven inline width/transform. */
-.hz-collapse {
-  transition: width 220ms cubic-bezier(0.16, 1, 0.3, 1);
-  will-change: width;
-}
-
-.hz-slide {
-  transition: transform 260ms cubic-bezier(0.16, 1, 0.3, 1);
-  will-change: transform;
-}
-
-/* Backdrop cross-fade behind a SlideOver / dialog. */
-.hz-fade {
-  transition: opacity 240ms cubic-bezier(0.16, 1, 0.3, 1);
-  will-change: opacity;
-}
-
-/* Drag-to-reorder — a pinned row while it is being dragged (pointer DnD). The
-   lifted row gets a subtle lift; siblings ease into place via `.hz-slide`. */
-.hz-drag-item {
-  touch-action: none;
-  transition: transform 180ms cubic-bezier(0.16, 1, 0.3, 1);
-}
-.hz-drag-item[data-dragging='true'] {
-  transition: none;
-  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.28);
-  opacity: 0.96;
-  cursor: grabbing;
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .hz-collapse,
-  .hz-slide,
-  .hz-fade,
-  .hz-drag-item {
-    transition: none;
-  }
-}
-
-/* Sidebar category accordion — a collapsible level-1 section. The body animates
-   its HEIGHT via grid-template-rows 0fr↔1fr (no magic max-height — the row
-   resolves to the real content height) plus a short opacity fade; the header
-   chevron rotates ▸→▾. Collapsed content stays in the DOM (so both directions
-   animate) but is `inert` (out of tab order + a11y tree). One place defines the
-   easing; the shell toggles `data-open`. */
-.hz-acc {
-  display: grid;
-  grid-template-rows: 0fr;
-  transition: grid-template-rows 220ms cubic-bezier(0.16, 1, 0.3, 1);
-}
-.hz-acc[data-open='true'] {
-  grid-template-rows: 1fr;
-}
-.hz-acc-inner {
-  overflow: hidden;
-  min-height: 0;
-  opacity: 0;
-  transition: opacity 180ms ease;
-}
-.hz-acc[data-open='true'] .hz-acc-inner {
-  opacity: 1;
-}
-.hz-chevron {
-  transition: transform 200ms cubic-bezier(0.16, 1, 0.3, 1);
-  will-change: transform;
-}
-@media (prefers-reduced-motion: reduce) {
-  .hz-acc,
-  .hz-acc-inner,
-  .hz-chevron {
-    transition: none;
-  }
-}
-
-/* LivingOverview motion — the "videogame-like" living dashboard. The count-up +
-   live sparkline are driven in JS (rAF, gated by prefers-reduced-motion in the
-   hooks); these are the pure-CSS bits: a loading shimmer, a live-feed pulse, and
-   a brief highlight when a tile's number changes. One place defines the easing. */
-
-/* Skeleton shimmer — an honest "loading", never fabricated content. */
-@keyframes hz-shimmer {
-  0% {
-    background-position: -160px 0;
-  }
-  100% {
-    background-position: 160px 0;
-  }
-}
-
-.hz-skeleton {
-  background-color: var(--color3, rgba(148, 163, 184, 0.14));
-  background-image: linear-gradient(
-    90deg,
-    transparent 0%,
-    var(--color4, rgba(148, 163, 184, 0.22)) 50%,
-    transparent 100%
-  );
-  background-size: 160px 100%;
-  background-repeat: no-repeat;
-  animation: hz-shimmer 1.2s ease-in-out infinite;
-}
-
-/* Live-feed pulse — the "Live" dot on a streaming panel. */
-@keyframes hz-pulse {
-  0%,
-  100% {
-    opacity: 1;
-    transform: scale(1);
-  }
-  50% {
-    opacity: 0.45;
-    transform: scale(0.82);
-  }
-}
-
-/* Entrance for a freshly-arrived activity row (staggerless — one row at a time). */
-@keyframes hz-row-in {
-  from {
-    opacity: 0;
-    transform: translateY(-6px);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-.hz-row-in {
-  animation: hz-row-in 0.35s cubic-bezier(0.16, 1, 0.3, 1) both;
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .hz-skeleton {
-    animation: none;
-  }
-  .hz-row-in {
-    animation: none;
-  }
-}
-
-
-/* RailwayDeploy — the deployment pipeline. A smooth flowing gradient marches along the
-   active leg of the track (stroke-dashoffset), a soft halo pulses out from the current
-   station, and the status dot breathes. All reduced-motion-guarded (→ static). One place
-   defines the easing; RailwayDeploy applies the classes. */
-@keyframes hz-rail-flow {
-  to {
-    stroke-dashoffset: -28;
-  }
-}
-.hz-rail-flow {
-  stroke-dasharray: 5 9;
-  animation: hz-rail-flow 0.85s linear infinite;
-}
-
-@keyframes hz-rail-pulse {
-  0% {
-    transform: scale(1);
-    opacity: 0.34;
-  }
-  70% {
-    transform: scale(2.1);
-    opacity: 0;
-  }
-  100% {
-    transform: scale(2.1);
-    opacity: 0;
-  }
-}
-.hz-rail-pulse {
-  transform-box: fill-box;
-  transform-origin: center;
-  animation: hz-rail-pulse 1.7s ease-out infinite;
-}
-
-.hz-rail-dot {
-  animation: hz-pulse 1.5s ease-in-out infinite;
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .hz-rail-flow,
-  .hz-rail-pulse,
-  .hz-rail-dot {
-    animation: none;
-  }
-}
-
-/* Hover lift — a subtle rise + border/background brighten on interactive cards and
-   rows (the deploy-hub aesthetic: true-black ground, hairline borders, hover lift).
-   Reduced-motion keeps the color transition but drops the transform. */
-.hz-lift {
-  transition: transform 0.16s cubic-bezier(0.16, 1, 0.3, 1), border-color 0.16s ease, background-color 0.16s ease;
-}
-.hz-lift:hover {
-  transform: translateY(-1px);
-}
-@media (prefers-reduced-motion: reduce) {
-  .hz-lift {
-    transition: border-color 0.16s ease, background-color 0.16s ease;
-  }
-  .hz-lift:hover {
-    transform: none;
-  }
-}

app/icon.svg

@@ -1,8 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 67 67" role="img" aria-label="Hanzo">
-<style>path{fill:#000}@media (prefers-color-scheme:dark){path{fill:#fff}}</style>
-<path d="M22.21 67V44.6369H0V67H22.21Z"/>
-<path d="M66.7038 22.3184H22.2534L0.0878906 44.6367H44.4634L66.7038 22.3184Z"/>
-<path d="M22.21 0H0V22.3184H22.21V0Z"/>
-<path d="M66.7198 0H44.5098V22.3184H66.7198V0Z"/>
-<path d="M66.7198 67V44.6369H44.5098V67H66.7198Z"/>
-</svg>

app/layout.tsx

@@ -1,39 +0,0 @@
-import '@hanzogui/core/reset.css'
-import './globals.css'
-
-import type { Metadata, Viewport } from 'next'
-import type { ReactNode } from 'react'
-import { headers } from 'next/headers'
-
-import { Provider } from '~/components/Provider'
-import { ChunkGuard } from '~/components/ChunkGuard'
-import { resolveConfig } from '~/config'
-
-// The document <title> is SSR metadata, so it must reflect the REQUEST host's
-// brand (console.lux.cloud -> "Lux Cloud Console"), not the build-time default.
-// The visible shell resolves the brand client-side from window.location, but the
-// tab title is server-rendered — without reading the Host header here the browser
-// tab leaks "Hanzo Cloud Console" on Lux/Zoo hosts, a white-label violation.
-export async function generateMetadata(): Promise<Metadata> {
-  const host = (await headers()).get('host') ?? undefined
-  const { brandName } = resolveConfig(host)
-  return {
-    title: `${brandName} Console`,
-    description: 'Unified admin console for Hanzo Cloud and all cloud products.',
-  }
-}
-
-export const viewport: Viewport = {
-  themeColor: '#000000',
-}
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en" className="t_dark" style={{ backgroundColor: '#000000', colorScheme: 'dark' }} suppressHydrationWarning>
-      <body style={{ margin: 0 }}>
-        <ChunkGuard />
-        <Provider>{children}</Provider>
-      </body>
-    </html>
-  )
-}

app/nodes/[...path]/route.ts

@@ -1,167 +0,0 @@
-/**
- * Per-user proxy to the REAL luxd node RPC — the Nodes module's ONE transport.
- * The browser calls console2's OWN origin (`/nodes/v1/inventory`) with just the
- * session cookie; this handler resolves the caller, resolves the BRAND from the
- * request host, and fetches the allowlisted luxd RPC methods server-side for each
- * network that brand may see, returning NORMALIZED per-node rows. No RPC host or
- * method ever reaches the browser, and the browser can never choose either.
- *
- * Security (mirrors app/bootnode/[...path]/route.ts):
- *  - Session-gated: an unauthenticated caller gets 401 (the RPC data is public,
- *    but the console surface is authenticated, same as every other module).
- *  - Org/brand-aware: the network set is scoped by `nodeNetworksForBrand(brand)`,
- *    brand resolved from the host — so cloud.lux.cloud sees only Lux networks,
- *    console.hanzo.ai (hanzo) sees all.
- *  - Least privilege: the ONLY path is `v1/inventory`, and the ONLY luxd methods
- *    called are the four read methods below — this is not a general RPC tunnel.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { brandFromHost } from '~/config'
-import { resolveUser } from '~/lib/server/identity'
-import { nodeNetworksForBrand, type NodeNetworkId } from '~/lib/products/brand-scope'
-import {
-  NODE_NETWORK_META,
-  combineInventory,
-  normalizeChains,
-  parseHeight,
-  type NetworkInventory,
-  type RawBlockchain,
-  type RawPeer,
-  type RawValidator,
-} from '~/lib/api/nodes'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-
-/**
- * Public luxd RPC host per network — the ONLY endpoints this proxy will call.
- * These are PUBLIC RPC hosts (not secrets); each is overridable per-deploy so a
- * network can be repointed or disabled without a code change. A host that is
- * unset/unreachable yields an honest `not-reporting` network — never fake rows.
- */
-const HOSTS: Record<NodeNetworkId, string> = {
-  'lux-mainnet': trim(process.env.LUX_MAINNET_RPC ?? 'https://api.lux.network'),
-  'lux-testnet': trim(process.env.LUX_TESTNET_RPC ?? 'https://api.lux-test.network'),
-  'lux-devnet': trim(process.env.LUX_DEVNET_RPC ?? 'https://api.lux-dev.network'),
-  'pars-mainnet': trim(process.env.PARS_MAINNET_RPC ?? 'https://api.pars.network'),
-  // Zoo has no confirmed public primary-network host yet; the default is the
-  // conventional host (api.<brand>.network) and reports honestly when unreachable.
-  'zoo-mainnet': trim(process.env.ZOO_MAINNET_RPC ?? 'https://api.zoo.network'),
-}
-
-/** Per-network probe timeout (ms). */
-const TIMEOUT_MS = Number(process.env.NODES_RPC_TIMEOUT_MS ?? 8000)
-
-/** A single allowlisted luxd JSON-RPC call. `path` and `method` are fixed here. */
-async function rpc<T>(
-  host: string,
-  path: '/ext/bc/P' | '/ext/info',
-  method: string,
-  signal: AbortSignal,
-): Promise<T> {
-  const res = await fetch(`${host}${path}`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json', accept: 'application/json' },
-    body: JSON.stringify({ jsonrpc: '2.0', id: 1, method }),
-    cache: 'no-store',
-    signal,
-  })
-  if (!res.ok) throw new Error(`${method} ${res.status}`)
-  const json = (await res.json()) as { result?: T; error?: { message?: string } }
-  if (json?.error) throw new Error(json.error.message ?? `${method} error`)
-  return json.result as T
-}
-
-/** Probe ONE network: validators + peers + version + height, normalized. */
-async function probe(net: NodeNetworkId): Promise<NetworkInventory> {
-  const meta = NODE_NETWORK_META[net]
-  const host = HOSTS[net]
-  const base: NetworkInventory = {
-    id: net,
-    chain: meta.chain,
-    env: meta.env,
-    label: meta.label,
-    status: 'not-reporting',
-    validators: 0,
-    peers: 0,
-    nodes: [],
-    chains: [],
-  }
-
-  const ctrl = new AbortController()
-  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS)
-  try {
-    const [valR, peerR, verR, hgtR, chainR] = await Promise.allSettled([
-      rpc<{ validators?: RawValidator[] }>(host, '/ext/bc/P', 'platform.getCurrentValidators', ctrl.signal),
-      rpc<{ numPeers?: string; peers?: RawPeer[] }>(host, '/ext/info', 'info.peers', ctrl.signal),
-      rpc<{ version?: string }>(host, '/ext/info', 'info.getNodeVersion', ctrl.signal),
-      rpc<{ height?: string }>(host, '/ext/bc/P', 'platform.getHeight', ctrl.signal),
-      rpc<{ blockchains?: RawBlockchain[] }>(host, '/ext/bc/P', 'platform.getBlockchains', ctrl.signal),
-    ])
-
-    const reachable =
-      valR.status === 'fulfilled' || peerR.status === 'fulfilled' || chainR.status === 'fulfilled'
-    if (!reachable) {
-      const reason =
-        valR.status === 'rejected'
-          ? valR.reason
-          : peerR.status === 'rejected'
-            ? peerR.reason
-            : chainR.status === 'rejected'
-              ? chainR.reason
-              : null
-      base.error = reason instanceof Error ? reason.message : 'unreachable'
-      return base
-    }
-
-    const validators = valR.status === 'fulfilled' ? valR.value?.validators : undefined
-    const peers = peerR.status === 'fulfilled' ? peerR.value?.peers : undefined
-    const nodes = combineInventory(validators, peers, net)
-
-    base.status = 'reporting'
-    base.nodes = nodes
-    base.validators = nodes.filter((n) => n.role === 'validator').length
-    base.peers = nodes.filter((n) => n.role === 'peer').length
-    if (verR.status === 'fulfilled') base.version = verR.value?.version
-    if (hgtR.status === 'fulfilled') base.height = parseHeight(hgtR.value?.height)
-    // Chains are best-effort: a network can report validators/peers yet not answer
-    // getBlockchains — then the chains list is honestly empty (no fabricated chains).
-    if (chainR.status === 'fulfilled') base.chains = normalizeChains(chainR.value?.blockchains)
-    return base
-  } catch (e) {
-    base.error = e instanceof Error ? e.message : String(e)
-    return base
-  } finally {
-    clearTimeout(timer)
-  }
-}
-
-async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
-  // ONE endpoint — the inventory. No arbitrary RPC pass-through.
-  if (path.join('/') !== 'v1/inventory') {
-    return NextResponse.json({ error: 'not found' }, { status: 404 })
-  }
-
-  const user = await resolveUser(req)
-  if (!user) {
-    return NextResponse.json({ error: 'Sign in to view node infrastructure.' }, { status: 401 })
-  }
-
-  const brand = brandFromHost(req.headers.get('host'))
-  let networks = nodeNetworksForBrand(brand)
-
-  // Optional single-network scope, still gated by the brand's allowed set.
-  const only = req.nextUrl.searchParams.get('network') as NodeNetworkId | null
-  if (only) networks = networks.filter((n) => n === only)
-
-  const inventory = await Promise.all(networks.map(probe))
-  return NextResponse.json({ brand, networks: inventory })
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}

app/org/iam/[...path]/route.ts

@@ -1,78 +0,0 @@
-/**
- * Server-gated SELF-SERVICE org member proxy — a CUSTOMER managing their OWN org.
- *
- * The `/admin/iam` proxy is GLOBAL-admin only, so a tenant org owner (e.g.
- * Dave/maxpower) could never manage their own members through it. This proxy
- * closes that: it admits ANY authenticated user with an org (`getOrgGate`), then
- * the shared `forwardIam`:
- *   - scopes every reference (query `owner`, `id` owner, and the mutation BODY
- *     owner) to the caller's OWN org — a global admin may cross, a customer never;
- *   - guards get-organization by org NAME (no reading another org's settings);
- *   - requires an ORG ADMIN for writes (invite / change-role / remove), while any
- *     member may READ the roster.
- * IAM enforces its own checks on the user-bound bearer too — this is the matching,
- * fail-closed server gate, not the only one.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { getOrgGate } from '~/lib/server/identity'
-import { forwardIam } from '~/lib/server/iam-proxy'
-
-export const runtime = 'nodejs'
-
-/** Reads — any member of the org (own org only, unless global). */
-const GET_SEGMENTS = new Set([
-  'get-users',
-  'get-user',
-  'get-roles',
-  'get-organization',
-  // Projects live under the org (IAM-served); the console host's /v1 sends /v1/iam/*
-  // to the cloud binary → 404, so the Projects page routes here (Bearer → IAM).
-  'get-organization-projects',
-])
-
-/** Writes — org admin only, own org only (unless global). */
-const POST_SEGMENTS = new Set([
-  'add-user',
-  'update-user',
-  'delete-user',
-  // Org branding/settings — org-admin only, pinned to the caller's OWN org by both
-  // the `?id` name AND the body name (below), so a brand admin can't retarget another.
-  'update-organization',
-  // Project CRUD — org-admin only (requireAdminForWrite), pinned to the caller's org.
-  'add-project',
-  'delete-project',
-])
-
-/** Org objects are owned by the `admin` metadata org (name guarded separately). */
-const ORG_META = new Set(['get-organization', 'update-organization'])
-/** Segments carrying an org NAME to pin to the caller's scope (read id + write body). */
-const ORG_NAME = new Set(['get-organization', 'update-organization'])
-/** Segments keyed by `organization` (projects) — pin it to the caller's own org so an
- *  omitted/empty organization can't enumerate/pollute across tenants. */
-const ORG_PARAM = new Set(['get-organization-projects', 'add-project', 'delete-project'])
-
-const forbidden = () => NextResponse.json({ error: 'forbidden' }, { status: 403 })
-
-async function handle(req: NextRequest, path: string[], method: 'GET' | 'POST'): Promise<NextResponse> {
-  const gate = await getOrgGate(req)
-  if (!gate) return forbidden()
-  return forwardIam(req, gate, {
-    segment: path.join('/'),
-    method,
-    allowed: method === 'GET' ? GET_SEGMENTS : POST_SEGMENTS,
-    orgMetaSegments: ORG_META,
-    orgNameSegments: ORG_NAME,
-    orgParamSegments: ORG_PARAM,
-    requireAdminForWrite: true,
-  })
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path, 'GET')
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, (await ctx.params).path, 'POST')
-}

app/paas/[...path]/route.ts

@@ -1,115 +0,0 @@
-/**
- * Same-origin proxy to the platform.hanzo.ai control plane (Job 3 — embedded
- * PaaS). The browser calls console2's OWN origin (`/paas/...`); this server-side
- * handler forwards to `platform.hanzo.ai/v1/...`, injecting the service token
- * from server-only env (sourced via KMS — never `NEXT_PUBLIC_`, never in the
- * browser bundle). This is the real control-plane API, not an iframe stub.
- *
- * SECURITY: the forwarded token is a PLATFORM SERVICE token — full control-plane
- * authority, NOT tenant-scoped. So this route is gated to brand admins exactly
- * like the IAM/KMS admin proxies: `getAdminGate` resolves the caller from their
- * own session and requires a verified brand-admin (no gate → 403). Without this,
- * any authenticated browser could drive the whole control plane through the
- * service token. The gate is the control, NOT a deploy-time env toggle.
- *
- * When `PAAS_SERVICE_TOKEN` is unset the proxy returns an honest 501 so the UI
- * can show a truthful "not configured" state — it never fabricates apps/deploys.
- *
- * SCOPE: the browser stamps the active tenant path (X-Org-Id / X-Project-Id /
- * X-Environment) on every call. We forward it to the control plane so PaaS
- * resources scope by org → project → environment like the rest of the console —
- * but the ORG is re-resolved server-side through the admin policy (`orgFor`): a
- * global admin's switched org is honored, a brand admin is PINNED to their own,
- * so the forwarded X-Org-Id is authoritative and never the spoofable claim.
- * Project + environment are sub-scopes the admin picks WITHIN that org, passed
- * through verbatim.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { getAdminGate } from '~/lib/server/identity'
-import { orgFor as policyOrgFor } from '~/lib/server/admin-policy'
-import { csrfRefusal } from '~/lib/server/bearer-proxy'
-import { fetchWithTimeout } from '~/lib/server/fetch-timeout'
-
-export const runtime = 'nodejs'
-
-const PLATFORM_URL = (process.env.PLATFORM_URL ?? 'https://platform.hanzo.ai').replace(/\/+$/, '')
-const TOKEN = process.env.PAAS_SERVICE_TOKEN ?? ''
-
-async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
-  // CSRF FIRST — the service token below is control-plane god-mode, so a cross-site
-  // page carrying the admin's auto-sent cookie must never drive a deploy/scale/delete.
-  // Refuse a cross-origin MUTATION before the admin gate or any body read (safe reads
-  // pass). Defense in depth on top of the session cookie's own SameSite attribute.
-  const csrf = csrfRefusal(req)
-  if (csrf) return csrf
-
-  // Brand-admin gate — the service token below is control-plane god-mode.
-  const gate = await getAdminGate(req)
-  if (!gate) {
-    return NextResponse.json({ error: 'forbidden' }, { status: 403 })
-  }
-  if (!TOKEN) {
-    return NextResponse.json(
-      { error: 'PaaS control plane is not configured (PAAS_SERVICE_TOKEN missing).' },
-      { status: 501 },
-    )
-  }
-  // Resolve the authoritative tenant path. Org: the admin policy honors a global
-  // admin's switched org (the X-Org-Id the browser sends = currentOrg()) and pins
-  // a brand admin to their own — so we forward the resolved org, never the raw
-  // claim. Project + environment are sub-scopes within that org, forwarded as-is.
-  const org = policyOrgFor(
-    { isGlobalAdmin: gate.user.isGlobalAdmin, orgScope: gate.orgScope },
-    req.headers.get('X-Org-Id'),
-  )
-  const projectId = req.headers.get('X-Project-Id')
-  const environment = req.headers.get('X-Environment')
-
-  const search = req.nextUrl.search
-  const url = `${PLATFORM_URL}/v1/${path.join('/')}${search}`
-  const init: RequestInit = {
-    method: req.method,
-    headers: {
-      Authorization: `Bearer ${TOKEN}`,
-      'Content-Type': 'application/json',
-      Accept: 'application/json',
-      'X-Org-Id': org,
-      ...(projectId ? { 'X-Project-Id': projectId } : {}),
-      ...(environment ? { 'X-Environment': environment } : {}),
-    },
-    // Never cache control-plane reads.
-    cache: 'no-store',
-  }
-  if (req.method !== 'GET' && req.method !== 'HEAD') {
-    init.body = await req.text()
-  }
-  try {
-    const res = await fetchWithTimeout(url, init)
-    const text = await res.text()
-    return new NextResponse(text, {
-      status: res.status,
-      headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' },
-    })
-  } catch (e) {
-    return NextResponse.json(
-      { error: `PaaS upstream unreachable: ${e instanceof Error ? e.message : String(e)}` },
-      { status: 502 },
-    )
-  }
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}
-export async function PATCH(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}
-export async function DELETE(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}

app/railway-demo/page.tsx

@@ -1,69 +0,0 @@
-'use client'
-
-/**
- * Design-reference route — renders the ProductLanding kit + the RailwayDeploy pipeline
- * in its lifecycle states OFFLINE (static status props, no backend, no auth), so the
- * landing/pipeline design can be reviewed and screenshotted from `next dev` without a
- * live session. Data-free by construction; not linked from the product nav.
- */
-import { Boxes, DollarSign, FileText, Gauge, Layers, Plus, Search, Sparkles } from '@hanzogui/lucide-icons-2'
-import { Card, Text, XStack, YStack } from '@hanzo/gui'
-
-import { ProductLanding, apiBaseFromDocs, type LandingMetric, type ProductLandingConfig } from '~/components/products/landing'
-import { RailwayDeploy } from '~/components/products/paas/RailwayDeploy'
-import { embeddingsCodeSamples } from '~/components/products/embeddings/logic'
-
-const metrics: LandingMetric[] = [
-  { key: 'collections', label: 'Collections', value: 12, format: (n) => Math.round(n).toLocaleString(), icon: <Boxes size={14} opacity={0.6} /> },
-  { key: 'documents', label: 'Documents indexed', value: 3420, format: (n) => Math.round(n).toLocaleString(), icon: <FileText size={14} opacity={0.6} /> },
-  { key: 'vectors', label: 'Total vectors', value: 184213, format: (n) => Math.round(n).toLocaleString(), series: [120, 138, 150, 171, 184], deltaPct: 12, icon: <Layers size={14} opacity={0.6} /> },
-  { key: 'queries', label: 'Queries (7D)', value: 8241, format: (n) => Math.round(n).toLocaleString(), series: [900, 1100, 1050, 1300, 1450], deltaPct: 8, icon: <Search size={14} opacity={0.6} /> },
-  { key: 'latency', label: 'Avg latency', value: 42, format: (n) => `${Math.round(n)} ms`, series: [55, 50, 47, 44, 42], deltaPct: -6, icon: <Gauge size={14} opacity={0.6} /> },
-  { key: 'cost', label: 'Cost (7D)', value: null, format: (n) => `$${(n / 100).toFixed(2)}`, icon: <DollarSign size={14} opacity={0.6} />, hint: 'Awaiting metering' },
-]
-
-const landingConfig: ProductLandingConfig = {
-  productId: 'embeddings',
-  title: 'Vector embeddings & semantic search',
-  tagline: 'Generate, store, and search embeddings at scale — one API for semantic search and RAG, powered by Zen embedding models.',
-  icon: Boxes,
-  docsProduct: 'embeddings',
-  primary: { label: 'Create collection', icon: <Plus size={16} />, onPress: () => {} },
-  secondary: { label: 'Try search', icon: <Search size={15} />, onPress: () => {} },
-  metrics,
-  samples: embeddingsCodeSamples(apiBaseFromDocs('https://docs.hanzo.ai'), 'zen-embedding'),
-  run: { label: 'Generate in console', icon: <Sparkles size={14} />, onPress: () => {} },
-  actions: [
-    { label: 'Create collection', icon: <Plus size={15} />, onPress: () => {} },
-    { label: 'Explore search', icon: <Search size={15} />, onPress: () => {} },
-    { label: 'Generate embeddings', icon: <Sparkles size={15} />, onPress: () => {} },
-  ],
-}
-
-function RailCard({ title, status }: { title: string; status: string }) {
-  return (
-    <Card p="$4" gap="$3" borderWidth={1} borderColor="$borderColor" bg="$color2" flex={1} minW={320}>
-      <Text fontSize="$3" fontWeight="700" color="$color12">
-        {title}
-      </Text>
-      <RailwayDeploy status={status} />
-    </Card>
-  )
-}
-
-export default function RailwayDemoPage() {
-  return (
-    <YStack gap="$6" p="$5" maxW={1180} self="center" width="100%">
-      <Text fontSize="$9" fontWeight="900">RailwayDeploy pipeline</Text>
-      <XStack gap="$4" flexWrap="wrap">
-        <RailCard title="Building (in progress)" status="building" />
-        <RailCard title="Deploying (in progress)" status="deploying" />
-        <RailCard title="Live" status="live" />
-        <RailCard title="Failed" status="error" />
-      </XStack>
-
-      <Text fontSize="$9" fontWeight="900">Embeddings landing (ProductLanding kit)</Text>
-      <ProductLanding config={landingConfig} />
-    </YStack>
-  )
-}

app/signin/page.tsx

@@ -1,18 +0,0 @@
-'use client'
-
-import { useEffect } from 'react'
-import { useRouter } from 'next/navigation'
-
-import { SignInForm } from '~/components/SignInForm'
-import { useSession } from '~/lib/auth/session'
-
-export default function SignInPage() {
-  const { account, loading } = useSession()
-  const router = useRouter()
-
-  useEffect(() => {
-    if (!loading && account) router.replace('/')
-  }, [loading, account, router])
-
-  return <SignInForm />
-}

app/superbase/[...path]/route.ts

@@ -1,61 +0,0 @@
-/**
- * Per-user proxy to the Hanzo Base control plane (base.hanzo.ai) — the embedded
- * Base module's ONE transport. The browser calls console2's OWN origin
- * (`/superbase/v1/...`) with just the session cookie; `forwardWithUserBearer`
- * resolves the user, mints a short-lived user-bound IAM token (shared per-user
- * cache), and forwards to base.hanzo.ai with that token. No token ever reaches the
- * browser, and the SAME @hanzo/superbase-dashboard screens render here and standalone.
- *
- * NOT the PaaS pattern: PaaS forwards a god-mode SERVICE token and is gated to brand
- * admins. Base authorizes PER USER itself — the `tenants` collection's
- * `ListRule = "owner_iam_user = @request.auth.id"` and admin-only mutations are
- * enforced by Base against the forwarded user identity. So here we forward the
- * USER's own minted bearer (least privilege, tenant-scoped by Base), and the only
- * gate is "must be signed in" (resolveUser → 401). A non-admin simply sees their own
- * tenants and gets Base's 403 on a mutation — honest, not faked.
- *
- * Least privilege on the path too: only the Base DATA PLANE is proxied — the
- * collection schemas (read) and any collection's records (list/get/create/update/
- * delete), via `allowBaseSurface`. Base's admin/settings/backup/log surfaces 404,
- * so this stays a data-plane proxy, not a general Base tunnel. Base still authorizes
- * every read/write per-user and per-collection itself, so a non-admin sees only what
- * a collection's rules permit and gets Base's own honest 403 on a denied mutation.
- * (The tenants manager rides this same proxy — records/tenants is one such path.)
- */
-import { type NextRequest } from 'next/server'
-
-import { forwardWithUserBearer } from '~/lib/server/bearer-proxy'
-import { allowBaseSurface } from '~/lib/server/proxy-allow'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** The Base control plane the proxied calls are forwarded to. */
-const BASE_URL = trim(process.env.BASE_DASHBOARD_URL ?? 'https://base.hanzo.ai')
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-function handle(req: NextRequest, ctx: Ctx) {
-  return (async () => {
-    const path = (await ctx.params).path.join('/')
-    return forwardWithUserBearer(req, {
-      target: BASE_URL,
-      path,
-      allow: allowBaseSurface,
-      unauthorizedMessage: 'Sign in to manage Base records.',
-    })
-  })()
-}
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function PATCH(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function DELETE(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}

app/tasksd/[...path]/route.ts

@@ -1,38 +0,0 @@
-/**
- * Same-origin proxy to the durable task engine (hanzoai/tasks `tasksd`, the native
- * Temporal-style HTTP surface at `/v1/tasks/*`).
- *
- * `tasksd` runs `TASKSD_REQUIRE_IDENTITY=true`: it validates an IAM **Bearer JWT**
- * against the IAM JWKS, unconditionally STRIPS inbound `X-Org-Id`, and mints org +
- * user from the JWT claims (`owner`→org). So — like the `/ai` proxy — the console
- * calls its OWN origin (`/tasksd/...`) with just the session cookie;
- * `forwardWithUserBearer` resolves the signed-in user, mints a short-lived
- * user-bound IAM token (shared per-user cache), and forwards it as the Bearer. No
- * key in the browser, and every read is org-scoped by the JWT server-side.
- *
- * READ-ONLY: only GET is proxied (the console never mutates workflows here), scoped
- * to the `v1/tasks/*` subtree. When the engine is unreachable the UI shows an honest
- * BackendStateCard — never fabricated workflows.
- */
-import { type NextRequest } from 'next/server'
-
-import { forwardWithUserBearer } from '~/lib/server/bearer-proxy'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** The durable task engine. Public TLS is not live yet → default to the in-cluster
- *  service. The tasks Service exposes REST on :7243 (http port); there is NO :80,
- *  so target :7243 explicitly. Override with TASKS_URL. `|| default` (not `??`) so a
- *  blank env still falls back to the in-cluster service. */
-const TASKS_URL = trim(process.env.TASKS_URL?.trim() || 'http://tasks.hanzo.svc.cluster.local:7243')
-
-export async function GET(req: NextRequest, ctx: { params: Promise<{ path: string[] }> }) {
-  const rel = (await ctx.params).path.join('/')
-  return forwardWithUserBearer(req, {
-    target: TASKS_URL,
-    path: `v1/tasks/${rel}`,
-    allow: (p) => p === 'v1/tasks' || p.startsWith('v1/tasks/'),
-    unauthorizedMessage: 'Sign in to view tasks.',
-  })
-}

app/telemetry/[...path]/route.ts

@@ -1,106 +0,0 @@
-/**
- * Same-origin READ-ONLY proxy to VictoriaMetrics — the live platform telemetry
- * store (Prometheus-compatible TSDB, `vmsingle-victoria-metrics-single-server`).
- *
- * The browser calls this OWN-origin route (`/telemetry/api/v1/query?query=up`) with
- * just its first-party session cookie; this handler resolves the caller
- * (`resolveUser`) and — only for a signed-in user — forwards the READ query to
- * VictoriaMetrics. It powers Status (real `up{}` service health) and Metrics (real
- * infra time-series), replacing the empty `/paas/apps` board and the unwired
- * Metrics overview. VictoriaMetrics has no per-request auth of its own (it is an
- * internal ClusterIP service), so this route IS the access boundary — hence three
- * hard limits, all fail-closed:
- *
- *   1. Authenticated only — `resolveUser` (401 otherwise). Platform status/metrics
- *      is not tenant-customer data; it is the health of the Hanzo Cloud platform the
- *      user is signed into (a status-page concern), appropriate for any signed-in
- *      console user and strictly READ-ONLY — no service token, far weaker than the
- *      admin `/paas` control plane.
- *   2. READ-only — GET only, and only the allow-listed VictoriaMetrics query
- *      endpoints (`allowTelemetrySurface`): `/api/v1/query`, `/query_range`,
- *      `/series`, `/labels`, `/label/<name>/values`, `/status/tsdb`, `/metadata`.
- *      Never `/api/v1/write`, `/import`, `/-/reload`, or any admin/mutating path.
- *   3. Traversal-hardened — `pathIsClean` rejects `.`/`..`/`%XX`/`;` segments and the
- *      forward re-validates the WHATWG-normalized path, exactly like the bearer
- *      proxies.
- *
- * Honest 501 when `VM_URL` is unset, so the UI shows a truthful "telemetry not
- * configured" state — never fabricated metrics.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { resolveUser } from '~/lib/server/identity'
-import { pathIsClean } from '~/lib/server/bearer-proxy'
-import { allowTelemetrySurface } from '~/lib/server/proxy-allow'
-import { fetchWithTimeout } from '~/lib/server/fetch-timeout'
-
-export const runtime = 'nodejs'
-
-const trimR = (s: string) => s.replace(/\/+$/, '')
-const trimL = (s: string) => s.replace(/^\/+/, '')
-const msgOf = (e: unknown) => (e instanceof Error ? e.message : String(e))
-
-/** VictoriaMetrics single-node read API. In-cluster ClusterIP :8428 (headless).
- *  Override with VM_URL. `|| default` (not `??`) so a blank/whitespace env still
- *  resolves the in-cluster service (the same env-drift guard the /vm proxy uses). */
-const VM_URL = trimR(
-  process.env.VM_URL?.trim() || 'http://vmsingle-victoria-metrics-single-server.hanzo.svc:8428',
-)
-
-const json = (body: unknown, status: number) => NextResponse.json(body, { status })
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx): Promise<NextResponse> {
-  const rawPath = trimL((await ctx.params).path.join('/')).replace(/\/+$/, '')
-
-  // Traversal + least-privilege on the RAW path (literal `.`/`..`/`%XX`/`;` rejected).
-  if (!pathIsClean(rawPath) || !allowTelemetrySurface(rawPath)) {
-    return json({ status: 'error', errorType: 'not_allowed', error: 'Not a telemetry read endpoint.' }, 404)
-  }
-
-  if (!process.env.VM_URL?.trim() && !VM_URL) {
-    return json(
-      { status: 'error', errorType: 'not_configured', error: 'Telemetry store is not configured (VM_URL missing).' },
-      501,
-    )
-  }
-
-  // Authenticated only — the query surface is the access boundary (VM has no auth).
-  const user = await resolveUser(req)
-  if (!user) {
-    return json({ status: 'error', errorType: 'unauthenticated', error: 'Sign in to view platform telemetry.' }, 401)
-  }
-
-  // Re-validate the WHATWG-normalized destination (undici resolves %2e/double-encoded
-  // dot-segments a raw check can't see) — validate AND fetch the exact same URL.
-  let dest: URL
-  try {
-    dest = new URL(`${VM_URL}/${rawPath}${req.nextUrl.search}`)
-  } catch {
-    return json({ status: 'error', errorType: 'not_allowed', error: 'Bad telemetry path.' }, 404)
-  }
-  const normPath = trimL(dest.pathname).replace(/\/+$/, '')
-  if (!pathIsClean(normPath) || !allowTelemetrySurface(normPath)) {
-    return json({ status: 'error', errorType: 'not_allowed', error: 'Not a telemetry read endpoint.' }, 404)
-  }
-
-  try {
-    const res = await fetchWithTimeout(dest, {
-      method: 'GET',
-      headers: { Accept: 'application/json' },
-      cache: 'no-store',
-      signal: req.signal,
-    })
-    return new NextResponse(res.body, {
-      status: res.status,
-      headers: {
-        'Content-Type': res.headers.get('content-type') ?? 'application/json',
-        'Cache-Control': 'no-cache, no-transform',
-      },
-    })
-  } catch (e) {
-    console.error('telemetry-proxy: VictoriaMetrics unreachable:', msgOf(e))
-    return json({ status: 'error', errorType: 'upstream_error', error: 'Telemetry store is unavailable.' }, 502)
-  }
-}

app/trading/[...path]/route.ts

@@ -1,185 +0,0 @@
-/**
- * Per-user proxy to the LIVE trading-bot state — the Trading module's ONE
- * live-data transport (the DEPLOYED FLEET is read separately via the `/cloud`
- * PaaS proxy). The browser calls console2's OWN origin (`/trading/v1/*`) with just
- * the session cookie; this handler resolves the caller, resolves the BRAND from the
- * request host, and reads the allowlisted upstreams server-side, per network that
- * brand may see. No cluster host or RPC method ever reaches the browser, and the
- * browser can never choose either.
- *
- * Security (mirrors app/nodes/[...path]/route.ts):
- *  - Session-gated: an unauthenticated caller gets 401.
- *  - Org/brand-aware: the network set is scoped by `nodeNetworksForBrand(brand)`,
- *    brand resolved from the host — cloud.lux.cloud sees only Lux networks.
- *  - Least privilege: the ONLY paths are `v1/metrics` and `v1/orderbook`; the ONLY
- *    upstreams are the maker's :2112 /metrics scrape and the DEX read endpoint —
- *    this is not a general RPC/HTTP tunnel.
- *
- * Two upstreams, one concern each:
- *  1. METRICS — GETs the in-cluster maker's Prometheus `:2112/metrics` for a
- *     network and parses it to `MakerStatus`. The maker Service host per network is
- *     env-configurable; unset/unreachable → an honest `not-reporting` status.
- *  2. ORDERBOOK — reads the DEX CLOB `dex_get_orders?market=<poolHex>` for a market
- *     on a network. The DEX read host is env-configurable; the private D-Chain is
- *     not publicly exposed, so an unreachable venue → an honest `not-reporting` book
- *     (never fabricated bids/asks).
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { brandFromHost } from '~/config'
-import { resolveUser } from '~/lib/server/identity'
-import { nodeNetworksForBrand, type NodeNetworkId } from '~/lib/products/brand-scope'
-import { fetchWithTimeout } from '~/lib/server/fetch-timeout'
-import {
-  parseMakerMetrics,
-  normalizeBook,
-  type MakerStatus,
-  type OrderBook,
-  type RawBookOrder,
-} from '~/lib/api/trading'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-
-/**
- * The maker's Prometheus metrics host per network — the ONLY metrics endpoint this
- * proxy will scrape. These point at the in-cluster maker Service (`maker-coherence`,
- * port 2112) per luxd network namespace. Each is overridable per-deploy; an
- * unset/unreachable host yields an honest `not-reporting` status — never fake rows.
- * (Cross-cluster reach depends on network policy; when unreachable the console shows
- * the honest not-reporting state, exactly like the Nodes surface.)
- */
-const MAKER_METRICS_HOSTS: Partial<Record<NodeNetworkId, string>> = {
-  'lux-mainnet': trim(process.env.MAKER_METRICS_MAINNET ?? 'http://maker-coherence.lux-mainnet.svc:2112'),
-  'lux-testnet': trim(process.env.MAKER_METRICS_TESTNET ?? 'http://maker-coherence.lux-testnet.svc:2112'),
-  'lux-devnet': trim(process.env.MAKER_METRICS_DEVNET ?? 'http://maker-coherence.lux-devnet.svc:2112'),
-}
-
-/**
- * The DEX read host per network — the ONLY DEX endpoint this proxy will query for
- * the order book (`<host>/dex/dex_get_orders?market=<poolHex>`). The native D-Chain
- * CLOB is not publicly exposed, so these default to the in-cluster luxd router;
- * unreachable → an honest `not-reporting` book.
- */
-const DEX_READ_HOSTS: Partial<Record<NodeNetworkId, string>> = {
-  'lux-mainnet': trim(process.env.DEX_READ_MAINNET ?? 'http://luxd-0.luxd-headless.lux-mainnet.svc:9630/v1/bc/D'),
-  'lux-testnet': trim(process.env.DEX_READ_TESTNET ?? 'http://luxd-0.luxd-headless.lux-testnet.svc:9640/v1/bc/D'),
-  'lux-devnet': trim(process.env.DEX_READ_DEVNET ?? 'http://luxd-0.luxd-headless.lux-devnet.svc:9650/v1/bc/D'),
-}
-
-/** Per-upstream probe timeout (ms). */
-const TIMEOUT_MS = Number(process.env.TRADING_TIMEOUT_MS ?? 8000)
-
-/** Scrape ONE network's maker metrics → MakerStatus. Honest not-reporting on failure. */
-async function makerStatus(net: NodeNetworkId): Promise<MakerStatus> {
-  const host = MAKER_METRICS_HOSTS[net]
-  const base: MakerStatus = { status: 'not-reporting', symbols: [] }
-  if (!host) {
-    base.error = 'no metrics host configured for this network'
-    return base
-  }
-  try {
-    const res = await fetchWithTimeout(
-      `${host}/metrics`,
-      { headers: { accept: 'text/plain' }, cache: 'no-store' },
-      { timeoutMs: TIMEOUT_MS },
-    )
-    if (!res.ok) {
-      base.error = `metrics ${res.status}`
-      return base
-    }
-    const text = await res.text()
-    const parsed = parseMakerMetrics(text)
-    return { status: 'reporting', ...parsed }
-  } catch (e) {
-    base.error = e instanceof Error ? e.message : String(e)
-    return base
-  }
-}
-
-/** A single allowlisted DEX read call. `method` is fixed here (dex_get_orders). */
-async function dexGetOrders(host: string, poolHex: string): Promise<RawBookOrder[]> {
-  const url = `${host}/dex/dex_get_orders?market=${encodeURIComponent(poolHex)}`
-  const res = await fetchWithTimeout(url, { headers: { accept: 'application/json' }, cache: 'no-store' }, { timeoutMs: TIMEOUT_MS })
-  if (!res.ok) throw new Error(`dex_get_orders ${res.status}`)
-  const json = (await res.json()) as { orders?: RawBookOrder[] }
-  return Array.isArray(json?.orders) ? json.orders : []
-}
-
-/**
- * Read ONE market's order book. A `poolId` (32-byte hex) addresses the book
- * directly; a `symbol`/`base`/`quote` are echoed for display but the book is only
- * readable by poolId (the console does not compute keccak client- or server-side to
- * avoid an eth-crypto dep — the caller supplies the poolId, or the book is honestly
- * not-reporting). Honest not-reporting when the DEX is unreachable.
- */
-async function orderbook(net: NodeNetworkId, params: URLSearchParams): Promise<OrderBook> {
-  const symbol = params.get('symbol') ?? undefined
-  const poolId = params.get('poolId') ?? undefined
-  const base: OrderBook = { network: net, symbol, poolId, status: 'not-reporting', orders: [] }
-
-  const host = DEX_READ_HOSTS[net]
-  if (!host) {
-    base.error = 'no DEX read host configured for this network'
-    return base
-  }
-  if (!poolId) {
-    // No poolId → the book can't be addressed. Honest, never fabricated.
-    base.error = 'order book is read by poolId; none supplied for this market'
-    return base
-  }
-  try {
-    const raw = await dexGetOrders(host, poolId)
-    return { ...base, status: 'reporting', orders: normalizeBook(raw), error: undefined }
-  } catch (e) {
-    base.error = e instanceof Error ? e.message : String(e)
-    return base
-  }
-}
-
-/** Resolve the brand's networks, optionally narrowed to `?network=` (still gated). */
-function scopedNetworks(req: NextRequest): NodeNetworkId[] {
-  const brand = brandFromHost(req.headers.get('host'))
-  let networks = nodeNetworksForBrand(brand)
-  const only = req.nextUrl.searchParams.get('network') as NodeNetworkId | null
-  if (only) networks = networks.filter((n) => n === only)
-  return networks
-}
-
-async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
-  const route = path.join('/')
-
-  const user = await resolveUser(req)
-  if (!user) {
-    return NextResponse.json({ error: 'Sign in to view trading bots.' }, { status: 401 })
-  }
-
-  if (route === 'v1/metrics') {
-    const networks = scopedNetworks(req)
-    // A single-network scope is the common case (per-bot status); return the first
-    // (the network the caller asked for), or the brand's first if none specified.
-    const net = networks[0]
-    if (!net) return NextResponse.json({ status: 'not-reporting', symbols: [], error: 'no network in scope' })
-    const status = await makerStatus(net)
-    return NextResponse.json(status)
-  }
-
-  if (route === 'v1/orderbook') {
-    const networks = scopedNetworks(req)
-    const net = networks[0]
-    if (!net) {
-      return NextResponse.json({ network: null, status: 'not-reporting', orders: [], error: 'no network in scope' })
-    }
-    const book = await orderbook(net, req.nextUrl.searchParams)
-    return NextResponse.json(book)
-  }
-
-  return NextResponse.json({ error: 'not found' }, { status: 404 })
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}

app/training/[...path]/route.ts

@@ -1,118 +0,0 @@
-/**
- * Same-origin proxy to the cloud ML/training surface on hanzoai/ai (`/v1/train/*`,
- * `/v1/ml/models`, and the fine-tuning broker `/v1/finetune/*`).
- *
- * The console's Training page calls its OWN origin (`/training/...`) with just the
- * first-party session cookie; this server handler resolves the signed-in user from
- * that cookie and forwards to the cloud backend's `/v1/...` surface, passing the
- * cookie through (the proven `get-account` server-to-server pattern in
- * lib/server/identity.ts) plus the active `X-Org-Id`. Training is a TENANT action —
- * any signed-in org user may run it — so this is user-scoped (resolveUser), NOT the
- * control-plane admin gate the `/paas` proxy uses. The cloud backend scopes by org
- * (GetEffectiveOrg / the X-Org-Id the plain-REST train sub-service requires), so a
- * caller can only ever touch their own org's jobs. `POST /v1/train/jobs` is
- * billing-gated by the live ResourceMeter and returns 402 on an unfunded org — that
- * status flows straight back so the UI can surface it honestly.
- *
- * Least privilege: only the explicit ML/training sub-paths are forwarded; anything
- * else 404s, so this is not a general backend tunnel. No secret ever reaches the
- * browser — the HuggingFace token (for private repos) is resolved from KMS
- * server-side inside the broker, never here.
- */
-import { type NextRequest, NextResponse } from 'next/server'
-
-import { resolveUser } from '~/lib/server/identity'
-import { orgFor } from '~/lib/server/admin-policy'
-import { csrfRefusal } from '~/lib/server/bearer-proxy'
-import { fetchWithTimeout } from '~/lib/server/fetch-timeout'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** Cloud `/v1` backend (hanzoai/ai) — same target lib/server/identity.ts resolves. */
-const CLOUD_API_URL = trim(process.env.CLOUD_API_URL ?? 'http://cloud.hanzo.svc.cluster.local:8000')
-
-/** The exact `/v1/<...>` ML/training sub-paths the console is allowed to reach. */
-const ALLOWED = new Set([
-  // mlsvc — the canonical training surface (task #40 ResourceMeter gates POST jobs).
-  'train/jobs',
-  'train/experiments',
-  'ml/models',
-  // Real Kubeflow control-plane probe (which operators/CRDs are actually served).
-  // Read-only; 503 + body flows through so the UI can report a degraded plane.
-  'train/health',
-  // fine-tuning broker (custom-data runs, HF search) — sibling surface.
-  'finetune/jobs',
-  'finetune/job',
-  'finetune/cancel',
-  'finetune/deploy',
-  'finetune/presets',
-  'finetune/hf/models',
-  'finetune/hf/datasets',
-  'finetune/hf/repo',
-])
-
-async function forward(req: NextRequest, path: string[]): Promise<NextResponse> {
-  const rel = path.join('/')
-  if (!ALLOWED.has(rel)) {
-    return NextResponse.json({ status: 'error', msg: 'Not found' }, { status: 404 })
-  }
-
-  // CSRF: `POST /train/jobs` mutates (and bills) from the auto-sent cookie — refuse a
-  // cross-origin one before any work (safe reads pass).
-  const csrf = csrfRefusal(req, 'casibase')
-  if (csrf) return csrf
-
-  const user = await resolveUser(req)
-  if (!user) {
-    return NextResponse.json(
-      { status: 'error', msg: 'Sign in to manage training.' },
-      { status: 401 },
-    )
-  }
-
-  const cookie = req.headers.get('cookie') ?? ''
-  const url = `${CLOUD_API_URL}/v1/${rel}${req.nextUrl.search}`
-  const headers: Record<string, string> = {
-    cookie,
-    Accept: 'application/json',
-    'Content-Type': 'application/json',
-    // Org is SERVER-RESOLVED, not the raw browser header: a global admin's switched
-    // org (?/X-Org-Id) is honored, a non-global caller is PINNED to their own — so a
-    // brand admin can't drive another tenant's training jobs even if the backend
-    // trusted the forwarded header. Matches the /paas + /admin/kms orgFor pin.
-    'X-Org-Id': orgFor({ isGlobalAdmin: user.isGlobalAdmin, orgScope: user.owner }, req.headers.get('X-Org-Id')),
-  }
-  const projectId = req.headers.get('X-Project-Id')
-  const environment = req.headers.get('X-Environment')
-  if (projectId) headers['X-Project-Id'] = projectId
-  if (environment) headers['X-Environment'] = environment
-
-  const init: RequestInit = { method: req.method, headers, cache: 'no-store' }
-  if (req.method !== 'GET' && req.method !== 'HEAD') {
-    init.body = await req.text()
-  }
-
-  try {
-    const res = await fetchWithTimeout(url, init)
-    const text = await res.text()
-    return new NextResponse(text, {
-      status: res.status,
-      headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' },
-    })
-  } catch (e) {
-    return NextResponse.json(
-      { status: 'error', msg: `Fine-tuning backend unreachable: ${e instanceof Error ? e.message : String(e)}` },
-      { status: 502 },
-    )
-  }
-}
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return forward(req, (await ctx.params).path)
-}

app/vm/[...path]/route.ts

@@ -1,63 +0,0 @@
-/**
- * Same-origin user-bearer proxy to Visor (vm.hanzo.ai) — the compute control plane
- * (regions / gpus / machines / instances). The browser calls this OWN-origin route
- * (`/vm/v1/...`) with just its session cookie; `forwardWithUserBearer` resolves the
- * user, mints a short-lived user-bound IAM token, and forwards to visor with that
- * Bearer. Visor mints org + user from the JWT claims, so compute is org-scoped
- * server-side — a caller only ever sees their own org's machines. No token reaches
- * the browser.
- *
- * NOT the `/paas` pattern: `/paas` forwards a god-mode control-plane SERVICE token
- * and is gated to brand admins. Compute is a TENANT action (any signed-in org user
- * may list/manage their own machines), so this is user-scoped (resolveUser), and
- * visor itself authorizes the forwarded user bearer.
- *
- * Least privilege on the path: only the visor `v1/*` surface is reachable
- * (`allowVisorSurface`); anything else 404s.
- */
-import { type NextRequest } from 'next/server'
-
-import { forwardWithUserBearer } from '~/lib/server/bearer-proxy'
-import { allowVisorSurface } from '~/lib/server/proxy-allow'
-
-export const runtime = 'nodejs'
-
-const trim = (s: string) => s.replace(/\/+$/, '')
-/** Visor (vm.hanzo.ai). In-cluster ClusterIP on :19000 (its Service has NO :80) — public
- *  egress is CF-403'd. Override with VISOR_URL (the CR sets visor.hanzo.svc:19000).
- *  `|| default` (not `??`): if the env is reconciled to an EMPTY string (observed drift on
- *  the live pod), `??` would keep the blank and every machines/GPUs call would fail —
- *  `|| default` treats blank/whitespace as unset so visor ALWAYS resolves. */
-const VISOR_URL = trim(process.env.VISOR_URL?.trim() || 'http://visor.hanzo.svc:19000')
-
-type Ctx = { params: Promise<{ path: string[] }> }
-
-function handle(req: NextRequest, ctx: Ctx) {
-  return (async () => {
-    const path = (await ctx.params).path.join('/')
-    return forwardWithUserBearer(req, {
-      target: VISOR_URL,
-      path,
-      allow: allowVisorSurface,
-      // Org is authoritative (Bearer owner). Don't forward browser X-Project-Id/
-      // X-Environment (unvalidated sub-scopes) — RED MEDIUM.
-      unauthorizedMessage: 'Sign in to manage compute.',
-    })
-  })()
-}
-
-export async function GET(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function POST(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function PUT(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function PATCH(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}
-export async function DELETE(req: NextRequest, ctx: Ctx) {
-  return handle(req, ctx)
-}

docker-compose.build.yml

@@ -0,0 +1,67 @@
+version: "3.5"
+
+services:
+  server:
+    build:
+      dockerfile: ./web/Dockerfile
+      context: .
+    depends_on:
+      - db
+      - redis
+    ports:
+      - "3000:3000"
+    environment:
+      - DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
+      - NEXTAUTH_SECRET=mysecret
+      - SALT=mysalt
+      - NEXTAUTH_URL=http://localhost:3000
+      - TELEMETRY_ENABLED=${TELEMETRY_ENABLED:-true}
+      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-false}
+      - LANGFUSE_WORKER_HOST=${LANGFUSE_WORKER_HOST:-worker}
+      - LANGFUSE_WORKER_PASSWORD=${LANGFUSE_WORKER_PASSWORD:-mybasicauthsecret}
+    restart: always
+
+  worker:
+    build:
+      dockerfile: ./worker/Dockerfile
+      context: .
+    depends_on:
+      - db
+      - redis
+    ports:
+      - "3030:3030"
+    environment:
+      - DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
+      - NEXTAUTH_SECRET=mysecret
+      - TELEMETRY_ENABLED=${TELEMETRY_ENABLED:-true}
+      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-false}
+      - PORT=${PORT:-3030}
+      - REDIS_HOST=${REDIS_HOST:-redis}
+      - REDIS_PORT=${REDIS_PORT:-6379}
+      - REDIS_AUTH=${REDIS_AUTH:-myredissecret}
+      - LANGFUSE_WORKER_PASSWORD=${LANGFUSE_WORKER_PASSWORD:-mybasicauthsecret}
+    restart: always
+
+  redis:
+    image: redis:7.2.4
+    command: >
+      --requirepass ${REDIS_AUTH:-myredissecret}
+    restart: always
+    ports:
+      - 6379:6379
+
+  db:
+    image: postgres
+    restart: always
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=postgres
+      - POSTGRES_DB=postgres
+    ports:
+      - 5432:5432
+    volumes:
+      - database_data:/var/lib/postgresql/data
+
+volumes:
+  database_data:
+    driver: local

docker-compose.dev.yml

@@ -0,0 +1,27 @@
+version: "3.5"
+
+services:
+  redis:
+    image: redis:7.2.4
+    restart: always
+    command: >
+      --requirepass ${REDIS_AUTH:-myredissecret}
+    ports:
+      - 6379:6379
+
+  db:
+    image: postgres
+    restart: always
+    command: ["postgres", "-c", "log_statement=all"]
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=postgres
+      - POSTGRES_DB=postgres
+    ports:
+      - 5432:5432
+    volumes:
+      - database_data:/var/lib/postgresql/data
+
+volumes:
+  database_data:
+    driver: local

docker-compose.yml

@@ -0,0 +1,32 @@
+version: "3.5"
+
+services:
+  langfuse-server:
+    image: ghcr.io/langfuse/langfuse:latest
+    depends_on:
+      - db
+    ports:
+      - "3000:3000"
+    environment:
+      - DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
+      - NEXTAUTH_SECRET=mysecret
+      - SALT=mysalt
+      - NEXTAUTH_URL=http://localhost:3000
+      - TELEMETRY_ENABLED=${TELEMETRY_ENABLED:-true}
+      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=${LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES:-false}
+
+  db:
+    image: postgres
+    restart: always
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=postgres
+      - POSTGRES_DB=postgres
+    ports:
+      - 5432:5432
+    volumes:
+      - database_data:/var/lib/postgresql/data
+
+volumes:
+  database_data:
+    driver: local

docs/endpoints.md

@@ -1,74 +0,0 @@
-# Unified `/v1` backend endpoints
-
-The console talks to the unified Hanzo Cloud backend (`hanzoai/cloud`, the
-casibase API). Base URL: `${NEXT_PUBLIC_CLOUD_URL}/v1`. All requests send cookie
-credentials; responses are the envelope `{ status, msg, data, data2 }` (`data2`
-is the total row count on list endpoints).
-
-Client modules live in `src/lib/api/`.
-
-## Account / session — `AccountApi`
-
-| Method | Endpoint |
-| --- | --- |
-| `current()` | `GET /get-account` |
-| `signin(code, state)` | `POST /signin?code&state` |
-| `signout()` | `POST /signout` |
-
-## Providers — `ProviderApi`
-
-| Method | Endpoint |
-| --- | --- |
-| `listGlobal()` | `GET /get-global-providers` |
-| `list({ owner, store, p, pageSize, … })` | `GET /get-providers` |
-| `get(owner, name)` | `GET /get-provider?id=owner/name` |
-| `add(p)` | `POST /add-provider` |
-| `update(owner, name, p)` | `POST /update-provider?id=owner/name` |
-| `remove(p)` | `POST /delete-provider` |
-| `refreshMcpTools(p)` | `POST /refresh-mcp-tools` |
-
-## Model routes — `ModelRouteApi`
-
-| Method | Endpoint |
-| --- | --- |
-| `list({ owner, … })` | `GET /get-model-routes` |
-| `get(owner, modelName)` | `GET /get-model-route?owner&modelName` |
-| `add(r)` | `POST /add-model-route` |
-| `update(owner, modelName, r)` | `POST /update-model-route?owner&modelName` |
-| `remove(r)` | `POST /delete-model-route` |
-
-## Applications — `ApplicationApi`
-
-| Method | Endpoint |
-| --- | --- |
-| `list({ owner, … })` | `GET /get-applications` |
-| `get(owner, name)` | `GET /get-application?id=owner/name` |
-| `add(a)` | `POST /add-application` |
-| `update(owner, name, a)` | `POST /update-application?id=owner/name` |
-| `remove(a)` | `POST /delete-application` |
-| `deploy(a)` | `POST /deploy-application?id=owner/name` |
-| `undeploy(owner, name)` | `POST /undeploy-application?id=owner/name` |
-
-## Stores — `StoreApi`
-
-| Method | Endpoint |
-| --- | --- |
-| `listGlobal()` | `GET /get-global-stores` |
-| `list(owner)` | `GET /get-stores?owner` |
-| `get(owner, name)` | `GET /get-store?id=owner/name` |
-| `names(owner)` | `GET /get-store-names?owner` |
-| `add(s)` | `POST /add-store` |
-| `update(owner, name, s)` | `POST /update-store?id=owner/name` |
-| `remove(s)` | `POST /delete-store` |
-| `refreshVectors(s)` | `POST /refresh-store-vectors` |
-
-## Chat — `ChatApi`
-
-| Method | Endpoint |
-| --- | --- |
-| `listGlobal({ … })` | `GET /get-global-chats` |
-| `list({ user, store, selectedUser, … })` | `GET /get-chats` |
-| `get(owner, name)` | `GET /get-chat?id=owner/name` |
-| `add(c)` | `POST /add-chat` |
-| `update(owner, name, c)` | `POST /update-chat?id=owner/name` |
-| `remove(c)` | `POST /delete-chat` |

e2e/billing-isolation.spec.ts

@@ -1,94 +0,0 @@
-/**
- * e2e: two-tenant BILLING ISOLATION through the `/billing/*` proxy.
- *
- * The proxy (app/billing/v1/[...path]/route.ts) resolves the billing subject from the
- * session server-side and pins the full subject-key set (user/userId/customerId) +
- * the X-Org-Id header, so a tenant can only ever read its OWN commerce ledger. This
- * spec proves that end-to-end against the LIVE proxy: two accounts in DIFFERENT orgs
- * each fetch `/billing/subscriptions` (and `/payment-methods`), and we assert the
- * two result sets are disjoint — neither tenant can see the other's rows.
- *
- * This is the regression guard for the IDOR RED found (the proxy previously pinned
- * only `?user=` while commerce filters subscriptions on `?userId=`, so subscriptions
- * were returned across the whole namespace).
- *
- * Credentials (env, never in repo). Skips unless BOTH tenants are provided:
- *   TENANT_A_EMAIL / TENANT_A_PASSWORD  (org A)
- *   TENANT_B_EMAIL / TENANT_B_PASSWORD  (org B, a DIFFERENT org)
- *   BASE_URL  default https://console.hanzo.ai
- *
- * Run:  TENANT_A_EMAIL=.. TENANT_A_PASSWORD=.. TENANT_B_EMAIL=.. TENANT_B_PASSWORD=.. pnpm e2e billing-isolation.spec.ts
- */
-import { test, expect, type Page } from '@playwright/test'
-
-const BASE_URL = process.env.BASE_URL ?? 'https://console.hanzo.ai'
-const A = { email: process.env.TENANT_A_EMAIL ?? '', password: process.env.TENANT_A_PASSWORD ?? '' }
-const B = { email: process.env.TENANT_B_EMAIL ?? '', password: process.env.TENANT_B_PASSWORD ?? '' }
-
-async function signIn(page: Page, email: string, password: string) {
-  await page.goto(`${BASE_URL}/signin`)
-  await page.waitForSelector('input[placeholder="Email"]', { timeout: 20_000 })
-  await page.fill('input[placeholder="Email"]', email)
-  await page.fill('input[placeholder="Password"]', password)
-  await page.click('button:has-text("Sign in")')
-  const base = new URL(BASE_URL).origin
-  await page.waitForURL((url) => url.origin === base && url.pathname === '/', { timeout: 30_000 })
-  await page.waitForLoadState('domcontentloaded')
-}
-
-/** Fetch a billing path through the same-origin DATA proxy (`/billing/v1/*`), as the
- *  signed-in browser. (`/billing/<slug>` without `v1/` is a UI tab, served by the SPA.) */
-async function billing(page: Page, path: string): Promise<{ status: number; ids: string[] }> {
-  return page.evaluate(async (p) => {
-    const res = await fetch(`/billing/v1/${p}`, { credentials: 'include', headers: { Accept: 'application/json' } })
-    let ids: string[] = []
-    try {
-      const body = await res.json()
-      const rows = Array.isArray(body)
-        ? body
-        : (body?.subscriptions ?? body?.paymentMethods ?? body?.payment_methods ?? body?.data ?? [])
-      ids = (Array.isArray(rows) ? rows : [])
-        .map((r: { id?: unknown }) => (typeof r?.id === 'string' ? r.id : ''))
-        .filter(Boolean)
-    } catch {
-      /* non-JSON (e.g. 501 not-configured) — ids stays empty */
-    }
-    return { status: res.status, ids }
-  }, path)
-}
-
-test.describe('billing is isolated per tenant through the proxy', () => {
-  test.skip(
-    !A.email || !A.password || !B.email || !B.password,
-    'TENANT_A_* / TENANT_B_* not set — skipping two-tenant billing isolation',
-  )
-
-  test('two distinct-org tenants never see each other’s subscriptions or payment methods', async ({ browser }) => {
-    const ctxA = await browser.newContext()
-    const ctxB = await browser.newContext()
-    const pageA = await ctxA.newPage()
-    const pageB = await ctxB.newPage()
-
-    await signIn(pageA, A.email, A.password)
-    await signIn(pageB, B.email, B.password)
-
-    for (const path of ['subscriptions', 'payment-methods']) {
-      const a = await billing(pageA, path)
-      const b = await billing(pageB, path)
-
-      // A 401 would mean the session broke; a 501 means commerce isn't configured
-      // on this deployment (isolation is vacuously safe — nothing is returned).
-      expect(a.status, `tenant A /${path} not authorized`).not.toBe(401)
-      expect(b.status, `tenant B /${path} not authorized`).not.toBe(401)
-
-      if (a.status === 501 || b.status === 501) continue
-
-      // The core isolation assertion: the two tenants' row-id sets are disjoint.
-      const overlap = a.ids.filter((id) => b.ids.includes(id))
-      expect(overlap, `/${path} leaked ${overlap.length} shared rows across tenants`).toEqual([])
-    }
-
-    await ctxA.close()
-    await ctxB.close()
-  })
-})

e2e/console.spec.ts

@@ -1,295 +0,0 @@
-/**
- * e2e: Hanzo Cloud Console — login → API key → AI inference
- *
- * z@hanzo.ai is in the `hanzo` org (isGlobalAdmin), so the OrgGate now shows
- * a dismissible admin banner and renders the full console on console.hanzo.ai.
- * Admin ops still live at admin.hanzo.ai.
- *
- * Credentials (env, never in repo):
- *   HANZO_EMAIL    default z@hanzo.ai
- *   HANZO_PASSWORD required
- *   HANZO_API_KEY  optional; skip UI flow, go straight to inference
- *   HANZO_API_BASE default https://api.hanzo.ai
- *   BASE_URL       default https://console.hanzo.ai
- *
- * Run:
- *   HANZO_PASSWORD=xxx pnpm e2e
- *   HANZO_PASSWORD=xxx HANZO_API_KEY=hk-xxx pnpm e2e
- */
-import { test, expect, type Page } from '@playwright/test'
-
-const EMAIL    = process.env.HANZO_EMAIL    ?? 'z@hanzo.ai'
-const PASSWORD = process.env.HANZO_PASSWORD ?? ''
-const API_KEY  = process.env.HANZO_API_KEY  ?? ''
-const API_BASE = process.env.HANZO_API_BASE ?? 'https://api.hanzo.ai'
-const BASE_URL = process.env.BASE_URL       ?? 'https://console.hanzo.ai'
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-async function signIn(page: Page) {
-  await page.goto(`${BASE_URL}/signin`)
-  await page.waitForSelector('input[placeholder="Email"]', { timeout: 20_000 })
-  await page.fill('input[placeholder="Email"]', EMAIL)
-  await page.fill('input[placeholder="Password"]', PASSWORD)
-  await page.click('button:has-text("Sign in")')
-}
-
-/** Wait until we're on the dashboard (route replaced to '/'). */
-async function waitForDashboard(page: Page) {
-  const base = new URL(BASE_URL).origin
-  await page.waitForURL(url => url.origin === base && url.pathname === '/', { timeout: 30_000 })
-  // The dashboard renders product grid cards — wait for at least one visible card/link
-  await page.waitForLoadState('domcontentloaded')
-}
-
-// ─── tests ──────────────────────────────────────────────────────────────────
-
-// Public smoke — needs no credentials, so it always runs (in CI, for Dave, etc.)
-// and catches a dead/blank sign-in gate. The authenticated flows below gate on
-// HANZO_PASSWORD.
-test.describe('Hanzo Cloud Console — public', () => {
-  test('sign-in page renders (email/password + OAuth + passkey)', async ({ page }) => {
-    await page.goto(`${BASE_URL}/signin`)
-    await expect(page.locator('input[placeholder="Email"]')).toBeVisible({ timeout: 20_000 })
-    await expect(page.locator('input[placeholder="Password"]')).toBeVisible()
-    await expect(page.locator('button:has-text("Sign in")')).toBeVisible()
-    await expect(page.locator('button:has-text("Continue with GitHub")')).toBeVisible()
-    await expect(page.locator('button:has-text("Continue with Google")')).toBeVisible()
-    await expect(page.locator('text=/passkey/i')).toBeVisible()
-  })
-
-  test('root serves the app (200, dark #0a0a0a) + /base resolves', async ({ page, request }) => {
-    const res = await page.goto(BASE_URL)
-    expect(res?.status()).toBe(200)
-    await expect(page).toHaveTitle(/Hanzo Cloud Console/)
-    await expect(page.locator('meta[name="theme-color"][content="#0a0a0a"]')).toHaveCount(1)
-    expect((await request.get(`${BASE_URL}/base`)).status()).toBe(200)
-  })
-
-  // Security gates — the server proxies must reject unauthenticated calls and
-  // stay inside their allow-list. No credentials (plain request context) so this
-  // proves the production posture in CI. A regression is a real security bug.
-  test('server proxies reject unauthenticated calls (401)', async ({ request }) => {
-    for (const path of [
-      '/superbase/v1/collections/tenants/records',
-      '/keys',
-    ]) {
-      const res = await request.get(`${BASE_URL}${path}`)
-      expect(res.status(), `${path} must gate`).toBe(401)
-    }
-  })
-
-  test('proxy allow-lists reject off-list paths (no tunnel)', async ({ request }) => {
-    const res = await request.get(`${BASE_URL}/superbase/v1/collections/secrets/records`)
-    // The point is "no tunnel to the backend": the off-list path must be blocked,
-    // not proxied. The proxy may reject with 404 (off allow-list) or 401 (auth
-    // gate hit first) — both are blocked; a 2xx would be the real bug.
-    expect([401, 404], `off-list path must be blocked, got ${res.status()}`).toContain(res.status())
-  })
-
-  test('unknown route never 5xxs', async ({ request }) => {
-    const res = await request.get(`${BASE_URL}/no-such-surface-xyz`)
-    expect(res.status()).toBeLessThan(500)
-  })
-})
-
-test.describe('Hanzo Cloud Console e2e', () => {
-  test.skip(!PASSWORD, 'HANZO_PASSWORD not set — skipping live authenticated tests')
-
-  test('login as z@hanzo.ai — dashboard renders', async ({ page }) => {
-    await signIn(page)
-    await waitForDashboard(page)
-    // Dashboard renders — sign-in form must be gone
-    await expect(page.locator('input[placeholder="Password"]')).not.toBeVisible({ timeout: 10_000 })
-    // At least one product category or card is visible (Overview / AI / Compute etc.)
-    await expect(
-      page.locator('a, button, [role="link"]').filter({ hasText: /models|providers|overview|AI/i }).first()
-    ).toBeVisible({ timeout: 15_000 })
-    console.log('✓ Signed in; dashboard is rendering')
-  })
-
-  test('admin banner visible (z is isAdmin on console.hanzo.ai)', async ({ page }) => {
-    await signIn(page)
-    await waitForDashboard(page)
-    // OrgGate shows the admin banner for admins on the non-admin console host.
-    // The banner may have been dismissed in a prior run (localStorage). Skip softly.
-    const banner = page.locator('text=/Admin ops|admin\\.hanzo\\.ai/i').first()
-    const visible = await banner.isVisible({ timeout: 5_000 }).catch(() => false)
-    if (visible) {
-      console.log('✓ Admin banner visible')
-      await expect(page.locator('button:has-text("Open admin")')).toBeVisible()
-    } else {
-      console.log('ℹ Admin banner was dismissed (localStorage) — OK')
-    }
-  })
-
-  test('create or confirm API key', async ({ page }) => {
-    await signIn(page)
-    await waitForDashboard(page)
-
-    // API Keys module is at /api-keys (catch-all route, id='api-keys')
-    await page.goto(`${BASE_URL}/api-keys`, { waitUntil: 'domcontentloaded' })
-
-    // Wait for the module to hydrate — look for the page header or key cards
-    await expect(
-      page.locator('text=/API Keys/i, text=/Cloud API key/i, text=/Create.*API key/i').first()
-    ).toBeVisible({ timeout: 25_000 })
-
-    const hasKey  = page.locator('text=/Cloud API key/i')
-    const noKey   = page.locator('text=/Create your Cloud API key/i')
-    const createBtn = page.locator('button:has-text("Create API key")')
-
-    const needsCreate = await noKey.isVisible({ timeout: 3_000 }).catch(() => false)
-                     || await createBtn.isVisible({ timeout: 1_000 }).catch(() => false)
-
-    if (needsCreate) {
-      await createBtn.click()
-      // One-time reveal card with the hk- key
-      await expect(page.locator('text=/hk-/')).toBeVisible({ timeout: 25_000 })
-      await expect(page.locator('text=/shown only once/i')).toBeVisible()
-      await expect(page.locator('button:has-text("Copy")')).toBeVisible()
-      console.log('✓ API key created (hk- one-time reveal shown)')
-    } else {
-      // Key already exists
-      await expect(hasKey).toBeVisible({ timeout: 10_000 })
-      await expect(page.locator('text=/hk-…|hk-[A-Za-z0-9]{3,}/i')).toBeVisible({ timeout: 5_000 })
-      console.log('✓ API key already exists (prefix shown)')
-    }
-  })
-
-  test('API key works — GET /v1/models', async ({ page }) => {
-    let apiKey = API_KEY
-
-    if (!apiKey) {
-      await signIn(page)
-      await waitForDashboard(page)
-      await page.goto(`${BASE_URL}/api-keys`, { waitUntil: 'domcontentloaded' })
-      await expect(
-        page.locator('text=/API Keys/i').first()
-      ).toBeVisible({ timeout: 25_000 })
-
-      // Rotate (or create) to show the full key on-screen
-      const rotateBtn = page.locator('button:has-text("Rotate")')
-      const createBtn = page.locator('button:has-text("Create API key")')
-      if (await rotateBtn.isVisible({ timeout: 3_000 }).catch(() => false)) {
-        await rotateBtn.click()
-      } else if (await createBtn.isVisible({ timeout: 1_000 }).catch(() => false)) {
-        await createBtn.click()
-      }
-      await expect(page.locator('text=/hk-/')).toBeVisible({ timeout: 25_000 })
-
-      // Grab the FULL key from the one-time reveal — never the masked display
-      // (the account card shows `hk-2f18…` with an ellipsis, which is not a
-      // usable credential). Match only a full hk- token (no `…`/`...`).
-      const fullKey = /hk-[A-Za-z0-9._-]{16,}/
-      const keyEl = page.locator('[style*="monospace"]').filter({ hasText: fullKey }).first()
-      apiKey = (((await keyEl.textContent().catch(() => '')) ?? '').match(fullKey) ?? [''])[0]
-      if (!apiKey) {
-        const m = ((await page.textContent('body')) ?? '').match(fullKey)
-        apiKey = m ? m[0] : ''
-      }
-      expect(apiKey, 'Could not extract hk- key from page').toMatch(/^hk-/)
-      console.log(`✓ Extracted key prefix: ${apiKey.slice(0, 11)}…`)
-    }
-
-    // Verify the key works against api.hanzo.ai
-    const resp = await page.request.get(`${API_BASE}/v1/models`, {
-      headers: { Authorization: `Bearer ${apiKey}`, Accept: 'application/json' },
-      timeout: 30_000,
-    })
-    expect(resp.ok(), `GET /v1/models → ${resp.status()}`).toBe(true)
-    const json = await resp.json()
-    expect(json).toMatchObject({ data: expect.any(Array) })
-    const models: Array<{ id: string }> = json.data
-    expect(models.length).toBeGreaterThan(0)
-    const ids = models.map(m => m.id)
-    console.log(`✓ /v1/models: ${models.length} models`)
-    console.log(`  GLM      present: ${ids.some(id => id.includes('glm'))}`)
-    console.log(`  Claude   present: ${ids.some(id => id.includes('claude'))}`)
-    console.log(`  DeepSeek present: ${ids.some(id => id.includes('deepseek'))}`)
-    console.log(`  First 5: ${ids.slice(0, 5).join(', ')}`)
-  })
-
-  test('OpenAI inference — glm-5.2', async ({ page }) => {
-    test.skip(!API_KEY, 'Set HANZO_API_KEY to run inference tests')
-
-    const resp = await page.request.post(`${API_BASE}/v1/chat/completions`, {
-      headers: {
-        Authorization: `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-        Accept: 'application/json',
-      },
-      data: {
-        model: 'glm-5.2',
-        messages: [{ role: 'user', content: 'Reply with only: PONG' }],
-        max_tokens: 16,
-        stream: false,
-      },
-      timeout: 30_000,
-    })
-    expect(resp.ok(), `glm-5.2 → ${resp.status()}`).toBe(true)
-    const json = await resp.json()
-    const text: string = json.choices?.[0]?.message?.content ?? ''
-    expect(text).toBeTruthy()
-    console.log(`✓ glm-5.2: "${text.trim()}"`)
-  })
-
-  test('OpenAI inference — deepseek-v4-pro', async ({ page }) => {
-    test.skip(!API_KEY, 'Set HANZO_API_KEY to run inference tests')
-
-    const resp = await page.request.post(`${API_BASE}/v1/chat/completions`, {
-      headers: {
-        Authorization: `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-        Accept: 'application/json',
-      },
-      data: {
-        model: 'deepseek-v4-pro',
-        messages: [{ role: 'user', content: 'Reply with only: PONG' }],
-        max_tokens: 16,
-        stream: false,
-      },
-      timeout: 30_000,
-    })
-    expect(resp.ok(), `deepseek-v4-pro → ${resp.status()}`).toBe(true)
-    const json = await resp.json()
-    const text: string = json.choices?.[0]?.message?.content ?? ''
-    expect(text).toBeTruthy()
-    console.log(`✓ deepseek-v4-pro: "${text.trim()}"`)
-  })
-
-  test('Anthropic-compat /v1/messages — live catalog model', async ({ page }) => {
-    test.skip(!API_KEY, 'Set HANZO_API_KEY to run inference tests')
-
-    // Pick a model that is ACTUALLY available right now (the catalog changes;
-    // a hardcoded id like claude-sonnet-4-6 fails when it isn't provisioned).
-    // The /v1/messages Anthropic surface accepts any catalog model.
-    const listed = await page.request.get(`${API_BASE}/v1/models`, {
-      headers: { Authorization: `Bearer ${API_KEY}`, Accept: 'application/json' },
-      timeout: 30_000,
-    })
-    const ids: string[] = (await listed.json()).data?.map((m: { id: string }) => m.id) ?? []
-    const model = ids.find((id) => id.includes('claude')) ?? ids.find((id) => id === 'glm-5.2') ?? ids[0]
-    expect(model, 'no model available in catalog').toBeTruthy()
-
-    const resp = await page.request.post(`${API_BASE}/v1/messages`, {
-      headers: {
-        Authorization: `Bearer ${API_KEY}`,
-        'Content-Type': 'application/json',
-        Accept: 'application/json',
-        'anthropic-version': '2023-06-01',
-      },
-      data: {
-        model,
-        messages: [{ role: 'user', content: 'Reply with only: PONG' }],
-        max_tokens: 16,
-      },
-      timeout: 30_000,
-    })
-    expect(resp.ok(), `/v1/messages (${model}) → ${resp.status()}`).toBe(true)
-    const json = await resp.json()
-    const text: string = json.content?.[0]?.text ?? ''
-    expect(text).toBeTruthy()
-    console.log(`✓ Anthropic-compat /v1/messages (${model}): "${text.trim()}"`)
-  })
-})

e2e/deeplink-refresh.spec.ts

@@ -1,80 +0,0 @@
-/**
- * e2e regression: the reported launch bug — product routes must render on a
- * DIRECT URL load and a browser REFRESH, not only via in-app navigation.
- *
- * Product modules mount client-only under the catch-all route, so a throw in one
- * module's first render used to bubble to Next's root fallback and white-screen
- * the whole console with "Application error: a client-side exception has
- * occurred" — but ONLY on a direct load / refresh (in-app nav renders fresh and
- * hid it). `ProductErrorBoundary` + the dashboard `error.tsx` close that class:
- * even a module throw now keeps the shell and shows a retryable card, never a
- * white screen. This spec proves each target route:
- *   1. direct-loads without a client-exception white-screen,
- *   2. refreshes (F5) without one,
- *   3. still deep-links its own real content (shell + main region present).
- *
- * Credentials (env, never in repo): HANZO_EMAIL / HANZO_PASSWORD, BASE_URL.
- * Run:  HANZO_PASSWORD=xxx BASE_URL=https://console.hanzo.ai pnpm e2e deeplink-refresh.spec.ts
- */
-import { test, expect, type Page } from '@playwright/test'
-
-const EMAIL = process.env.HANZO_EMAIL ?? 'z@hanzo.ai'
-const PASSWORD = process.env.HANZO_PASSWORD ?? ''
-const BASE_URL = process.env.BASE_URL ?? 'https://console.hanzo.ai'
-
-// The three routes from the report, plus controls known to deep-link fine.
-const TARGETS = ['/playground', '/prompts', '/gpus']
-const CONTROLS = ['/models', '/providers']
-
-async function signIn(page: Page) {
-  await page.goto(`${BASE_URL}/signin`)
-  await page.waitForSelector('input[placeholder="Email"]', { timeout: 20_000 })
-  // @hanzo/gui Input binds onChangeText — real keystrokes, not fill().
-  await page.locator('input[placeholder="Email"]').pressSequentially(EMAIL, { delay: 12 })
-  await page.locator('input[placeholder="Password"]').pressSequentially(PASSWORD, { delay: 12 })
-  await page.click('button:has-text("Sign in")')
-  const origin = new URL(BASE_URL).origin
-  await page.waitForURL((u) => u.origin === origin && u.pathname === '/', { timeout: 30_000 })
-  await page.waitForLoadState('domcontentloaded')
-}
-
-/** Assert the page rendered the console (shell + main) and did NOT white-screen. */
-async function assertRendered(page: Page, route: string, phase: string) {
-  await page.waitForLoadState('networkidle', { timeout: 20_000 }).catch(() => {})
-  // No client-exception white-screen.
-  await expect(
-    page.locator('text=/Application error|client-side exception|Unhandled Runtime Error/i'),
-    `${route} (${phase}) must not white-screen`,
-  ).toHaveCount(0)
-  // Shell survived: the persistent nav ("Overview"/"Apps") is present.
-  const body = (await page.locator('body').innerText().catch(() => '')) || ''
-  expect(body.length, `${route} (${phase}) has content`).toBeGreaterThan(200)
-  expect(body, `${route} (${phase}) kept the shell`).toMatch(/Overview|Apps|Sign out/i)
-}
-
-test.describe('deep-link + refresh must not crash', () => {
-  test.skip(!PASSWORD, 'HANZO_PASSWORD not set — skipping authenticated deep-link pass')
-
-  test.beforeEach(async ({ page }) => {
-    await signIn(page)
-  })
-
-  for (const route of [...TARGETS, ...CONTROLS]) {
-    test(`direct load + refresh: ${route}`, async ({ page }) => {
-      const errors: string[] = []
-      page.on('pageerror', (e) => errors.push(String(e)))
-
-      // 1) DIRECT URL load (full navigation, fresh document).
-      const res = await page.goto(`${BASE_URL}${route}`, { waitUntil: 'domcontentloaded' })
-      expect(res?.status() ?? 0, `${route} HTTP`).toBeLessThan(500)
-      await assertRendered(page, route, 'direct')
-
-      // 2) REFRESH (F5) — the reported failing action.
-      await page.reload({ waitUntil: 'domcontentloaded' })
-      await assertRendered(page, route, 'refresh')
-
-      // An uncaught pageerror on these routes is the regression we are locking out.
-      expect(errors, `${route} uncaught pageerror(s): ${errors.join(' | ').slice(0, 300)}`).toEqual([])
-    })
-  }
-})

e2e/live-billing-admin.spec.ts

@@ -1,148 +0,0 @@
-/**
- * LIVE confirmation for feat/billing-usage-admin (v8.4.15) on the deployed cluster.
- *
- * Topology (verified live):
- *  - console.hanzo.ai: the console app is directly reachable at `/`; `/v1/*` is
- *    routed by the ingress to cloud-api (hanzoai/gateway), which enforces its OWN
- *    `global admin required` gate. The console's own H1 gate is reachable directly
- *    at `/admin/aggregate/*`. z@hanzo.ai is a global admin on this host.
- *  - admin.hanzo.ai: an EDGE forward-auth (`admin-guard@file`, org=admin, cookie
- *    on `.hanzo.ai`) sits in front of the SAME console image. A browser must carry
- *    a valid `.hanzo.ai` guard/session cookie to pass; a cold hit is 401.
- *
- * Three required checks (task bar):
- *   (a) admin business board (LivingOverview: MRR/usage/orgs/top-agents/fleet)
- *       renders for the GLOBAL admin z@hanzo.ai.
- *   (b) an unprivileged caller gets 403 on /v1/admin/* — no cross-org leak
- *       (fail-closed gate); iam/kms are not tunneled.
- *   (c) billing Reports shows the product/agent cost DIMENSION (honest-empty ok).
- */
-import { test, expect, type Page, type APIRequestContext } from '@playwright/test'
-
-const EMAIL    = process.env.HANZO_EMAIL    ?? 'z@hanzo.ai'
-const PASSWORD = process.env.HANZO_PASSWORD ?? ''
-const CONSOLE  = process.env.CONSOLE_URL    ?? 'https://console.hanzo.ai'
-const ADMIN    = process.env.ADMIN_URL      ?? 'https://admin.hanzo.ai'
-const SHOTS    = process.env.SHOT_DIR       ?? 'e2e-shots'
-
-/** Sign in via the console app sign-in form (email/password → cloud /v1/signin). */
-async function signIn(page: Page, base: string) {
-  await page.goto(`${base}/signin`)
-  await page.waitForSelector('input[placeholder="Email"]', { timeout: 25_000 })
-  await page.fill('input[placeholder="Email"]', EMAIL)
-  await page.fill('input[placeholder="Password"]', PASSWORD)
-  await page.click('button:has-text("Sign in")')
-  await page.waitForFunction(() => !location.pathname.startsWith('/signin'), { timeout: 30_000 })
-  await page.waitForLoadState('domcontentloaded')
-}
-
-// ─── (b) fail-closed gate — needs no credentials, always runs ─────────────────
-test.describe('LIVE v8.4.15 — (b) admin gate fail-closed', () => {
-  test('/v1/admin/* → 403 unauthenticated on console.hanzo.ai; iam/kms not tunneled', async ({ request }) => {
-    for (const head of ['overview', 'usage', 'orgs', 'audit', 'products']) {
-      const res = await request.get(`${CONSOLE}/v1/admin/${head}`)
-      expect(res.status(), `${CONSOLE}/v1/admin/${head} must be 403`).toBe(403)
-    }
-    // The console's OWN H1 route is also fail-closed.
-    const own = await request.get(`${CONSOLE}/admin/aggregate/overview`)
-    expect(own.status(), 'console app /admin/aggregate gate must be 403').toBe(403)
-    // Least privilege: iam/kms are NOT reachable through the aggregate rewrite.
-    for (const head of ['iam', 'kms']) {
-      const res = await request.get(`${CONSOLE}/admin/aggregate/${head}`)
-      expect([403, 404], `${head} must not tunnel via aggregate`).toContain(res.status())
-    }
-    // Edge-guarded admin host: cold hit is refused (401 forward-auth) — never open.
-    const edge = await request.get(`${ADMIN}/v1/admin/overview`)
-    expect(edge.status(), 'admin.hanzo.ai must be edge-gated (401/403)').toBeGreaterThanOrEqual(401)
-    expect(edge.status()).toBeLessThan(404)
-    console.log('✓ (b) console /v1/admin/* → 403 unauth; /admin/aggregate/{iam,kms} not tunneled; admin.hanzo.ai edge-gated')
-  })
-})
-
-// ─── (a) + (c) authenticated as the global admin z@hanzo.ai ───────────────────
-test.describe('LIVE v8.4.15 — (a) business board + (c) billing dimension', () => {
-  test.skip(!PASSWORD, 'HANZO_PASSWORD not set')
-
-  test('(a) admin business board renders for global admin z@hanzo.ai', async ({ page }) => {
-    await signIn(page, CONSOLE)
-
-    // The business board (catalog id `business`, admin:true) renders the ONE
-    // LivingOverview for `admin-business`: MRR / revenue / active orgs / customers,
-    // revenue+usage trend, top-agents-by-cost donut, fleet health.
-    await page.goto(`${CONSOLE}/business`, { waitUntil: 'domcontentloaded' })
-    await expect(page).not.toHaveURL(/\/signin/, { timeout: 15_000 })
-
-    // Global admin sees the board (not the admin-only "not authorized" gate).
-    const board = page.locator(
-      'text=/MRR|Revenue|Active orgs|Customers|Usage cost|Top agents|Fleet|Business/i'
-    ).first()
-    await expect(board, 'admin business board did not render for the global admin').toBeVisible({ timeout: 30_000 })
-    // The client admin gate did NOT block z (would show a forbidden/hidden state).
-    await expect(page.locator('text=/not authorized|access denied|admin only|forbidden/i')).toHaveCount(0)
-
-    await page.screenshot({ path: `${SHOTS}/a-business-board.png`, fullPage: true })
-    console.log('✓ (a) admin business board rendered for global admin z@hanzo.ai')
-  })
-
-  // (a2) The god-view gate is consistent with the account's ACTUAL grant. z@hanzo.ai
-  // lives in org `hanzo` (a brand/org admin), NOT the global `admin` org, so the
-  // all-orgs god view is correctly refused (403) and the board shows the honest
-  // "managed by Hanzo" fallback — no fabricated cross-org KPIs, no leak. A member of
-  // the `admin` org would instead get 200 and the KPI board. Either way the gate is
-  // fail-closed and matches what the board renders.
-  test('(a2) god-view gate matches the account grant (hanzo org-admin → honest 403)', async ({ page }) => {
-    await signIn(page, CONSOLE)
-    const acct = await (await page.request.get(`${CONSOLE}/v1/get-account`)).json().catch(() => ({}))
-    const owner = acct?.data?.owner
-    const res = await page.request.get(`${CONSOLE}/v1/admin/overview`)
-    if (owner === 'admin') {
-      expect(res.status(), 'global admin must pass the gate').not.toBe(403)
-      console.log(`✓ (a2) global-admin (org=admin) /v1/admin/overview → ${res.status()} (gate passed)`)
-    } else {
-      expect(res.status(), 'non-global-admin must be refused the god view').toBe(403)
-      console.log(`✓ (a2) org-admin (org=${owner}) → 403 on the god view; board shows honest managed fallback (no cross-org leak)`)
-    }
-  })
-
-  // (a3) admin.hanzo.ai: after establishing the shared `.hanzo.ai` session, the
-  // edge guard should admit the global admin and render the same board. If the
-  // guard still refuses (its own OIDC bootstrap), record the honest state — the
-  // board is proven on console.hanzo.ai (same image) and the edge gate is proven
-  // fail-closed above.
-  test('(a3) admin.hanzo.ai admits the global admin (or is honestly edge-gated)', async ({ page }) => {
-    await signIn(page, CONSOLE) // sets the `.hanzo.ai`-scoped session
-    const res = await page.request.get(`${ADMIN}/`)
-    if (res.status() === 200) {
-      await page.goto(`${ADMIN}/business`, { waitUntil: 'domcontentloaded' })
-      const board = page.locator('text=/MRR|Revenue|Active orgs|Customers|Top agents|Business/i').first()
-      await expect(board).toBeVisible({ timeout: 30_000 })
-      await page.screenshot({ path: `${SHOTS}/a3-admin-host-board.png`, fullPage: true })
-      console.log('✓ (a3) admin.hanzo.ai admitted the global admin; board rendered')
-    } else {
-      console.log(`ℹ (a3) admin.hanzo.ai edge-guard returned ${res.status()} for the shared session — board verified on console.hanzo.ai (same image)`)
-    }
-  })
-
-  test('(c) billing Reports renders the cost-dimension surface', async ({ page }) => {
-    await signIn(page, CONSOLE)
-    // v8.4.16: the data proxy moved to /billing/v1/*, so /billing/reports now falls
-    // through to the SPA (was shadowed by the /billing/[...path] proxy → raw JSON).
-    // A hard deep-link must render the Reports UI, not a proxy "not found".
-    await page.goto(`${CONSOLE}/billing/reports`, { waitUntil: 'domcontentloaded' })
-    await expect(page).not.toHaveURL(/\/signin/, { timeout: 15_000 })
-    // The route no longer resolves to the commerce proxy JSON.
-    await expect(page.locator('text=/^\\{"error":"not found"\\}$|could not be found/i'),
-      'reports still shadowed by the /billing proxy').toHaveCount(0, { timeout: 20_000 })
-
-    // The Cost-table Reports surface: the "spend by <dimension>" control. model +
-    // provider are always offered; product + agent appear the moment the commerce
-    // ledger tags a row (honest — never a fabricated column). Assert a dimension
-    // affordance renders (BillingReports mounted).
-    const dim = page.getByText(/by model|by provider|by product|by agent|group by|dimension|spend by|Cost by/i).first()
-    await expect(dim, 'cost dimension control did not render').toBeVisible({ timeout: 30_000 })
-    await expect(page.locator('text=/something went wrong|application error/i')).toHaveCount(0)
-
-    await page.screenshot({ path: `${SHOTS}/c-billing-reports.png`, fullPage: true })
-    console.log('✓ (c) /billing/reports rendered the BillingReports cost-dimension control (unshadowed)')
-  })
-})

e2e/open-edition.spec.ts

@@ -1,103 +0,0 @@
-/**
- * e2e: the Open Edition (run-for-pay) overview renders its real, product-specific
- * content — not just "a page mounted".
- *
- * `pages.spec.ts` proves /open-edition is reachable + doesn't crash (the generic
- * sweep). THIS spec proves the run-for-pay board actually rendered the things that
- * make it the Open Edition board: the "Open Edition" heading, the run-for-pay
- * framing, the "cost + 25%" margin caption on the Spend KPI, and the spend/tokens
- * KPI labels — all sourced from the config in
- * src/components/products/overview/living/registry.ts (id `open-edition`), which
- * reads the REAL commerce usage ledger scoped to the open-edition product tag.
- *
- * These are content assertions on the live surface, not a stub: if the config is
- * unwired, the route unrouted, or the board silently swapped for another usage
- * view, a specific assertion fails.
- *
- * Credentials (env, never in repo):
- *   HANZO_EMAIL     default z@hanzo.ai (global admin — sees every product)
- *   HANZO_PASSWORD  required (skips when unset)
- *   BASE_URL        default https://console.hanzo.ai
- *
- * Run:  HANZO_PASSWORD=xxx pnpm e2e open-edition.spec.ts
- */
-import { test, expect, type Page } from '@playwright/test'
-
-const EMAIL = process.env.HANZO_EMAIL ?? 'z@hanzo.ai'
-const PASSWORD = process.env.HANZO_PASSWORD ?? ''
-const BASE_URL = process.env.BASE_URL ?? 'https://console.hanzo.ai'
-
-async function signIn(page: Page) {
-  await page.goto(`${BASE_URL}/signin`)
-  await page.waitForSelector('input[placeholder="Email"]', { timeout: 20_000 })
-  await page.fill('input[placeholder="Email"]', EMAIL)
-  await page.fill('input[placeholder="Password"]', PASSWORD)
-  await page.click('button:has-text("Sign in")')
-  const base = new URL(BASE_URL).origin
-  await page.waitForURL((url) => url.origin === base && url.pathname === '/', { timeout: 30_000 })
-  await page.waitForLoadState('domcontentloaded')
-}
-
-test.describe('Open Edition — run-for-pay overview renders real content', () => {
-  test.skip(!PASSWORD, 'HANZO_PASSWORD not set — skipping authenticated Open Edition visual gate')
-
-  let ctx: import('@playwright/test').BrowserContext
-  let page: Page
-
-  test.beforeAll(async ({ browser }) => {
-    ctx = await browser.newContext()
-    page = await ctx.newPage()
-    await signIn(page)
-  })
-
-  test.afterAll(async () => {
-    await ctx?.close()
-  })
-
-  test('the /open-edition board mounts, is reachable, and does not crash', async () => {
-    const errors: string[] = []
-    const onErr = (e: Error) => errors.push(String(e))
-    page.on('pageerror', onErr)
-
-    const res = await page.goto(`${BASE_URL}/open-edition`, { waitUntil: 'domcontentloaded' })
-    expect(res?.status() ?? 0, '/open-edition HTTP').toBeLessThan(500)
-
-    await page.waitForLoadState('networkidle', { timeout: 20_000 }).catch(() => {})
-    await expect(page.locator('text=/Application error|Unhandled Runtime Error/i')).toHaveCount(0)
-
-    const bodyText = (await page.locator('body').innerText().catch(() => '')) || ''
-    expect(bodyText.trim().length, '/open-edition rendered content').toBeGreaterThan(0)
-
-    page.off('pageerror', onErr)
-    if (errors.length) console.log(`⚠ /open-edition pageerror: ${errors.join(' | ').slice(0, 200)}`)
-  })
-
-  test('renders the Open Edition run-for-pay header + the cost+25% Spend KPI', async () => {
-    await page.goto(`${BASE_URL}/open-edition`, { waitUntil: 'domcontentloaded' })
-    await page.waitForLoadState('networkidle', { timeout: 20_000 }).catch(() => {})
-
-    // The product heading — this is the Open Edition board, not a generic usage view.
-    await expect(page.getByText('Open Edition', { exact: false }).first()).toBeVisible({ timeout: 20_000 })
-
-    // The run-for-pay framing from the config subtitle (`Run open-source workloads
-    // for pay …`). Matches on the distinctive phrase so it can't pass on another board.
-    await expect(page.getByText(/run open-source workloads for pay/i).first()).toBeVisible()
-
-    // The load-bearing pricing detail: the Spend KPI carries the "cost + 25% margin"
-    // caption (the served revenue R = cost + resell margin). This is the visible
-    // proof the 25% run-for-pay model is surfaced, not just tokens.
-    await expect(page.getByText(/cost \+ 25% margin/i).first()).toBeVisible()
-
-    // The run-for-pay KPI labels the config declares (spend billed, tokens run).
-    await expect(page.getByText(/spend billed/i).first()).toBeVisible()
-    await expect(page.getByText(/tokens run/i).first()).toBeVisible()
-  })
-
-  test('captures a full-page screenshot of the Open Edition board', async () => {
-    await page.goto(`${BASE_URL}/open-edition`, { waitUntil: 'domcontentloaded' })
-    await page.waitForLoadState('networkidle', { timeout: 20_000 }).catch(() => {})
-    // Wait for the heading so the shot is of the rendered board, not a spinner frame.
-    await expect(page.getByText('Open Edition', { exact: false }).first()).toBeVisible({ timeout: 20_000 })
-    await page.screenshot({ path: 'e2e/screenshots/open-edition.png', fullPage: true })
-  })
-})

e2e/pages.spec.ts

@@ -1,121 +0,0 @@
-/**
- * e2e: screenshot every console page + assert each renders (FE↔BE wired).
- *
- * Signs in as z@hanzo.ai (global admin, sees every product), then visits all 89
- * registered product routes. For each page it:
- *   - navigates to /<id>,
- *   - waits for hydration,
- *   - asserts the app shell is present and the page did NOT hit a hard crash
- *     (Next error overlay / "Application error" / a blank body),
- *   - captures a full-page screenshot into e2e/screenshots/<id>.png.
- *
- * This is the "screenshot it all, make sure every page is wired" pass. It does
- * NOT click destructive buttons — it proves each surface mounts, renders real
- * state (or an honest empty/loading/403), and is reachable end to end. Deeper
- * per-button flows live in console.spec.ts (API key create/rotate, inference).
- *
- * Credentials (env, never in repo):
- *   HANZO_EMAIL     default z@hanzo.ai
- *   HANZO_PASSWORD  required (skips when unset)
- *   BASE_URL        default https://console.hanzo.ai
- *
- * Run:  HANZO_PASSWORD=xxx pnpm e2e pages.spec.ts
- */
-import { test, expect, type Page } from '@playwright/test'
-
-const EMAIL = process.env.HANZO_EMAIL ?? 'z@hanzo.ai'
-const PASSWORD = process.env.HANZO_PASSWORD ?? ''
-const BASE_URL = process.env.BASE_URL ?? 'https://console.hanzo.ai'
-
-/**
- * Every product route id in the registry (src/lib/products/registry.tsx).
- * Kept as a literal list so the spec has zero import coupling to the app bundle;
- * a page added to the registry gets a screenshot by adding its id here.
- */
-const PAGES: string[] = [
-  'overview', 'dashboards', 'status',
-  // AI
-  'models', 'model-catalog' /* alias */, 'providers', 'playground', 'chat', 'inference',
-  'agents', 'prompts', 'finetuning', 'embeddings', 'evals', 'datasets', 'experiments',
-  'annotation-queues', 'scores', 'score-configs', 'observations', 'traces', 'sessions',
-  // Compute / hypervisor
-  'machines', 'gpus', 'clusters', 'kubernetes', 'containers', 'networks', 'vpc',
-  'load-balancer', 'service-mesh', 'edge', 'zero-trust', 'dns', 'cdn',
-  // Data / storage
-  's3', 'sql', 'vector', 'datastore', 'kv', 'search', 'docdb', 'base', 'memory', 'indexer',
-  // Platform
-  'functions', 'pipelines', 'builds', 'releases', 'environments', 'projects', 'oracles',
-  // Identity / security
-  'iam', 'users', 'team', 'authz', 'kms', 'secrets', 'mpc', 'hsm', 'attestations',
-  'api-keys', 'tokens', 'applications',
-  // Business / analytics — the unified Billing Center + its sub-pages (Cost /
-  // Subscriptions / Payment-methods are now tabs of /billing, not top-level routes).
-  'billing', 'billing/reports', 'billing/budgets', 'billing/invoices',
-  'billing/subscriptions', 'billing/payment-methods', 'billing/credits',
-  'ai-metrics', 'open-edition', 'metrics', 'settlement', 'wallet', 'plans', 'referrals', 'marketplace',
-  // Ops / tooling
-  'logs', 'alerts', 'o11y', 'gateway', 'tasks', 'integrations', 'registry', 'audit',
-  'sdks', 'cli', 'ide', 'studio', 'desktop', 'bot', 'profile', 'settings',
-]
-
-async function signIn(page: Page) {
-  await page.goto(`${BASE_URL}/signin`)
-  await page.waitForSelector('input[placeholder="Email"]', { timeout: 20_000 })
-  await page.fill('input[placeholder="Email"]', EMAIL)
-  await page.fill('input[placeholder="Password"]', PASSWORD)
-  await page.click('button:has-text("Sign in")')
-  const base = new URL(BASE_URL).origin
-  await page.waitForURL((url) => url.origin === base && url.pathname === '/', { timeout: 30_000 })
-  await page.waitForLoadState('domcontentloaded')
-}
-
-// Sign in ONCE and reuse the session for all 94 pages. A per-test login (94×)
-// trips IAM's "too many login attempts" rate-limit around page 35, which is a
-// SECURITY FEATURE working correctly — not a page failure. One shared context
-// signs in once, then every page reuses the cookie. Serial so they share it.
-test.describe.configure({ mode: 'serial' })
-
-test.describe('Hanzo Cloud Console — every page renders + screenshot', () => {
-  test.skip(!PASSWORD, 'HANZO_PASSWORD not set — skipping authenticated screenshot pass')
-
-  let ctx: import('@playwright/test').BrowserContext
-  let page: Page
-
-  test.beforeAll(async ({ browser }) => {
-    ctx = await browser.newContext()
-    page = await ctx.newPage()
-    await signIn(page)
-  })
-
-  test.afterAll(async () => {
-    await ctx?.close()
-  })
-
-  for (const id of PAGES) {
-    test(`page: /${id}`, async () => {
-      const errors: string[] = []
-      const onErr = (e: Error) => errors.push(String(e))
-      page.on('pageerror', onErr)
-
-      const res = await page.goto(`${BASE_URL}/${id}`, { waitUntil: 'domcontentloaded' })
-      // Route must not 5xx.
-      expect(res?.status() ?? 0, `/${id} HTTP`).toBeLessThan(500)
-
-      // App shell mounted (the console renders a nav + main region on every page).
-      await page.waitForLoadState('networkidle', { timeout: 20_000 }).catch(() => {})
-
-      // Hard-crash guards: no Next error overlay, no generic crash banner.
-      await expect(page.locator('text=/Application error|Unhandled Runtime Error/i')).toHaveCount(0)
-
-      // The body must have real content (not a blank white page).
-      const bodyText = (await page.locator('body').innerText().catch(() => '')) || ''
-      expect(bodyText.trim().length, `/${id} rendered content`).toBeGreaterThan(0)
-
-      await page.screenshot({ path: `e2e/screenshots/${id}.png`, fullPage: true })
-
-      page.off('pageerror', onErr)
-      // Surface (don't fail on) any console page errors for triage.
-      if (errors.length) console.log(`⚠ /${id} pageerror: ${errors.join(' | ').slice(0, 200)}`)
-    })
-  }
-})

e2e/probe-o11y.spec.ts

@@ -1,153 +0,0 @@
-/**
- * LIVE probe of the o11y (SigNoz) backend through the console's own /cloud bearer
- * proxy. Logs in as z@hanzo.ai and, from the AUTHENTICATED page context, fetches
- * each candidate endpoint exactly as the new Observe modules will — same-origin
- * `<origin>/v1/o11y/*` (rewritten to `/cloud/v1/o11y/*`, cloud rewrites to the o11y
- * runtime's `/api/*`). Prints the HTTP status + a body snippet per endpoint so we
- * know what returns real data vs 404 (which must be flagged) before we build.
- *
- * Not a pass/fail test — a discovery harness. Run:
- *   BASE_URL=https://console.hanzo.ai HANZO_PASSWORD='…' npx playwright test probe-o11y --reporter=line
- */
-import { test, type Page } from '@playwright/test'
-
-const EMAIL = process.env.HANZO_EMAIL ?? 'z@hanzo.ai'
-const PASSWORD = process.env.HANZO_PASSWORD ?? ''
-const BASE_URL = process.env.BASE_URL ?? 'https://console.hanzo.ai'
-
-async function signIn(page: Page) {
-  await page.goto(`${BASE_URL}/signin`)
-  await page.waitForSelector('input[placeholder="Email"]', { timeout: 20_000 })
-  await page.fill('input[placeholder="Email"]', EMAIL)
-  await page.fill('input[placeholder="Password"]', PASSWORD)
-  await page.click('button:has-text("Sign in")')
-  const base = new URL(BASE_URL).origin
-  // Resilient: the post-login target may be '/' (dashboard) OR '/onboard' (org gate)
-  // OR it may just set the session cookie while staying put briefly. Wait for the
-  // sign-in form to DISAPPEAR (we left the /signin gate), whatever the destination.
-  await page
-    .waitForFunction(() => !document.querySelector('input[placeholder="Password"]'), { timeout: 90_000 })
-    .catch(() => {})
-  // Give the session cookie + any redirect a moment to settle, then land on '/'.
-  await page.goto(base, { waitUntil: 'domcontentloaded' }).catch(() => {})
-  await page.waitForTimeout(2500)
-}
-
-/** now() epoch — SigNoz wants ns for services/errors, ms for infra. */
-const nowMs = Date.now()
-const endNs = String(nowMs * 1_000_000)
-const startNs = String((nowMs - 60 * 60 * 1000) * 1_000_000) // 1h window
-const endMs = nowMs
-const startMs = nowMs - 60 * 60 * 1000
-
-type Probe = { name: string; path: string; method: 'GET' | 'POST'; body?: unknown }
-
-const PROBES: Probe[] = [
-  // ── Dashboards (SigNoz) ──
-  { name: 'dashboards.list', path: 'o11y/v1/dashboards', method: 'GET' },
-  { name: 'dashboards.v2', path: 'o11y/v2/dashboards', method: 'GET' },
-  // ── Service map / APM ──
-  { name: 'services.list', path: 'o11y/v1/services/list', method: 'GET' },
-  {
-    name: 'services',
-    path: 'o11y/v1/services',
-    method: 'POST',
-    body: { start: startNs, end: endNs, tags: [] },
-  },
-  {
-    name: 'dependency_graph',
-    path: 'o11y/v1/dependency_graph',
-    method: 'POST',
-    body: { start: startNs, end: endNs, tags: [] },
-  },
-  {
-    name: 'service.top_operations',
-    path: 'o11y/v1/service/top_operations',
-    method: 'POST',
-    body: { start: startNs, end: endNs, service: '' },
-  },
-  // ── Infra ──
-  {
-    name: 'hosts.list',
-    path: 'o11y/v1/hosts/list',
-    method: 'POST',
-    body: { start: startMs, end: endMs, filters: { op: 'AND', items: [] } },
-  },
-  {
-    name: 'pods.list',
-    path: 'o11y/v1/pods/list',
-    method: 'POST',
-    body: { start: startMs, end: endMs, filters: { op: 'AND', items: [] } },
-  },
-  {
-    name: 'nodes.list',
-    path: 'o11y/v1/nodes/list',
-    method: 'POST',
-    body: { start: startMs, end: endMs, filters: { op: 'AND', items: [] } },
-  },
-  {
-    name: 'namespaces.list',
-    path: 'o11y/v1/namespaces/list',
-    method: 'POST',
-    body: { start: startMs, end: endMs, filters: { op: 'AND', items: [] } },
-  },
-  {
-    name: 'clusters.list',
-    path: 'o11y/v1/clusters/list',
-    method: 'POST',
-    body: { start: startMs, end: endMs, filters: { op: 'AND', items: [] } },
-  },
-  // ── Exceptions ──
-  {
-    name: 'listErrors',
-    path: 'o11y/v1/listErrors',
-    method: 'POST',
-    body: { start: startNs, end: endNs, limit: 50, order: 'descending', orderParam: 'exceptionCount' },
-  },
-  {
-    name: 'countErrors',
-    path: 'o11y/v1/countErrors',
-    method: 'POST',
-    body: { start: startNs, end: endNs },
-  },
-  // ── Health (sanity: proves the runtime is reachable) ──
-  { name: 'health', path: 'o11y/v1/health', method: 'GET' },
-  { name: 'version', path: 'o11y/v1/version', method: 'GET' },
-  // ── Alerts (known-good baseline — AlertsModule already uses this) ──
-  { name: 'rules', path: 'o11y/v1/rules', method: 'GET' },
-]
-
-test('probe o11y endpoints (live, authenticated)', async ({ page }) => {
-  test.setTimeout(180_000)
-  if (!PASSWORD) throw new Error('HANZO_PASSWORD required for the live probe')
-  await signIn(page)
-
-  const results = await page.evaluate(
-    async ({ probes }: { probes: Probe[] }) => {
-      const out: { name: string; status: number; ok: boolean; snippet: string }[] = []
-      for (const p of probes) {
-        try {
-          const res = await fetch(`${window.location.origin}/v1/${p.path}`, {
-            method: p.method,
-            credentials: 'include',
-            headers: p.body !== undefined ? { 'Content-Type': 'application/json' } : {},
-            body: p.body !== undefined ? JSON.stringify(p.body) : undefined,
-          })
-          const text = await res.text()
-          out.push({ name: p.name, status: res.status, ok: res.ok, snippet: text.slice(0, 240) })
-        } catch (e) {
-          out.push({ name: p.name, status: -1, ok: false, snippet: String(e).slice(0, 240) })
-        }
-      }
-      return out
-    },
-    { probes: PROBES },
-  )
-
-  console.log('\n================ O11Y LIVE PROBE ================')
-  for (const r of results) {
-    console.log(`\n[${r.status}] ${r.name}`)
-    console.log(`   ${r.snippet.replace(/\n/g, ' ')}`)
-  }
-  console.log('\n================ END PROBE ================\n')
-})

ee/.eslintrc.js

@@ -0,0 +1,8 @@
+/** @type {import("eslint").Linter.Config} */
+module.exports = {
+  extends: ["@repo/eslint-config/library.js"],
+  parser: "@typescript-eslint/parser",
+  parserOptions: {
+    project: true,
+  },
+};

ee/LICENSE

@@ -0,0 +1,37 @@
+Langfuse Enterprise License (the “Enterprise License”)
+Copyright (c) 2024 Langfuse GmbH ('Langfuse')
+
+With regard to the Langfuse Software:
+This software and associated documentation files (the "Software") may only be
+used in production, if you (and any entity that you represent) have agreed to,
+and are in compliance with, the Langfuse Terms of Service, available
+at https://langfuse.com/terms (the “Enterprise Terms”), or other
+agreement governing the use of the Software, as agreed by you and Langfuse,
+and otherwise have a valid Langfuse Enterprise license.
+
+Subject to the foregoing sentence, you are free to
+modify this Software and publish patches to the Software. You agree that Langfuse
+and/or its licensors (as applicable) retain all right, title and interest in and
+to all such modifications and/or patches, and all such modifications and/or
+patches may only be used, copied, modified, displayed, distributed, or otherwise
+exploited with a valid Langfuse Enterprise license.
+
+Notwithstanding the foregoing, you may copy and modify
+the Software for development and testing purposes, without requiring a
+subscription. You agree that Langfuse and/or its licensors (as applicable) retain
+all right, title and interest in and to all such modifications. You are not
+granted any other rights beyond what is expressly stated herein. Subject to the
+foregoing, it is forbidden to copy, merge, publish, distribute, sublicense,
+and/or sell the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+For all third party components incorporated into the Langfuse Software, those
+components are licensed under the original license provided by the owner of the 
+applicable component.

ee/Readme.md

@@ -0,0 +1,5 @@
+# Enterprise Edition
+
+This folder includes features that are only available in the Enterprise Edition of Langfuse and on Langfuse Cloud.
+
+See [LICENSE](../LICENSE) and [docs](https://langfuse.com/docs/open-source) for more details.

ee/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@langfuse/ee",
+  "version": "1.0.0",
+  "private": true,
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/src/index.js",
+      "require": "./dist/src/index.js"
+    },
+    "./sso": {
+      "import": "./dist/src/sso/index.js",
+      "require": "./dist/src/sso/index.js"
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "lint": "eslint . --ext .js,.jsx,.ts,.tsx",
+    "lint:fix": "eslint . --ext .js,.jsx,.ts,.tsx --fix"
+  },
+  "dependencies": {
+    "@langfuse/shared": "workspace:*",
+    "next": "^14.2.3",
+    "next-auth": "^4.24.7",
+    "zod": "^3.22.4"
+  },
+  "devDependencies": {
+    "@repo/eslint-config": "*",
+    "@repo/typescript-config": "*",
+    "@types/node": "^20.11.29",
+    "@typescript-eslint/parser": "^7.7.0",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-config-standard": "^17.1.0",
+    "eslint-plugin-prettier": "^5.1.3",
+    "prettier": "^3.2.5",
+    "ts-node": "^10.9.2",
+    "tsc-watch": "^6.2.0",
+    "typescript": "^5.4.5"
+  }
+}

ee/prettierrc.json

@@ -0,0 +1,4 @@
+{
+  "trailingComma": "es5",
+  "printWidth": 120
+}

ee/src/ee-license-check/index.ts

@@ -0,0 +1,4 @@
+import { env } from "../env";
+
+export const isEeAvailable: boolean =
+  env.NEXT_PUBLIC_LANGFUSE_CLOUD_REGION !== undefined;

ee/src/env.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+import { env as sharedEnv } from "@langfuse/shared";
+
+const EnvSchema = z.object({
+  NEXT_PUBLIC_LANGFUSE_CLOUD_REGION: z.string().optional(),
+  ADMIN_API_KEY: z.string().optional(),
+});
+
+export const env = { ...sharedEnv, ...EnvSchema.parse(process.env) };

ee/src/index.ts

@@ -0,0 +1 @@
+export { isEeAvailable } from "./ee-license-check";

ee/src/sso/index.ts

@@ -0,0 +1,236 @@
+import { type Provider } from "next-auth/providers/index";
+import GoogleProvider from "next-auth/providers/google";
+import GitHubProvider from "next-auth/providers/github";
+import OktaProvider from "next-auth/providers/okta";
+import Auth0Provider from "next-auth/providers/auth0";
+import AzureADProvider from "next-auth/providers/azure-ad";
+import { isEeAvailable } from "..";
+import { prisma } from "@langfuse/shared/src/db";
+import { encrypt, decrypt } from "@langfuse/shared/encryption";
+import { SsoProviderSchema } from "./types";
+import { type NextApiRequest, type NextApiResponse } from "next";
+import { env } from "../env";
+
+// Local cache for SSO configurations
+let cachedSsoConfigs: {
+  data: SsoProviderSchema[];
+  timestamp: number;
+} | null = null;
+
+/**
+ * Get all SSO configurations from the database or from local cache and parse them into SsoProviderSchema objects.
+ *
+ * @returns {Promise<SsoProviderSchema[]>} - A list of all SSO configurations. Empty array if none are configured or EE is not available.
+ */
+async function getSsoConfigs(): Promise<SsoProviderSchema[]> {
+  if (!isEeAvailable) return [];
+  const CACHE_TTL = 60 * 1000; // 1 minute
+
+  // Set/refresh the cache if it's empty or expired
+  if (
+    cachedSsoConfigs === null ||
+    Date.now() - cachedSsoConfigs.timestamp > CACHE_TTL
+  ) {
+    // transform into zod object
+    const dbConfigs = await prisma.ssoConfig.findMany();
+    const parsedSsoConfigs = dbConfigs
+      .map((v) => {
+        try {
+          const parsedValue = SsoProviderSchema.parse(v);
+          return parsedValue;
+        } catch (e) {
+          console.error(
+            `Failed to parse SSO provider config for domain ${v.domain}`,
+            e
+          );
+          return null;
+        }
+      })
+      .filter((parsed) => parsed !== null) as SsoProviderSchema[];
+
+    cachedSsoConfigs = {
+      data: parsedSsoConfigs,
+      timestamp: Date.now(),
+    };
+  }
+
+  return cachedSsoConfigs.data;
+}
+
+/**
+ * Load all custom SSO providers from the database. To be used within `providers` in NextAuth backend configuration.
+ *
+ * @returns {Promise<Provider[]>} - A list of all custom SSO providers.
+ */
+export async function loadSsoProviders(): Promise<Provider[]> {
+  if (!isEeAvailable) return [];
+
+  const ssoConfigs = await getSsoConfigs();
+
+  const providers: Provider[] = [];
+
+  for (const dbSsoConfig of ssoConfigs) {
+    const provider = dbToNextAuthProvider(dbSsoConfig);
+    if (provider !== null) providers.push(provider);
+  }
+
+  return providers;
+}
+
+/**
+ * @returns `true` if any custom SSO provider is configured in the database.
+ */
+export async function isAnySsoConfigured(): Promise<boolean> {
+  if (!isEeAvailable) return false;
+  const ssoConfigs = await getSsoConfigs();
+  return ssoConfigs.length > 0;
+}
+
+/**
+ * Get the custom SSO providerId for a domain. To be used with NextAuth's `signIn(providerId)`.
+ *
+ * @param domain - The domain to check for a custom SSO provider, e.g. "example.com".
+ * @returns `providerId` or null if none is configured or EE is not available.
+ */
+export async function getSsoAuthProviderIdForDomain(
+  domain: string
+): Promise<string | null> {
+  if (!isEeAvailable) return null;
+  const ssoConfig = (await getSsoConfigs()).find(
+    (ssoConfig) => ssoConfig.domain === domain.toLowerCase()
+  );
+
+  if (!ssoConfig) return null;
+  return getAuthProviderIdForSsoConfig(ssoConfig);
+}
+
+/**
+ * Converts a SsoProviderConfig to a NextAuth Provider instance.
+ *
+ * @param {SsoProviderSchema} provider - The SSO configuration from the database.
+ * @returns {Provider | null} - A NextAuth Provider instance or null if parsing fails or no custom credentials are used for this SSO config.
+ */
+const dbToNextAuthProvider = (provider: SsoProviderSchema): Provider | null => {
+  // If the SsoConfig does not use custom credentials, return null as no additional provider needs to be added to NextAuth
+  if (!provider.authConfig) return null;
+
+  if (provider.authProvider === "google")
+    return GoogleProvider({
+      id: getAuthProviderIdForSsoConfig(provider), // use the domain as the provider id as we use domain-specific credentials
+      ...provider.authConfig,
+      clientSecret: decrypt(provider.authConfig.clientSecret),
+    });
+  else if (provider.authProvider === "github")
+    return GitHubProvider({
+      id: getAuthProviderIdForSsoConfig(provider), // use the domain as the provider id as we use domain-specific credentials
+      ...provider.authConfig,
+      clientSecret: decrypt(provider.authConfig.clientSecret),
+    });
+  else if (provider.authProvider === "auth0")
+    return Auth0Provider({
+      id: getAuthProviderIdForSsoConfig(provider), // use the domain as the provider id as we use domain-specific credentials
+      ...provider.authConfig,
+      clientSecret: decrypt(provider.authConfig.clientSecret),
+    });
+  else if (provider.authProvider === "okta")
+    return OktaProvider({
+      id: getAuthProviderIdForSsoConfig(provider), // use the domain as the provider id as we use domain-specific credentials
+      ...provider.authConfig,
+      clientSecret: decrypt(provider.authConfig.clientSecret),
+    });
+  else if (provider.authProvider === "azure-ad")
+    return AzureADProvider({
+      id: getAuthProviderIdForSsoConfig(provider), // use the domain as the provider id as we use domain-specific credentials
+      ...provider.authConfig,
+      clientSecret: decrypt(provider.authConfig.clientSecret),
+    });
+  else {
+    // Type check to ensure we handle all providers
+    // eslint-disable-next-line no-unused-vars
+    const _: never = provider;
+    throw new Error(
+      `Unrecognized SSO provider for domain ${(provider as any).domain}`
+    );
+  }
+};
+
+/**
+ * Get the custom SSO providerId for a database SSO configuration. To be used with NextAuth's `signIn(providerId)`.
+ *
+ * @param {DbSsoConfig} dbSsoConfig - The SSO configuration from the database.
+ * @returns {string} - The providerId used in NextAuth.
+ */
+const getAuthProviderIdForSsoConfig = (
+  dbSsoConfig: SsoProviderSchema
+): string => {
+  if (!dbSsoConfig.authConfig) return dbSsoConfig.authProvider;
+  return `${dbSsoConfig.domain}.${dbSsoConfig.authProvider}`;
+};
+
+export async function createNewSsoConfigHandler(
+  req: NextApiRequest,
+  res: NextApiResponse
+) {
+  try {
+    if (!isEeAvailable) {
+      res.status(403).json({ error: "EE is not available" });
+      return;
+    }
+    // allow only POST requests
+    if (req.method !== "POST") {
+      res.status(405).json({ error: "Method Not Allowed" });
+      return;
+    }
+    // check if ADMIN_API_KEY is set
+    if (!env.ADMIN_API_KEY) {
+      res.status(500).json({ error: "ADMIN_API_KEY is not set" });
+      return;
+    }
+    if (!env.ENCRYPTION_KEY) {
+      res.status(500).json({ error: "ENCRYPTION_KEY is not set" });
+      return;
+    }
+    // check bearer token
+    const { authorization } = req.headers;
+    if (!authorization) {
+      res
+        .status(401)
+        .json({ error: "Unauthorized: No authorization header provided" });
+      return;
+    }
+    const [scheme, token] = authorization.split(" ");
+    if (scheme !== "Bearer" || !token || token !== env.ADMIN_API_KEY) {
+      res.status(401).json({ error: "Unauthorized: Invalid token" });
+      return;
+    }
+
+    const body = SsoProviderSchema.safeParse(req.body);
+    if (!body.success) {
+      res.status(400).json({ error: body.error });
+      return;
+    }
+
+    const { domain, authProvider, authConfig } = body.data;
+
+    const encryptedClientSecret = authConfig
+      ? {
+          ...authConfig,
+          clientSecret: encrypt(authConfig.clientSecret),
+        }
+      : undefined;
+
+    await prisma.ssoConfig.create({
+      data: {
+        domain,
+        authProvider,
+        authConfig: encryptedClientSecret,
+      },
+    });
+    res.status(201).json({
+      message: "SSO configuration created successfully",
+    });
+  } catch (e) {
+    console.log(e);
+    res.status(500).json({ error: "Internal Server Error" });
+  }
+}

ee/src/sso/types.ts

@@ -0,0 +1,81 @@
+import { z } from "zod";
+
+const base = z.object({
+  domain: z.string().refine((v) => v === v.toLowerCase(), {
+    message: "Domain must be lowercase",
+  }),
+});
+
+export const GoogleProviderSchema = base.extend({
+  authProvider: z.literal("google"),
+  authConfig: z
+    .object({
+      clientId: z.string(),
+      clientSecret: z.string(),
+      allowDangerousEmailAccountLinking: z.boolean().optional().default(false),
+    })
+    .nullish(),
+});
+
+export const GithubProviderSchema = base.extend({
+  authProvider: z.literal("github"),
+  authConfig: z
+    .object({
+      clientId: z.string(),
+      clientSecret: z.string(),
+      allowDangerousEmailAccountLinking: z.boolean().optional().default(false),
+    })
+    .nullish(),
+});
+
+export const Auth0ProviderSchema = base.extend({
+  authProvider: z.literal("auth0"),
+  authConfig: z
+    .object({
+      clientId: z.string(),
+      clientSecret: z.string(),
+      issuer: z.string(),
+      allowDangerousEmailAccountLinking: z.boolean().optional().default(false),
+    })
+    .nullish(),
+});
+
+export const OktaProviderSchema = base.extend({
+  authProvider: z.literal("okta"),
+  authConfig: z
+    .object({
+      clientId: z.string(),
+      clientSecret: z.string(),
+      issuer: z.string(),
+      allowDangerousEmailAccountLinking: z.boolean().optional().default(false),
+    })
+    .nullish(),
+});
+
+export const AzureAdProviderSchema = base.extend({
+  authProvider: z.literal("azure-ad"),
+  authConfig: z
+    .object({
+      clientId: z.string(),
+      clientSecret: z.string(),
+      tenantId: z.string(),
+      allowDangerousEmailAccountLinking: z.boolean().optional().default(false),
+    })
+    .nullish(),
+});
+
+export type GoogleProviderSchema = z.infer<typeof GoogleProviderSchema>;
+export type GithubProviderSchema = z.infer<typeof GithubProviderSchema>;
+export type Auth0ProviderSchema = z.infer<typeof Auth0ProviderSchema>;
+export type OktaProviderSchema = z.infer<typeof OktaProviderSchema>;
+export type AzureAdProviderSchema = z.infer<typeof AzureAdProviderSchema>;
+
+export const SsoProviderSchema = z.discriminatedUnion("authProvider", [
+  GoogleProviderSchema,
+  GithubProviderSchema,
+  Auth0ProviderSchema,
+  OktaProviderSchema,
+  AzureAdProviderSchema,
+]);
+
+export type SsoProviderSchema = z.infer<typeof SsoProviderSchema>;

ee/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "extends": "@repo/typescript-config/base.json",
+  "compilerOptions": {
+    "moduleResolution": "NodeNext",
+    "module": "NodeNext",
+    "lib": ["ES2020"],
+    "outDir": "./dist",
+    "types": ["node"],
+    "target": "ES2020",
+    "rootDir": "."
+  },
+  "include": ["."],
+  "exclude": ["node_modules", "dist"]
+}

fern/apis/client/definition/api.yml

@@ -0,0 +1,11 @@
+name: langfuse
+error-discrimination:
+  strategy: status-code
+auth: bearer
+imports:
+  commons: commons.yml
+errors:
+  - commons.Error
+  - commons.UnauthorizedError
+  - commons.AccessDeniedError
+  - commons.MethodNotAllowedError

fern/apis/client/definition/commons.yml

@@ -0,0 +1,13 @@
+errors:
+  Error:
+    status-code: 400
+    type: string
+  UnauthorizedError:
+    status-code: 401
+    type: string
+  AccessDeniedError:
+    status-code: 403
+    type: string
+  MethodNotAllowedError:
+    status-code: 405
+    type: string

fern/apis/client/definition/score.yml

@@ -0,0 +1,31 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fern-api/fern/main/fern.schema.json
+
+service:
+  auth: true
+  base-path: /api/public
+  endpoints:
+    create:
+      docs: Add a score to the database, upserts on id
+      method: POST
+      path: /scores
+      request: CreateScoreRequest
+      response: Score
+
+types:
+  CreateScoreRequest:
+    properties:
+      id: optional<string>
+      traceId: string
+      name: string
+      value: double
+      observationId: optional<string>
+      comment: optional<string>
+  Score:
+    properties:
+      id: string
+      traceId: string
+      name: string
+      value: double
+      observationId: optional<string>
+      timestamp: datetime
+      comment: optional<string>

fern/apis/client/generators.yml

@@ -0,0 +1,21 @@
+default-group: local
+groups:
+  local:
+    generators:
+      # - name: fernapi/fern-typescript-browser-sdk
+      #   version: 0.7.1
+      #   output:
+      #     location: npm
+      #     url: npm.buildwithfern.com
+      #     package-name: "@finto-fern/react-client"
+      #   config:
+      #     namespaceExport: Langfuse
+      #     allowCustomFetcher: true
+      - name: fernapi/fern-openapi
+        version: 0.0.26
+        output:
+          location: local-file-system
+          path: ../../../web/public/generated/api-client
+        config:
+          namespaceExport: Langfuse
+          allowCustomFetcher: true

fern/apis/server/definition/api.yml

@@ -0,0 +1,29 @@
+name: langfuse
+docs: |
+  ## Authentication
+
+  Authenticate with the API using [Basic Auth](https://en.wikipedia.org/wiki/Basic_access_authentication), get API keys in the project settings:
+
+  - username: Langfuse Public Key
+  - password: Langfuse Secret Key
+
+  ## Exports
+
+  - OpenAPI spec: https://cloud.langfuse.com/generated/api/openapi.yml
+  - Postman collection: https://cloud.langfuse.com/generated/postman/collection.json
+
+error-discrimination:
+  strategy: status-code
+auth: basic
+imports:
+  commons: commons.yml
+errors:
+  - commons.Error
+  - commons.UnauthorizedError
+  - commons.AccessDeniedError
+  - commons.MethodNotAllowedError
+  - commons.NotFoundError
+headers:
+  X-Langfuse-Sdk-Name: optional<string>
+  X-Langfuse-Sdk-Version: optional<string>
+  X-Langfuse-Public-Key: optional<string>

fern/apis/server/definition/commons.yml

@@ -0,0 +1,231 @@
+types:
+  # Objects
+  Trace:
+    properties:
+      id:
+        type: string
+        docs: The unique identifier of a trace
+      timestamp: datetime
+      name: optional<string>
+      input: optional<unknown>
+      output: optional<unknown>
+      sessionId: optional<string>
+      release: optional<string>
+      version: optional<string>
+      userId: optional<string>
+      metadata: optional<unknown>
+      tags: optional<list<string>>
+      public:
+        type: optional<boolean>
+        docs: Public traces are accessible via url without login
+  TraceWithDetails: # GET /traces
+    extends: Trace
+    properties:
+      htmlPath:
+        type: string
+        docs: Path of trace in Langfuse UI
+      latency:
+        type: double
+        docs: Latency of trace in seconds
+      totalCost:
+        type: double
+        docs: Cost of trace in USD
+      observations:
+        type: list<string>
+        docs: List of observation ids
+      scores:
+        type: list<string>
+        docs: List of score ids
+  TraceWithFullDetails: # GET traces/[traceID]
+    extends: Trace
+    properties:
+      htmlPath:
+        type: string
+        docs: Path of trace in Langfuse UI
+      totalCost:
+        type: double
+        docs: Cost of trace in USD
+      observations: list<ObservationsView>
+      scores: list<Score>
+  Session:
+    properties:
+      id: string
+      createdAt: datetime
+      projectId: string
+  SessionWithTraces:
+    extends: Session
+    properties:
+      traces: list<Trace>
+  Observation:
+    properties:
+      id: string
+      traceId: optional<string>
+      type: string
+      name: optional<string>
+      startTime: datetime
+      endTime: optional<datetime>
+      completionStartTime: optional<datetime>
+      model: optional<string>
+      modelParameters: optional<map<string, MapValue>>
+      input: optional<unknown>
+      version: optional<string>
+      metadata: optional<unknown>
+      output: optional<unknown>
+      usage: optional<Usage>
+      level: ObservationLevel
+      statusMessage: optional<string>
+      parentObservationId: optional<string>
+      promptId: optional<string>
+
+  ObservationsView:
+    extends: Observation
+    properties:
+      modelId: optional<string>
+      inputPrice: optional<double>
+      outputPrice: optional<double>
+      totalPrice: optional<double>
+      calculatedInputCost: optional<double>
+      calculatedOutputCost: optional<double>
+      calculatedTotalCost: optional<double>
+      latency: optional<double>
+
+  Usage:
+    docs: Standard interface for usage and cost
+    properties:
+      input:
+        docs: Number of input units (e.g. tokens)
+        type: optional<integer>
+      output:
+        docs: Number of output units (e.g. tokens)
+        type: optional<integer>
+      total:
+        docs: Defaults to input+output if not set
+        type: optional<integer>
+      unit: optional<ModelUsageUnit>
+      inputCost:
+        docs: USD input cost
+        type: optional<double>
+      outputCost:
+        docs: USD output cost
+        type: optional<double>
+      totalCost:
+        docs: USD total cost, defaults to input+output
+        type: optional<double>
+
+  Score:
+    properties:
+      id: string
+      traceId: string
+      name: string
+      value: double
+      source: ScoreSource
+      observationId: optional<string>
+      timestamp: datetime
+      comment: optional<string>
+  DatasetCore:
+    properties:
+      id: string
+      name: string
+      description: optional<string>
+      metadata: optional<unknown>
+      projectId: string
+      createdAt: datetime
+      updatedAt: datetime
+  DatasetWithReferences: # GET datasets
+    extends: DatasetCore
+    properties:
+      items:
+        type: list<string>
+        docs: list of dataset item ids
+      runs:
+        type: list<string>
+        docs: list of dataset run names
+  Dataset: # GET datasets/[name]
+    docs: Dataset including all items
+    extends: DatasetCore
+    properties:
+      items: list<DatasetItem>
+      runs: list<string>
+  DatasetItem:
+    properties:
+      id: string
+      status: DatasetStatus
+      input: optional<unknown>
+      expectedOutput: optional<unknown>
+      metadata: optional<unknown>
+      sourceTraceId: optional<string>
+      sourceObservationId: optional<string>
+      datasetId: string
+      datasetName: string
+      createdAt: datetime
+      updatedAt: datetime
+  DatasetRunItem:
+    properties:
+      id: string
+      datasetRunId: string
+      datasetRunName: string
+      datasetItemId: string
+      traceId: string
+      observationId: optional<string>
+      createdAt: datetime
+      updatedAt: datetime
+  DatasetRun:
+    properties:
+      id: string
+      name: string
+      description: optional<string>
+      metadata: optional<unknown>
+      datasetId: string
+      datasetName: string
+      createdAt: datetime
+      updatedAt: datetime
+      datasetRunItems: list<DatasetRunItem>
+
+  # Utilities
+  ModelUsageUnit:
+    docs: Unit of usage in Langfuse
+    enum:
+      - CHARACTERS
+      - TOKENS
+      - MILLISECONDS
+      - SECONDS
+      - IMAGES
+  ObservationLevel:
+    enum:
+      - DEBUG
+      - DEFAULT
+      - WARNING
+      - ERROR
+  MapValue:
+    discriminated: false
+    union:
+      - optional<string>
+      - optional<integer>
+      - optional<boolean>
+      - optional<list<string>>
+  DatasetStatus:
+    enum:
+      - ACTIVE
+      - ARCHIVED
+  ScoreSource:
+    enum:
+      - API
+      - REVIEW
+      - EVAL
+
+errors:
+  Error:
+    status-code: 400
+    type: unknown
+  UnauthorizedError:
+    status-code: 401
+    type: unknown
+  AccessDeniedError:
+    status-code: 403
+    type: unknown
+  NotFoundError:
+    status-code: 404
+    type: unknown
+  MethodNotAllowedError:
+    status-code: 405
+    type: unknown