lazy load zod proposal

this still requires zod to be unbundled in the "scope" feature
2025-12-22 04:34:27 +08:00 · 2025-11-06 17:30:18 +01:00
239 changed files with 2968 additions and 10861 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -98,7 +98,6 @@
 /apps/correlations @grafana/datapro
 /apps/example/ @grafana/grafana-app-platform-squad
 /apps/logsdrilldown/ @grafana/observability-logs
-/apps/annotation/ @grafana/grafana-backend-services-squad
 /pkg/api/ @grafana/grafana-backend-group
 /pkg/apis/ @grafana/grafana-app-platform-squad
 /pkg/apis/query @grafana/grafana-datasources-core-services
@@ -227,7 +226,6 @@
 /devenv/datasources.yaml @grafana/grafana-backend-group
 /devenv/datasources_docker.yaml @grafana/grafana-backend-group
 /devenv/dev-dashboards-without-uid/ @grafana/dashboards-squad
-/devenv/scopes/ @grafana/grafana-operator-experience-squad

 /devenv/dev-dashboards/annotations @grafana/dataviz-squad
 /devenv/dev-dashboards/migrations @grafana/dataviz-squad
@@ -254,6 +252,7 @@
 /devenv/dev-dashboards/all-panels.json @grafana/dataviz-squad
 /devenv/dev-dashboards/dashboards.go @grafana/dataviz-squad
 /devenv/dev-dashboards/home.json @grafana/dataviz-squad
+
 /devenv/dev-dashboards/datasource-elasticsearch/ @grafana/partner-datasources
 /devenv/dev-dashboards/datasource-opentsdb/ @grafana/partner-datasources
 /devenv/dev-dashboards/datasource-influxdb/ @grafana/partner-datasources
@@ -549,7 +548,6 @@ i18next.config.ts @grafana/grafana-frontend-platform
 /packages/grafana-data/src/geo/ @grafana/dataviz-squad
 /packages/grafana-data/src/monaco/ @grafana/partner-datasources
 /packages/grafana-data/src/panel/ @grafana/dashboards-squad
-/packages/grafana-data/src/panel/suggestions/ @grafana/dataviz-squad
 /packages/grafana-data/src/query/ @grafana/grafana-datasources-core-services
 /packages/grafana-data/src/rbac/ @grafana/access-squad
 /packages/grafana-data/src/table/ @grafana/dataviz-squad
--- a/.github/workflows/pr-test-integration.yml
+++ b/.github/workflows/pr-test-integration.yml
@@ -150,16 +150,10 @@ jobs:
              echo "✅ $full_pkg passed"
            fi
          done
-          # Set output for artifact upload
-          if [ $EXIT_CODE -ne 0 ]; then
-            echo "upload_artifacts=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "upload_artifacts=false" >> "$GITHUB_OUTPUT"
-          fi
          exit $EXIT_CODE
      - name: Output test profiles and traces
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v4
-        if: matrix.shard == 'profiled' && !cancelled() && steps.run-profiled-tests.outputs.upload_artifacts == 'true'
+        if: (matrix.shard == 'profiled' && !cancelled())
        with:
          name: integration-test-profiles-sqlite-nocgo-${{ github.run_number }}
          path: profiles/
--- a/1
+++ b/1
@@ -95,7 +95,6 @@ COPY pkg/aggregator pkg/aggregator
 COPY apps/playlist apps/playlist
 COPY apps/plugins apps/plugins
 COPY apps/shorturl apps/shorturl
-COPY apps/annotation apps/annotation
 COPY apps/correlations apps/correlations
 COPY apps/preferences apps/preferences
 COPY apps/provisioning apps/provisioning
--- a/apps/advisor/go.mod
+++ b/apps/advisor/go.mod
@@ -68,13 +68,13 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/at-wat/mqtt-go v0.19.4 // indirect
 	github.com/aws/aws-sdk-go v1.55.7 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.39.1 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.14 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.38.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 // indirect
 	github.com/aws/smithy-go v1.23.1 // indirect
 	github.com/barkimedes/go-deepcopy v0.0.0-20220514131651-17c30cfc62df // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
@@ -91,6 +91,7 @@ require (
 	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/diegoholiveira/jsonlogic/v3 v3.7.4 // indirect
@@ -113,7 +114,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
-	github.com/go-logfmt/logfmt v0.6.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.24.0 // indirect
@@ -158,7 +159,7 @@ require (
 	github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
 	github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4 // indirect
-	github.com/grafana/grafana-aws-sdk v1.3.0 // indirect
+	github.com/grafana/grafana-aws-sdk v1.2.0 // indirect
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 // indirect
 	github.com/grafana/grafana/apps/plugins v0.0.0 // indirect
 	github.com/grafana/grafana/apps/provisioning v0.0.0 // indirect
@@ -198,6 +199,7 @@ require (
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lestrrat-go/strftime v1.0.4 // indirect
 	github.com/lib/pq v1.10.9 // indirect
+	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattetti/filebuffer v1.0.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
@@ -250,6 +252,7 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/cors v1.11.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
@@ -262,7 +265,11 @@ require (
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tetratelabs/wazero v1.8.2 // indirect
 	github.com/thomaspoignant/go-feature-flag v1.42.0 // indirect
-	github.com/tjhop/slog-gokit v0.1.5 // indirect
+	github.com/tjhop/slog-gokit v0.1.3 // indirect
+	github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 // indirect
+	github.com/unknwon/com v1.0.1 // indirect
+	github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a // indirect
+	github.com/urfave/cli v1.22.17 // indirect
 	github.com/woodsbury/decimal128 v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
@@ -312,6 +319,7 @@ require (
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/mail.v2 v2.3.1 // indirect
--- a/apps/advisor/go.sum
+++ b/apps/advisor/go.sum
@@ -173,42 +173,42 @@ github.com/aws/aws-sdk-go v1.17.7/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN
 github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
-github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.38.1 h1:j7sc33amE74Rz0M/PoCpsZQ6OunLqys/m5antM0J+Z8=
+github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
-github.com/aws/aws-sdk-go-v2/config v1.31.10 h1:7LllDZAegXU3yk41mwM6KcPu0wmjKGQB1bg99bNdQm4=
-github.com/aws/aws-sdk-go-v2/config v1.31.10/go.mod h1:Ge6gzXPjqu4v0oHvgAwvGzYcK921GU0hQM25WF/Kl+8=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14 h1:TxkI7QI+sFkTItN/6cJuMZEIVMFXeu2dI1ZffkXngKI=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14/go.mod h1:12x4Uw/vijC11XkctTjy92TNCQ+UnNJkT7fzX0Yd93E=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 h1:gLD09eaJUdiszm7vd1btiQUYE0Hj+0I2b8AS+75z9AY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8/go.mod h1:4RW3oMPt1POR74qVOC4SbubxAwdP4pCT0nSw3jycOU4=
+github.com/aws/aws-sdk-go-v2/config v1.31.2 h1:NOaSZpVGEH2Np/c1toSeW0jooNl+9ALmsUTZ8YvkJR0=
+github.com/aws/aws-sdk-go-v2/config v1.31.2/go.mod h1:17ft42Yb2lF6OigqSYiDAiUcX4RIkEMY6XxEMJsrAes=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6 h1:AmmvNEYrru7sYNJnp3pf57lGbiarX4T9qU/6AZ9SucU=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6/go.mod h1:/jdQkh1iVPa01xndfECInp1v1Wnp70v3K4MvtlLGVEc=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 h1:lpdMwTzmuDLkgW7086jE94HweHCqG+uOJwHf3LZs7T0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 h1:cTXRdLkpBanlDwISl+5chq5ui1d1YWg4PWMR9c3kXyw=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84/go.mod h1:kwSy5X7tfIHN39uucmjQVs2LvDdXEjQucgQQEqCggEo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 h1:IdCLsiiIj5YJ3AFevsewURCPV+YWUlOW8JiPhoAy8vg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 h1:j7vjtr1YIssWQOMeOWRbh3z8g2oY/xPjnZH2gLY4sGw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36/go.mod h1:gDhdAV6wL3PmPqBhiPbnlS447GoWs8HTTOYef9/9Inw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 h1:ueB2Te0NacDMnaC+68za9jLwkjzxGWm0KB5HTUHjLTI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4/go.mod h1:nLEfLnVMmLvyIG58/6gsSA03F1voKGaCfHV7+lR8S7s=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 h1:0reDqfEN+tB+sozj2r92Bep8MEwBZgtAXTND1Kk9OXg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 h1:FTdEN9dtWPB0EOURNtDPmwGp6GGvMqRJCAihkSl/1No=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4/go.mod h1:mYubxV9Ff42fZH4kexj43gFPhgc/LyC7KqvUKt1watc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 h1:I7ghctfGXrscr7r1Ga/mDqSJKm7Fkpl5Mwq79Z+rZqU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0/go.mod h1:Zo9id81XP6jbayIFWNuDpA6lMBWhsVy+3ou2jLa4JnA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 h1:+LVB0xBqEgjQoqr9bGZbRzvg212B0f17JdflleJRNR4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5/go.mod h1:xoaxeqnnUaZjPjaICgIy5B+MHCSb/ZSOn4MvkFNOUA0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 h1:ve9dYBB8CfJGTFqcQ3ZLAAb/KXWgYlgu/2R2TZL2Ko0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2/go.mod h1:n9bTZFZcBa9hGGqVz3i/a6+NG0zmZgtkB9qVVFDqPA8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 h1:pd9G9HQaM6UZAZh19pYOkpKSQkyQQ9ftnl/LttQOcGI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2/go.mod h1:eknndR9rU8UpE/OmFpqU78V1EcXPKFTTm5l/buZYgvM=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 h1:iV1Ko4Em/lkJIsoKyGfc0nQySi+v0Udxr6Igq+y9JZc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0/go.mod h1:bEPcjW7IbolPfK67G1nilqWyoxYMSPrDiIQ3RdIdKgo=
 github.com/aws/smithy-go v1.23.1 h1:sLvcH6dfAFwGkHLZ7dGiYF7aK6mg4CgKA/iDKjLDt9M=
 github.com/aws/smithy-go v1.23.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/axiomhq/hyperloglog v0.0.0-20240507144631-af9851f82b27 h1:60m4tnanN1ctzIu4V3bfCNJ39BiOPSm1gHFlFjTkRE0=
@@ -334,7 +334,10 @@ github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03V
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cznic/b v0.0.0-20180115125044-35e9bbe41f07/go.mod h1:URriBxXwVq5ijiJ12C7iIZqlA69nTlI+LgI6/pwftG8=
 github.com/cznic/fileutil v0.0.0-20180108211300-6a051e75936f/go.mod h1:8S58EK26zhXSxzv7NQFpnliaOQsmDUxvoQO3rt154Vg=
@@ -453,8 +456,8 @@ github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXg
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
-github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
@@ -660,6 +663,9 @@ github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
+github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.1/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
@@ -683,8 +689,8 @@ github.com/grafana/grafana-app-sdk v0.48.1 h1:bKJadWH18WCpJ+Zk8AezRFXCcZgGredRv+
 github.com/grafana/grafana-app-sdk v0.48.1/go.mod h1:5LljCz+wvmGfkQ8ZKTOfserhtXNEF0cSFthoWShvN6c=
 github.com/grafana/grafana-app-sdk/logging v0.48.1 h1:veM0X5LAPyN3KsDLglWjIofndbGuf7MqnrDuDN+F/Ng=
 github.com/grafana/grafana-app-sdk/logging v0.48.1/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-aws-sdk v1.3.0 h1:/bfJzP93rCel1GbWoRSq0oUo424MZXt8jAp2BK9w8tM=
-github.com/grafana/grafana-aws-sdk v1.3.0/go.mod h1:VGycF0JkCGKND2O5je1ucOqPJ0ZNhZYzV3c2bNBAaGk=
+github.com/grafana/grafana-aws-sdk v1.2.0 h1:LLR4/g91WBuCRwm2cbWfCREq565+GxIFe08nqqIcIuw=
+github.com/grafana/grafana-aws-sdk v1.2.0/go.mod h1:bBo7qOmM3f61vO+2JxTolNUph1l2TmtzmWcU9/Im+8A=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 h1:FFcEA01tW+SmuJIuDbHOdgUBL+d7DPrZ2N4zwzPhfGk=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1/go.mod h1:Oi4anANlCuTCc66jCyqIzfVbgLXFll8Wja+Y4vfANlc=
 github.com/grafana/grafana-plugin-sdk-go v0.281.0 h1:V8dGyatzcOLQeivFhBV2JWMwTSZH/clDnpfKG9p3dTA=
@@ -827,6 +833,9 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6 h1:SwcnSwBR7X/5EHJQlXBockkJVIMRVt5yKaesBPMtyZQ=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6/go.mod h1:WrYiIuiXUMIvTDAQw97C+9l0CnBmCcvosPjN3XDqS/o=
+github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
@@ -873,6 +882,8 @@ github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/madflojo/testcerts v1.4.0 h1:I09gN0C1ly9IgeVNcAqKk8RAKIJTe3QnFrrPBDyvzN4=
 github.com/madflojo/testcerts v1.4.0/go.mod h1:MW8sh39gLnkKh4K0Nc55AyHEDl9l/FBLDUsQhpmkuo0=
+github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
+github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
@@ -1104,6 +1115,8 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/sagikazarmark/crypt v0.6.0/go.mod h1:U8+INwJo3nBv1m6A/8OBXAq7Jnpspk5AxSgDyEQcea8=
@@ -1119,6 +1132,7 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c h1:aqg5Vm5dwtvL+YgDpBcK1ITf3o96N/K7/wsRXQnUTEs=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c/go.mod h1:owqhoLW1qZoYLZzLnBw+QkPP9WZnjlSWihhxAJC1+/M=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 h1:OfRzdxCzDhp+rsKWXuOO2I/quKMJ/+TQwVbIP/gltZg=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92/go.mod h1:7/OT02F6S6I7v6WXb+IjhMuZEYfH/RJ5RwEWnEo5BMg=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -1127,6 +1141,10 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c h1:Ho+uVpkel/udgjbwB5Lktg9BtvJSh2DT0Hi6LPSyI2w=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
 github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
@@ -1171,6 +1189,7 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
@@ -1183,8 +1202,8 @@ github.com/thejerf/slogassert v0.3.4/go.mod h1:0zn9ISLVKo1aPMTqcGfG1o6dWwt+Rk574
 github.com/thomaspoignant/go-feature-flag v1.42.0 h1:C7embmOTzaLyRki+OoU2RvtVjJE9IrvgBA2C1mRN1lc=
 github.com/thomaspoignant/go-feature-flag v1.42.0/go.mod h1:y0QiWH7chHWhGATb/+XqwAwErORmPSH2MUsQlCmmWlM=
 github.com/tidwall/pretty v0.0.0-20180105212114-65a9db5fad51/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tjhop/slog-gokit v0.1.5 h1:ayloIUi5EK2QYB8eY4DOPO95/mRtMW42lUkp3quJohc=
-github.com/tjhop/slog-gokit v0.1.5/go.mod h1:yA48zAHvV+Sg4z4VRyeFyFUNNXd3JY5Zg84u3USICq0=
+github.com/tjhop/slog-gokit v0.1.3 h1:6SdexP3UIeg93KLFeiM1Wp1caRwdTLgsD/THxBUy1+o=
+github.com/tjhop/slog-gokit v0.1.3/go.mod h1:Bbu5v2748qpAWH7k6gse/kw3076IJf6owJmh7yArmJs=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
@@ -1194,6 +1213,16 @@ github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVK
 github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
 github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 h1:aVGB3YnaS/JNfOW3tiHIlmNmTDg618va+eT0mVomgyI=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8/go.mod h1:fVle4kNr08ydeohzYafr20oZzbAkhQT39gKK/pFQ5M4=
+github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
+github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
+github.com/unknwon/log v0.0.0-20150304194804-e617c87089d3/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a h1:vcrhXnj9g9PIE+cmZgaPSwOyJ8MAQTRmsgGrB0x5rF4=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
+github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo=
 github.com/wk8/go-ordered-map v1.0.0 h1:BV7z+2PaK8LTSd/mWgY12HyMAo5CEgkHqbkVq2thqr8=
 github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
 github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
@@ -1499,6 +1528,7 @@ golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191020152052-9984515f0562/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1862,6 +1892,8 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7 h1:XNNYLJHt73EyYiCZi6+xjupS9CpvmiDgjPTAjrBlQbo=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7/go.mod h1:Fyux9zXlo4rWoMSIzpn9fDAYjalPqJ/K1qJ27s+7ltE=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
--- a/apps/alerting/rules/definitions/alerting-manifest.yaml
+++ b/apps/alerting/rules/definitions/alerting-manifest.yaml
@@ -8,16 +8,7 @@ spec:
  preferredVersion: v0alpha1
  versions:
  - kinds:
-    - admission:
-        mutation:
-          operations:
-          - CREATE
-          - UPDATE
-        validation:
-          operations:
-          - CREATE
-          - UPDATE
-      conversion: false
+    - conversion: false
      kind: AlertRule
      plural: AlertRules
      schemas:
@@ -223,16 +214,7 @@ spec:
      - spec.panelRef.dashboardUID
      - spec.panelRef.panelID
      - spec.notificationSettings.receiver
-    - admission:
-        mutation:
-          operations:
-          - CREATE
-          - UPDATE
-        validation:
-          operations:
-          - CREATE
-          - UPDATE
-      conversion: false
+    - conversion: false
      kind: RecordingRule
      plural: RecordingRules
      schemas:
--- a/apps/alerting/rules/go.mod
+++ b/apps/alerting/rules/go.mod
@@ -5,7 +5,6 @@ go 1.25.3
 require (
 	github.com/grafana/grafana-app-sdk v0.48.1
 	github.com/grafana/grafana-app-sdk/logging v0.48.1
-	github.com/prometheus/common v0.67.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
 )
@@ -50,6 +49,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/puzpuzpuz/xsync/v2 v2.5.1 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
--- a/apps/alerting/rules/kinds/alertRule.cue
+++ b/apps/alerting/rules/kinds/alertRule.cue
@@ -13,18 +13,6 @@ alertRulev0alpha1: alertRuleKind & {
 	schema: {
 		spec: v0alpha1.AlertRuleSpec
 	}
-	validation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
-	mutation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
 	selectableFields: [
 		"spec.title",
 		"spec.paused",
--- a/apps/alerting/rules/kinds/recordingRule.cue
+++ b/apps/alerting/rules/kinds/recordingRule.cue
@@ -13,18 +13,6 @@ recordingRulev0alpha1: recordingRuleKind & {
 	schema: {
 		spec: v0alpha1.RecordingRuleSpec
 	}
-	validation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
-	mutation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
 	selectableFields: [
 		"spec.title",
 		"spec.paused",
--- a/apps/alerting/rules/pkg/apis/alerting/v0alpha1/alertrule_ext.go
+++ b/apps/alerting/rules/pkg/apis/alerting/v0alpha1/alertrule_ext.go
@@ -3,7 +3,6 @@ package v0alpha1
 import (
 	"fmt"
 	"slices"
-	"time"
 )

 func (o *AlertRule) GetProvenanceStatus() string {
@@ -49,78 +48,4 @@ func (s *AlertRuleSpec) ExecErrStateOrDefault() string {
 	return s.ExecErrState
 }

-func (d *AlertRulePromDuration) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *AlertRulePromDurationWMillis) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *AlertRulePromDuration) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = AlertRulePromDuration(clampedDuration)
-	return nil
-}
-
-func (d *AlertRulePromDurationWMillis) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = AlertRulePromDurationWMillis(clampedDuration)
-	return nil
-}
-
-func (spec *AlertRuleSpec) ClampDurations() error {
-	// clamp all duration fields
-	if err := spec.Trigger.Interval.Clamp(); err != nil {
-		return err
-	}
-	if spec.For != nil {
-		clamped, err := ClampDuration(*spec.For)
-		if err != nil {
-			return err
-		}
-		spec.For = &clamped
-	}
-	if spec.KeepFiringFor != nil {
-		clamped, err := ClampDuration(*spec.KeepFiringFor)
-		if err != nil {
-			return err
-		}
-		spec.KeepFiringFor = &clamped
-	}
-	if spec.NotificationSettings != nil {
-		if spec.NotificationSettings.GroupWait != nil {
-			if err := spec.NotificationSettings.GroupWait.Clamp(); err != nil {
-				return err
-			}
-		}
-		if spec.NotificationSettings.GroupInterval != nil {
-			if err := spec.NotificationSettings.GroupInterval.Clamp(); err != nil {
-				return err
-			}
-		}
-		if spec.NotificationSettings.RepeatInterval != nil {
-			if err := spec.NotificationSettings.RepeatInterval.Clamp(); err != nil {
-				return err
-			}
-		}
-	}
-	for k, expr := range spec.Expressions {
-		if expr.RelativeTimeRange != nil {
-			if err := expr.RelativeTimeRange.From.Clamp(); err != nil {
-				return err
-			}
-			if err := expr.RelativeTimeRange.To.Clamp(); err != nil {
-				return err
-			}
-			spec.Expressions[k] = expr
-		}
-	}
-	return nil
-}
+// TODO: add duration clamping for the field types AlertRulePromDuration, AlertRulePromDurationWMillis, and the For and KeepFiringFor string pointers
--- a/apps/alerting/rules/pkg/apis/alerting/v0alpha1/ext.go
+++ b/apps/alerting/rules/pkg/apis/alerting/v0alpha1/ext.go
@@ -1,22 +1,10 @@
 package v0alpha1

-import (
-	"fmt"
-	"time"
-
-	prom_model "github.com/prometheus/common/model"
-)
-
 const (
 	InternalPrefix                = "grafana.com/"
 	GroupLabelKey                 = InternalPrefix + "group"
 	GroupIndexLabelKey            = GroupLabelKey + "-index"
 	ProvenanceStatusAnnotationKey = InternalPrefix + "provenance"
-	// Copy of the max title length used in legacy validation path
-	AlertRuleMaxTitleLength = 190
-	// Annotation key used to store the folder UID on resources
-	FolderAnnotationKey = "grafana.app/folder"
-	FolderLabelKey      = FolderAnnotationKey
 )

 const (
@@ -27,20 +15,3 @@ const (
 var (
 	AcceptedProvenanceStatuses = []string{ProvenanceStatusNone, ProvenanceStatusAPI}
 )
-
-func ToDuration(s string) (time.Duration, error) {
-	promDuration, err := prom_model.ParseDuration(s)
-	if err != nil {
-		return 0, fmt.Errorf("invalid duration format: %w", err)
-	}
-	return time.Duration(promDuration), nil
-}
-
-// Convert the string duration to the longest valid Prometheus duration format (e.g., "60s" -> "1m")
-func ClampDuration(s string) (string, error) {
-	promDuration, err := prom_model.ParseDuration(s)
-	if err != nil {
-		return "", fmt.Errorf("invalid duration format: %w", err)
-	}
-	return promDuration.String(), nil
-}
--- a/apps/alerting/rules/pkg/apis/alerting/v0alpha1/recordingrule_ext.go
+++ b/apps/alerting/rules/pkg/apis/alerting/v0alpha1/recordingrule_ext.go
@@ -3,7 +3,6 @@ package v0alpha1
 import (
 	"fmt"
 	"slices"
-	"time"
 )

 func (o *RecordingRule) GetProvenanceStatus() string {
@@ -28,47 +27,4 @@ func (o *RecordingRule) SetProvenanceStatus(status string) (err error) {
 	return
 }

-func (d *RecordingRulePromDuration) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *RecordingRulePromDurationWMillis) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *RecordingRulePromDuration) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = RecordingRulePromDuration(clampedDuration)
-	return nil
-}
-
-func (d *RecordingRulePromDurationWMillis) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = RecordingRulePromDurationWMillis(clampedDuration)
-	return nil
-}
-
-func (spec *RecordingRuleSpec) ClampDurations() error {
-	// clamp all duration fields
-	if err := spec.Trigger.Interval.Clamp(); err != nil {
-		return err
-	}
-	for k, expr := range spec.Expressions {
-		if expr.RelativeTimeRange != nil {
-			if err := expr.RelativeTimeRange.From.Clamp(); err != nil {
-				return err
-			}
-			if err := expr.RelativeTimeRange.To.Clamp(); err != nil {
-				return err
-			}
-			spec.Expressions[k] = expr
-		}
-	}
-	return nil
-}
+// TODO: add duration clamping for the field types RecordingRulePromDurationWMillis and RecordingRulePromDuration
--- a/apps/alerting/rules/pkg/apis/alerting_manifest.go
+++ b/apps/alerting/rules/pkg/apis/alerting_manifest.go
@@ -42,21 +42,7 @@ var appManifestData = app.ManifestData{
 					Plural:     "AlertRules",
 					Scope:      "Namespaced",
 					Conversion: false,
-					Admission: &app.AdmissionCapabilities{
-						Validation: &app.ValidationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-						Mutation: &app.MutationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-					},
-					Schema: &versionSchemaAlertRulev0alpha1,
+					Schema:     &versionSchemaAlertRulev0alpha1,
 					SelectableFields: []string{
 						"spec.title",
 						"spec.paused",
@@ -71,21 +57,7 @@ var appManifestData = app.ManifestData{
 					Plural:     "RecordingRules",
 					Scope:      "Namespaced",
 					Conversion: false,
-					Admission: &app.AdmissionCapabilities{
-						Validation: &app.ValidationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-						Mutation: &app.MutationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-					},
-					Schema: &versionSchemaRecordingRulev0alpha1,
+					Schema:     &versionSchemaRecordingRulev0alpha1,
 					SelectableFields: []string{
 						"spec.title",
 						"spec.paused",
--- a/apps/alerting/rules/pkg/app/alertrule/mutator.go
+++ b/apps/alerting/rules/pkg/app/alertrule/mutator.go
@@ -1,45 +0,0 @@
-package alertrule
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/simple"
-	v1 "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-)
-
-func NewMutator(cfg config.RuntimeConfig) *simple.Mutator {
-	return &simple.Mutator{
-		MutateFunc: func(ctx context.Context, req *app.AdmissionRequest) (*app.MutatingResponse, error) {
-			// Mutate folder label to match folder UID from annotation
-			r, ok := req.Object.(*v1.AlertRule)
-			if !ok || r == nil {
-				// Nothing to do or wrong type; no mutation
-				return nil, nil
-			}
-
-			// Read folder UID from annotation
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[v1.FolderAnnotationKey]
-			}
-
-			// Ensure labels map exists and set the folder label if folderUID is present
-			if folderUID != "" {
-				if r.Labels == nil {
-					r.Labels = make(map[string]string)
-				}
-				// Maintain folder metadata label for downstream systems (alertmanager grouping etc.)
-				r.Labels[v1.FolderLabelKey] = folderUID
-			}
-
-			// clamp all duration fields
-			if err := r.Spec.ClampDurations(); err != nil {
-				return nil, err
-			}
-
-			return &app.MutatingResponse{UpdatedObject: r}, nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/alertrule/validator.go
+++ b/apps/alerting/rules/pkg/app/alertrule/validator.go
@@ -1,123 +0,0 @@
-package alertrule
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strconv"
-	"time"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"github.com/grafana/grafana-app-sdk/simple"
-	model "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/util"
-	prom_model "github.com/prometheus/common/model"
-)
-
-func NewValidator(cfg config.RuntimeConfig) *simple.Validator {
-	return &simple.Validator{
-		ValidateFunc: func(ctx context.Context, req *app.AdmissionRequest) error {
-			// Cast to specific type
-			r, ok := req.Object.(*model.AlertRule)
-			if !ok {
-				return fmt.Errorf("object is not of type *v0alpha1.AlertRule")
-			}
-
-			// 1) Validate provenance status annotation
-			sourceProv := r.GetProvenanceStatus()
-			if !slices.Contains(model.AcceptedProvenanceStatuses, sourceProv) {
-				return fmt.Errorf("invalid provenance status: %s", sourceProv)
-			}
-
-			// 2) Validate group labels rules
-			group := r.Labels[model.GroupLabelKey]
-			groupIndexStr := r.Labels[model.GroupIndexLabelKey]
-			if req.Action == resource.AdmissionActionCreate {
-				if group != "" || groupIndexStr != "" {
-					return fmt.Errorf("cannot set group when creating alert rule")
-				}
-			}
-			if group != "" { // if group is set, group-index must be set and numeric
-				if groupIndexStr == "" {
-					return fmt.Errorf("%s must be set when %s is set", model.GroupIndexLabelKey, model.GroupLabelKey)
-				}
-				if _, err := strconv.Atoi(groupIndexStr); err != nil {
-					return fmt.Errorf("invalid %s: %w", model.GroupIndexLabelKey, err)
-				}
-			}
-
-			// 3) Validate folder is set and exists
-			// Read folder UID directly from annotations
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[model.FolderAnnotationKey]
-			}
-			if folderUID == "" {
-				return fmt.Errorf("folder is required")
-			}
-			if cfg.FolderValidator != nil {
-				ok, verr := cfg.FolderValidator(ctx, folderUID)
-				if verr != nil {
-					return fmt.Errorf("failed to validate folder: %w", verr)
-				}
-				if !ok {
-					return fmt.Errorf("folder does not exist: %s", folderUID)
-				}
-			}
-
-			// 4) Validate notification settings receiver if provided
-			if r.Spec.NotificationSettings != nil && r.Spec.NotificationSettings.Receiver != "" && cfg.NotificationSettingsValidator != nil {
-				ok, nerr := cfg.NotificationSettingsValidator(ctx, r.Spec.NotificationSettings.Receiver)
-				if nerr != nil {
-					return fmt.Errorf("failed to validate notification settings: %w", nerr)
-				}
-				if !ok {
-					return fmt.Errorf("invalid notification receiver: %s", r.Spec.NotificationSettings.Receiver)
-				}
-			}
-
-			// 5) Enforce max title length
-			if len(r.Spec.Title) > model.AlertRuleMaxTitleLength {
-				return fmt.Errorf("alert rule title is too long. Max length is %d", model.AlertRuleMaxTitleLength)
-			}
-
-			// 6) Validate evaluation interval against base interval
-			if err := util.ValidateInterval(cfg.BaseEvaluationInterval, &r.Spec.Trigger.Interval); err != nil {
-				return err
-			}
-
-			// 7) Disallow reserved/spec system label keys
-			if r.Spec.Labels != nil {
-				for key := range r.Spec.Labels {
-					if _, bad := cfg.ReservedLabelKeys[key]; bad {
-						return fmt.Errorf("label key is reserved and cannot be specified: %s", key)
-					}
-				}
-			}
-
-			// 8) For and KeepFiringFor must be >= 0 if set
-			if r.Spec.For != nil {
-				d, err := prom_model.ParseDuration(*r.Spec.For)
-				if err != nil {
-					return fmt.Errorf("invalid 'for' duration: %w", err)
-				}
-				if time.Duration(d) < 0 {
-					return fmt.Errorf("'for' cannot be less than 0")
-				}
-			}
-			if r.Spec.KeepFiringFor != nil {
-				d, err := prom_model.ParseDuration(*r.Spec.KeepFiringFor)
-				if err != nil {
-					return fmt.Errorf("invalid 'keepFiringFor' duration: %w", err)
-				}
-				if time.Duration(d) < 0 {
-					return fmt.Errorf("'keepFiringFor' cannot be less than 0")
-				}
-			}
-
-			return nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/app.go
+++ b/apps/alerting/rules/pkg/app/app.go
@@ -6,29 +6,16 @@ import (
 	"github.com/grafana/grafana-app-sdk/app"
 	"github.com/grafana/grafana-app-sdk/logging"
 	"github.com/grafana/grafana-app-sdk/operator"
-	"github.com/grafana/grafana-app-sdk/resource"
 	"github.com/grafana/grafana-app-sdk/simple"

 	"github.com/grafana/grafana/apps/alerting/rules/pkg/apis"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/alertrule"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/recordingrule"
 )

 func New(cfg app.Config) (app.App, error) {
 	managedKinds := make([]simple.AppManagedKind, 0)
-	runtimeCfg, ok := cfg.SpecificConfig.(config.RuntimeConfig)
-	if !ok {
-		return nil, config.ErrInvalidRuntimeConfig
-	}
 	for _, kinds := range apis.GetKinds() {
 		for _, kind := range kinds {
-			managedKind := simple.AppManagedKind{
-				Kind:      kind,
-				Validator: buildKindValidator(kind, runtimeCfg),
-				Mutator:   buildKindMutator(kind, runtimeCfg),
-			}
-			managedKinds = append(managedKinds, managedKind)
+			managedKinds = append(managedKinds, simple.AppManagedKind{Kind: kind})
 		}
 	}

@@ -57,23 +44,3 @@ func New(cfg app.Config) (app.App, error) {

 	return a, nil
 }
-
-func buildKindValidator(kind resource.Kind, cfg config.RuntimeConfig) *simple.Validator {
-	switch kind.Kind() {
-	case "AlertRule":
-		return alertrule.NewValidator(cfg)
-	case "RecordingRule":
-		return recordingrule.NewValidator(cfg)
-	}
-	return nil
-}
-
-func buildKindMutator(kind resource.Kind, cfg config.RuntimeConfig) *simple.Mutator {
-	switch kind.Kind() {
-	case "AlertRule":
-		return alertrule.NewMutator(cfg)
-	case "RecordingRule":
-		return recordingrule.NewMutator(cfg)
-	}
-	return nil
-}
--- a/apps/alerting/rules/pkg/app/app_test.go
+++ b/apps/alerting/rules/pkg/app/app_test.go
@@ -1,175 +0,0 @@
-package app_test
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	appsdk "github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-
-	v1 "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/alertrule"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/recordingrule"
-)
-
-func makeDefaultRuntimeConfig() config.RuntimeConfig {
-	return config.RuntimeConfig{
-		FolderValidator:               func(ctx context.Context, folderUID string) (bool, error) { return folderUID == "f1", nil },
-		BaseEvaluationInterval:        60 * time.Second, // seconds
-		ReservedLabelKeys:             map[string]struct{}{"__reserved__": {}, "grafana_folder": {}},
-		NotificationSettingsValidator: func(ctx context.Context, receiver string) (bool, error) { return receiver == "notif-ok", nil },
-	}
-}
-
-func TestAlertRuleValidation_Success(t *testing.T) {
-	r := &v1.AlertRule{}
-	r.SetGroupVersionKind(v1.AlertRuleKind().GroupVersionKind())
-	r.Name = "uid-1"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.AlertRuleSpec{
-		Title:                "ok",
-		Trigger:              v1.AlertRuleIntervalTrigger{Interval: v1.AlertRulePromDuration("60s")},
-		Expressions:          v1.AlertRuleExpressionMap{"A": v1.AlertRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		NoDataState:          v1.DefaultNoDataState,
-		ExecErrState:         v1.DefaultExecErrState,
-		NotificationSettings: &v1.AlertRuleV0alpha1SpecNotificationSettings{Receiver: "notif-ok"},
-	}
-
-	req := &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r}
-	validator := alertrule.NewValidator(makeDefaultRuntimeConfig())
-	if err := validator.Validate(context.Background(), req); err != nil {
-		t.Fatalf("expected success, got error: %v", err)
-	}
-}
-
-func TestAlertRuleValidation_Errors(t *testing.T) {
-	mk := func(mut func(r *v1.AlertRule)) error {
-		r := baseAlertRule()
-		mut(r)
-		return alertrule.NewValidator(makeDefaultRuntimeConfig()).Validate(context.Background(), &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r})
-	}
-
-	if err := mk(func(r *v1.AlertRule) { r.Annotations = nil }); err == nil {
-		t.Errorf("want folder required error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Annotations[v1.FolderAnnotationKey] = "bad" }); err == nil {
-		t.Errorf("want folder not exist error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Spec.Trigger.Interval = v1.AlertRulePromDuration("30s") }); err == nil {
-		t.Errorf("want base interval multiple error")
-	}
-	if err := mk(func(r *v1.AlertRule) {
-		r.Spec.NotificationSettings = &v1.AlertRuleV0alpha1SpecNotificationSettings{Receiver: "bad"}
-	}); err == nil {
-		t.Errorf("want invalid receiver error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Labels[v1.GroupLabelKey] = "grp" }); err == nil {
-		t.Errorf("want group set on create error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Spec.For = strPtr("-10s") }); err == nil {
-		t.Errorf("want for>=0 error")
-	}
-	if err := mk(func(r *v1.AlertRule) {
-		if r.Spec.Labels == nil {
-			r.Spec.Labels = map[string]v1.AlertRuleTemplateString{}
-		}
-		r.Spec.Labels["__reserved__"] = v1.AlertRuleTemplateString("x")
-	}); err == nil {
-		t.Errorf("want reserved label key error")
-	}
-}
-
-func baseAlertRule() *v1.AlertRule {
-	r := &v1.AlertRule{}
-	r.SetGroupVersionKind(v1.AlertRuleKind().GroupVersionKind())
-	r.Name = "uid-1"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.AlertRuleSpec{
-		Title:        "ok",
-		Trigger:      v1.AlertRuleIntervalTrigger{Interval: v1.AlertRulePromDuration("60s")},
-		Expressions:  v1.AlertRuleExpressionMap{"A": v1.AlertRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		NoDataState:  v1.DefaultNoDataState,
-		ExecErrState: v1.DefaultExecErrState,
-	}
-	return r
-}
-
-func TestRecordingRuleValidation_Success(t *testing.T) {
-	r := &v1.RecordingRule{}
-	r.SetGroupVersionKind(v1.RecordingRuleKind().GroupVersionKind())
-	r.Name = "uid-2"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.RecordingRuleSpec{
-		Title:               "ok",
-		Trigger:             v1.RecordingRuleIntervalTrigger{Interval: v1.RecordingRulePromDuration("60s")},
-		Expressions:         v1.RecordingRuleExpressionMap{"A": v1.RecordingRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		Metric:              "test_metric",
-		TargetDatasourceUID: "ds1",
-	}
-
-	req := &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r}
-	validator := recordingrule.NewValidator(makeDefaultRuntimeConfig())
-	if err := validator.Validate(context.Background(), req); err != nil {
-		t.Fatalf("expected success, got error: %v", err)
-	}
-}
-
-func TestRecordingRuleValidation_Errors(t *testing.T) {
-	mk := func(mut func(r *v1.RecordingRule)) error {
-		r := baseRecordingRule()
-		mut(r)
-		return recordingrule.NewValidator(makeDefaultRuntimeConfig()).Validate(context.Background(), &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r})
-	}
-
-	if err := mk(func(r *v1.RecordingRule) { r.Annotations = nil }); err == nil {
-		t.Errorf("want folder required error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Annotations[v1.FolderAnnotationKey] = "bad" }); err == nil {
-		t.Errorf("want folder not exist error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Spec.Trigger.Interval = v1.RecordingRulePromDuration("30s") }); err == nil {
-		t.Errorf("want base interval multiple error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Labels[v1.GroupLabelKey] = "grp" }); err == nil {
-		t.Errorf("want group set on create error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Spec.Metric = "" }); err == nil {
-		t.Errorf("want metric required error")
-	}
-	if err := mk(func(r *v1.RecordingRule) {
-		if r.Spec.Labels == nil {
-			r.Spec.Labels = map[string]v1.RecordingRuleTemplateString{}
-		}
-		r.Spec.Labels["__reserved__"] = v1.RecordingRuleTemplateString("x")
-	}); err == nil {
-		t.Errorf("want reserved label key error")
-	}
-}
-
-func baseRecordingRule() *v1.RecordingRule {
-	r := &v1.RecordingRule{}
-	r.SetGroupVersionKind(v1.RecordingRuleKind().GroupVersionKind())
-	r.Name = "uid-1"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.RecordingRuleSpec{
-		Title:               "ok",
-		Trigger:             v1.RecordingRuleIntervalTrigger{Interval: v1.RecordingRulePromDuration("60s")},
-		Expressions:         v1.RecordingRuleExpressionMap{"A": v1.RecordingRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		Metric:              "test_metric",
-		TargetDatasourceUID: "ds1",
-	}
-	return r
-}
-
-func boolPtr(b bool) *bool    { return &b }
-func strPtr(s string) *string { return &s }
--- a/apps/alerting/rules/pkg/app/config/runtime.go
+++ b/apps/alerting/rules/pkg/app/config/runtime.go
@@ -1,22 +0,0 @@
-package config
-
-import (
-	"context"
-	"errors"
-	"time"
-)
-
-var (
-	ErrInvalidRuntimeConfig = errors.New("invalid runtime config provided to alerting/rules app")
-)
-
-// RuntimeConfig holds configuration values needed at runtime by the alerting/rules app from the running Grafana instance.
-type RuntimeConfig struct {
-	// function to check folder existence given its uid
-	FolderValidator func(ctx context.Context, folderUID string) (bool, error)
-	// base evaluation interval
-	BaseEvaluationInterval time.Duration
-	// set of strings which are illegal for label keys on rules
-	ReservedLabelKeys             map[string]struct{}
-	NotificationSettingsValidator func(ctx context.Context, receiver string) (bool, error)
-}
--- a/apps/alerting/rules/pkg/app/recordingrule/mutator.go
+++ b/apps/alerting/rules/pkg/app/recordingrule/mutator.go
@@ -1,37 +0,0 @@
-package recordingrule
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/simple"
-	v1 "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-)
-
-func NewMutator(cfg config.RuntimeConfig) *simple.Mutator {
-	return &simple.Mutator{
-		MutateFunc: func(ctx context.Context, req *app.AdmissionRequest) (*app.MutatingResponse, error) {
-			r, ok := req.Object.(*v1.RecordingRule)
-			if !ok || r == nil {
-				return nil, nil
-			}
-
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[v1.FolderAnnotationKey]
-			}
-
-			if folderUID != "" {
-				if r.Labels == nil {
-					r.Labels = make(map[string]string)
-				}
-				r.Labels[v1.FolderLabelKey] = folderUID
-			}
-			if err := r.Spec.ClampDurations(); err != nil {
-				return nil, err
-			}
-			return &app.MutatingResponse{UpdatedObject: r}, nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/recordingrule/validator.go
+++ b/apps/alerting/rules/pkg/app/recordingrule/validator.go
@@ -1,95 +0,0 @@
-package recordingrule
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strconv"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"github.com/grafana/grafana-app-sdk/simple"
-	model "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/util"
-	prom_model "github.com/prometheus/common/model"
-)
-
-func NewValidator(cfg config.RuntimeConfig) *simple.Validator {
-	return &simple.Validator{
-		ValidateFunc: func(ctx context.Context, req *app.AdmissionRequest) error {
-			// Cast to specific type
-			r, ok := req.Object.(*model.RecordingRule)
-			if !ok {
-				return fmt.Errorf("object is not of type *v0alpha1.RecordingRule")
-			}
-
-			sourceProv := r.GetProvenanceStatus()
-			if !slices.Contains(model.AcceptedProvenanceStatuses, sourceProv) {
-				return fmt.Errorf("invalid provenance status: %s", sourceProv)
-			}
-
-			group := r.Labels[model.GroupLabelKey]
-			groupIndexStr := r.Labels[model.GroupIndexLabelKey]
-			if req.Action == resource.AdmissionActionCreate {
-				if group != "" || groupIndexStr != "" {
-					return fmt.Errorf("cannot set group when creating recording rule")
-				}
-			}
-			if group != "" {
-				if groupIndexStr == "" {
-					return fmt.Errorf("%s must be set when %s is set", model.GroupIndexLabelKey, model.GroupLabelKey)
-				}
-				if _, err := strconv.Atoi(groupIndexStr); err != nil {
-					return fmt.Errorf("invalid %s: %w", model.GroupIndexLabelKey, err)
-				}
-			}
-
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[model.FolderAnnotationKey]
-			}
-			if folderUID == "" {
-				return fmt.Errorf("folder is required")
-			}
-			if cfg.FolderValidator != nil {
-				ok, verr := cfg.FolderValidator(ctx, folderUID)
-				if verr != nil {
-					return fmt.Errorf("failed to validate folder: %w", verr)
-				}
-				if !ok {
-					return fmt.Errorf("folder does not exist: %s", folderUID)
-				}
-			}
-
-			if len(r.Spec.Title) > model.AlertRuleMaxTitleLength {
-				return fmt.Errorf("recording rule title is too long. Max length is %d", model.AlertRuleMaxTitleLength)
-			}
-
-			if err := util.ValidateInterval(cfg.BaseEvaluationInterval, &r.Spec.Trigger.Interval); err != nil {
-				return err
-			}
-
-			if r.Spec.Labels != nil {
-				for key := range r.Spec.Labels {
-					if _, bad := cfg.ReservedLabelKeys[key]; bad {
-						return fmt.Errorf("label key is reserved and cannot be specified: %s", key)
-					}
-				}
-			}
-
-			if r.Spec.Metric == "" {
-				return fmt.Errorf("metric must be specified")
-			}
-			metric := prom_model.LabelValue(r.Spec.Metric)
-			if !metric.IsValid() {
-				return fmt.Errorf("metric contains invalid characters")
-			}
-			if !prom_model.IsValidMetricName(metric) { // nolint:staticcheck
-				return fmt.Errorf("invalid metric name")
-			}
-
-			return nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/util/validator.go
+++ b/apps/alerting/rules/pkg/app/util/validator.go
@@ -1,27 +0,0 @@
-package util
-
-import (
-	"fmt"
-	"time"
-)
-
-type DurationLike interface {
-	ToDuration() (time.Duration, error)
-}
-
-func ValidateInterval(baseInterval time.Duration, d DurationLike) error {
-	interval, err := d.ToDuration()
-	if err != nil {
-		return fmt.Errorf("invalid trigger interval: %w", err)
-	}
-	// Ensure interval is positive and an integer multiple of BaseEvaluationInterval (if provided)
-	if interval <= 0 {
-		return fmt.Errorf("trigger interval must be greater than 0")
-	}
-	if baseInterval > 0 {
-		if (interval % baseInterval) != 0 {
-			return fmt.Errorf("trigger interval must be a multiple of base evaluation interval (%s)", baseInterval.String())
-		}
-	}
-	return nil
-}
--- a/apps/annotation/Makefile
+++ b/apps/annotation/Makefile
@@ -1,9 +0,0 @@
-include ../sdk.mk
-
-.PHONY: generate # Run Grafana App SDK code generation
-generate: install-app-sdk update-app-sdk
-	@$(APP_SDK_BIN) generate \
-		--source=./kinds/ \
-		--gogenpath=./pkg/apis \
-		--grouping=group \
-		--defencoding=none
--- a/apps/annotation/go.mod
+++ b/apps/annotation/go.mod
@@ -1,93 +0,0 @@
-module github.com/grafana/grafana/apps/annotation
-
-go 1.24.0
-
-require (
-	github.com/grafana/grafana-app-sdk v0.48.1
-	github.com/grafana/grafana-app-sdk/logging v0.48.1
-	k8s.io/apimachinery v0.34.1
-	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
-)
-
-require (
-	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
-	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/getkin/kin-openapi v0.133.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.22.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.2 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.1 // indirect
-	github.com/go-test/deep v1.1.1 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
-	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
-	github.com/onsi/ginkgo/v2 v2.22.2 // indirect
-	github.com/onsi/gomega v1.36.2 // indirect
-	github.com/perimeterx/marshmallow v1.1.5 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.1 // indirect
-	github.com/prometheus/procfs v0.16.1 // indirect
-	github.com/puzpuzpuz/xsync/v2 v2.5.1 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/woodsbury/decimal128 v1.3.0 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/otel v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
-	go.opentelemetry.io/otel/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
-	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.46.0 // indirect
-	golang.org/x/oauth2 v0.32.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.37.0 // indirect
-	golang.org/x/term v0.36.0 // indirect
-	golang.org/x/text v0.30.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 // indirect
-	google.golang.org/grpc v1.76.0 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.34.1 // indirect
-	k8s.io/apiextensions-apiserver v0.34.1 // indirect
-	k8s.io/client-go v0.34.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
-)
--- a/apps/annotation/go.sum
+++ b/apps/annotation/go.sum
@@ -1,240 +0,0 @@
-github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 h1:N7oVaKyGp8bttX0bfZGmcGkjz7DLQXhAn3DNd3T0ous=
-github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874/go.mod h1:r5xuitiExdLAJ09PR7vBVENGvp4ZuTBeWTGtxuX3K+c=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
-github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
-github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/getkin/kin-openapi v0.133.0 h1:pJdmNohVIJ97r4AUFtEXRXwESr8b0bD721u/Tz6k8PQ=
-github.com/getkin/kin-openapi v0.133.0/go.mod h1:boAciF6cXk5FhPqe/NQeBTeenbjqU4LhWBf09ILVvWE=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/jsonpointer v0.22.1 h1:sHYI1He3b9NqJ4wXLoJDKmUmHkWy/L7rtEo92JUxBNk=
-github.com/go-openapi/jsonpointer v0.22.1/go.mod h1:pQT9OsLkfz1yWoMgYFy4x3U5GY5nUlsOn1qSBH5MkCM=
-github.com/go-openapi/jsonreference v0.21.2 h1:Wxjda4M/BBQllegefXrY/9aq1fxBA8sI5M/lFU6tSWU=
-github.com/go-openapi/jsonreference v0.21.2/go.mod h1:pp3PEjIsJ9CZDGCNOyXIQxsNuroxm8FAJ/+quA0yKzQ=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
-github.com/go-openapi/swag/jsonname v0.25.1 h1:Sgx+qbwa4ej6AomWC6pEfXrA6uP2RkaNjA9BR8a1RJU=
-github.com/go-openapi/swag/jsonname v0.25.1/go.mod h1:71Tekow6UOLBD3wS7XhdT98g5J5GR13NOTQ9/6Q11Zo=
-github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
-github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
-github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
-github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grafana/grafana-app-sdk v0.48.1 h1:bKJadWH18WCpJ+Zk8AezRFXCcZgGredRv+fRS+8zkek=
-github.com/grafana/grafana-app-sdk v0.48.1/go.mod h1:5LljCz+wvmGfkQ8ZKTOfserhtXNEF0cSFthoWShvN6c=
-github.com/grafana/grafana-app-sdk/logging v0.48.1 h1:veM0X5LAPyN3KsDLglWjIofndbGuf7MqnrDuDN+F/Ng=
-github.com/grafana/grafana-app-sdk/logging v0.48.1/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
-github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
-github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
-github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU=
-github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk=
-github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
-github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
-github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
-github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.1 h1:OTSON1P4DNxzTg4hmKCc37o4ZAZDv0cfXLkOt0oEowI=
-github.com/prometheus/common v0.67.1/go.mod h1:RpmT9v35q2Y+lsieQsdOh5sXZ6ajUGC8NjZAmr8vb0Q=
-github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
-github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
-github.com/puzpuzpuz/xsync/v2 v2.5.1 h1:mVGYAvzDSu52+zaGyNjC+24Xw2bQi3kTr4QJ6N9pIIU=
-github.com/puzpuzpuz/xsync/v2 v2.5.1/go.mod h1:gD2H2krq/w52MfPLE+Uy64TzJDVY7lP2znR9qmR35kU=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
-github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
-github.com/woodsbury/decimal128 v1.3.0 h1:8pffMNWIlC0O5vbyHWFZAt5yWvWcrHA+3ovIIjVWss0=
-github.com/woodsbury/decimal128 v1.3.0/go.mod h1:C5UTmyTjW3JftjUFzOVhC20BEQa2a4ZKOB5I6Zjb+ds=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
-go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 h1:aTL7F04bJHUlztTsNGJ2l+6he8c+y/b//eR0jjjemT4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0/go.mod h1:kldtb7jDTeol0l3ewcmd8SDvx3EmIE7lyvqbasU3QC4=
-go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
-go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
-go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
-go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
-go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
-go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
-go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
-go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
-go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
-go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
-golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
-golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
-golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
-golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
-golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
-golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
-gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090 h1:d8Nakh1G+ur7+P3GcMjpRDEkoLUcLW2iU92XVqR+XMQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090/go.mod h1:U8EXRNSd8sUYyDfs/It7KVWodQr+Hf9xtxyxWudSwEw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 h1:CirRxTOwnRWVLKzDNrs0CXAaVozJoR4G9xvdRecrdpk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
-google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
-google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
-gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
-k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
-k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
-k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
-k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
-k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
-k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
-sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
--- a/apps/annotation/kinds/annotation.cue
+++ b/apps/annotation/kinds/annotation.cue
@@ -1,17 +0,0 @@
-package kinds
-
-annotationv0alpha1: {
-	kind:       "Annotation"
-  pluralName: "Annotations"
-	schema: {
-		spec: {
-			text: string
-      time: int64
-      timeEnd?: int64
-      dashboardUID?: string
-      panelID?: int64
-      tags?: [...string]
-		}
-	}
-}
-
--- a/apps/annotation/kinds/cue.mod/module.cue
+++ b/apps/annotation/kinds/cue.mod/module.cue
@@ -1,2 +0,0 @@
-module: "github.com/grafana/grafana/apps/annotation/kinds"
-language: version: "v0.8.2"
--- a/apps/annotation/kinds/manifest.cue
+++ b/apps/annotation/kinds/manifest.cue
@@ -1,21 +0,0 @@
-package kinds
-
-manifest: {
-	appName: "annotation"
-  groupOverride: "annotation.grafana.app"
-	versions: {
-	    "v0alpha1": v0alpha1
-	}
-}
-
-v0alpha1: {
-    kinds: [annotationv0alpha1]
-    codegen: {
-        ts: {
-            enabled: true
-        }
-        go: {
-            enabled: true
-        }
-    }
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_client_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_client_gen.go
@@ -1,99 +0,0 @@
-package v0alpha1
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-type AnnotationClient struct {
-	client *resource.TypedClient[*Annotation, *AnnotationList]
-}
-
-func NewAnnotationClient(client resource.Client) *AnnotationClient {
-	return &AnnotationClient{
-		client: resource.NewTypedClient[*Annotation, *AnnotationList](client, AnnotationKind()),
-	}
-}
-
-func NewAnnotationClientFromGenerator(generator resource.ClientGenerator) (*AnnotationClient, error) {
-	c, err := generator.ClientFor(AnnotationKind())
-	if err != nil {
-		return nil, err
-	}
-	return NewAnnotationClient(c), nil
-}
-
-func (c *AnnotationClient) Get(ctx context.Context, identifier resource.Identifier) (*Annotation, error) {
-	return c.client.Get(ctx, identifier)
-}
-
-func (c *AnnotationClient) List(ctx context.Context, namespace string, opts resource.ListOptions) (*AnnotationList, error) {
-	return c.client.List(ctx, namespace, opts)
-}
-
-func (c *AnnotationClient) ListAll(ctx context.Context, namespace string, opts resource.ListOptions) (*AnnotationList, error) {
-	resp, err := c.client.List(ctx, namespace, resource.ListOptions{
-		ResourceVersion: opts.ResourceVersion,
-		Limit:           opts.Limit,
-		LabelFilters:    opts.LabelFilters,
-		FieldSelectors:  opts.FieldSelectors,
-	})
-	if err != nil {
-		return nil, err
-	}
-	for resp.GetContinue() != "" {
-		page, err := c.client.List(ctx, namespace, resource.ListOptions{
-			Continue:        resp.GetContinue(),
-			ResourceVersion: opts.ResourceVersion,
-			Limit:           opts.Limit,
-			LabelFilters:    opts.LabelFilters,
-			FieldSelectors:  opts.FieldSelectors,
-		})
-		if err != nil {
-			return nil, err
-		}
-		resp.SetContinue(page.GetContinue())
-		resp.SetResourceVersion(page.GetResourceVersion())
-		resp.SetItems(append(resp.GetItems(), page.GetItems()...))
-	}
-	return resp, nil
-}
-
-func (c *AnnotationClient) Create(ctx context.Context, obj *Annotation, opts resource.CreateOptions) (*Annotation, error) {
-	// Make sure apiVersion and kind are set
-	obj.APIVersion = GroupVersion.Identifier()
-	obj.Kind = AnnotationKind().Kind()
-	return c.client.Create(ctx, obj, opts)
-}
-
-func (c *AnnotationClient) Update(ctx context.Context, obj *Annotation, opts resource.UpdateOptions) (*Annotation, error) {
-	return c.client.Update(ctx, obj, opts)
-}
-
-func (c *AnnotationClient) Patch(ctx context.Context, identifier resource.Identifier, req resource.PatchRequest, opts resource.PatchOptions) (*Annotation, error) {
-	return c.client.Patch(ctx, identifier, req, opts)
-}
-
-func (c *AnnotationClient) UpdateStatus(ctx context.Context, identifier resource.Identifier, newStatus AnnotationStatus, opts resource.UpdateOptions) (*Annotation, error) {
-	return c.client.Update(ctx, &Annotation{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       AnnotationKind().Kind(),
-			APIVersion: GroupVersion.Identifier(),
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			ResourceVersion: opts.ResourceVersion,
-			Namespace:       identifier.Namespace,
-			Name:            identifier.Name,
-		},
-		Status: newStatus,
-	}, resource.UpdateOptions{
-		Subresource:     "status",
-		ResourceVersion: opts.ResourceVersion,
-	})
-}
-
-func (c *AnnotationClient) Delete(ctx context.Context, identifier resource.Identifier, opts resource.DeleteOptions) error {
-	return c.client.Delete(ctx, identifier, opts)
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_codec_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_codec_gen.go
@@ -1,28 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/grafana/grafana-app-sdk/resource"
-)
-
-// AnnotationJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
-type AnnotationJSONCodec struct{}
-
-// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
-func (*AnnotationJSONCodec) Read(reader io.Reader, into resource.Object) error {
-	return json.NewDecoder(reader).Decode(into)
-}
-
-// Write writes JSON-encoded bytes into `writer` marshaled from `from`
-func (*AnnotationJSONCodec) Write(writer io.Writer, from resource.Object) error {
-	return json.NewEncoder(writer).Encode(from)
-}
-
-// Interface compliance checks
-var _ resource.Codec = &AnnotationJSONCodec{}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_metadata_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_metadata_gen.go
@@ -1,31 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-import (
-	time "time"
-)
-
-// metadata contains embedded CommonMetadata and can be extended with custom string fields
-// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
-// without external reference as using the CommonMetadata reference breaks thema codegen.
-type AnnotationMetadata struct {
-	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
-	CreatedBy         string            `json:"createdBy"`
-	Uid               string            `json:"uid"`
-	CreationTimestamp time.Time         `json:"creationTimestamp"`
-	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
-	Finalizers        []string          `json:"finalizers"`
-	ResourceVersion   string            `json:"resourceVersion"`
-	Generation        int64             `json:"generation"`
-	UpdatedBy         string            `json:"updatedBy"`
-	Labels            map[string]string `json:"labels"`
-}
-
-// NewAnnotationMetadata creates a new AnnotationMetadata object.
-func NewAnnotationMetadata() *AnnotationMetadata {
-	return &AnnotationMetadata{
-		Finalizers: []string{},
-		Labels:     map[string]string{},
-	}
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_object_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_object_gen.go
@@ -1,319 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"fmt"
-	"github.com/grafana/grafana-app-sdk/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"time"
-)
-
-// +k8s:openapi-gen=true
-type Annotation struct {
-	metav1.TypeMeta   `json:",inline" yaml:",inline"`
-	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
-
-	// Spec is the spec of the Annotation
-	Spec AnnotationSpec `json:"spec" yaml:"spec"`
-
-	Status AnnotationStatus `json:"status" yaml:"status"`
-}
-
-func (o *Annotation) GetSpec() any {
-	return o.Spec
-}
-
-func (o *Annotation) SetSpec(spec any) error {
-	cast, ok := spec.(AnnotationSpec)
-	if !ok {
-		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
-	}
-	o.Spec = cast
-	return nil
-}
-
-func (o *Annotation) GetSubresources() map[string]any {
-	return map[string]any{
-		"status": o.Status,
-	}
-}
-
-func (o *Annotation) GetSubresource(name string) (any, bool) {
-	switch name {
-	case "status":
-		return o.Status, true
-	default:
-		return nil, false
-	}
-}
-
-func (o *Annotation) SetSubresource(name string, value any) error {
-	switch name {
-	case "status":
-		cast, ok := value.(AnnotationStatus)
-		if !ok {
-			return fmt.Errorf("cannot set status type %#v, not of type AnnotationStatus", value)
-		}
-		o.Status = cast
-		return nil
-	default:
-		return fmt.Errorf("subresource '%s' does not exist", name)
-	}
-}
-
-func (o *Annotation) GetStaticMetadata() resource.StaticMetadata {
-	gvk := o.GroupVersionKind()
-	return resource.StaticMetadata{
-		Name:      o.ObjectMeta.Name,
-		Namespace: o.ObjectMeta.Namespace,
-		Group:     gvk.Group,
-		Version:   gvk.Version,
-		Kind:      gvk.Kind,
-	}
-}
-
-func (o *Annotation) SetStaticMetadata(metadata resource.StaticMetadata) {
-	o.Name = metadata.Name
-	o.Namespace = metadata.Namespace
-	o.SetGroupVersionKind(schema.GroupVersionKind{
-		Group:   metadata.Group,
-		Version: metadata.Version,
-		Kind:    metadata.Kind,
-	})
-}
-
-func (o *Annotation) GetCommonMetadata() resource.CommonMetadata {
-	dt := o.DeletionTimestamp
-	var deletionTimestamp *time.Time
-	if dt != nil {
-		deletionTimestamp = &dt.Time
-	}
-	// Legacy ExtraFields support
-	extraFields := make(map[string]any)
-	if o.Annotations != nil {
-		extraFields["annotations"] = o.Annotations
-	}
-	if o.ManagedFields != nil {
-		extraFields["managedFields"] = o.ManagedFields
-	}
-	if o.OwnerReferences != nil {
-		extraFields["ownerReferences"] = o.OwnerReferences
-	}
-	return resource.CommonMetadata{
-		UID:               string(o.UID),
-		ResourceVersion:   o.ResourceVersion,
-		Generation:        o.Generation,
-		Labels:            o.Labels,
-		CreationTimestamp: o.CreationTimestamp.Time,
-		DeletionTimestamp: deletionTimestamp,
-		Finalizers:        o.Finalizers,
-		UpdateTimestamp:   o.GetUpdateTimestamp(),
-		CreatedBy:         o.GetCreatedBy(),
-		UpdatedBy:         o.GetUpdatedBy(),
-		ExtraFields:       extraFields,
-	}
-}
-
-func (o *Annotation) SetCommonMetadata(metadata resource.CommonMetadata) {
-	o.UID = types.UID(metadata.UID)
-	o.ResourceVersion = metadata.ResourceVersion
-	o.Generation = metadata.Generation
-	o.Labels = metadata.Labels
-	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
-	if metadata.DeletionTimestamp != nil {
-		dt := metav1.NewTime(*metadata.DeletionTimestamp)
-		o.DeletionTimestamp = &dt
-	} else {
-		o.DeletionTimestamp = nil
-	}
-	o.Finalizers = metadata.Finalizers
-	if o.Annotations == nil {
-		o.Annotations = make(map[string]string)
-	}
-	if !metadata.UpdateTimestamp.IsZero() {
-		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
-	}
-	if metadata.CreatedBy != "" {
-		o.SetCreatedBy(metadata.CreatedBy)
-	}
-	if metadata.UpdatedBy != "" {
-		o.SetUpdatedBy(metadata.UpdatedBy)
-	}
-	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
-	if metadata.ExtraFields != nil {
-		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
-			if cast, ok := annotations.(map[string]string); ok {
-				o.Annotations = cast
-			}
-		}
-		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
-			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
-				o.ManagedFields = cast
-			}
-		}
-		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
-			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
-				o.OwnerReferences = cast
-			}
-		}
-	}
-}
-
-func (o *Annotation) GetCreatedBy() string {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
-}
-
-func (o *Annotation) SetCreatedBy(createdBy string) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
-}
-
-func (o *Annotation) GetUpdateTimestamp() time.Time {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
-	return parsed
-}
-
-func (o *Annotation) SetUpdateTimestamp(updateTimestamp time.Time) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
-}
-
-func (o *Annotation) GetUpdatedBy() string {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
-}
-
-func (o *Annotation) SetUpdatedBy(updatedBy string) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
-}
-
-func (o *Annotation) Copy() resource.Object {
-	return resource.CopyObject(o)
-}
-
-func (o *Annotation) DeepCopyObject() runtime.Object {
-	return o.Copy()
-}
-
-func (o *Annotation) DeepCopy() *Annotation {
-	cpy := &Annotation{}
-	o.DeepCopyInto(cpy)
-	return cpy
-}
-
-func (o *Annotation) DeepCopyInto(dst *Annotation) {
-	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
-	dst.TypeMeta.Kind = o.TypeMeta.Kind
-	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
-	o.Spec.DeepCopyInto(&dst.Spec)
-	o.Status.DeepCopyInto(&dst.Status)
-}
-
-// Interface compliance compile-time check
-var _ resource.Object = &Annotation{}
-
-// +k8s:openapi-gen=true
-type AnnotationList struct {
-	metav1.TypeMeta `json:",inline" yaml:",inline"`
-	metav1.ListMeta `json:"metadata" yaml:"metadata"`
-	Items           []Annotation `json:"items" yaml:"items"`
-}
-
-func (o *AnnotationList) DeepCopyObject() runtime.Object {
-	return o.Copy()
-}
-
-func (o *AnnotationList) Copy() resource.ListObject {
-	cpy := &AnnotationList{
-		TypeMeta: o.TypeMeta,
-		Items:    make([]Annotation, len(o.Items)),
-	}
-	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
-	for i := 0; i < len(o.Items); i++ {
-		if item, ok := o.Items[i].Copy().(*Annotation); ok {
-			cpy.Items[i] = *item
-		}
-	}
-	return cpy
-}
-
-func (o *AnnotationList) GetItems() []resource.Object {
-	items := make([]resource.Object, len(o.Items))
-	for i := 0; i < len(o.Items); i++ {
-		items[i] = &o.Items[i]
-	}
-	return items
-}
-
-func (o *AnnotationList) SetItems(items []resource.Object) {
-	o.Items = make([]Annotation, len(items))
-	for i := 0; i < len(items); i++ {
-		o.Items[i] = *items[i].(*Annotation)
-	}
-}
-
-func (o *AnnotationList) DeepCopy() *AnnotationList {
-	cpy := &AnnotationList{}
-	o.DeepCopyInto(cpy)
-	return cpy
-}
-
-func (o *AnnotationList) DeepCopyInto(dst *AnnotationList) {
-	resource.CopyObjectInto(dst, o)
-}
-
-// Interface compliance compile-time check
-var _ resource.ListObject = &AnnotationList{}
-
-// Copy methods for all subresource types
-
-// DeepCopy creates a full deep copy of Spec
-func (s *AnnotationSpec) DeepCopy() *AnnotationSpec {
-	cpy := &AnnotationSpec{}
-	s.DeepCopyInto(cpy)
-	return cpy
-}
-
-// DeepCopyInto deep copies Spec into another Spec object
-func (s *AnnotationSpec) DeepCopyInto(dst *AnnotationSpec) {
-	resource.CopyObjectInto(dst, s)
-}
-
-// DeepCopy creates a full deep copy of AnnotationStatus
-func (s *AnnotationStatus) DeepCopy() *AnnotationStatus {
-	cpy := &AnnotationStatus{}
-	s.DeepCopyInto(cpy)
-	return cpy
-}
-
-// DeepCopyInto deep copies AnnotationStatus into another AnnotationStatus object
-func (s *AnnotationStatus) DeepCopyInto(dst *AnnotationStatus) {
-	resource.CopyObjectInto(dst, s)
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_schema_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_schema_gen.go
@@ -1,34 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"github.com/grafana/grafana-app-sdk/resource"
-)
-
-// schema is unexported to prevent accidental overwrites
-var (
-	schemaAnnotation = resource.NewSimpleSchema("annotation.grafana.app", "v0alpha1", &Annotation{}, &AnnotationList{}, resource.WithKind("Annotation"),
-		resource.WithPlural("annotations"), resource.WithScope(resource.NamespacedScope))
-	kindAnnotation = resource.Kind{
-		Schema: schemaAnnotation,
-		Codecs: map[resource.KindEncoding]resource.Codec{
-			resource.KindEncodingJSON: &AnnotationJSONCodec{},
-		},
-	}
-)
-
-// Kind returns a resource.Kind for this Schema with a JSON codec
-func AnnotationKind() resource.Kind {
-	return kindAnnotation
-}
-
-// Schema returns a resource.SimpleSchema representation of Annotation
-func AnnotationSchema() *resource.SimpleSchema {
-	return schemaAnnotation
-}
-
-// Interface compliance checks
-var _ resource.Schema = kindAnnotation
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_spec_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_spec_gen.go
@@ -1,18 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-// +k8s:openapi-gen=true
-type AnnotationSpec struct {
-	Text         string   `json:"text"`
-	Time         int64    `json:"time"`
-	TimeEnd      *int64   `json:"timeEnd,omitempty"`
-	DashboardUID *string  `json:"dashboardUID,omitempty"`
-	PanelID      *int64   `json:"panelID,omitempty"`
-	Tags         []string `json:"tags,omitempty"`
-}
-
-// NewAnnotationSpec creates a new AnnotationSpec object.
-func NewAnnotationSpec() *AnnotationSpec {
-	return &AnnotationSpec{}
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_status_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_status_gen.go
@@ -1,44 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-// +k8s:openapi-gen=true
-type AnnotationstatusOperatorState struct {
-	// lastEvaluation is the ResourceVersion last evaluated
-	LastEvaluation string `json:"lastEvaluation"`
-	// state describes the state of the lastEvaluation.
-	// It is limited to three possible states for machine evaluation.
-	State AnnotationStatusOperatorStateState `json:"state"`
-	// descriptiveState is an optional more descriptive state field which has no requirements on format
-	DescriptiveState *string `json:"descriptiveState,omitempty"`
-	// details contains any extra information that is operator-specific
-	Details map[string]interface{} `json:"details,omitempty"`
-}
-
-// NewAnnotationstatusOperatorState creates a new AnnotationstatusOperatorState object.
-func NewAnnotationstatusOperatorState() *AnnotationstatusOperatorState {
-	return &AnnotationstatusOperatorState{}
-}
-
-// +k8s:openapi-gen=true
-type AnnotationStatus struct {
-	// operatorStates is a map of operator ID to operator state evaluations.
-	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
-	OperatorStates map[string]AnnotationstatusOperatorState `json:"operatorStates,omitempty"`
-	// additionalFields is reserved for future use
-	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
-}
-
-// NewAnnotationStatus creates a new AnnotationStatus object.
-func NewAnnotationStatus() *AnnotationStatus {
-	return &AnnotationStatus{}
-}
-
-// +k8s:openapi-gen=true
-type AnnotationStatusOperatorStateState string
-
-const (
-	AnnotationStatusOperatorStateStateSuccess    AnnotationStatusOperatorStateState = "success"
-	AnnotationStatusOperatorStateStateInProgress AnnotationStatusOperatorStateState = "in_progress"
-	AnnotationStatusOperatorStateStateFailed     AnnotationStatusOperatorStateState = "failed"
-)
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/constants.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/constants.go
@@ -1,18 +0,0 @@
-package v0alpha1
-
-import "k8s.io/apimachinery/pkg/runtime/schema"
-
-const (
-	// APIGroup is the API group used by all kinds in this package
-	APIGroup = "annotation.grafana.app"
-	// APIVersion is the API version used by all kinds in this package
-	APIVersion = "v0alpha1"
-)
-
-var (
-	// GroupVersion is a schema.GroupVersion consisting of the Group and Version constants for this package
-	GroupVersion = schema.GroupVersion{
-		Group:   APIGroup,
-		Version: APIVersion,
-	}
-)
--- a/apps/annotation/pkg/apis/annotation_manifest.go
+++ b/apps/annotation/pkg/apis/annotation_manifest.go
@@ -1,124 +0,0 @@
-//
-// This file is generated by grafana-app-sdk
-// DO NOT EDIT
-//
-
-package apis
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/kube-openapi/pkg/spec3"
-	"k8s.io/kube-openapi/pkg/validation/spec"
-
-	v0alpha1 "github.com/grafana/grafana/apps/annotation/pkg/apis/annotation/v0alpha1"
-)
-
-var (
-	rawSchemaAnnotationv0alpha1     = []byte(`{"Annotation":{"properties":{"spec":{"$ref":"#/components/schemas/spec"},"status":{"$ref":"#/components/schemas/status"}},"required":["spec"]},"OperatorState":{"additionalProperties":false,"properties":{"descriptiveState":{"description":"descriptiveState is an optional more descriptive state field which has no requirements on format","type":"string"},"details":{"additionalProperties":{"additionalProperties":{},"type":"object"},"description":"details contains any extra information that is operator-specific","type":"object"},"lastEvaluation":{"description":"lastEvaluation is the ResourceVersion last evaluated","type":"string"},"state":{"description":"state describes the state of the lastEvaluation.\nIt is limited to three possible states for machine evaluation.","enum":["success","in_progress","failed"],"type":"string"}},"required":["lastEvaluation","state"],"type":"object"},"spec":{"additionalProperties":false,"properties":{"dashboardUID":{"type":"string"},"panelID":{"type":"integer"},"tags":{"items":{"type":"string"},"type":"array"},"text":{"type":"string"},"time":{"type":"integer"},"timeEnd":{"type":"integer"}},"required":["text","time"],"type":"object"},"status":{"additionalProperties":false,"properties":{"additionalFields":{"additionalProperties":{"additionalProperties":{},"type":"object"},"description":"additionalFields is reserved for future use","type":"object"},"operatorStates":{"additionalProperties":{"$ref":"#/components/schemas/OperatorState"},"description":"operatorStates is a map of operator ID to operator state evaluations.\nAny operator which consumes this kind SHOULD add its state evaluation information to this field.","type":"object"}},"type":"object"}}`)
-	versionSchemaAnnotationv0alpha1 app.VersionSchema
-	_                               = json.Unmarshal(rawSchemaAnnotationv0alpha1, &versionSchemaAnnotationv0alpha1)
-)
-
-var appManifestData = app.ManifestData{
-	AppName:          "annotation",
-	Group:            "annotation.grafana.app",
-	PreferredVersion: "v0alpha1",
-	Versions: []app.ManifestVersion{
-		{
-			Name:   "v0alpha1",
-			Served: true,
-			Kinds: []app.ManifestVersionKind{
-				{
-					Kind:       "Annotation",
-					Plural:     "Annotations",
-					Scope:      "Namespaced",
-					Conversion: false,
-					Schema:     &versionSchemaAnnotationv0alpha1,
-				},
-			},
-			Routes: app.ManifestVersionRoutes{
-				Namespaced: map[string]spec3.PathProps{},
-				Cluster:    map[string]spec3.PathProps{},
-				Schemas:    map[string]spec.Schema{},
-			},
-		},
-	},
-}
-
-func LocalManifest() app.Manifest {
-	return app.NewEmbeddedManifest(appManifestData)
-}
-
-func RemoteManifest() app.Manifest {
-	return app.NewAPIServerManifest("annotation")
-}
-
-var kindVersionToGoType = map[string]resource.Kind{
-	"Annotation/v0alpha1": v0alpha1.AnnotationKind(),
-}
-
-// ManifestGoTypeAssociator returns the associated resource.Kind instance for a given Kind and Version, if one exists.
-// If there is no association for the provided Kind and Version, exists will return false.
-func ManifestGoTypeAssociator(kind, version string) (goType resource.Kind, exists bool) {
-	goType, exists = kindVersionToGoType[fmt.Sprintf("%s/%s", kind, version)]
-	return goType, exists
-}
-
-var customRouteToGoResponseType = map[string]any{}
-
-// ManifestCustomRouteResponsesAssociator returns the associated response go type for a given kind, version, custom route path, and method, if one exists.
-// kind may be empty for custom routes which are not kind subroutes. Leading slashes are removed from subroute paths.
-// If there is no association for the provided kind, version, custom route path, and method, exists will return false.
-// Resource routes (those without a kind) should prefix their route with "<namespace>/" if the route is namespaced (otherwise the route is assumed to be cluster-scope)
-func ManifestCustomRouteResponsesAssociator(kind, version, path, verb string) (goType any, exists bool) {
-	if len(path) > 0 && path[0] == '/' {
-		path = path[1:]
-	}
-	goType, exists = customRouteToGoResponseType[fmt.Sprintf("%s|%s|%s|%s", version, kind, path, strings.ToUpper(verb))]
-	return goType, exists
-}
-
-var customRouteToGoParamsType = map[string]runtime.Object{}
-
-func ManifestCustomRouteQueryAssociator(kind, version, path, verb string) (goType runtime.Object, exists bool) {
-	if len(path) > 0 && path[0] == '/' {
-		path = path[1:]
-	}
-	goType, exists = customRouteToGoParamsType[fmt.Sprintf("%s|%s|%s|%s", version, kind, path, strings.ToUpper(verb))]
-	return goType, exists
-}
-
-var customRouteToGoRequestBodyType = map[string]any{}
-
-func ManifestCustomRouteRequestBodyAssociator(kind, version, path, verb string) (goType any, exists bool) {
-	if len(path) > 0 && path[0] == '/' {
-		path = path[1:]
-	}
-	goType, exists = customRouteToGoRequestBodyType[fmt.Sprintf("%s|%s|%s|%s", version, kind, path, strings.ToUpper(verb))]
-	return goType, exists
-}
-
-type GoTypeAssociator struct{}
-
-func NewGoTypeAssociator() *GoTypeAssociator {
-	return &GoTypeAssociator{}
-}
-
-func (g *GoTypeAssociator) KindToGoType(kind, version string) (goType resource.Kind, exists bool) {
-	return ManifestGoTypeAssociator(kind, version)
-}
-func (g *GoTypeAssociator) CustomRouteReturnGoType(kind, version, path, verb string) (goType any, exists bool) {
-	return ManifestCustomRouteResponsesAssociator(kind, version, path, verb)
-}
-func (g *GoTypeAssociator) CustomRouteQueryGoType(kind, version, path, verb string) (goType runtime.Object, exists bool) {
-	return ManifestCustomRouteQueryAssociator(kind, version, path, verb)
-}
-func (g *GoTypeAssociator) CustomRouteRequestBodyGoType(kind, version, path, verb string) (goType any, exists bool) {
-	return ManifestCustomRouteRequestBodyAssociator(kind, version, path, verb)
-}
--- a/apps/annotation/pkg/app/app.go
+++ b/apps/annotation/pkg/app/app.go
@@ -1,54 +0,0 @@
-package app
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/logging"
-	"github.com/grafana/grafana-app-sdk/operator"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"github.com/grafana/grafana-app-sdk/simple"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-
-	annotationv0alpha1 "github.com/grafana/grafana/apps/annotation/pkg/apis/annotation/v0alpha1"
-)
-
-func New(cfg app.Config) (app.App, error) {
-	simpleConfig := simple.AppConfig{
-		Name:       "annotation",
-		KubeConfig: cfg.KubeConfig,
-		InformerConfig: simple.AppInformerConfig{
-			InformerOptions: operator.InformerOptions{
-				ErrorHandler: func(ctx context.Context, err error) {
-					logging.FromContext(ctx).Error("Informer processing error", "error", err)
-				},
-			},
-		},
-		ManagedKinds: []simple.AppManagedKind{{
-			Kind: annotationv0alpha1.AnnotationKind(),
-		},
-		},
-	}
-
-	a, err := simple.NewApp(simpleConfig)
-	if err != nil {
-		return nil, err
-	}
-
-	err = a.ValidateManifest(cfg.ManifestData)
-	if err != nil {
-		return nil, err
-	}
-
-	return a, nil
-}
-
-func GetKinds() map[schema.GroupVersion][]resource.Kind {
-	gv := schema.GroupVersion{
-		Group:   annotationv0alpha1.AnnotationKind().Group(),
-		Version: annotationv0alpha1.AnnotationKind().Version(),
-	}
-	return map[schema.GroupVersion][]resource.Kind{
-		gv: {annotationv0alpha1.AnnotationKind()},
-	}
-}
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/annotation_object_gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/annotation_object_gen.ts
@@ -1,49 +0,0 @@
-/*
- * This file was generated by grafana-app-sdk. DO NOT EDIT.
- */
-import { Spec } from './types.spec.gen';
-import { Status } from './types.status.gen';
-
-export interface Metadata {
-    name: string;
-    namespace: string;
-    generateName?: string;
-    selfLink?: string;
-    uid?: string;
-    resourceVersion?: string;
-    generation?: number;
-    creationTimestamp?: string;
-    deletionTimestamp?: string;
-    deletionGracePeriodSeconds?: number;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-    ownerReferences?: OwnerReference[];
-    finalizers?: string[];
-    managedFields?: ManagedFieldsEntry[];
-}
-
-export interface OwnerReference {
-    apiVersion: string;
-    kind: string;
-    name: string;
-    uid: string;
-    controller?: boolean;
-    blockOwnerDeletion?: boolean;
-}
-
-export interface ManagedFieldsEntry {
-    manager?: string;
-    operation?: string;
-    apiVersion?: string;
-    time?: string;
-    fieldsType?: string;
-    subresource?: string;
-}
-
-export interface Annotation {
-    kind: string;
-    apiVersion: string;
-    metadata: Metadata;
-    spec: Spec;
-    status: Status;
-}
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.metadata.gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.metadata.gen.ts
@@ -1,30 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-// metadata contains embedded CommonMetadata and can be extended with custom string fields
-// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
-// without external reference as using the CommonMetadata reference breaks thema codegen.
-export interface Metadata {
-	updateTimestamp: string;
-	createdBy: string;
-	uid: string;
-	creationTimestamp: string;
-	deletionTimestamp?: string;
-	finalizers: string[];
-	resourceVersion: string;
-	generation: number;
-	updatedBy: string;
-	labels: Record<string, string>;
-}
-
-export const defaultMetadata = (): Metadata => ({
-	updateTimestamp: "",
-	createdBy: "",
-	uid: "",
-	creationTimestamp: "",
-	finalizers: [],
-	resourceVersion: "",
-	generation: 0,
-	updatedBy: "",
-	labels: {},
-});
-
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.spec.gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.spec.gen.ts
@@ -1,16 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-export interface Spec {
-	text: string;
-	time: number;
-	timeEnd?: number;
-	dashboardUID?: string;
-	panelID?: number;
-	tags?: string[];
-}
-
-export const defaultSpec = (): Spec => ({
-	text: "",
-	time: 0,
-});
-
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.status.gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.status.gen.ts
@@ -1,30 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-export interface OperatorState {
-	// lastEvaluation is the ResourceVersion last evaluated
-	lastEvaluation: string;
-	// state describes the state of the lastEvaluation.
-	// It is limited to three possible states for machine evaluation.
-	state: "success" | "in_progress" | "failed";
-	// descriptiveState is an optional more descriptive state field which has no requirements on format
-	descriptiveState?: string;
-	// details contains any extra information that is operator-specific
-	details?: Record<string, any>;
-}
-
-export const defaultOperatorState = (): OperatorState => ({
-	lastEvaluation: "",
-	state: "success",
-});
-
-export interface Status {
-	// operatorStates is a map of operator ID to operator state evaluations.
-	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
-	operatorStates?: Record<string, OperatorState>;
-	// additionalFields is reserved for future use
-	additionalFields?: Record<string, any>;
-}
-
-export const defaultStatus = (): Status => ({
-});
-
--- a/apps/iam/go.mod
+++ b/apps/iam/go.mod
@@ -100,24 +100,24 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/at-wat/mqtt-go v0.19.4 // indirect
 	github.com/aws/aws-sdk-go v1.55.7 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.39.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.38.1 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.31.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.14 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.2 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 // indirect
 	github.com/aws/smithy-go v1.23.1 // indirect
 	github.com/axiomhq/hyperloglog v0.0.0-20240507144631-af9851f82b27 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
@@ -151,6 +151,7 @@ require (
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dennwc/varint v1.0.0 // indirect
 	github.com/dgraph-io/badger/v4 v4.7.0 // indirect
@@ -181,7 +182,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
-	github.com/go-logfmt/logfmt v0.6.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.24.0 // indirect
@@ -234,7 +235,7 @@ require (
 	github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37 // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
 	github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4 // indirect
-	github.com/grafana/grafana-aws-sdk v1.3.0 // indirect
+	github.com/grafana/grafana-aws-sdk v1.2.0 // indirect
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 // indirect
 	github.com/grafana/grafana-plugin-sdk-go v0.281.0 // indirect
 	github.com/grafana/grafana/apps/dashboard v0.0.0 // indirect
@@ -294,6 +295,7 @@ require (
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lestrrat-go/strftime v1.0.4 // indirect
 	github.com/lib/pq v1.10.9 // indirect
+	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38 // indirect
 	github.com/mattetti/filebuffer v1.0.1 // indirect
@@ -359,6 +361,7 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/cors v1.11.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/sethvargo/go-retry v0.3.0 // indirect
@@ -379,9 +382,13 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tetratelabs/wazero v1.8.2 // indirect
 	github.com/thomaspoignant/go-feature-flag v1.42.0 // indirect
-	github.com/tjhop/slog-gokit v0.1.5 // indirect
+	github.com/tjhop/slog-gokit v0.1.3 // indirect
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
 	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
+	github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 // indirect
+	github.com/unknwon/com v1.0.1 // indirect
+	github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a // indirect
+	github.com/urfave/cli v1.22.17 // indirect
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/woodsbury/decimal128 v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -448,6 +455,7 @@ require (
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/mail.v2 v2.3.1 // indirect
--- a/apps/iam/go.sum
+++ b/apps/iam/go.sum
@@ -237,22 +237,22 @@ github.com/aws/aws-sdk-go v1.17.7/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN
 github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
-github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.38.1 h1:j7sc33amE74Rz0M/PoCpsZQ6OunLqys/m5antM0J+Z8=
+github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
-github.com/aws/aws-sdk-go-v2/config v1.31.10 h1:7LllDZAegXU3yk41mwM6KcPu0wmjKGQB1bg99bNdQm4=
-github.com/aws/aws-sdk-go-v2/config v1.31.10/go.mod h1:Ge6gzXPjqu4v0oHvgAwvGzYcK921GU0hQM25WF/Kl+8=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14 h1:TxkI7QI+sFkTItN/6cJuMZEIVMFXeu2dI1ZffkXngKI=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14/go.mod h1:12x4Uw/vijC11XkctTjy92TNCQ+UnNJkT7fzX0Yd93E=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 h1:gLD09eaJUdiszm7vd1btiQUYE0Hj+0I2b8AS+75z9AY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8/go.mod h1:4RW3oMPt1POR74qVOC4SbubxAwdP4pCT0nSw3jycOU4=
+github.com/aws/aws-sdk-go-v2/config v1.31.2 h1:NOaSZpVGEH2Np/c1toSeW0jooNl+9ALmsUTZ8YvkJR0=
+github.com/aws/aws-sdk-go-v2/config v1.31.2/go.mod h1:17ft42Yb2lF6OigqSYiDAiUcX4RIkEMY6XxEMJsrAes=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6 h1:AmmvNEYrru7sYNJnp3pf57lGbiarX4T9qU/6AZ9SucU=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6/go.mod h1:/jdQkh1iVPa01xndfECInp1v1Wnp70v3K4MvtlLGVEc=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 h1:lpdMwTzmuDLkgW7086jE94HweHCqG+uOJwHf3LZs7T0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 h1:cTXRdLkpBanlDwISl+5chq5ui1d1YWg4PWMR9c3kXyw=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84/go.mod h1:kwSy5X7tfIHN39uucmjQVs2LvDdXEjQucgQQEqCggEo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 h1:IdCLsiiIj5YJ3AFevsewURCPV+YWUlOW8JiPhoAy8vg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 h1:j7vjtr1YIssWQOMeOWRbh3z8g2oY/xPjnZH2gLY4sGw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
@@ -263,12 +263,12 @@ github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.51.0 h1:e5cbPZYTIY2nUEFie
 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.51.0/go.mod h1:UseIHRfrm7PqeZo6fcTb6FUCXzCnh1KJbQbmOfxArGM=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.225.2 h1:IfMb3Ar8xEaWjgH/zeVHYD8izwJdQgRP5mKCTDt4GNk=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.225.2/go.mod h1:35jGWx7ECvCwTsApqicFYzZ7JFEnBc6oHUuOQ3xIS54=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 h1:ueB2Te0NacDMnaC+68za9jLwkjzxGWm0KB5HTUHjLTI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4/go.mod h1:nLEfLnVMmLvyIG58/6gsSA03F1voKGaCfHV7+lR8S7s=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
 github.com/aws/aws-sdk-go-v2/service/kms v1.41.2 h1:zJeUxFP7+XP52u23vrp4zMcVhShTWbNO8dHV6xCSvFo=
@@ -279,12 +279,12 @@ github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.6 h1:Pwbxovp
 github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.6/go.mod h1:Z4xLt5mXspLKjBV92i165wAJ/3T6TIv4n7RtIS8pWV0=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 h1:0reDqfEN+tB+sozj2r92Bep8MEwBZgtAXTND1Kk9OXg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 h1:FTdEN9dtWPB0EOURNtDPmwGp6GGvMqRJCAihkSl/1No=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4/go.mod h1:mYubxV9Ff42fZH4kexj43gFPhgc/LyC7KqvUKt1watc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 h1:I7ghctfGXrscr7r1Ga/mDqSJKm7Fkpl5Mwq79Z+rZqU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0/go.mod h1:Zo9id81XP6jbayIFWNuDpA6lMBWhsVy+3ou2jLa4JnA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 h1:+LVB0xBqEgjQoqr9bGZbRzvg212B0f17JdflleJRNR4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5/go.mod h1:xoaxeqnnUaZjPjaICgIy5B+MHCSb/ZSOn4MvkFNOUA0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 h1:ve9dYBB8CfJGTFqcQ3ZLAAb/KXWgYlgu/2R2TZL2Ko0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2/go.mod h1:n9bTZFZcBa9hGGqVz3i/a6+NG0zmZgtkB9qVVFDqPA8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 h1:pd9G9HQaM6UZAZh19pYOkpKSQkyQQ9ftnl/LttQOcGI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2/go.mod h1:eknndR9rU8UpE/OmFpqU78V1EcXPKFTTm5l/buZYgvM=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 h1:iV1Ko4Em/lkJIsoKyGfc0nQySi+v0Udxr6Igq+y9JZc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0/go.mod h1:bEPcjW7IbolPfK67G1nilqWyoxYMSPrDiIQ3RdIdKgo=
 github.com/aws/smithy-go v1.23.1 h1:sLvcH6dfAFwGkHLZ7dGiYF7aK6mg4CgKA/iDKjLDt9M=
 github.com/aws/smithy-go v1.23.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/axiomhq/hyperloglog v0.0.0-20191112132149-a4c4c47bc57f/go.mod h1:2stgcRjl6QmW+gU2h5E7BQXg4HU0gzxKWDuT5HviN9s=
@@ -444,8 +444,8 @@ github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
 github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
-github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -595,8 +595,8 @@ github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXg
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
-github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
@@ -826,6 +826,9 @@ github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
+github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.1/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
@@ -855,8 +858,8 @@ github.com/grafana/grafana-app-sdk v0.48.1 h1:bKJadWH18WCpJ+Zk8AezRFXCcZgGredRv+
 github.com/grafana/grafana-app-sdk v0.48.1/go.mod h1:5LljCz+wvmGfkQ8ZKTOfserhtXNEF0cSFthoWShvN6c=
 github.com/grafana/grafana-app-sdk/logging v0.48.1 h1:veM0X5LAPyN3KsDLglWjIofndbGuf7MqnrDuDN+F/Ng=
 github.com/grafana/grafana-app-sdk/logging v0.48.1/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-aws-sdk v1.3.0 h1:/bfJzP93rCel1GbWoRSq0oUo424MZXt8jAp2BK9w8tM=
-github.com/grafana/grafana-aws-sdk v1.3.0/go.mod h1:VGycF0JkCGKND2O5je1ucOqPJ0ZNhZYzV3c2bNBAaGk=
+github.com/grafana/grafana-aws-sdk v1.2.0 h1:LLR4/g91WBuCRwm2cbWfCREq565+GxIFe08nqqIcIuw=
+github.com/grafana/grafana-aws-sdk v1.2.0/go.mod h1:bBo7qOmM3f61vO+2JxTolNUph1l2TmtzmWcU9/Im+8A=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 h1:FFcEA01tW+SmuJIuDbHOdgUBL+d7DPrZ2N4zwzPhfGk=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1/go.mod h1:Oi4anANlCuTCc66jCyqIzfVbgLXFll8Wja+Y4vfANlc=
 github.com/grafana/grafana-cloud-migration-snapshot v1.9.0 h1:JOzchPgptwJdruYoed7x28lFDwhzs7kssResYsnC0iI=
@@ -1064,6 +1067,9 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6 h1:SwcnSwBR7X/5EHJQlXBockkJVIMRVt5yKaesBPMtyZQ=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6/go.mod h1:WrYiIuiXUMIvTDAQw97C+9l0CnBmCcvosPjN3XDqS/o=
+github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
@@ -1118,6 +1124,8 @@ github.com/m3db/prometheus_remote_client_golang v0.4.4 h1:DsAIjVKoCp7Ym35tAOFL1O
 github.com/m3db/prometheus_remote_client_golang v0.4.4/go.mod h1:wHfVbA3eAK6dQvKjCkHhusWYegCk3bDGkA15zymSHdc=
 github.com/madflojo/testcerts v1.4.0 h1:I09gN0C1ly9IgeVNcAqKk8RAKIJTe3QnFrrPBDyvzN4=
 github.com/madflojo/testcerts v1.4.0/go.mod h1:MW8sh39gLnkKh4K0Nc55AyHEDl9l/FBLDUsQhpmkuo0=
+github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
+github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
@@ -1418,8 +1426,8 @@ github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
 github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
@@ -1450,6 +1458,7 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c h1:aqg5Vm5dwtvL+YgDpBcK1ITf3o96N/K7/wsRXQnUTEs=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c/go.mod h1:owqhoLW1qZoYLZzLnBw+QkPP9WZnjlSWihhxAJC1+/M=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 h1:OfRzdxCzDhp+rsKWXuOO2I/quKMJ/+TQwVbIP/gltZg=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92/go.mod h1:7/OT02F6S6I7v6WXb+IjhMuZEYfH/RJ5RwEWnEo5BMg=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -1458,6 +1467,11 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
@@ -1512,6 +1526,7 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
@@ -1526,8 +1541,8 @@ github.com/thejerf/slogassert v0.3.4/go.mod h1:0zn9ISLVKo1aPMTqcGfG1o6dWwt+Rk574
 github.com/thomaspoignant/go-feature-flag v1.42.0 h1:C7embmOTzaLyRki+OoU2RvtVjJE9IrvgBA2C1mRN1lc=
 github.com/thomaspoignant/go-feature-flag v1.42.0/go.mod h1:y0QiWH7chHWhGATb/+XqwAwErORmPSH2MUsQlCmmWlM=
 github.com/tidwall/pretty v0.0.0-20180105212114-65a9db5fad51/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tjhop/slog-gokit v0.1.5 h1:ayloIUi5EK2QYB8eY4DOPO95/mRtMW42lUkp3quJohc=
-github.com/tjhop/slog-gokit v0.1.5/go.mod h1:yA48zAHvV+Sg4z4VRyeFyFUNNXd3JY5Zg84u3USICq0=
+github.com/tjhop/slog-gokit v0.1.3 h1:6SdexP3UIeg93KLFeiM1Wp1caRwdTLgsD/THxBUy1+o=
+github.com/tjhop/slog-gokit v0.1.3/go.mod h1:Bbu5v2748qpAWH7k6gse/kw3076IJf6owJmh7yArmJs=
 github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
 github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
 github.com/tklauser/numcpus v0.8.0 h1:Mx4Wwe/FjZLeQsK/6kt2EOepwwSl7SmJrK5bV/dXYgY=
@@ -1544,7 +1559,16 @@ github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
 github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 h1:aVGB3YnaS/JNfOW3tiHIlmNmTDg618va+eT0mVomgyI=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8/go.mod h1:fVle4kNr08ydeohzYafr20oZzbAkhQT39gKK/pFQ5M4=
+github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
+github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
+github.com/unknwon/log v0.0.0-20150304194804-e617c87089d3/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a h1:vcrhXnj9g9PIE+cmZgaPSwOyJ8MAQTRmsgGrB0x5rF4=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
+github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
 github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
@@ -1892,6 +1916,7 @@ golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191020152052-9984515f0562/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2268,6 +2293,8 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7 h1:XNNYLJHt73EyYiCZi6+xjupS9CpvmiDgjPTAjrBlQbo=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7/go.mod h1:Fyux9zXlo4rWoMSIzpn9fDAYjalPqJ/K1qJ27s+7ltE=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
--- a/apps/provisioning/pkg/jobs/validator.go
+++ b/apps/provisioning/pkg/jobs/validator.go
@@ -1,172 +0,0 @@
-package jobs
-
-import (
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/util/validation/field"
-
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-	"github.com/grafana/grafana/apps/provisioning/pkg/repository/git"
-	"github.com/grafana/grafana/apps/provisioning/pkg/safepath"
-)
-
-// ValidateJob performs validation on the Job specification and returns an error if validation fails
-func ValidateJob(job *provisioning.Job) error {
-	list := field.ErrorList{}
-
-	// Validate action is specified
-	if job.Spec.Action == "" {
-		list = append(list, field.Required(field.NewPath("spec", "action"), "action must be specified"))
-		return toError(job.Name, list) // Early return since we can't validate further without knowing the action
-	}
-
-	// Validate repository is specified
-	if job.Spec.Repository == "" {
-		list = append(list, field.Required(field.NewPath("spec", "repository"), "repository must be specified"))
-	}
-
-	// Validate action-specific options
-	switch job.Spec.Action {
-	case provisioning.JobActionPull:
-		if job.Spec.Pull == nil {
-			list = append(list, field.Required(field.NewPath("spec", "pull"), "pull options required for pull action"))
-		}
-		// Pull options are simple, just incremental bool - no further validation needed
-
-	case provisioning.JobActionPush:
-		if job.Spec.Push == nil {
-			list = append(list, field.Required(field.NewPath("spec", "push"), "push options required for push action"))
-		} else {
-			list = append(list, validateExportJobOptions(job.Spec.Push)...)
-		}
-
-	case provisioning.JobActionPullRequest:
-		if job.Spec.PullRequest == nil {
-			list = append(list, field.Required(field.NewPath("spec", "pr"), "pull request options required for pr action"))
-		}
-		// PullRequest options are mostly informational - no strict validation needed
-
-	case provisioning.JobActionMigrate:
-		if job.Spec.Migrate == nil {
-			list = append(list, field.Required(field.NewPath("spec", "migrate"), "migrate options required for migrate action"))
-		}
-		// Migrate options are simple - no further validation needed
-
-	case provisioning.JobActionDelete:
-		if job.Spec.Delete == nil {
-			list = append(list, field.Required(field.NewPath("spec", "delete"), "delete options required for delete action"))
-		} else {
-			list = append(list, validateDeleteJobOptions(job.Spec.Delete)...)
-		}
-
-	case provisioning.JobActionMove:
-		if job.Spec.Move == nil {
-			list = append(list, field.Required(field.NewPath("spec", "move"), "move options required for move action"))
-		} else {
-			list = append(list, validateMoveJobOptions(job.Spec.Move)...)
-		}
-	default:
-		list = append(list, field.Invalid(field.NewPath("spec", "action"), job.Spec.Action, "invalid action"))
-	}
-
-	return toError(job.Name, list)
-}
-
-// toError converts a field.ErrorList to an error, returning nil if the list is empty
-func toError(name string, list field.ErrorList) error {
-	if len(list) == 0 {
-		return nil
-	}
-	return apierrors.NewInvalid(
-		provisioning.JobResourceInfo.GroupVersionKind().GroupKind(),
-		name, list)
-}
-
-// validateExportJobOptions validates export (push) job options
-func validateExportJobOptions(opts *provisioning.ExportJobOptions) field.ErrorList {
-	list := field.ErrorList{}
-
-	// Validate branch name if specified
-	if opts.Branch != "" {
-		if !git.IsValidGitBranchName(opts.Branch) {
-			list = append(list, field.Invalid(field.NewPath("spec", "push", "branch"), opts.Branch, "invalid git branch name"))
-		}
-	}
-
-	// Validate path if specified
-	if opts.Path != "" {
-		if err := safepath.IsSafe(opts.Path); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "push", "path"), opts.Path, err.Error()))
-		}
-	}
-
-	return list
-}
-
-// validateDeleteJobOptions validates delete job options
-func validateDeleteJobOptions(opts *provisioning.DeleteJobOptions) field.ErrorList {
-	list := field.ErrorList{}
-
-	// At least one of paths or resources must be specified
-	if len(opts.Paths) == 0 && len(opts.Resources) == 0 {
-		list = append(list, field.Required(field.NewPath("spec", "delete"), "at least one path or resource must be specified"))
-		return list
-	}
-
-	// Validate paths
-	for i, p := range opts.Paths {
-		if err := safepath.IsSafe(p); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "delete", "paths").Index(i), p, err.Error()))
-		}
-	}
-
-	// Validate resources
-	for i, r := range opts.Resources {
-		if r.Name == "" {
-			list = append(list, field.Required(field.NewPath("spec", "delete", "resources").Index(i).Child("name"), "resource name is required"))
-		}
-		if r.Kind == "" {
-			list = append(list, field.Required(field.NewPath("spec", "delete", "resources").Index(i).Child("kind"), "resource kind is required"))
-		}
-	}
-
-	return list
-}
-
-// validateMoveJobOptions validates move job options
-func validateMoveJobOptions(opts *provisioning.MoveJobOptions) field.ErrorList {
-	list := field.ErrorList{}
-
-	// At least one of paths or resources must be specified
-	if len(opts.Paths) == 0 && len(opts.Resources) == 0 {
-		list = append(list, field.Required(field.NewPath("spec", "move"), "at least one path or resource must be specified"))
-		return list
-	}
-
-	// Target path is required
-	if opts.TargetPath == "" {
-		list = append(list, field.Required(field.NewPath("spec", "move", "targetPath"), "target path is required"))
-	} else {
-		if err := safepath.IsSafe(opts.TargetPath); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "move", "targetPath"), opts.TargetPath, err.Error()))
-		}
-	}
-
-	// Validate source paths
-	for i, p := range opts.Paths {
-		if err := safepath.IsSafe(p); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "move", "paths").Index(i), p, err.Error()))
-		}
-	}
-
-	// Validate resources
-	for i, r := range opts.Resources {
-		if r.Name == "" {
-			list = append(list, field.Required(field.NewPath("spec", "move", "resources").Index(i).Child("name"), "resource name is required"))
-		}
-		if r.Kind == "" {
-			list = append(list, field.Required(field.NewPath("spec", "move", "resources").Index(i).Child("kind"), "resource kind is required"))
-		}
-	}
-
-	return list
-}
--- a/apps/provisioning/pkg/jobs/validator_test.go
+++ b/apps/provisioning/pkg/jobs/validator_test.go
@@ -1,593 +0,0 @@
-package jobs
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-)
-
-func TestValidateJob(t *testing.T) {
-	tests := []struct {
-		name          string
-		job           *provisioning.Job
-		wantErr       bool
-		validateError func(t *testing.T, err error)
-	}{
-		{
-			name: "valid pull job",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPull,
-					Repository: "test-repo",
-					Pull: &provisioning.SyncJobOptions{
-						Incremental: true,
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "missing action",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Repository: "test-repo",
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.action: Required value")
-			},
-		},
-		{
-			name: "invalid action",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobAction("invalid"),
-					Repository: "test-repo",
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.action: Invalid value")
-			},
-		},
-		{
-			name: "missing repository",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action: provisioning.JobActionPull,
-					Pull: &provisioning.SyncJobOptions{
-						Incremental: true,
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.repository: Required value")
-			},
-		},
-		{
-			name: "pull action without pull options",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPull,
-					Repository: "test-repo",
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.pull: Required value")
-			},
-		},
-		{
-			name: "push action without push options",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPush,
-					Repository: "test-repo",
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.push: Required value")
-			},
-		},
-		{
-			name: "valid push job with valid branch",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPush,
-					Repository: "test-repo",
-					Push: &provisioning.ExportJobOptions{
-						Branch:  "main",
-						Message: "Test commit",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "push job with invalid branch name",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPush,
-					Repository: "test-repo",
-					Push: &provisioning.ExportJobOptions{
-						Branch:  "feature..branch", // Invalid: contains consecutive dots
-						Message: "Test commit",
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.push.branch")
-				require.Contains(t, err.Error(), "invalid git branch name")
-			},
-		},
-		{
-			name: "push job with invalid path",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPush,
-					Repository: "test-repo",
-					Push: &provisioning.ExportJobOptions{
-						Path:    "../../../etc/passwd", // Invalid: path traversal
-						Message: "Test commit",
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.push.path")
-			},
-		},
-		{
-			name: "delete action without options",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.delete: Required value")
-			},
-		},
-		{
-			name: "delete action without paths or resources",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-					Delete:     &provisioning.DeleteJobOptions{},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "at least one path or resource must be specified")
-			},
-		},
-		{
-			name: "valid delete action with paths",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-					Delete: &provisioning.DeleteJobOptions{
-						Paths: []string{"dashboard.json", "folder/other.json"},
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "valid delete action with resources",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-					Delete: &provisioning.DeleteJobOptions{
-						Resources: []provisioning.ResourceRef{
-							{
-								Name: "my-dashboard",
-								Kind: "Dashboard",
-							},
-						},
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "delete action with invalid path",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-					Delete: &provisioning.DeleteJobOptions{
-						Paths: []string{"../../etc/passwd"}, // Invalid: path traversal
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.delete.paths[0]")
-			},
-		},
-		{
-			name: "delete action with resource missing name",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-					Delete: &provisioning.DeleteJobOptions{
-						Resources: []provisioning.ResourceRef{
-							{
-								Kind: "Dashboard",
-							},
-						},
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.delete.resources[0].name")
-			},
-		},
-		{
-			name: "move action without options",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.move: Required value")
-			},
-		},
-		{
-			name: "move action without paths or resources",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						TargetPath: "new-location/",
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "at least one path or resource must be specified")
-			},
-		},
-		{
-			name: "move action without target path",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						Paths: []string{"dashboard.json"},
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.move.targetPath: Required value")
-			},
-		},
-		{
-			name: "valid move action",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						Paths:      []string{"old-location/dashboard.json"},
-						TargetPath: "new-location/",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "move action with invalid target path",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						Paths:      []string{"dashboard.json"},
-						TargetPath: "../../../etc/", // Invalid: path traversal
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.move.targetPath")
-			},
-		},
-		{
-			name: "valid migrate job",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMigrate,
-					Repository: "test-repo",
-					Migrate: &provisioning.MigrateJobOptions{
-						History: true,
-						Message: "Migrate from legacy",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "migrate action without migrate options",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMigrate,
-					Repository: "test-repo",
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.migrate: Required value")
-			},
-		},
-		{
-			name: "valid pr job",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPullRequest,
-					Repository: "test-repo",
-					PullRequest: &provisioning.PullRequestJobOptions{
-						PR:  123,
-						Ref: "refs/pull/123/head",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "delete action with resource missing kind",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-					Delete: &provisioning.DeleteJobOptions{
-						Resources: []provisioning.ResourceRef{
-							{
-								Name: "my-dashboard",
-							},
-						},
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.delete.resources[0].kind")
-			},
-		},
-		{
-			name: "move action with valid resources",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						Resources: []provisioning.ResourceRef{
-							{
-								Name: "my-dashboard",
-								Kind: "Dashboard",
-							},
-						},
-						TargetPath: "new-location/",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "move action with resource missing kind",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						Resources: []provisioning.ResourceRef{
-							{
-								Name: "my-dashboard",
-							},
-						},
-						TargetPath: "new-location/",
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.move.resources[0].kind")
-			},
-		},
-		{
-			name: "move action with both paths and resources",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						Paths: []string{"dashboard.json"},
-						Resources: []provisioning.ResourceRef{
-							{
-								Name: "my-dashboard",
-								Kind: "Dashboard",
-							},
-						},
-						TargetPath: "new-location/",
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "move action with invalid source path",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionMove,
-					Repository: "test-repo",
-					Move: &provisioning.MoveJobOptions{
-						Paths:      []string{"../invalid/path"},
-						TargetPath: "valid/target/",
-					},
-				},
-			},
-			wantErr: true,
-			validateError: func(t *testing.T, err error) {
-				require.Contains(t, err.Error(), "spec.move.paths[0]")
-			},
-		},
-		{
-			name: "delete action with both paths and resources",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionDelete,
-					Repository: "test-repo",
-					Delete: &provisioning.DeleteJobOptions{
-						Paths: []string{"dashboard.json"},
-						Resources: []provisioning.ResourceRef{
-							{
-								Name: "my-dashboard",
-								Kind: "Dashboard",
-							},
-						},
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "push action with valid path",
-			job: &provisioning.Job{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "test-job",
-				},
-				Spec: provisioning.JobSpec{
-					Action:     provisioning.JobActionPush,
-					Repository: "test-repo",
-					Push: &provisioning.ExportJobOptions{
-						Path:    "some/valid/path",
-						Message: "Test commit",
-					},
-				},
-			},
-			wantErr: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := ValidateJob(tt.job)
-			if tt.wantErr {
-				require.Error(t, err)
-				if tt.validateError != nil {
-					tt.validateError(t, err)
-				}
-			} else {
-				require.NoError(t, err)
-			}
-		})
-	}
-}
--- a/devenv/scopes/README.md
+++ b/devenv/scopes/README.md
@@ -1,140 +0,0 @@
-# Scopes Provisioning Script
-
-This script generates Scopes, ScopeNodes, and ScopeNavigations for Grafana development environments.
-
-## Usage
-
-### Create resources
-
-```bash
-# From devenv directory
-./setup.sh scopes
-
-# Or run directly
-cd scopes
-go run scopes.go
-```
-
-### Delete all gdev-prefixed resources
-
-```bash
-# From devenv directory
-./setup.sh undev
-
-# Or run directly
-cd scopes
-go run scopes.go -clean
-```
-
-**Note about caching**: The `/find/scope_navigations` endpoint used by the UI caches ScopeNavigation results for 15 minutes. After running cleanup, deleted resources may still appear in the UI until the cache expires. The resources are actually deleted (you can verify by checking the `/scopenavigations` list endpoint), but the UI will refresh after ~15 minutes or after restarting Grafana.
-
-Doing an `Empty Cache and Hard Reload` will also help.
-
-## Configuration
-
-The script reads from `scopes-config.yaml` by default. You can specify a different config file:
-
-```bash
-go run scopes.go -config=my-config.yaml
-```
-
-### Configuration Format
-
-The configuration file uses YAML format with a natural tree structure. The indentation itself represents the hierarchy:
-
- **scopes**: Map of scope definitions (key is the scope name)
- **tree**: Tree structure of scope nodes where the YAML structure defines parent-child relationships
- **navigations**: Map of scope navigations linking URLs to scopes (key is the navigation name)
-
-Example:
-
-```yaml
-scopes:
-  app1:
-    title: Application 1
-    filters:
-      - key: app
-        operator: equals
-        value: app1
-
-tree:
-  environments:
-    title: Environments
-    nodeType: container
-    children:
-      production:
-        title: Production
-        nodeType: container
-        children:
-          app1-prod:
-            title: Application 1
-            nodeType: leaf
-            linkId: app1
-            linkType: scope
-
-navigations:
-  # Link to a dashboard
-  app1-nav:
-    url: /d/86Js1xRmk
-    scope: app1
-
-  # Link to another dashboard
-  app2-nav:
-    url: /d/GlAqcPgmz
-    scope: app2
-
-  # Custom URLs
-  explore-nav:
-    url: /explore
-    scope: app1
-```
-
-### Tree Structure
-
-The tree structure uses YAML's natural indentation to represent hierarchy:
-
- **Key**: Unique identifier for the node (will be prefixed with "gdev-")
- **title**: Display title
- **nodeType**: Either "container" (can have children) or "leaf" (selectable scope)
- **linkId**: References a scope name (if nodeType is "leaf")
- **linkType**: Usually "scope"
- **children**: Map of child nodes (nested structure follows YAML indentation)
-
-### Node Types
-
- **container**: A category/grouping node that can contain other nodes
- **leaf**: A selectable node that links to a scope
-
-### Navigations
-
-Navigations link URLs to scopes. The `url` field should contain the full URL path (e.g., `/d/abc123` for dashboards or `/explore` for other pages).
-
-To find dashboard UIDs from gdev dashboards:
-
-```bash
-# Find UIDs of all gdev dashboards
-find devenv/dev-dashboards -name "*.json" -exec sh -c 'echo "{}:" && jq -r ".uid // .dashboard.uid // \"NO_UID\"" {}' \;
-
-# Or for a specific dashboard
-jq -r ".uid // .dashboard.uid" devenv/dev-dashboards/all-panels.json
-```
-
-## Environment Variables
-
- `GRAFANA_URL`: Grafana URL (default: http://localhost:3000)
- `GRAFANA_NAMESPACE`: Namespace (default: default)
- `GRAFANA_USER`: Grafana username (default: admin)
- `GRAFANA_PASSWORD`: Grafana password (default: admin)
-
-## Command Line Flags
-
- `-url`: Grafana URL
- `-namespace`: Namespace
- `-config`: Config file path (default: scopes-config.yaml)
- `-user`: Grafana username
- `-password`: Grafana password
- `-clean`: Delete all gdev-prefixed resources
-
-## Prefix
-
-All resources are automatically prefixed with "gdev-" to avoid conflicts with production data.
--- a/devenv/scopes/scopes-config.yaml
+++ b/devenv/scopes/scopes-config.yaml
@@ -1,84 +0,0 @@
-scopes:
-  app1:
-    title: Application 1
-    filters:
-      - key: app
-        operator: equals
-        value: app1
-
-  app2:
-    title: Application 2
-    filters:
-      - key: app
-        operator: equals
-        value: app2
-
-  cluster1:
-    title: Cluster 1
-    filters:
-      - key: cluster
-        operator: equals
-        value: cluster1
-
-tree:
-  gdev-scopes:
-    title: gdev-scopes
-    nodeType: container
-    children:
-      production:
-        title: Production
-        nodeType: container
-        children:
-          app1-prod:
-            title: Application 1
-            nodeType: leaf
-            linkId: app1
-            linkType: scope
-          app2-prod:
-            title: Application 2
-            nodeType: leaf
-            linkId: app2
-            linkType: scope
-      test-cases:
-        title: Test cases
-        nodeType: container
-        disableMultiSelect: true
-        children:
-          test-case-1:
-            title: Test case 1
-            nodeType: leaf
-            linkId: test-case-1
-            linkType: scope
-          test-case-2:
-            title: Test case 2
-            nodeType: leaf
-            linkId: test-case-2
-            linkType: scope
-
-      clusters:
-        title: Clusters
-        nodeType: container
-        linkId: cluster1
-        linkType: scope
-        children:
-          cluster1-node:
-            title: Cluster 1
-            nodeType: leaf
-            linkId: cluster1
-            linkType: scope
-
-navigations:
-  # Example: Link to a dashboard
-  app1-nav:
-    url: /d/86Js1xRmk
-    scope: app1
-
-  # Example: Link to a dashboard with full URL (already has /d/)
-  app2-nav:
-    url: /d/GlAqcPgmz
-    scope: app2
-
-  # Example: Custom URL path
-  custom-nav:
-    url: /explore
-    scope: app1
--- a/devenv/scopes/scopes.go
+++ b/devenv/scopes/scopes.go
@@ -1,433 +0,0 @@
-//go:build ignore
-// +build ignore
-
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"strings"
-
-	"gopkg.in/yaml.v3"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	"github.com/grafana/grafana/apps/scope/pkg/apis/scope/v0alpha1"
-)
-
-const (
-	prefix      = "gdev"
-	apiVersion  = "scope.grafana.app/v0alpha1"
-	defaultURL  = "http://localhost:3000"
-	defaultUser = "admin"
-)
-
-var (
-	grafanaURL  = flag.String("url", getEnv("GRAFANA_URL", defaultURL), "Grafana URL")
-	namespace   = flag.String("namespace", getEnv("GRAFANA_NAMESPACE", "default"), "Namespace")
-	configFile  = flag.String("config", "scopes-config.yaml", "Config file path")
-	user        = flag.String("user", getEnv("GRAFANA_USER", defaultUser), "Grafana username")
-	password    = flag.String("password", getEnv("GRAFANA_PASSWORD", "admin"), "Grafana password")
-	cleanupFlag = flag.Bool("clean", false, "Delete all gdev-prefixed resources")
-)
-
-func getEnv(key, defaultValue string) string {
-	if value := os.Getenv(key); value != "" {
-		return value
-	}
-	return defaultValue
-}
-
-type Config struct {
-	Scopes      map[string]ScopeConfig      `yaml:"scopes"`
-	Tree        map[string]TreeNode         `yaml:"tree"`
-	Navigations map[string]NavigationConfig `yaml:"navigations"`
-}
-
-// ScopeConfig is used for YAML parsing - converts to v0alpha1.ScopeSpec
-type ScopeConfig struct {
-	Title   string              `yaml:"title"`
-	Filters []ScopeFilterConfig `yaml:"filters"`
-}
-
-// ScopeFilterConfig is used for YAML parsing - converts to v0alpha1.ScopeFilter
-type ScopeFilterConfig struct {
-	Key      string   `yaml:"key"`
-	Value    string   `yaml:"value"`
-	Values   []string `yaml:"values,omitempty"`
-	Operator string   `yaml:"operator"`
-}
-
-// TreeNode is used for YAML parsing - converts to v0alpha1.ScopeNodeSpec
-type TreeNode struct {
-	Title    string              `yaml:"title"`
-	NodeType string              `yaml:"nodeType"`
-	LinkID   string              `yaml:"linkId,omitempty"`
-	LinkType string              `yaml:"linkType,omitempty"`
-	Children map[string]TreeNode `yaml:"children,omitempty"`
-}
-
-type NavigationConfig struct {
-	URL   string `yaml:"url"` // URL path (e.g., /d/abc123 or /explore)
-	Scope string `yaml:"scope"`
-}
-
-// Helper function to convert ScopeFilterConfig to v0alpha1.ScopeFilter
-func convertFilter(cfg ScopeFilterConfig) v0alpha1.ScopeFilter {
-	filter := v0alpha1.ScopeFilter{
-		Key:      cfg.Key,
-		Value:    cfg.Value,
-		Values:   cfg.Values,
-		Operator: v0alpha1.FilterOperator(cfg.Operator),
-	}
-	return filter
-}
-
-// Helper function to convert ScopeConfig to v0alpha1.ScopeSpec
-func convertScopeSpec(cfg ScopeConfig) v0alpha1.ScopeSpec {
-	filters := make([]v0alpha1.ScopeFilter, len(cfg.Filters))
-	for i, f := range cfg.Filters {
-		filters[i] = convertFilter(f)
-	}
-	return v0alpha1.ScopeSpec{
-		Title:   cfg.Title,
-		Filters: filters,
-	}
-}
-
-type Client struct {
-	baseURL    string
-	namespace  string
-	httpClient *http.Client
-	auth       string
-}
-
-func NewClient(baseURL, namespace, user, password string) *Client {
-	return &Client{
-		baseURL:    baseURL,
-		namespace:  namespace,
-		httpClient: &http.Client{},
-		auth:       basicAuth(user, password),
-	}
-}
-
-func basicAuth(username, password string) string {
-	return fmt.Sprintf("%s:%s", username, password)
-}
-
-func (c *Client) makeRequest(method, endpoint string, body []byte) error {
-	url := fmt.Sprintf("%s/apis/%s/namespaces/%s%s", c.baseURL, apiVersion, c.namespace, endpoint)
-
-	var req *http.Request
-	var err error
-
-	if body != nil {
-		req, err = http.NewRequest(method, url, bytes.NewBuffer(body))
-	} else {
-		req, err = http.NewRequest(method, url, nil)
-	}
-
-	if err != nil {
-		return fmt.Errorf("failed to create request: %w", err)
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-	req.SetBasicAuth(strings.Split(c.auth, ":")[0], strings.Split(c.auth, ":")[1])
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		bodyBytes, _ := io.ReadAll(resp.Body)
-		// For DELETE requests, 404 is acceptable (resource already deleted)
-		if resp.StatusCode == 404 {
-			return nil
-		}
-		return fmt.Errorf("API request failed: HTTP %d - %s", resp.StatusCode, string(bodyBytes))
-	}
-
-	return nil
-}
-
-func (c *Client) createScope(name string, cfg ScopeConfig) error {
-	prefixedName := prefix + "-" + name
-
-	spec := convertScopeSpec(cfg)
-
-	resource := v0alpha1.Scope{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: apiVersion,
-			Kind:       "Scope",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name: prefixedName,
-		},
-		Spec: spec,
-	}
-
-	body, err := json.Marshal(resource)
-	if err != nil {
-		return fmt.Errorf("failed to marshal scope: %w", err)
-	}
-
-	fmt.Printf("✓ Creating scope: %s\n", prefixedName)
-	return c.makeRequest("POST", "/scopes", body)
-}
-
-func (c *Client) createScopeNode(name string, node TreeNode, parentName string) error {
-	prefixedName := prefix + "-" + name
-	prefixedParent := ""
-	prefixedLinkID := ""
-
-	if parentName != "" {
-		prefixedParent = prefix + "-" + parentName
-	}
-
-	if node.LinkID != "" {
-		prefixedLinkID = prefix + "-" + node.LinkID
-	}
-
-	nodeType := v0alpha1.NodeType(node.NodeType)
-	if nodeType == "" {
-		nodeType = v0alpha1.NodeTypeContainer
-	}
-
-	linkType := v0alpha1.LinkType(node.LinkType)
-	if linkType == "" {
-		linkType = v0alpha1.LinkTypeScope
-	}
-
-	spec := v0alpha1.ScopeNodeSpec{
-		Title:              node.Title,
-		NodeType:           nodeType,
-		DisableMultiSelect: false,
-	}
-
-	if prefixedParent != "" {
-		spec.ParentName = prefixedParent
-	}
-
-	if prefixedLinkID != "" {
-		spec.LinkID = prefixedLinkID
-		spec.LinkType = linkType
-	}
-
-	resource := v0alpha1.ScopeNode{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: apiVersion,
-			Kind:       "ScopeNode",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name: prefixedName,
-		},
-		Spec: spec,
-	}
-
-	body, err := json.Marshal(resource)
-	if err != nil {
-		return fmt.Errorf("failed to marshal scope node: %w", err)
-	}
-
-	fmt.Printf("✓ Creating scope node: %s\n", prefixedName)
-	return c.makeRequest("POST", "/scopenodes", body)
-}
-
-func (c *Client) createScopeNavigation(name string, nav NavigationConfig) error {
-	prefixedName := prefix + "-" + name
-	prefixedScope := prefix + "-" + nav.Scope
-
-	if nav.URL == "" {
-		return fmt.Errorf("navigation %s must have 'url' specified", name)
-	}
-
-	spec := v0alpha1.ScopeNavigationSpec{
-		URL:   nav.URL,
-		Scope: prefixedScope,
-	}
-
-	resource := v0alpha1.ScopeNavigation{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: apiVersion,
-			Kind:       "ScopeNavigation",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name: prefixedName,
-		},
-		Spec: spec,
-	}
-
-	body, err := json.Marshal(resource)
-	if err != nil {
-		return fmt.Errorf("failed to marshal scope navigation: %w", err)
-	}
-
-	fmt.Printf("✓ Creating scope navigation: %s\n", prefixedName)
-	return c.makeRequest("POST", "/scopenavigations", body)
-}
-
-func (c *Client) createTreeNodes(children map[string]TreeNode, parentName string) error {
-	for name, node := range children {
-		// Build full node name by appending to parent name
-		// This makes it easy to see the tree path from the node name
-		fullNodeName := name
-		if parentName != "" {
-			fullNodeName = parentName + "-" + name
-		}
-
-		// parentName here is the full parent name (already includes full path)
-		err := c.createScopeNode(fullNodeName, node, parentName)
-		if err != nil {
-			return err
-		}
-
-		if len(node.Children) > 0 {
-			// Pass fullNodeName as parent for children (will be prefixed with "gdev-" in createScopeNode)
-			if err := c.createTreeNodes(node.Children, fullNodeName); err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
-}
-
-func (c *Client) deleteResources() {
-	fmt.Println("Deleting all gdev-prefixed resources...")
-
-	// Delete scopes (silently handle errors if endpoints aren't available)
-	c.deleteResourceType("/scopes", "scope")
-
-	// Delete scope nodes
-	c.deleteResourceType("/scopenodes", "scope node")
-
-	// Delete scope navigations
-	c.deleteResourceType("/scopenavigations", "scope navigation")
-
-	fmt.Println("✓ Cleanup complete")
-}
-
-func (c *Client) deleteResourceType(endpoint, resourceType string) {
-	url := fmt.Sprintf("%s/apis/%s/namespaces/%s%s", c.baseURL, apiVersion, c.namespace, endpoint)
-
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		// Silently skip if we can't create request
-		return
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-	req.SetBasicAuth(strings.Split(c.auth, ":")[0], strings.Split(c.auth, ":")[1])
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		// Silently skip if endpoint isn't available
-		return
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		// Silently skip if endpoint returns error (might not be available)
-		return
-	}
-
-	var listResponse struct {
-		Items []struct {
-			Metadata struct {
-				Name string `json:"name"`
-			} `json:"metadata"`
-		} `json:"items"`
-	}
-
-	bodyBytes, _ := io.ReadAll(resp.Body)
-	if err := json.Unmarshal(bodyBytes, &listResponse); err != nil {
-		// Silently skip if we can't decode response
-		return
-	}
-
-	if len(listResponse.Items) == 0 {
-		return
-	}
-
-	deletedCount := 0
-	for _, item := range listResponse.Items {
-		if strings.HasPrefix(item.Metadata.Name, prefix+"-") {
-			fmt.Printf("  Deleting %s: %s\n", resourceType, item.Metadata.Name)
-			deleteURL := fmt.Sprintf("%s/%s", endpoint, item.Metadata.Name)
-			if err := c.makeRequest("DELETE", deleteURL, nil); err != nil {
-				// Silently skip deletion errors
-			} else {
-				deletedCount++
-			}
-		}
-	}
-}
-
-func main() {
-	flag.Parse()
-
-	client := NewClient(*grafanaURL, *namespace, *user, *password)
-
-	if *cleanupFlag {
-		// Cleanup should be silent if endpoints aren't available
-		client.deleteResources()
-		return
-	}
-
-	configData, err := os.ReadFile(*configFile)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error reading config file: %v\n", err)
-		os.Exit(1)
-	}
-
-	var config Config
-	if err := yaml.Unmarshal(configData, &config); err != nil {
-		fmt.Fprintf(os.Stderr, "Error parsing config file: %v\n", err)
-		os.Exit(1)
-	}
-
-	fmt.Printf("Loading configuration from: %s\n", *configFile)
-	fmt.Printf("Grafana URL: %s\n", *grafanaURL)
-	fmt.Printf("Namespace: %s\n", *namespace)
-	fmt.Printf("Prefix: %s\n\n", prefix)
-
-	// Create scopes
-	fmt.Println("Creating scopes...")
-	for name, scope := range config.Scopes {
-		if err := client.createScope(name, scope); err != nil {
-			fmt.Fprintf(os.Stderr, "Error creating scope %s: %v\n", name, err)
-			os.Exit(1)
-		}
-	}
-	fmt.Println()
-
-	// Create scope nodes (tree structure)
-	if len(config.Tree) > 0 {
-		fmt.Println("Creating scope nodes...")
-		if err := client.createTreeNodes(config.Tree, ""); err != nil {
-			fmt.Fprintf(os.Stderr, "Error creating scope nodes: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Println()
-	}
-
-	// Create scope navigations
-	if len(config.Navigations) > 0 {
-		fmt.Println("Creating scope navigations...")
-		for name, nav := range config.Navigations {
-			if err := client.createScopeNavigation(name, nav); err != nil {
-				fmt.Fprintf(os.Stderr, "Error creating scope navigation %s: %v\n", name, err)
-				os.Exit(1)
-			}
-		}
-		fmt.Println()
-	}
-
-	fmt.Println("✓ All resources created successfully!")
-}
--- a/devenv/setup.sh
+++ b/devenv/setup.sh
@@ -19,13 +19,6 @@ bulkFolders() {
 	ln -s -f ../../../devenv/bulk-folders/bulk-folders.yaml ../conf/provisioning/dashboards/bulk-folders.yaml
 }

-scopes() {
-	echo -e "\xE2\x9C\x94 Setting up scopes, scope nodes, and scope navigations"
-	cd scopes
-	go run scopes.go
-	cd ..
-}
-
 requiresJsonnet() {
 		if ! type "jsonnet" > /dev/null; then
 				echo "you need you install jsonnet to run this script"
@@ -56,12 +49,6 @@ undev() {
    rm -rf bulk-folders/Bulk\ Folder*
    echo -e "    \xE2\x9C\x94 Reverting bulk-folders provisioning"

-    # Removing scopes, scope nodes, and scope navigations
-    cd scopes
-    go run scopes.go -clean
-    cd ..
-    echo -e "    \xE2\x9C\x94 Deleting scopes, scope nodes, and scope navigations"
-
    # Removing the symlinks
    rm -f ../conf/provisioning/dashboards/custom.yaml
    rm -f ../conf/provisioning/dashboards/bulk-folders.yaml
@@ -76,7 +63,6 @@ usage() {
 	echo "  bulk-dashboards                      - provision 400 dashboards"
 	echo "  bulk-folders [folders] [dashboards]  - provision many folders with dashboards"
 	echo "  bulk-folders                         - provision 200 folders with 3 dashboards in each"
-	echo "  scopes                               - provision scopes, scope nodes, and scope navigations"
 	echo "  no args                              - provision core datasources and dev dashboards"
 	echo "  undev                                - removes any provisioning done by the setup.sh"
 }
@@ -94,8 +80,6 @@ main() {
 		bulkDashboard
 	elif [[ $cmd == "bulk-folders" ]]; then
 		bulkFolders "$arg1"
-	elif [[ $cmd == "scopes" ]]; then
-		scopes
 	elif [[ $cmd == "undev" ]]; then
 	   undev
 	else
--- a/docs/sources/alerting/set-up/performance-limitations/index.md
+++ b/docs/sources/alerting/set-up/performance-limitations/index.md
@@ -68,21 +68,7 @@ You can change this behavior by disabling the `alertingSaveStateCompressed` feat

 You can also reduce database load by writing states periodically instead of after every evaluation.

-There are two approaches for periodic state saving:
-
-#### Compressed periodic saves
-
-You can combine compressed alert state storage with periodic saves by enabling both `alertingSaveStateCompressed` and `alertingSaveStatePeriodic` feature toggles together.
-
-This approach groups all alert instances by rule UID and compresses them together for efficient storage.
-
-When both feature toggles are enabled, Grafana will save compressed alert states at the interval specified by `state_periodic_save_interval`. Note that in compressed mode, the `state_periodic_save_batch_size` setting is ignored as the system groups instances by rule UID rather than by batch size.
-
-#### Batch-based periodic saves
-
-Alternatively, you can use batch-based periodic saves without compression:
-
-This approach processes individual alert instances in batches of a specified size.
+To save state periodically:

 1. Enable the `alertingSaveStatePeriodic` feature toggle.
 1. Disable the `alertingSaveStateCompressed` feature toggle.
@@ -91,7 +77,7 @@ By default, it saves the states every 5 minutes to the database and on each shut
 can also be configured using the `state_periodic_save_interval` configuration flag. During this process, Grafana deletes all existing alert instances from the database and then writes the entire current set of instances back in batches in a single transaction.
 Configure the size of each batch using the `state_periodic_save_batch_size` configuration option.

-##### Jitter for batch-based periodic saves
+#### Jitter for periodic saves

 To further distribute database load, you can enable jitter for periodic state saves by setting `state_periodic_save_jitter_enabled = true`. When jitter is enabled, instead of saving all batches simultaneously, Grafana spreads the batch writes across a calculated time window of 85% of the save interval.

--- a/docs/sources/datasources/aws-cloudwatch/query-editor/index.md
+++ b/docs/sources/datasources/aws-cloudwatch/query-editor/index.md
@@ -250,19 +250,6 @@ You can query CloudWatch Logs using three supported query language options:

 1. Select a region.
 1. Select **CloudWatch Logs** from the query type drop-down.
-1. Select the Logs Mode depending on whether you would like to query CloudWatch Logs Insights or Log Anomalies
-
-**Log Anomalies**
-
-[Anomaly detection](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection.html) uses machine-learning and pattern recognition to establish baselines of typical log content.  
-The Log Anomalies query editor fetches the list of anomalies detected in your CloudWatch service. In order to query log anomalies in the editor, a log anomaly detector must be created in the AWS CloudWatch console first.
-The log trend cell shows the number of occurrences of the pattern over the selected query time range.
-The table shows 50 log anomalies at a time. If you would like to narrow down the list, you can filter anomalies by their ARN and suppressed state.
-
-In addition to this, you can use the Logs Insights QL editor and the `anomaly` command together with the `patterns` command to define and display log anomalies in real time. See the [CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-Insights.html) documentation for more info.
-
-**Logs Insights**
-
 1. Select the query language you would like to use in the **Query Language** drop-down.
 1. Click **Select log groups** and choose up to 20 log groups to query.
 1. Use the main input area to write your logs query. Amazon CloudWatch only supports a subset of OpenSearch SQL and PPL commands. To find out more about the syntax supported, consult [Amazon CloudWatch Logs documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Languages.html)
@@ -271,7 +258,7 @@ In addition to this, you can use the Logs Insights QL editor and the `anomaly` c
   You must specify the region and log groups when querying with **Logs Insights QL** and **OpenSearch PPL**. **OpenSearch SQL** doesn't require log group selection. However, selecting log groups simplifies query writing by populating syntax suggestions with discovered log group fields.
   {{< /admonition >}}

-Click **View in CloudWatch console** to interactively view, search, and analyze your log data in the CloudWatch Logs Insights console. If you're not logged in to the CloudWatch console, the link forwards you to the login page.
+Click **CloudWatch Logs Insights** to interactively view, search, and analyze your log data in the CloudWatch Logs Insights console. If you're not logged in to the CloudWatch console, the link forwards you to the login page.

 ### Query Log groups with OpenSearch SQL

--- a/docs/sources/datasources/concepts.md
+++ b/docs/sources/datasources/concepts.md
@@ -1,154 +0,0 @@
---
-aliases:
-labels:
-  products:
-    - cloud
-    - enterprise
-    - oss
-menuTitle: Concepts
-title: Data sources, plugins and integrations
-weight: 70
-refs:
-  data-source-management:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
-    - pattern: /docs/grafana-cloud/
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/
-  plugin-management:
-    - pattern: /docs/grafana/
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/plugin-management/
-    - pattern: /docs/grafana-cloud
-      destination: /docs/grafana/<GRAFANA_VERSION>/administration/plugin-management/
---
-
-# Data sources, plugins, and integrations
-
-When working with Grafana, you'll encounter three key concepts: data sources, plugins, and integrations. Each one is essential in building effective monitoring solutions, but they serve distinct purposes, and are often confused with one another. This document clarifies the meaning of each concept and what each one does, when to use it, and how they work together to create observability solutions in Grafana.
-
-## Data sources
-
-A data source is a connection to a specific database, monitoring system, service, or other external location that stores data, metrics, logs, or traces. Examples include Prometheus, InfluxDB, PostgreSQL, or CloudWatch. When you configure a data source in Grafana, you're telling it where to fetch data from, providing connection details, credentials, and endpoints. Data sources are the foundation for working with Grafana. Without them, Grafana has nothing to visualize. Once configured, you can query your Prometheus data source to display CPU metrics, or query CloudWatch to visualize AWS infrastructure performance.
-
-## Plugins
-
-A plugin extends Grafana’s core functionality. Plugins can add new data source types, visualization panels, or full-featured applications that integrate with Grafana. They make Grafana modular and extensible.
-
-Plugins come in three types:
-
- **Data source plugins** connect Grafana to **external data sources**. You use this type of plugin when you want to access and work with data from an external source or third party. Examples include Prometheus, MSSQL, and Databricks.
-
- **Panel plugins** control how data appears in Grafana dashboards. Examples of panel plugins include pie chart, candlestick, and traffic light. Note that in some cases, panels don't rely on a data source at all. The **Text** panel can render static or templated content without querying data. Panels can also support user-driven actions. For example, the **Button** panel can trigger workflows or external calls.
-
- **App plugins** allow you to bundle data sources and panel plugins within a single package. They enable you to create custom pages within Grafana that can function like dashboards, providing dedicated spaces for documentation, sign-up forms, custom UI extensions, and integration with other services via HTTP. Cloud apps built as app plugins offer out-of-the-box observability solutions, such as Azure Cloud Native Monitoring and Redis Application, that provide comprehensive monitoring capabilities compared to standalone integrations
-
-## Integrations
-
-_Integrations are exclusive to Grafana Cloud._ An integration is a pre-packaged monitoring solution that bundles export/scrape configurations, pre-built dashboards, alert rules, and sometimes recording rules. Unlike standalone data sources, integrations handle the complete workflow: they configure how telemetry is collected and sent to Grafana Cloud's hosted databases, then provide ready-to-use dashboards and alerts. For example, a Kubernetes integration configures metric collection from your cluster, creates dashboards for monitoring, and sets up common alerts—all working together out of the box
-
-## When to use each
-
-Use a data source when:
-
- You want to connect Grafana to a specific system (for example, Prometheus or MySQL).
- You’re building custom dashboards with hand-picked metrics and visualizations.
- Your monitoring needs are unique or not covered by pre-packaged integrations.
-
-Use a plugin when:
-
- You need to connect to a system Grafana doesn’t support natively.
- You want to add new functionality (visualizations, workflows, or app-style extensions).
- You have specialized or industry-specific requirements (for example, IoT).
-
-Use an integration when:
-
- You’re using Grafana Cloud and want a quick, pre-built setup.
- You prefer minimal configuration with ready-to-use dashboards and alerts.
- You’re new to observability and want to learn what good monitoring looks like.
-
-## Relationships and interactions
-
-How data sources, plugins, and integrations work together:
-
- Plugins extend what Grafana can do.
- Data sources define where Grafana reads data from.
- Integrations combine telemetry collection and pre-built content to create complete monitoring solutions.
-
-Examples:
-
- Install the Databricks data source plugin. Configure the Databricks data source and run SQL queries against your Databricks workspace. Use the `Histogram` panel to visualize distributions in your query results, such as latency buckets, job durations, or model output scores.
-
- Install the Redis Application app plugin. This app provides a unified experience for monitoring Redis by working with your existing Redis data source. It adds custom pages for configuration and exploration, along with prebuilt dashboards, commands, and visualizations that help you analyze performance, memory usage, and key activity.
-
-<!-- - Install the Azure Cloud Native Monitoring app plugin, which bundles the app and data source plugin types. It includes data source plugins for Azure Monitor and Log Analytics, panel plugins for visualizing Azure metrics, and a custom configuration page for managing authentication and subscriptions. -->
-
- If you’re using Grafana Cloud, add the ClickHouse integration. This integration provides pre-built dashboards and alerts to monitor ClickHouse cluster metrics and logs, enabling users to visualize and analyze their ClickHouse performance and health in real-time.
-
-## Frequently asked questions
-
-**What's the difference between a data source and a data source plugin?**
-
-A data source plugin is a **software component that enables Grafana to communicate** with specific types of databases or services, like Prometheus, MySQL, or InfluxDB. A data source is **an actual configured connection** to one of these databases, including the credentials, URL, and settings needed to retrieve data.
-
-Think of it this way: You _install_ a plugin but _configure_ a data source.
-
-**Do I need a plugin to use a data source?**
-
-You must install the plugin before you configure or use the data source. Each data source plugin has its own versioning and lifecycle. Grafana includes built-in core data sources, which can be thought of as pre-installed plugins.
-
-**Can I use integrations in self-hosted Grafana?**
-
-No, integrations are exclusive to Grafana Cloud. In self-hosted Grafana, you can replicate similar setups manually using data sources and dashboards.
-
-**Aren't integrations just pre-built dashboards?**
-
-No, integrations are much more than just dashboards. While dashboards are part of an integration, they’re only one piece. Integrations typically include:
-
- Data collection setup (for example, pre-configured agents or exporters).
- Predefined metrics and queries tailored to the technology.
- Alerting rules and notifications to help detect common issues.
- Dashboards to visualize and explore that data.
-
-**What’s the difference between plugin types?**
-
-A data source plugin in Grafana is a software component that enables Grafana to connect to and retrieve data from various external data sources. After you install the plugin, you can use it to configure one or more data sources. Each data source defines the actual connection details, like the server URL, authentication method, and query options.
-
-A panel plugin in Grafana is an extension that allows you to add new and custom visualizations to your Grafana dashboards. While Grafana comes with several built-in panel types (like graphs, single stats, and tables), panel plugins extend this functionality by providing specialized ways to display data.
-
-An app plugin in Grafana is a type of plugin that provides a comprehensive, integrated, and often out-of-the-box experience within Grafana. Unlike data source plugins, which connect to external data sources, or panel plugins, which provide new visualization types, app plugins can combine various functionalities to create a more complete experience.
-
-**How do data sources and integrations differ in how they handle data?**
-
-Data sources query data where it already lives. They connect Grafana to an external system or database, such as Prometheus, MySQL, or Elasticsearch and fetch data on demand. You keep full control over your own data stores, schemas and retention policies.
-
-In contrast, integrations focus on getting data into Grafana Cloud’s hosted backends. They ingest metrics, logs, and traces into systems like Mimir, Loki, or Tempo, using pre-configured agents and pipelines. Instead of querying an external database, Grafana queries its own managed storage where the integration has placed the data.
-
-## Summary reference
-
-Use the following table to compare how data sources, plugins, and integrations differ in scope, purpose, and use. It highlights where each applies within Grafana, what problems it solves, and how they work together to build observability solutions.
-
-| Concept                | Where it applies       | Purpose                                              | What it includes                                            | When to use it                                          | Example                                    |
-| ---------------------- | ---------------------- | ---------------------------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------- | ------------------------------------------ |
-| **Data source**        | Self-hosted and Cloud  | Connect to external metrics, logs, or traces storage | Connection settings, auth, query config                     | Visualize data from a database or monitoring system     | Prometheus, CloudWatch, PostgreSQL         |
-| **Plugin**             | Self-hosted and Cloud  | Extend Grafana with new capabilities                 | Three types: data source, panel, and app                    | Add connectivity or functionality not included by default | Plotly panel, MongoDB data source          |
-| **App plugin**         | Self-hosted and Cloud  | Bundle plugins with custom pages or UI               | Data source + panel plugins + custom routes                 | Create a dedicated app-like experience                  | Azure Cloud Native Monitoring              |
-| **Panel plugin**       | Self-hosted and Cloud  | Add new visualization types                          | Custom panels and visualization logic                       | Display data beyond built-in visualizations             | Pie chart, Candlestick, Geomap             |
-| **Data source plugin** | Self-hosted and Cloud  | Connect to a new external system type                | Connector code for querying that system                     | Access data from an unsupported backend                 | Databricks, MongoDB, MSSQL                 |
-| **Integration**        | Grafana Cloud only     | Pre-packaged observability for a specific technology | Telemetry config, dashboards, alerts, recording rules       | Get an out-of-the-box setup with minimal configuration  | Kubernetes, Redis, NGINX                   |
-
-For detailed documentation and how-to guides related to data sources, plugins, and integrations, refer to the following references:
-
-**Data sources**:
-
- [Manage data sources](ref:data-source-management)
-
-**Plugins**:
-
- [Plugin types and usage](https://grafana.com/developers/plugin-tools/key-concepts/plugin-types-usage)
- [App plugins](https://grafana.com/developers/plugin-tools/how-to-guides/app-plugins/)
- [Data source plugins](https://grafana.com/developers/plugin-tools/how-to-guides/data-source-plugins/)
- [Panel plugins](https://grafana.com/developers/plugin-tools/how-to-guides/panel-plugins/)
-
-**Integrations**:
-
- [Grafana integrations](https://grafana.com/docs/grafana-cloud/monitor-infrastructure/integrations/)
- [Install and manage integrations](https://grafana.com/docs/grafana-cloud/monitor-infrastructure/integrations/install-and-manage-integrations/)
--- a/docs/sources/observability-as-code/grafana-cli/grafanacli-workflows.md
+++ b/docs/sources/observability-as-code/grafana-cli/grafanacli-workflows.md
@@ -18,7 +18,7 @@ weight: 300
 # Manage resources with Grafana CLI

 {{< admonition type="note" >}}
-`grafanactl` is under active development. Command-line flags and subcommands described here may change. This document outlines the target workflows the tool is expected to support. You can find a full list of supported commands [in this page](https://grafana.github.io/grafanactl/reference/cli/grafanactl/).
+`grafanactl` is under active development. Command-line flags and subcommands described here may change. This document outlines the target workflows the tool is expected to support.
 {{< /admonition >}}

 ## Migrate resources between environments
--- a/docs/sources/setup-grafana/configure-grafana/_index.md
+++ b/docs/sources/setup-grafana/configure-grafana/_index.md
@@ -1969,12 +1969,6 @@ If a rule frequency is lower than this value, then this value is enforced.

 <hr>

-#### `rule_version_record_limit`
-
-Defines the limits for how many alert rule versions are stored in the database per alert rule.
-
-The default `0` value means there's no limit.
-
 ### `[unified_alerting.screenshots]`

 For more information about screenshots, refer to [Images in notifications](../../alerting/configure-notifications/template-notifications/images-in-notifications/).
--- a/docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md
+++ b/docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md
@@ -40,6 +40,7 @@ Most [generally available](https://grafana.com/docs/release-life-cycle/#general-
 | `transformationsRedesign`              | Enables the transformations redesign                                                                                                                          | Yes                |
 | `awsAsyncQueryCaching`                 | Enable caching for async queries for Redshift and Athena. Requires that the datasource has caching and async query support enabled                            | Yes                |
 | `dashgpt`                              | Enable AI powered features in dashboards                                                                                                                      | Yes                |
+| `panelMonitoring`                      | Enables panel monitoring through logs and measurements                                                                                                        | Yes                |
 | `formatString`                         | Enable format string transformer                                                                                                                              | Yes                |
 | `kubernetesDashboards`                 | Use the kubernetes API in the frontend for dashboards                                                                                                         | Yes                |
 | `addFieldFromCalculationStatFunctions` | Add cumulative and window functions to the add field from calculation transformation                                                                          | Yes                |
--- a/e2e-playwright/dashboards-suite/adhoc-filter-from-panel.spec.ts
+++ b/e2e-playwright/dashboards-suite/adhoc-filter-from-panel.spec.ts
@@ -1,9 +1,16 @@
+import { Page, Locator } from '@playwright/test';
+
 import { test, expect } from '@grafana/plugin-e2e';

 import testDashboard from '../dashboards/AdHocFilterTest.json';
-import { getCell } from '../panels-suite/table-utils';

-const fixture = require('../fixtures/prometheus-response.json');
+// Helper function to get a specific cell in a table
+const getCell = async (loc: Page | Locator, rowIdx: number, colIdx: number) =>
+  loc
+    .getByRole('row')
+    .nth(rowIdx)
+    .getByRole(rowIdx === 0 ? 'columnheader' : 'gridcell')
+    .nth(colIdx);

 test.describe(
  'Dashboard with Table powered by Prometheus data source',
@@ -39,90 +46,80 @@ test.describe(
      gotoDashboardPage,
      selectors,
    }) => {
-      // Handle query and query_range API calls. Ideally, this would instead be directly tested against gdev-prometheus.
+      // Handle query and query_range API calls
      await page.route(/\/api\/ds\/query/, async (route) => {
-        const response = JSON.parse(JSON.stringify(fixture));
-
-        // This simulates the behavior of prometheus applying a filter and removing dataframes from the response where
-        // the label matches the selected filter. We check for either the slice being applied inline into the prometheus
-        // query or the adhoc filter being present in the request body of prometheus applying that filter and removing
-        // dataframes from the response.
-        const postData = route.request().postData();
-        const match =
-          postData?.match(/{slice=\\\"([\w_]+)\\\"}/) ??
-          postData?.match(/"adhocFilters":\[{"key":"slice","operator":"equals","value":"([\w_]+)"}\]/);
-        if (match) {
-          response.results.A.frames = response.results.A.frames.filter((frame) =>
-            frame.schema.fields.every((field) => !field.labels || field.labels.slice === match[1])
-          );
+        const fixture = require('../fixtures/prometheus-response.json');
+        // during the test, we select the "inner_eval" slice to filter; this simulates the behavior
+        // of prometheus applying that filter and removing dataframes from the response.
+        if (route.request().postData()?.includes('{slice=\\\"inner_eval\\\"}')) {
+          delete fixture.results.A.frames[1];
        }

        await route.fulfill({
          status: 200,
          contentType: 'application/json',
-          body: JSON.stringify(response),
+          body: JSON.stringify(fixture),
        });
      });

      const dashboardPage = await gotoDashboardPage({ uid: dashboardUID });

-      let panel = dashboardPage.getByGrafanaSelector(
+      const panel = dashboardPage.getByGrafanaSelector(
        selectors.components.Panels.Panel.title('Table powered by Prometheus')
      );
-      await expect(panel, 'panel is rendered').toBeVisible();
+      await expect(panel).toBeVisible();

      // Wait for the table to load completely
-      const table = panel.locator('.rdg');
-      await expect(table, 'table is rendered').toBeVisible();
+      await expect(panel.locator('.rdg')).toBeVisible();

-      const firstValue = (await getCell(table, 1, 1).textContent())!;
-      const secondValue = (await getCell(table, 2, 1).textContent())!;
-      expect(firstValue, `first cell is "${firstValue}"`).toBeTruthy();
-      expect(secondValue, `second cell is "${secondValue}"`).toBeTruthy();
-      expect(firstValue, 'first and second cell values are different').not.toBe(secondValue);
+      // Get the first data cell in the third column (row 1, column 2)
+      const labelValueCell = await getCell(panel, 1, 1);
+      await expect(labelValueCell).toBeVisible();

-      async function performTest(labelValue: string) {
-        // Confirm both cells are rendered before we proceed
-        const otherValue = labelValue === firstValue ? secondValue : firstValue;
-        await expect(table.getByText(labelValue), `"${labelValue}" is rendered`).toContainText(labelValue);
-        await expect(table.getByText(otherValue), `"${otherValue}" is rendered`).toContainText(otherValue);
+      // Get the cell value before clicking the filter button
+      const labelValue = await labelValueCell.textContent();
+      expect(labelValue).toBeTruthy();

-        // click the "Filter for value" button on the cell with the specified labelValue
-        await table.getByText(labelValue).hover();
-        table.getByText(labelValue).getByRole('button', { name: 'Filter for value' }).click();
+      const otherValueCell = await getCell(panel, 2, 1);
+      const otherValueLabel = await otherValueCell.textContent();
+      expect(otherValueLabel).toBeTruthy();
+      expect(otherValueLabel).not.toBe(labelValue);

-        // Look for submenu items that contain the filtered value
-        // The adhoc filter should appear as a filter chip or within the variable controls
-        const submenuItems = dashboardPage.getByGrafanaSelector(selectors.pages.Dashboard.SubMenu.submenuItem);
-        await expect(submenuItems.filter({ hasText: labelValue }), `submenu contains "${labelValue}"`).toBeVisible();
-        await expect(
-          submenuItems.filter({ hasText: otherValue }),
-          `submenu does not contain "${otherValue}"`
-        ).toBeHidden();
+      // Hover over the first cell to trigger the appearance of filter actions
+      await labelValueCell.hover();

-        // The URL parameter should contain the filter in format like: var-PromAdHoc=["columnName","=","value"]
-        const currentUrl = page.url();
-        const urlParams = new URLSearchParams(new URL(currentUrl).search);
-        const promAdHocParam = urlParams.get('var-PromAdHoc');
-        expect(promAdHocParam, `url contains "${labelValue}"`).toContain(labelValue);
-        expect(promAdHocParam, `url does not contain "${otherValue}"`).not.toContain(otherValue);
+      // Check if the "Filter for value" button appears on hover
+      const filterForValueButton = labelValueCell.getByRole('button', { name: 'Filter for value' });
+      await expect(filterForValueButton).toBeVisible();

-        // finally, let's check that the table was updated and that the value was filtered out when the query was re-run
-        await expect(table.getByText(labelValue), `"${labelValue}" is still visible`).toHaveText(labelValue);
-        await expect(table.getByText(otherValue), `"${otherValue}" is filtered out`).toBeHidden();
+      // Click on the "Filter for value" button
+      await filterForValueButton.click();

-        // Remove the adhoc filter by clicking the submenu item again
-        const filterChip = submenuItems.filter({ hasText: labelValue });
-        await filterChip.getByLabel(/Remove filter with key/).click();
-        await page.click('body', { position: { x: 0, y: 0 } }); // click outside to close the open menu from ad-hoc filters
+      // Check if the adhoc filter appears in the dashboard submenu
+      const submenuItems = dashboardPage.getByGrafanaSelector(selectors.pages.Dashboard.SubMenu.submenuItem);
+      await expect(submenuItems.first()).toBeVisible();

-        // the "first" and "second" cells locators don't work here for some reason.
-        await expect(table.getByText(labelValue), `"${labelValue}" is still rendered`).toContainText(labelValue);
-        await expect(table.getByText(otherValue), `"${otherValue}" is rendered again`).toContainText(otherValue);
-      }
+      // Look for submenu items that contain the filtered value
+      // The adhoc filter should appear as a filter chip or within the variable controls
+      const hasFilterValue = await submenuItems.filter({ hasText: labelValue! }).count();
+      expect(hasFilterValue).toBeGreaterThan(0);

-      await performTest(firstValue);
-      await performTest(secondValue);
+      const hasOtherValue = await submenuItems.filter({ hasText: otherValueLabel! }).count();
+      expect(hasOtherValue).toBe(0);
+
+      // Check if the URL contains the var-PromAdHoc parameter with the filtered value
+      const currentUrl = page.url();
+      expect(currentUrl).toContain('var-PromAdHoc');
+
+      // The URL parameter should contain the filter in format like: var-PromAdHoc=["columnName","=","value"]
+      const urlParams = new URLSearchParams(new URL(currentUrl).search);
+      const promAdHocParam = urlParams.get('var-PromAdHoc');
+      expect(promAdHocParam).toBeTruthy();
+      expect(promAdHocParam).toContain(labelValue!);
+      expect(promAdHocParam).not.toContain(otherValueLabel!);
+
+      // finally, let's check that the table was updated and that the value was filtered out when the query was re-run
+      await expect(otherValueCell).toBeHidden();
    });
  }
 );
--- a/e2e-playwright/dashboards-suite/dashboard-time-zone.spec.ts
+++ b/e2e-playwright/dashboards-suite/dashboard-time-zone.spec.ts
@@ -17,7 +17,7 @@ test.describe(
    tag: ['@dashboards'],
  },
  () => {
-    test('Tests dashboard time zone scenarios', async ({ page, gotoDashboardPage, selectors }) => {
+    test.fixme('Tests dashboard time zone scenarios', async ({ page, gotoDashboardPage, selectors }) => {
      const dashboardPage = await gotoDashboardPage({ uid: TIMEZONE_DASHBOARD_UID });

      const fromTimeZone = 'UTC';
@@ -106,18 +106,12 @@ test.describe(
        zone: 'Browser',
      });

-      const relativeTimeRow = dashboardPage
-        .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
-        .locator('[role="row"]')
-        .filter({ hasText: '00:00:00' })
-        .first();
-      const timezoneRow = dashboardPage
-        .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel in timezone'))
-        .locator('[role="row"]')
-        .filter({ hasText: '00:00:00' })
-        .first();
-
-      await expect(relativeTimeRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();

      // Today so far, still in Browser timezone
      await setTimeRange(page, dashboardPage, selectors, {
@@ -125,8 +119,19 @@ test.describe(
        to: 'now',
      });

-      await expect(relativeTimeRow).toBeVisible();
-      await expect(timezoneRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();
+
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel in timezone'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();

      // Test UTC timezone
      await setTimeRange(page, dashboardPage, selectors, {
@@ -135,7 +140,12 @@ test.describe(
        zone: 'Coordinated Universal Time',
      });

-      await expect(relativeTimeRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();

      // Today so far, still in UTC timezone
      await setTimeRange(page, dashboardPage, selectors, {
@@ -143,8 +153,19 @@ test.describe(
        to: 'now',
      });

-      await expect(relativeTimeRow).toBeVisible();
-      await expect(timezoneRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();
+
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel in timezone'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();

      // Test Tokyo timezone
      await setTimeRange(page, dashboardPage, selectors, {
@@ -153,7 +174,12 @@ test.describe(
        zone: 'Asia/Tokyo',
      });

-      await expect(relativeTimeRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();

      // Today so far, still in Tokyo timezone
      await setTimeRange(page, dashboardPage, selectors, {
@@ -161,8 +187,19 @@ test.describe(
        to: 'now',
      });

-      await expect(relativeTimeRow).toBeVisible();
-      await expect(timezoneRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();
+
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel in timezone'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();

      // Test LA timezone
      await setTimeRange(page, dashboardPage, selectors, {
@@ -171,7 +208,12 @@ test.describe(
        zone: 'America/Los Angeles',
      });

-      await expect(relativeTimeRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();

      // Today so far, still in LA timezone
      await setTimeRange(page, dashboardPage, selectors, {
@@ -179,8 +221,19 @@ test.describe(
        to: 'now',
      });

-      await expect(relativeTimeRow).toBeVisible();
-      await expect(timezoneRow).toBeVisible();
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel with relative time override'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();
+
+      await expect(
+        dashboardPage
+          .getByGrafanaSelector(selectors.components.Panels.Panel.title('Panel in timezone'))
+          .locator('[role="row"]')
+          .filter({ hasText: '00:00:00' })
+      ).toBeVisible();
    });
  }
 );
--- a/e2e-playwright/panels-suite/table-kitchenSink.spec.ts
+++ b/e2e-playwright/panels-suite/table-kitchenSink.spec.ts
@@ -65,11 +65,11 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']
    await expect(getCellHeight(page, 1, longTextColIdx)).resolves.toBeLessThan(100);

    // test that hover overflow works.
-    const loremIpsumCell = getCell(page, 1, longTextColIdx);
+    const loremIpsumCell = await getCell(page, 1, longTextColIdx);
    await loremIpsumCell.scrollIntoViewIfNeeded();
    await loremIpsumCell.hover();
    await expect(getCellHeight(page, 1, longTextColIdx)).resolves.toBeGreaterThan(100);
-    await getCell(page, 1, longTextColIdx + 1).hover();
+    await (await getCell(page, 1, longTextColIdx + 1)).hover();
    await expect(getCellHeight(page, 1, longTextColIdx)).resolves.toBeLessThan(100);

    // enable cell inspect, confirm that hover no longer triggers.
@@ -140,15 +140,15 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']
    ).toBeVisible();

    // click the "State" column header to sort it.
-    const stateColumnHeader = getCell(page, 0, 1);
+    const stateColumnHeader = await getCell(page, 0, 1);

    await stateColumnHeader.getByText('Info').click();
    await expect(stateColumnHeader).toHaveAttribute('aria-sort', 'ascending');
-    await expect(getCell(page, 1, 1)).toContainText('down'); // down or down fast
+    expect(getCell(page, 1, 1)).resolves.toContainText('down'); // down or down fast

    await stateColumnHeader.getByText('Info').click();
    await expect(stateColumnHeader).toHaveAttribute('aria-sort', 'descending');
-    await expect(getCell(page, 1, 1)).toContainText('up'); // up or up fast
+    expect(getCell(page, 1, 1)).resolves.toContainText('up'); // up or up fast

    await stateColumnHeader.getByText('Info').click();
    await expect(stateColumnHeader).not.toHaveAttribute('aria-sort');
@@ -171,7 +171,7 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']
    const stateColumnHeader = page.getByRole('columnheader').nth(infoColumnIdx);

    // get the first value in the "State" column, filter it out, then check that it went away.
-    const firstStateValue = (await getCell(page, 1, infoColumnIdx).textContent())!;
+    const firstStateValue = (await (await getCell(page, 1, infoColumnIdx)).textContent())!;
    await stateColumnHeader.getByTestId(selectors.components.Panels.Visualization.TableNG.Filters.HeaderButton).click();
    const filterContainer = dashboardPage.getByGrafanaSelector(
      selectors.components.Panels.Visualization.TableNG.Filters.Container
@@ -188,7 +188,7 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']
    await expect(filterContainer).not.toBeVisible();

    // did it actually filter out our value?
-    await expect(getCell(page, 1, infoColumnIdx)).not.toHaveText(firstStateValue);
+    await expect(getCell(page, 1, infoColumnIdx)).resolves.not.toHaveText(firstStateValue);
  });

  test('Tests pagination, row height adjustment', async ({ gotoDashboardPage, selectors, page }) => {
@@ -289,7 +289,7 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']
    const dataLinkColIdx = await getColumnIdx(page, 'Data Link');

    // Info column has a single DataLink by default.
-    const infoCell = getCell(page, 1, infoColumnIdx);
+    const infoCell = await getCell(page, 1, infoColumnIdx);
    await expect(infoCell.locator('a')).toBeVisible();
    expect(infoCell.locator('a')).toHaveAttribute('href');
    expect(infoCell.locator('a')).not.toHaveAttribute('aria-haspopup');
@@ -306,7 +306,7 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']
        continue;
      }

-      const cell = getCell(page, 1, colIdx);
+      const cell = await getCell(page, 1, colIdx);
      await expect(cell.locator('a')).toBeVisible();
      expect(cell.locator('a')).toHaveAttribute('href');
      expect(cell.locator('a')).not.toHaveAttribute('aria-haspopup', 'menu');
@@ -319,7 +319,7 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']

    // loop thru the columns, click the links, observe that the tooltip appears, and close the tooltip.
    for (let colIdx = 0; colIdx < colCount; colIdx++) {
-      const cell = getCell(page, 1, colIdx);
+      const cell = await getCell(page, 1, colIdx);
      if (colIdx === infoColumnIdx) {
        // the Info column should still have its single link.
        expect(cell.locator('a')).not.toHaveAttribute('aria-haspopup', 'menu');
@@ -433,7 +433,7 @@ test.describe('Panels test: Table - Kitchen Sink', { tag: ['@panels', '@table']
    await filterContainer.getByTitle('up', { exact: true }).locator('label').click();
    await filterContainer.getByRole('button', { name: 'Ok' }).click();

-    const cell = getCell(page, 1, dataLinkColumnIdx);
+    const cell = await getCell(page, 1, dataLinkColumnIdx);
    await expect(cell).toBeVisible();
    await expect(cell).toHaveCSS('text-decoration', /line-through/);

--- a/e2e-playwright/panels-suite/table-utils.ts
+++ b/e2e-playwright/panels-suite/table-utils.ts
@@ -1,6 +1,6 @@
 import { Page, Locator } from '@playwright/test';

-export const getCell = (loc: Page | Locator, rowIdx: number, colIdx: number) =>
+export const getCell = async (loc: Page | Locator, rowIdx: number, colIdx: number) =>
  loc
    .getByRole('row')
    .nth(rowIdx)
@@ -8,7 +8,7 @@ export const getCell = (loc: Page | Locator, rowIdx: number, colIdx: number) =>
    .nth(colIdx);

 export const getCellHeight = async (loc: Page | Locator, rowIdx: number, colIdx: number) => {
-  const cell = getCell(loc, rowIdx, colIdx);
+  const cell = await getCell(loc, rowIdx, colIdx);
  return (await cell.boundingBox())?.height ?? 0;
 };

@@ -18,7 +18,7 @@ export const getColumnIdx = async (loc: Page | Locator, columnName: string) => {
  let result = -1;
  const colCount = await loc.getByRole('columnheader').count();
  for (let colIdx = 0; colIdx < colCount; colIdx++) {
-    const cell = getCell(loc, 0, colIdx);
+    const cell = await getCell(loc, 0, colIdx);
    if ((await cell.textContent()) === columnName) {
      result = colIdx;
      break;
--- a/e2e-playwright/plugin-e2e/plugin-e2e-api-tests/as-admin-user/panelDataAssertion.spec.ts
+++ b/e2e-playwright/plugin-e2e/plugin-e2e-api-tests/as-admin-user/panelDataAssertion.spec.ts
@@ -38,7 +38,7 @@ test.describe(
          formatExpectError('Could not locate header elements in table panel')
        ).toContainText(['col1', 'col2']);
        await expect(
-          panelEditPage.panel.data,
+          panelEditPage.panel.locator.getByRole('gridcell'),
          formatExpectError('Could not locate headers in table panel')
        ).toContainText(['val1', 'val2', 'val3', 'val4']);
      });
@@ -58,7 +58,7 @@ test.describe(
          formatExpectError('Could not locate header elements in table panel')
        ).toContainText(['col1', 'col2']);
        await expect(
-          panelEditPage.panel.data,
+          panelEditPage.panel.locator.getByRole('gridcell'),
          formatExpectError('Could not locate data elements in table panel')
        ).toContainText(['val1', 'val2', 'val3', 'val4']);
      });
--- a/go.mod
+++ b/go.mod
@@ -32,7 +32,7 @@ require (
 	github.com/apache/arrow-go/v18 v18.4.1 // @grafana/plugins-platform-backend
 	github.com/armon/go-radix v1.0.0 // @grafana/grafana-app-platform-squad
 	github.com/aws/aws-sdk-go v1.55.7 // @grafana/aws-datasources
-	github.com/aws/aws-sdk-go-v2 v1.39.1 // @grafana/aws-datasources
+	github.com/aws/aws-sdk-go-v2 v1.38.1 // @grafana/aws-datasources
 	github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.45.3 // @grafana/aws-datasources
 	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.51.0 // @grafana/aws-datasources
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.225.2 // @grafana/aws-datasources
@@ -63,7 +63,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.2 // @grafana/identity-access-team
 	github.com/go-kit/log v0.2.1 //  @grafana/grafana-backend-group
 	github.com/go-ldap/ldap/v3 v3.4.4 // @grafana/identity-access-team
-	github.com/go-logfmt/logfmt v0.6.1 // @grafana/oss-big-tent
+	github.com/go-logfmt/logfmt v0.6.0 // @grafana/oss-big-tent
 	github.com/go-openapi/loads v0.23.1 // @grafana/alerting-backend
 	github.com/go-openapi/runtime v0.28.0 // @grafana/alerting-backend
 	github.com/go-openapi/strfmt v0.24.0 // @grafana/alerting-backend
@@ -98,7 +98,7 @@ require (
 	github.com/grafana/grafana-api-golang-client v0.27.0 // @grafana/alerting-backend
 	github.com/grafana/grafana-app-sdk v0.48.1 // @grafana/grafana-app-platform-squad
 	github.com/grafana/grafana-app-sdk/logging v0.48.1 // @grafana/grafana-app-platform-squad
-	github.com/grafana/grafana-aws-sdk v1.3.0 // @grafana/aws-datasources
+	github.com/grafana/grafana-aws-sdk v1.2.0 // @grafana/aws-datasources
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 // @grafana/partner-datasources
 	github.com/grafana/grafana-cloud-migration-snapshot v1.9.0 // @grafana/grafana-operator-experience-squad
 	github.com/grafana/grafana-google-sdk-go v0.4.2 // @grafana/partner-datasources
@@ -172,7 +172,7 @@ require (
 	github.com/stretchr/testify v1.11.1 // @grafana/grafana-backend-group
 	github.com/testcontainers/testcontainers-go v0.36.0 //@grafana/grafana-app-platform-squad
 	github.com/thomaspoignant/go-feature-flag v1.42.0 // @grafana/grafana-backend-group
-	github.com/tjhop/slog-gokit v0.1.5 // @grafana/grafana-app-platform-squad
+	github.com/tjhop/slog-gokit v0.1.3 // @grafana/grafana-app-platform-squad
 	github.com/ua-parser/uap-go v0.0.0-20250213224047-9c035f085b90 // @grafana/grafana-backend-group
 	github.com/urfave/cli v1.22.17 // indirect; @grafana/grafana-backend-group
 	github.com/urfave/cli/v2 v2.27.7 // @grafana/grafana-backend-group
@@ -237,7 +237,6 @@ require (
 	github.com/grafana/grafana/apps/alerting/alertenrichment v0.0.0 // @grafana/alerting-backend
 	github.com/grafana/grafana/apps/alerting/notifications v0.0.0 // @grafana/alerting-backend
 	github.com/grafana/grafana/apps/alerting/rules v0.0.0 // @grafana/alerting-backend
-	github.com/grafana/grafana/apps/annotation v0.0.0 // @grafana/grafana-backend-services-squad
 	github.com/grafana/grafana/apps/correlations v0.0.0 // @grafana/datapro
 	github.com/grafana/grafana/apps/dashboard v0.0.0 // @grafana/grafana-app-platform-squad @grafana/dashboards-squad
 	github.com/grafana/grafana/apps/example v0.0.0-20251027162426-edef69fdc82b // @grafana/grafana-app-platform-squad
@@ -269,7 +268,6 @@ replace (
 	github.com/grafana/grafana/apps/alerting/alertenrichment => ./apps/alerting/alertenrichment
 	github.com/grafana/grafana/apps/alerting/notifications => ./apps/alerting/notifications
 	github.com/grafana/grafana/apps/alerting/rules => ./apps/alerting/rules
-	github.com/grafana/grafana/apps/annotation => ./apps/annotation
 	github.com/grafana/grafana/apps/correlations => ./apps/correlations
 	github.com/grafana/grafana/apps/dashboard => ./apps/dashboard
 	github.com/grafana/grafana/apps/folder => ./apps/folder
@@ -334,23 +332,23 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/at-wat/mqtt-go v0.19.4 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.31.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.14 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.2 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/kms v1.41.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 // indirect
 	github.com/axiomhq/hyperloglog v0.0.0-20240507144631-af9851f82b27 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/barkimedes/go-deepcopy v0.0.0-20220514131651-17c30cfc62df // indirect
--- a/go.sum
+++ b/go.sum
@@ -846,22 +846,22 @@ github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2z
 github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
-github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.38.1 h1:j7sc33amE74Rz0M/PoCpsZQ6OunLqys/m5antM0J+Z8=
+github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
-github.com/aws/aws-sdk-go-v2/config v1.31.10 h1:7LllDZAegXU3yk41mwM6KcPu0wmjKGQB1bg99bNdQm4=
-github.com/aws/aws-sdk-go-v2/config v1.31.10/go.mod h1:Ge6gzXPjqu4v0oHvgAwvGzYcK921GU0hQM25WF/Kl+8=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14 h1:TxkI7QI+sFkTItN/6cJuMZEIVMFXeu2dI1ZffkXngKI=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14/go.mod h1:12x4Uw/vijC11XkctTjy92TNCQ+UnNJkT7fzX0Yd93E=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 h1:gLD09eaJUdiszm7vd1btiQUYE0Hj+0I2b8AS+75z9AY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8/go.mod h1:4RW3oMPt1POR74qVOC4SbubxAwdP4pCT0nSw3jycOU4=
+github.com/aws/aws-sdk-go-v2/config v1.31.2 h1:NOaSZpVGEH2Np/c1toSeW0jooNl+9ALmsUTZ8YvkJR0=
+github.com/aws/aws-sdk-go-v2/config v1.31.2/go.mod h1:17ft42Yb2lF6OigqSYiDAiUcX4RIkEMY6XxEMJsrAes=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6 h1:AmmvNEYrru7sYNJnp3pf57lGbiarX4T9qU/6AZ9SucU=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6/go.mod h1:/jdQkh1iVPa01xndfECInp1v1Wnp70v3K4MvtlLGVEc=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 h1:lpdMwTzmuDLkgW7086jE94HweHCqG+uOJwHf3LZs7T0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 h1:cTXRdLkpBanlDwISl+5chq5ui1d1YWg4PWMR9c3kXyw=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84/go.mod h1:kwSy5X7tfIHN39uucmjQVs2LvDdXEjQucgQQEqCggEo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 h1:IdCLsiiIj5YJ3AFevsewURCPV+YWUlOW8JiPhoAy8vg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 h1:j7vjtr1YIssWQOMeOWRbh3z8g2oY/xPjnZH2gLY4sGw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
@@ -872,12 +872,12 @@ github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.51.0 h1:e5cbPZYTIY2nUEFie
 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.51.0/go.mod h1:UseIHRfrm7PqeZo6fcTb6FUCXzCnh1KJbQbmOfxArGM=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.225.2 h1:IfMb3Ar8xEaWjgH/zeVHYD8izwJdQgRP5mKCTDt4GNk=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.225.2/go.mod h1:35jGWx7ECvCwTsApqicFYzZ7JFEnBc6oHUuOQ3xIS54=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 h1:ueB2Te0NacDMnaC+68za9jLwkjzxGWm0KB5HTUHjLTI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4/go.mod h1:nLEfLnVMmLvyIG58/6gsSA03F1voKGaCfHV7+lR8S7s=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
 github.com/aws/aws-sdk-go-v2/service/kms v1.41.2 h1:zJeUxFP7+XP52u23vrp4zMcVhShTWbNO8dHV6xCSvFo=
@@ -888,12 +888,12 @@ github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.6 h1:Pwbxovp
 github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.6/go.mod h1:Z4xLt5mXspLKjBV92i165wAJ/3T6TIv4n7RtIS8pWV0=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 h1:0reDqfEN+tB+sozj2r92Bep8MEwBZgtAXTND1Kk9OXg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 h1:FTdEN9dtWPB0EOURNtDPmwGp6GGvMqRJCAihkSl/1No=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4/go.mod h1:mYubxV9Ff42fZH4kexj43gFPhgc/LyC7KqvUKt1watc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 h1:I7ghctfGXrscr7r1Ga/mDqSJKm7Fkpl5Mwq79Z+rZqU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0/go.mod h1:Zo9id81XP6jbayIFWNuDpA6lMBWhsVy+3ou2jLa4JnA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 h1:+LVB0xBqEgjQoqr9bGZbRzvg212B0f17JdflleJRNR4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5/go.mod h1:xoaxeqnnUaZjPjaICgIy5B+MHCSb/ZSOn4MvkFNOUA0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 h1:ve9dYBB8CfJGTFqcQ3ZLAAb/KXWgYlgu/2R2TZL2Ko0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2/go.mod h1:n9bTZFZcBa9hGGqVz3i/a6+NG0zmZgtkB9qVVFDqPA8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 h1:pd9G9HQaM6UZAZh19pYOkpKSQkyQQ9ftnl/LttQOcGI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2/go.mod h1:eknndR9rU8UpE/OmFpqU78V1EcXPKFTTm5l/buZYgvM=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 h1:iV1Ko4Em/lkJIsoKyGfc0nQySi+v0Udxr6Igq+y9JZc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0/go.mod h1:bEPcjW7IbolPfK67G1nilqWyoxYMSPrDiIQ3RdIdKgo=
 github.com/aws/smithy-go v1.23.1 h1:sLvcH6dfAFwGkHLZ7dGiYF7aK6mg4CgKA/iDKjLDt9M=
 github.com/aws/smithy-go v1.23.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/axiomhq/hyperloglog v0.0.0-20191112132149-a4c4c47bc57f/go.mod h1:2stgcRjl6QmW+gU2h5E7BQXg4HU0gzxKWDuT5HviN9s=
@@ -1248,8 +1248,8 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
-github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
-github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -1637,8 +1637,8 @@ github.com/grafana/grafana-app-sdk v0.48.1 h1:bKJadWH18WCpJ+Zk8AezRFXCcZgGredRv+
 github.com/grafana/grafana-app-sdk v0.48.1/go.mod h1:5LljCz+wvmGfkQ8ZKTOfserhtXNEF0cSFthoWShvN6c=
 github.com/grafana/grafana-app-sdk/logging v0.48.1 h1:veM0X5LAPyN3KsDLglWjIofndbGuf7MqnrDuDN+F/Ng=
 github.com/grafana/grafana-app-sdk/logging v0.48.1/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-aws-sdk v1.3.0 h1:/bfJzP93rCel1GbWoRSq0oUo424MZXt8jAp2BK9w8tM=
-github.com/grafana/grafana-aws-sdk v1.3.0/go.mod h1:VGycF0JkCGKND2O5je1ucOqPJ0ZNhZYzV3c2bNBAaGk=
+github.com/grafana/grafana-aws-sdk v1.2.0 h1:LLR4/g91WBuCRwm2cbWfCREq565+GxIFe08nqqIcIuw=
+github.com/grafana/grafana-aws-sdk v1.2.0/go.mod h1:bBo7qOmM3f61vO+2JxTolNUph1l2TmtzmWcU9/Im+8A=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 h1:FFcEA01tW+SmuJIuDbHOdgUBL+d7DPrZ2N4zwzPhfGk=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1/go.mod h1:Oi4anANlCuTCc66jCyqIzfVbgLXFll8Wja+Y4vfANlc=
 github.com/grafana/grafana-cloud-migration-snapshot v1.9.0 h1:JOzchPgptwJdruYoed7x28lFDwhzs7kssResYsnC0iI=
@@ -2499,8 +2499,8 @@ github.com/thomaspoignant/go-feature-flag v1.42.0 h1:C7embmOTzaLyRki+OoU2RvtVjJE
 github.com/thomaspoignant/go-feature-flag v1.42.0/go.mod h1:y0QiWH7chHWhGATb/+XqwAwErORmPSH2MUsQlCmmWlM=
 github.com/tidwall/pretty v0.0.0-20180105212114-65a9db5fad51/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tjhop/slog-gokit v0.1.5 h1:ayloIUi5EK2QYB8eY4DOPO95/mRtMW42lUkp3quJohc=
-github.com/tjhop/slog-gokit v0.1.5/go.mod h1:yA48zAHvV+Sg4z4VRyeFyFUNNXd3JY5Zg84u3USICq0=
+github.com/tjhop/slog-gokit v0.1.3 h1:6SdexP3UIeg93KLFeiM1Wp1caRwdTLgsD/THxBUy1+o=
+github.com/tjhop/slog-gokit v0.1.3/go.mod h1:Bbu5v2748qpAWH7k6gse/kw3076IJf6owJmh7yArmJs=
 github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
 github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
 github.com/tklauser/numcpus v0.8.0 h1:Mx4Wwe/FjZLeQsK/6kt2EOepwwSl7SmJrK5bV/dXYgY=
--- a/go.work
+++ b/go.work
@@ -9,7 +9,6 @@ use (
 	./apps/alerting/alertenrichment
 	./apps/alerting/notifications
 	./apps/alerting/rules
-	./apps/annotation
 	./apps/correlations
 	./apps/dashboard
 	./apps/example
--- a/go.work.sum
+++ b/go.work.sum
@@ -336,8 +336,6 @@ github.com/MicahParks/keyfunc/v2 v2.1.0/go.mod h1:rW42fi+xgLJ2FRRXAfNx9ZA8WpD4Oe
 github.com/Microsoft/go-winio v0.4.21/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/Microsoft/hcsshim v0.11.5/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
-github.com/MissingRoberto/slog-gokit v0.0.0-20251105092822-783f72952ce4 h1:gTtFbl79tuZSeJuSO7kXSbmXSvKSa/PoUXda1tuz0O8=
-github.com/MissingRoberto/slog-gokit v0.0.0-20251105092822-783f72952ce4/go.mod h1:yA48zAHvV+Sg4z4VRyeFyFUNNXd3JY5Zg84u3USICq0=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
 github.com/PuerkitoBio/goquery v1.10.3 h1:pFYcNSqHxBD06Fpj/KsbStFRsgRATgnf3LeXiUkhzPo=
@@ -410,75 +408,44 @@ github.com/aws/aws-lambda-go v1.47.0/go.mod h1:dpMpZgvWx5vuQJfBt0zqBha60q7Dd7Rfg
 github.com/aws/aws-msk-iam-sasl-signer-go v1.0.1 h1:nMp7diZObd4XEVUR0pEvn7/E13JIgManMX79Q6quV6E=
 github.com/aws/aws-msk-iam-sasl-signer-go v1.0.1/go.mod h1:MVYeeOhILFFemC/XlYTClvBjYZrg/EPd3ts885KrNTI=
 github.com/aws/aws-sdk-go-v2 v1.36.5/go.mod h1:EYrzvCCN9CMUTa5+6lf6MM4tq3Zjp8UhSGR/cBsjai0=
-github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
 github.com/aws/aws-sdk-go-v2/config v1.29.17/go.mod h1:9P4wwACpbeXs9Pm9w1QTh6BwWwJjwYvJ1iCt5QbCXh8=
-github.com/aws/aws-sdk-go-v2/config v1.31.2/go.mod h1:17ft42Yb2lF6OigqSYiDAiUcX4RIkEMY6XxEMJsrAes=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.70/go.mod h1:M+lWhhmomVGgtuPOhO85u4pEa3SmssPTdcYpP/5J/xc=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.6/go.mod h1:/jdQkh1iVPa01xndfECInp1v1Wnp70v3K4MvtlLGVEc=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.5 h1:oUEqVqonG3xuarrsze1KVJ30KagNYDemikTbdu8KlN8=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.19.5/go.mod h1:VNM08cHlOsIbSHRqb6D/M2L4kKXfJv3A2/f0GNbOQSc=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.7.87 h1:oDPArGgCrG/4aTi86ij3S2PB59XXkTSKYVNQlmqRHXQ=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.7.87/go.mod h1:ZeQC4gVarhdcWeM1c90DyBLaBCNhEeAbKUXwVI/byvw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32/go.mod h1:h4Sg6FQdexC1yYG9RDnOvLbW1a/P986++/Y/a+GyEM8=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.69/go.mod h1:GJj8mmO6YT6EqgduWocwhMoxTLFitkhIrK+owzrYL2I=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.36/go.mod h1:Q1lnJArKRXkenyog6+Y+zr7WDpk4e6XlR6gs20bbeNo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.36/go.mod h1:UdyGa7Q91id/sdyHPwth+043HhmP6yP9MBHgbZM0xo8=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.44.0 h1:A99gjqZDbdhjtjJVZrmVzVKO2+p3MSg35bDWtbMQVxw=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.44.0/go.mod h1:mWB0GE1bqcVSvpW7OtFA0sKuHk52+IqtnsYU2jUfYAs=
 github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.26.0 h1:0wOCTKrmwkyC8Bk76hYH/B4IJn5MGt6gMkSXc0A2uyc=
 github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.26.0/go.mod h1:He/RikglWUczbkV+fkdpcV/3GdL/rTRNVy7VaUiezMo=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4/go.mod h1:/xFi9KtvBXP97ppCz1TAEvU1Uf66qvid89rbem3wCzQ=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17 h1:x187MqiHwBGjMGAed8Y8K1VGuCtFvQvXb24r+bwmSdo=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.17/go.mod h1:mC9qMbA6e1pwEq6X3zDGtZRXMG2YaElJkbJlMVHLs5I=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.17/go.mod h1:ygpklyoaypuyDvOM5ujWGrYWpAK3h7ugnmKCU/76Ys4=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4/go.mod h1:nLEfLnVMmLvyIG58/6gsSA03F1voKGaCfHV7+lR8S7s=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
 github.com/aws/aws-sdk-go-v2/service/kinesis v1.33.0 h1:JPXkrQk5OS/+Q81fKH97Ll/Vmmy0p9vwHhxw+V+tVjg=
 github.com/aws/aws-sdk-go-v2/service/kinesis v1.33.0/go.mod h1:dJngkoVMrq0K7QvRkdRZYM4NUp6cdWa2GBdpm8zoY8U=
-github.com/aws/aws-sdk-go-v2/service/kms v1.35.3 h1:UPTdlTOwWUX49fVi7cymEN6hDqCwe3LNv1vi7TXUutk=
-github.com/aws/aws-sdk-go-v2/service/kms v1.35.3/go.mod h1:gjDP16zn+WWalyaUqwCCioQ8gU8lzttCCc9jYsiQI/8=
 github.com/aws/aws-sdk-go-v2/service/kms v1.38.1/go.mod h1:cQn6tAF77Di6m4huxovNM7NVAozWTZLsDRp9t8Z/WYk=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.78.2/go.mod h1:U5SNqwhXB3Xe6F47kXvWihPl/ilGaEDe8HD/50Z9wxc=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.32.4 h1:NgRFYyFpiMD62y4VPXh4DosPFbZd4vdMVBWKk0VmWXc=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.32.4/go.mod h1:TKKN7IQoM7uTnyuFm9bm9cw5P//ZYTl4m3htBWQ1G/c=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.2 h1:vlYXbindmagyVA3RS2SPd47eKZ00GZZQcr+etTviHtc=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.2/go.mod h1:yGhDiLKguA3iFJYxbrQkQiNzuy+ddxesSZYWVeeEH5Q=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.7 h1:d+mnMa4JbJlooSbYQfrJpit/YINaB30JEVgrhtjZneA=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.7/go.mod h1:1X1NotbcGHH7PCQJ98PsExSxsJj/VWzz8MfFz43+02M=
-github.com/aws/aws-sdk-go-v2/service/sns v1.31.3 h1:eSTEdxkfle2G98FE+Xl3db/XAXXVTJPNQo9K/Ar8oAI=
-github.com/aws/aws-sdk-go-v2/service/sns v1.31.3/go.mod h1:1dn0delSO3J69THuty5iwP0US2Glt0mx2qBBlI13pvw=
-github.com/aws/aws-sdk-go-v2/service/sns v1.34.2 h1:PajtbJ/5bEo6iUAIGMYnK8ljqg2F1h4mMCGh1acjN30=
-github.com/aws/aws-sdk-go-v2/service/sns v1.34.2/go.mod h1:PJtxxMdj747j8DeZENRTTYAz/lx/pADn/U0k7YNNiUY=
 github.com/aws/aws-sdk-go-v2/service/sns v1.34.7 h1:OBuZE9Wt8h2imuRktu+WfjiTGrnYdCIJg8IX92aalHE=
 github.com/aws/aws-sdk-go-v2/service/sns v1.34.7/go.mod h1:4WYoZAhHt+dWYpoOQUgkUKfuQbE6Gg/hW4oXE0pKS9U=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.34.3 h1:Vjqy5BZCOIsn4Pj8xzyqgGmsSqzz7y/WXbN3RgOoVrc=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.34.3/go.mod h1:L0enV3GCRd5iG9B64W35C4/hwsCB00Ib+DKVGTadKHI=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.38.3 h1:j5BchjfDoS7K26vPdyJlyxBIIBGDflq3qjjJKBDlbcI=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.38.3/go.mod h1:Bar4MrRxeqdn6XIh8JGfiXuFRmyrrsZNTJotxEJmWW0=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8 h1:80dpSqWMwx2dAm30Ib7J6ucz1ZHfiv5OCRwN/EnCOXQ=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.38.8/go.mod h1:IzNt/udsXlETCdvBOL0nmyMe2t9cGmXmZgsdoZGYYhI=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.52.4 h1:hgSBvRT7JEWx2+vEGI9/Ld5rZtl7M5lu8PqdvOmbRHw=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.52.4/go.mod h1:v7NIzEFIHBiicOMaMTuEmbnzGnqW0d+6ulNALul6fYE=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.58.0 h1:zQz6Q5uaC8s9734DV9UDAm2q1TEEfOvEejDBSulOapI=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.58.0/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.60.1 h1:OwMzNDe5VVTXD4kGmeK/FtqAITiV8Mw4TCa8IyNO0as=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.60.1/go.mod h1:IyVabkWrs8SNdOEZLyFFcW9bUltV4G6OQS0s6H20PHg=
 github.com/aws/aws-sdk-go-v2/service/sso v1.25.5/go.mod h1:b7SiVprpU+iGazDUqvRSLf5XmCdn+JtT1on7uNL6Ipc=
-github.com/aws/aws-sdk-go-v2/service/sso v1.28.2/go.mod h1:n9bTZFZcBa9hGGqVz3i/a6+NG0zmZgtkB9qVVFDqPA8=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3/go.mod h1:vq/GQR1gOFLquZMSrxUK/cpvKCNVYibNyJ1m7JrU88E=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2/go.mod h1:eknndR9rU8UpE/OmFpqU78V1EcXPKFTTm5l/buZYgvM=
 github.com/aws/aws-sdk-go-v2/service/sts v1.34.0/go.mod h1:7ph2tGpfQvwzgistp2+zga9f+bCjlQJPkPUmMgDSD7w=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.0/go.mod h1:bEPcjW7IbolPfK67G1nilqWyoxYMSPrDiIQ3RdIdKgo=
 github.com/aws/smithy-go v1.22.4/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
-github.com/aws/smithy-go v1.22.5 h1:P9ATCXPMb2mPjYBgueqJNCA5S9UfktsW0tTxi+a7eqw=
 github.com/aws/smithy-go v1.22.5/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
-github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/awslabs/aws-lambda-go-api-proxy v0.16.2 h1:CJyGEyO1CIwOnXTU40urf0mchf6t3voxpvUDikOU9LY=
 github.com/awslabs/aws-lambda-go-api-proxy v0.16.2/go.mod h1:vxxjwBHe/KbgFeNlAP/Tvp4SsVRL3WQamcWRxqVh0z0=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
@@ -583,6 +550,7 @@ github.com/couchbase/ghistogram v0.1.0 h1:b95QcQTCzjTUocDXp/uMgSNQi8oj1tGwnJ4bOD
 github.com/couchbase/ghistogram v0.1.0/go.mod h1:s1Jhy76zqfEecpNWJfWUiKZookAFaiGOEoyzgHt9i7k=
 github.com/couchbase/moss v0.2.0 h1:VCYrMzFwEryyhRSeI+/b3tRBSeTpi/8gn5Kf6dxqn+o=
 github.com/couchbase/moss v0.2.0/go.mod h1:9MaHIaRuy9pvLPUJxB8sh8OrLfyDczECVL37grCIubs=
+github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
 github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -738,7 +706,6 @@ github.com/go-json-experiment/json v0.0.0-20250211171154-1ae217ad3535/go.mod h1:
 github.com/go-kit/kit v0.12.0 h1:e4o3o3IsBfAKQh5Qbbiqyfu97Ku7jrO/JbohvztANh4=
 github.com/go-kit/kit v0.12.0/go.mod h1:lHd+EkCZPIwYItmGDDRdhinkzX2A1sj+M9biaEaizzs=
 github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81 h1:6zl3BbBhdnMkpSj2YY30qV3gDcVBGtFgVsV3+/i+mKQ=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
 github.com/go-openapi/errors v0.22.0/go.mod h1:J3DmZScxCDufmIMsdOuDHxJbdOGC0xtUynjIx092vXE=
@@ -838,76 +805,13 @@ github.com/grafana/dskit v0.0.0-20250818234656-8ff9c6532e85/go.mod h1:kImsvJ1xnm
 github.com/grafana/go-gelf/v2 v2.0.1 h1:BOChP0h/jLeD+7F9mL7tq10xVkDG15he3T1zHuQaWak=
 github.com/grafana/go-gelf/v2 v2.0.1/go.mod h1:lexHie0xzYGwCgiRGcvZ723bSNyNI8ZRD4s0CLobh90=
 github.com/grafana/go-mysql-server v0.20.1-0.20251027172658-317a8d46ffa4/go.mod h1:EeYR0apo+8j2Dyxmn2ghkPlirO2S5mT1xHBrA+Efys8=
-github.com/grafana/gomemcache v0.0.0-20250228145437-da7b95fd2ac1/go.mod h1:j/s0jkda4UXTemDs7Pgw/vMT06alWc42CHisvYac0qw=
-github.com/grafana/grafana-app-sdk v0.40.1/go.mod h1:4P8h7VB6KcDjX9bAoBQc6IP8iNylxe6bSXLR9gA39gM=
 github.com/grafana/grafana-app-sdk v0.40.2/go.mod h1:BbNXPNki3mtbkWxYqJsyA1Cj9AShSyaY33z8WkyfVv0=
-github.com/grafana/grafana-app-sdk v0.41.0 h1:SYHN3U7B1myRKY3UZZDkFsue9TDmAOap0UrQVTqtYBU=
-github.com/grafana/grafana-app-sdk v0.41.0/go.mod h1:Wg/3vEZfok1hhIWiHaaJm+FwkosfO98o8KbeLFEnZpY=
-github.com/grafana/grafana-app-sdk v0.46.0/go.mod h1:LCTrqR1SwBS13XGVYveBmM7giJDDjzuXK+M9VzPuPWc=
-github.com/grafana/grafana-app-sdk v0.47.0/go.mod h1:kywXmkppq0oReUMzkjTW8Fq2EBzyN7v914jttTWnWxA=
-github.com/grafana/grafana-app-sdk/logging v0.38.0/go.mod h1:Y/bvbDhBiV/tkIle9RW49pgfSPIPSON8Q4qjx3pyqDk=
-github.com/grafana/grafana-app-sdk/logging v0.39.0 h1:3GgN5+dUZYqq74Q+GT9/ET+yo+V54zWQk/Q2/JsJQB4=
-github.com/grafana/grafana-app-sdk/logging v0.39.0/go.mod h1:WhDENSnaGHtyVVwZGVnAR7YLvh2xlLDYR3D7E6h7XVk=
-github.com/grafana/grafana-app-sdk/logging v0.39.1/go.mod h1:WhDENSnaGHtyVVwZGVnAR7YLvh2xlLDYR3D7E6h7XVk=
-github.com/grafana/grafana-app-sdk/logging v0.40.0/go.mod h1:otUD9XpJD7A5sCLb8mcs9hIXGdeV6lnhzVwe747g4RU=
 github.com/grafana/grafana-app-sdk/logging v0.40.2/go.mod h1:otUD9XpJD7A5sCLb8mcs9hIXGdeV6lnhzVwe747g4RU=
-github.com/grafana/grafana-app-sdk/logging v0.43.0/go.mod h1:0xrjKSGY5z+NLGuGsXQpxiCHR4Smu79i/CbAfdkaB1M=
-github.com/grafana/grafana-app-sdk/logging v0.43.1/go.mod h1:0xrjKSGY5z+NLGuGsXQpxiCHR4Smu79i/CbAfdkaB1M=
-github.com/grafana/grafana-app-sdk/logging v0.43.2/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-app-sdk/logging v0.45.0/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-app-sdk/logging v0.46.0/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-app-sdk/logging v0.48.0 h1:xolkQxBlA2LQF4hprKIAeu+zUem1DigYZ6XC1TOhFJE=
 github.com/grafana/grafana-app-sdk/logging v0.48.0/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-app-sdk/plugin v0.41.0 h1:ShUvGpAVzM3UxcsfwS6l/lwW4ytDeTbCQXf8w2P8Yp8=
-github.com/grafana/grafana-app-sdk/plugin v0.41.0/go.mod h1:YIhimVfAqtOp3kdhxOanaSZjypVKh/bYxf9wfFfhDm0=
-github.com/grafana/grafana-aws-sdk v0.38.2 h1:TzQD0OpWsNjtldi5G5TLDlBRk8OyDf+B5ujcoAu4Dp0=
-github.com/grafana/grafana-aws-sdk v0.38.2/go.mod h1:j3vi+cXYHEFqjhBGrI6/lw1TNM+dl0Y3f0cSnDOPy+s=
-github.com/grafana/grafana-aws-sdk v1.0.2 h1:98eBuHYFmgvH0xO9kKf4RBsEsgQRp8EOA/9yhDIpkss=
-github.com/grafana/grafana-aws-sdk v1.0.2/go.mod h1:hO7q7yWV+t6dmiyJjMa3IbuYnYkBua+G/IAlOPVIYKE=
 github.com/grafana/grafana-aws-sdk v1.1.0/go.mod h1:7e+47EdHynteYWGoT5Ere9KeOXQObsk8F0vkOLQ1tz8=
-github.com/grafana/grafana-aws-sdk v1.2.0/go.mod h1:bBo7qOmM3f61vO+2JxTolNUph1l2TmtzmWcU9/Im+8A=
-github.com/grafana/grafana-azure-sdk-go/v2 v2.1.6/go.mod h1:V7y2BmsWxS3A9Ohebwn4OiSfJJqi//4JQydQ8fHTduo=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.2.0/go.mod h1:H9sVh9A4yg5egMGZeh0mifxT1Q/uqwKe1LBjBJU6pN8=
-github.com/grafana/grafana-plugin-sdk-go v0.263.0/go.mod h1:U43Cnrj/9DNYyvFcNdeUWNjMXTKNB0jcTcQGpWKd2gw=
-github.com/grafana/grafana-plugin-sdk-go v0.267.0/go.mod h1:OuwS4c/JYgn0rr/w5zhJBpLo4gKm/vw15RsfpYAvK9Q=
-github.com/grafana/grafana-plugin-sdk-go v0.269.1/go.mod h1:yv2KbO4mlr9WuDK2f+2gHAMTwwLmLuqaEnrPXTRU+OI=
-github.com/grafana/grafana-plugin-sdk-go v0.275.0/go.mod h1:mO9LJqdXDh5JpO/xIdPAeg5LdThgQ06Y/SLpXDWKw2c=
-github.com/grafana/grafana-plugin-sdk-go v0.277.0/go.mod h1:mAUWg68w5+1f5TLDqagIr8sWr1RT9h7ufJl5NMcWJAU=
 github.com/grafana/grafana-plugin-sdk-go v0.278.0/go.mod h1:+8NXT/XUJ/89GV6FxGQ366NZ3nU+cAXDMd0OUESF9H4=
 github.com/grafana/grafana-plugin-sdk-go v0.279.0/go.mod h1:/7oGN6Z7DGTGaLHhgIYrRr6Wvmdsb3BLw5hL4Kbjy88=
-github.com/grafana/grafana-plugin-sdk-go v0.280.0/go.mod h1:Z15Wiq3c4I0tzHYrLYpOqrO8u3+2RJ+HN2Q9uiZTILA=
-github.com/grafana/grafana/apps/advisor v0.0.0-20250123151950-b066a6313173/go.mod h1:goSDiy3jtC2cp8wjpPZdUHRENcoSUHae1/Px/MDfddA=
-github.com/grafana/grafana/apps/advisor v0.0.0-20250220154326-6e5de80ef295/go.mod h1:9I1dKV3Dqr0NPR9Af0WJGxOytp5/6W3JLiNChOz8r+c=
-github.com/grafana/grafana/apps/alerting/notifications v0.0.0-20250121113133-e747350fee2d/go.mod h1:AvleS6icyPmcBjihtx5jYEvdzLmHGBp66NuE0AMR57A=
-github.com/grafana/grafana/apps/alerting/notifications v0.0.0-20250416173722-ec17e0e4ce03/go.mod h1:oemrhKvFxxc5m32xKHPxInEHAObH0/hPPyHUiBUZ1Cc=
-github.com/grafana/grafana/apps/alerting/notifications v0.0.0-20250506052906-7a2fc797fb4a/go.mod h1:VkX53kBiqIMHBoGgeEDJnzm5Nwcmv/726tuZuT5SvJY=
-github.com/grafana/grafana/apps/alerting/rules v0.0.0-20250731223157-26b18dda3364/go.mod h1:wi4njPm5mJ8IpK13h57be8sWoxOhqr1UQOwmXhRM9Gk=
-github.com/grafana/grafana/apps/dashboard v0.0.0-20250616135341-59c2f154336b/go.mod h1:OIlvNnUufYDhBXa4xK4CyzPI2C69ZJkHy5+aFDyPtXw=
-github.com/grafana/grafana/apps/dashboard v0.0.0-20250616145019-8d27f12428cb/go.mod h1:OIlvNnUufYDhBXa4xK4CyzPI2C69ZJkHy5+aFDyPtXw=
-github.com/grafana/grafana/apps/dashboard v0.0.0-20250627191313-2f1a6ae1712b/go.mod h1:eR8wca74ADgxBrvX0uNpdB1qnPaGx/KhCm4Xj8oqHfQ=
-github.com/grafana/grafana/apps/investigation v0.0.0-20250121113133-e747350fee2d/go.mod h1:HQprw3MmiYj5OUV9CZnkwA1FKDZBmYACuAB3oDvUOmI=
-github.com/grafana/grafana/apps/playlist v0.0.0-20250121113133-e747350fee2d/go.mod h1:DjJe5osrW/BKrzN9hAAOSElNWutj1bcriExa7iDP7kA=
-github.com/grafana/grafana/apps/preferences v0.0.0-20250805113453-4b17c24d67ff h1:JDT0Mcfpi3c525xzeli+v5dR9pf5HhdFjr8djRdhs10=
-github.com/grafana/grafana/apps/preferences v0.0.0-20250805113453-4b17c24d67ff/go.mod h1:NQlHMO5fHhjexw71wVjv522532NRvFg5F4tcjUEktjs=
-github.com/grafana/grafana/apps/preferences v0.0.0-20250805120145-0c5a00302924 h1:uGXX6gCF1q2ytIL0w1X3UAKgF/UZ7eDDAgOaSqLOeW8=
-github.com/grafana/grafana/apps/preferences v0.0.0-20250805120145-0c5a00302924/go.mod h1:NQlHMO5fHhjexw71wVjv522532NRvFg5F4tcjUEktjs=
-github.com/grafana/grafana/apps/preferences v0.0.0-20250805123034-066163d71001 h1:y2AHkdji2I+zXv8rsSC8OjWEzJJjqW5OlmCsZR5+RuU=
-github.com/grafana/grafana/apps/preferences v0.0.0-20250805123034-066163d71001/go.mod h1:NQlHMO5fHhjexw71wVjv522532NRvFg5F4tcjUEktjs=
-github.com/grafana/grafana/pkg/aggregator v0.0.0-20250121113133-e747350fee2d/go.mod h1:1sq0guad+G4SUTlBgx7SXfhnzy7D86K/LcVOtiQCiMA=
-github.com/grafana/grafana/pkg/semconv v0.0.0-20250121113133-e747350fee2d/go.mod h1:tfLnBpPYgwrBMRz4EXqPCZJyCjEG4Ev37FSlXnocJ2c=
-github.com/grafana/grafana/pkg/storage/unified/apistore v0.0.0-20250121113133-e747350fee2d/go.mod h1:CXpwZ3Mkw6xVlGKc0SqUxqXCP3Uv182q6qAQnLaLxRg=
-github.com/grafana/grafana/pkg/storage/unified/apistore v0.0.0-20250514132646-acbc7b54ed9e/go.mod h1:xrKQcxQxz+IUF90ybtfENFeEXtlj9nAsX/3Fw0KEIeQ=
-github.com/grafana/nanogit v0.0.0-20250616082354-5e94194d02ed h1:59JF1WhHLT+lNX89Tm1OzOEySMVMASAhaPbsRjtp8Kc=
-github.com/grafana/nanogit v0.0.0-20250616082354-5e94194d02ed/go.mod h1:OIAAKNgG5fpuJQRNO1lUSj9nc18Xl3O7M8fjIlBO1cI=
-github.com/grafana/nanogit v0.0.0-20250619160700-ebf70d342aa5 h1:MAQ2B0cu0V1S91ZjVa7NomNZFjaR2SmdtvdwhqBtyhU=
-github.com/grafana/nanogit v0.0.0-20250619160700-ebf70d342aa5/go.mod h1:tN93IZUaAmnSWgL0IgnKdLv6DNeIhTJGvl1wvQMrWco=
-github.com/grafana/nanogit v0.0.0-20250723104447-68f58f5ecec0/go.mod h1:ToqLjIdvV3AZQa3K6e5m9hy/nsGaUByc2dWQlctB9iA=
-github.com/grafana/prometheus-alertmanager v0.25.1-0.20240930132144-b5e64e81e8d3 h1:6D2gGAwyQBElSrp3E+9lSr7k8gLuP3Aiy20rweLWeBw=
-github.com/grafana/prometheus-alertmanager v0.25.1-0.20240930132144-b5e64e81e8d3/go.mod h1:YeND+6FDA7OuFgDzYODN8kfPhXLCehcpxe4T9mdnpCY=
-github.com/grafana/prometheus-alertmanager v0.25.1-0.20250331083058-4563aec7a975 h1:4/BZkGObFWZf4cLbE2Vqg/1VTz67Q0AJ7LHspWLKJoQ=
-github.com/grafana/prometheus-alertmanager v0.25.1-0.20250331083058-4563aec7a975/go.mod h1:FGdGvhI40Dq+CTQaSzK9evuve774cgOUdGfVO04OXkw=
-github.com/grafana/prometheus-alertmanager v0.25.1-0.20250604130045-92c8f6389b36 h1:AjZ58JRw1ZieFH/SdsddF5BXtsDKt5kSrKNPWrzYz3Y=
-github.com/grafana/prometheus-alertmanager v0.25.1-0.20250604130045-92c8f6389b36/go.mod h1:O/QP1BCm0HHIzbKvgMzqb5sSyH88rzkFk84F4TfJjBU=
 github.com/grafana/pyroscope-go/godeltaprof v0.1.8/go.mod h1:2+l7K7twW49Ct4wFluZD3tZ6e0SjanjcUUBPVD/UuGU=
 github.com/grafana/sqlds/v4 v4.2.4/go.mod h1:BQRjUG8rOqrBI4NAaeoWrIMuoNgfi8bdhCJ+5cgEfLU=
 github.com/grafana/tail v0.0.0-20230510142333-77b18831edf0 h1:bjh0PVYSVVFxzINqPFYJmAmJNrWPgnVjuSdYJGHmtFU=
@@ -1425,7 +1329,6 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=
 github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=
-github.com/tjhop/slog-gokit v0.1.3/go.mod h1:Bbu5v2748qpAWH7k6gse/kw3076IJf6owJmh7yArmJs=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
 github.com/trivago/tgo v1.0.7 h1:uaWH/XIy9aWYWpjm2CU3RpcqZXmX2ysQ9/Go+d9gyrM=
--- a/package.json
+++ b/package.json
@@ -92,7 +92,7 @@
    "@emotion/eslint-plugin": "11.12.0",
    "@grafana/eslint-config": "8.2.0",
    "@grafana/eslint-plugin": "link:./packages/grafana-eslint-rules",
-    "@grafana/plugin-e2e": "^3.0.1",
+    "@grafana/plugin-e2e": "2.1.7",
    "@grafana/test-utils": "workspace:*",
    "@manypkg/get-packages": "^3.0.0",
    "@npmcli/package-json": "^6.0.0",
--- a/packages/grafana-api-clients/src/clients/rtkq/dashboard/v0alpha1/endpoints.gen.ts
+++ b/packages/grafana-api-clients/src/clients/rtkq/dashboard/v0alpha1/endpoints.gen.ts
@@ -244,7 +244,6 @@ const injectedRtkApi = api
            folder: queryArg.folder,
            facet: queryArg.facet,
            tags: queryArg.tags,
-            libraryPanel: queryArg.libraryPanel,
            sort: queryArg.sort,
            limit: queryArg.limit,
            explain: queryArg.explain,
@@ -609,8 +608,6 @@ export type GetSearchApiArg = {
  facet?: string[];
  /** tag query filter */
  tags?: string[];
-  /** find dashboards that reference a given libraryPanel */
-  libraryPanel?: string;
  /** sortable field */
  sort?: string;
  /** number of results to return */
--- a/packages/grafana-data/src/index.ts
+++ b/packages/grafana-data/src/index.ts
@@ -435,7 +435,6 @@ export {
  isStandardFieldProp,
  type OptionDefaults,
 } from './panel/getPanelOptionsWithDefaults';
-export { type PanelDataSummary, getPanelDataSummary } from './panel/suggestions/getPanelDataSummary';
 export { createFieldConfigRegistry } from './panel/registryFactories';
 export { type QueryRunner, type QueryRunnerOptions } from './types/queryRunner';
 export { type GroupingToMatrixTransformerOptions } from './transformations/transformers/groupingToMatrix';
@@ -652,6 +651,7 @@ export {
  type AngularPanelMenuItem,
  type PanelPluginDataSupport,
  type VisualizationSuggestion,
+  type PanelDataSummary,
  type VisualizationSuggestionsSupplier,
  VizOrientation,
  VisualizationSuggestionScore,
--- a/packages/grafana-data/src/panel/suggestions/getPanelDataSummary.test.ts
+++ b/packages/grafana-data/src/panel/suggestions/getPanelDataSummary.test.ts
@@ -1,94 +0,0 @@
-import { createDataFrame } from '../../dataframe/processDataFrame';
-import { FieldType } from '../../types/dataFrame';
-
-import { getPanelDataSummary } from './getPanelDataSummary';
-
-describe('getPanelDataSummary', () => {
-  describe('when called with no dataframes', () => {
-    it('should return summary with zero counts', () => {
-      const summary = getPanelDataSummary();
-
-      expect(summary.rowCountTotal).toBe(0);
-      expect(summary.rowCountMax).toBe(0);
-      expect(summary.fieldCount).toBe(0);
-      expect(summary.frameCount).toBe(0);
-      expect(summary.hasData).toBe(false);
-
-      expect(summary.fieldCountByType(FieldType.time)).toBe(0);
-      expect(summary.fieldCountByType(FieldType.number)).toBe(0);
-      expect(summary.fieldCountByType(FieldType.string)).toBe(0);
-      expect(summary.fieldCountByType(FieldType.boolean)).toBe(0);
-
-      expect(summary.hasFieldType(FieldType.time)).toBe(false);
-      expect(summary.hasFieldType(FieldType.number)).toBe(false);
-      expect(summary.hasFieldType(FieldType.string)).toBe(false);
-      expect(summary.hasFieldType(FieldType.boolean)).toBe(false);
-    });
-  });
-
-  describe('when called with a single dataframes', () => {
-    it('should return correct summary', () => {
-      const frames = [
-        createDataFrame({
-          fields: [
-            { name: 'time', type: FieldType.time, values: [1, 2, 3] },
-            { name: 'value', type: FieldType.number, values: [10, 20, 30] },
-          ],
-        }),
-      ];
-      const summary = getPanelDataSummary(frames);
-
-      expect(summary.rowCountTotal).toBe(3);
-      expect(summary.rowCountMax).toBe(3);
-      expect(summary.fieldCount).toBe(2);
-      expect(summary.frameCount).toBe(1);
-      expect(summary.hasData).toBe(true);
-
-      expect(summary.fieldCountByType(FieldType.time)).toBe(1);
-      expect(summary.fieldCountByType(FieldType.number)).toBe(1);
-      expect(summary.fieldCountByType(FieldType.string)).toBe(0);
-      expect(summary.fieldCountByType(FieldType.boolean)).toBe(0);
-
-      expect(summary.hasFieldType(FieldType.time)).toBe(true);
-      expect(summary.hasFieldType(FieldType.number)).toBe(true);
-      expect(summary.hasFieldType(FieldType.string)).toBe(false);
-      expect(summary.hasFieldType(FieldType.boolean)).toBe(false);
-    });
-  });
-
-  describe('when called with multiple dataframes', () => {
-    it('should return correct summary', () => {
-      const frames = [
-        createDataFrame({
-          fields: [
-            { name: 'time', type: FieldType.time, values: [1, 2, 3] },
-            { name: 'value', type: FieldType.number, values: [10, 20, 30] },
-          ],
-        }),
-        createDataFrame({
-          fields: [
-            { name: 'category', type: FieldType.string, values: ['A', 'B'] },
-            { name: 'amount', type: FieldType.number, values: [100, 200] },
-          ],
-        }),
-      ];
-      const summary = getPanelDataSummary(frames);
-
-      expect(summary.rowCountTotal).toBe(5);
-      expect(summary.rowCountMax).toBe(3);
-      expect(summary.fieldCount).toBe(4);
-      expect(summary.frameCount).toBe(2);
-      expect(summary.hasData).toBe(true);
-
-      expect(summary.fieldCountByType(FieldType.time)).toBe(1);
-      expect(summary.fieldCountByType(FieldType.number)).toBe(2);
-      expect(summary.fieldCountByType(FieldType.string)).toBe(1);
-      expect(summary.fieldCountByType(FieldType.boolean)).toBe(0);
-
-      expect(summary.hasFieldType(FieldType.time)).toBe(true);
-      expect(summary.hasFieldType(FieldType.number)).toBe(true);
-      expect(summary.hasFieldType(FieldType.string)).toBe(true);
-      expect(summary.hasFieldType(FieldType.boolean)).toBe(false);
-    });
-  });
-});
--- a/packages/grafana-data/src/panel/suggestions/getPanelDataSummary.ts
+++ b/packages/grafana-data/src/panel/suggestions/getPanelDataSummary.ts
@@ -1,82 +0,0 @@
-import { PreferredVisualisationType } from '../../types/data';
-import { DataFrame, FieldType } from '../../types/dataFrame';
-
-/**
- * @alpha
- */
-export interface PanelDataSummary {
-  hasData?: boolean;
-  rowCountTotal: number;
-  rowCountMax: number;
-  frameCount: number;
-  fieldCount: number;
-  fieldCountByType: (type: FieldType) => number;
-  hasFieldType: (type: FieldType) => boolean;
-  /** The first frame that set's this value */
-  preferredVisualisationType?: PreferredVisualisationType;
-
-  /* --- DEPRECATED FIELDS BELOW --- */
-  /** @deprecated use PanelDataSummary.fieldCountByType(FieldType.number) */
-  numberFieldCount: number;
-  /** @deprecated use PanelDataSummary.fieldCountByType(FieldType.time) */
-  timeFieldCount: number;
-  /** @deprecated use PanelDataSummary.fieldCountByType(FieldType.string) */
-  stringFieldCount: number;
-  /** @deprecated use PanelDataSummary.hasFieldType(FieldType.number) */
-  hasNumberField?: boolean;
-  /** @deprecated use PanelDataSummary.hasFieldType(FieldType.time) */
-  hasTimeField?: boolean;
-  /** @deprecated use PanelDataSummary.hasFieldType(FieldType.string) */
-  hasStringField?: boolean;
-}
-
-/**
- * @alpha
- * given a list of dataframes, summarize attributes of those frames for features like suggestions.
- * @param frames - dataframes to summarize
- * @returns summary of the dataframes
- */
-export function getPanelDataSummary(frames: DataFrame[] = []): PanelDataSummary {
-  let rowCountTotal = 0;
-  let rowCountMax = 0;
-  let fieldCount = 0;
-  const countByType: Partial<Record<FieldType, number>> = {};
-  let preferredVisualisationType: PreferredVisualisationType | undefined;
-
-  for (const frame of frames) {
-    rowCountTotal += frame.length;
-
-    if (frame.meta?.preferredVisualisationType) {
-      preferredVisualisationType = frame.meta.preferredVisualisationType;
-    }
-
-    for (const field of frame.fields) {
-      fieldCount++;
-      countByType[field.type] = (countByType[field.type] || 0) + 1;
-    }
-
-    if (frame.length > rowCountMax) {
-      rowCountMax = frame.length;
-    }
-  }
-
-  const fieldCountByType = (f: FieldType) => countByType[f] ?? 0;
-
-  return {
-    rowCountTotal,
-    rowCountMax,
-    fieldCount,
-    preferredVisualisationType,
-    frameCount: frames.length,
-    hasData: rowCountTotal > 0,
-    hasFieldType: (f: FieldType) => fieldCountByType(f) > 0,
-    fieldCountByType,
-    // deprecated
-    numberFieldCount: fieldCountByType(FieldType.number),
-    timeFieldCount: fieldCountByType(FieldType.time),
-    stringFieldCount: fieldCountByType(FieldType.string),
-    hasTimeField: fieldCountByType(FieldType.time) > 0,
-    hasNumberField: fieldCountByType(FieldType.number) > 0,
-    hasStringField: fieldCountByType(FieldType.string) > 0,
-  };
-}
--- a/packages/grafana-data/src/types/featureToggles.gen.ts
+++ b/packages/grafana-data/src/types/featureToggles.gen.ts
@@ -248,6 +248,11 @@ export interface FeatureToggles {
  */
  externalServiceAccounts?: boolean;
  /**
+  * Enables panel monitoring through logs and measurements
+  * @default true
+  */
+  panelMonitoring?: boolean;
+  /**
  * Enables native HTTP Histograms
  */
  enableNativeHTTPHistogram?: boolean;
@@ -560,13 +565,9 @@ export interface FeatureToggles {
  */
  queryLibrary?: boolean;
  /**
-  * Enable dashboard library experiments that are production ready
-  */
-  dashboardLibrary?: boolean;
-  /**
  * Enable suggested dashboards when creating new dashboards
  */
-  suggestedDashboards?: boolean;
+  dashboardLibrary?: boolean;
  /**
  * Sets the logs table as default visualisation in logs explore
  */
@@ -1245,9 +1246,4 @@ export interface FeatureToggles {
  * Enable template dashboards
  */
  dashboardTemplates?: boolean;
-  /**
-  * Enables app platform API for annotations
-  * @default false
-  */
-  kubernetesAnnotations?: boolean;
 }
--- a/packages/grafana-data/src/types/icon.ts
+++ b/packages/grafana-data/src/types/icon.ts
@@ -162,7 +162,6 @@ export const availableIconsIndex = {
  globe: true,
  grafana: true,
  'graph-bar': true,
-  'hand-pointer': true,
  heart: true,
  'heart-rate': true,
  'heart-break': true,
--- a/packages/grafana-data/src/types/panel.ts
+++ b/packages/grafana-data/src/types/panel.ts
@@ -2,15 +2,14 @@ import { defaultsDeep } from 'lodash';

 import { EventBus } from '../events/types';
 import { StandardEditorProps } from '../field/standardFieldConfigEditorRegistry';
-import { PanelDataSummary, getPanelDataSummary } from '../panel/suggestions/getPanelDataSummary';
 import { Registry } from '../utils/Registry';

 import { OptionsEditorItem } from './OptionsUIRegistryBuilder';
 import { ScopedVars } from './ScopedVars';
 import { AlertStateInfo } from './alerts';
 import { PanelModel } from './dashboard';
-import { LoadingState } from './data';
-import { DataFrame } from './dataFrame';
+import { LoadingState, PreferredVisualisationType } from './data';
+import { DataFrame, FieldType } from './dataFrame';
 import { DataQueryError, DataQueryRequest, DataQueryTimings } from './datasource';
 import { FieldConfigSource } from './fieldOverrides';
 import { IconName } from './icon';
@@ -259,6 +258,25 @@ export enum VisualizationSuggestionScore {
  OK = 50,
 }

+/**
+ * @alpha
+ */
+export interface PanelDataSummary {
+  hasData?: boolean;
+  rowCountTotal: number;
+  rowCountMax: number;
+  frameCount: number;
+  fieldCount: number;
+  numberFieldCount: number;
+  timeFieldCount: number;
+  stringFieldCount: number;
+  hasNumberField?: boolean;
+  hasTimeField?: boolean;
+  hasStringField?: boolean;
+  /** The first frame that set's this value */
+  preferredVisualisationType?: PreferredVisualisationType;
+}
+
 /**
 * @alpha
 */
@@ -275,13 +293,68 @@ export class VisualizationSuggestionsBuilder {
  constructor(data?: PanelData, panel?: PanelModel) {
    this.data = data;
    this.panel = panel;
-    this.dataSummary = getPanelDataSummary(this.data?.series);
+    this.dataSummary = this.computeDataSummary();
  }

  getListAppender<TOptions, TFieldConfig>(defaults: VisualizationSuggestion<TOptions, TFieldConfig>) {
    return new VisualizationSuggestionsListAppender<TOptions, TFieldConfig>(this.list, defaults);
  }

+  private computeDataSummary() {
+    const frames = this.data?.series || [];
+
+    let numberFieldCount = 0;
+    let timeFieldCount = 0;
+    let stringFieldCount = 0;
+    let rowCountTotal = 0;
+    let rowCountMax = 0;
+    let fieldCount = 0;
+    let preferredVisualisationType: PreferredVisualisationType | undefined;
+
+    for (const frame of frames) {
+      rowCountTotal += frame.length;
+
+      if (frame.meta?.preferredVisualisationType) {
+        preferredVisualisationType = frame.meta.preferredVisualisationType;
+      }
+
+      for (const field of frame.fields) {
+        fieldCount++;
+
+        switch (field.type) {
+          case FieldType.number:
+            numberFieldCount += 1;
+            break;
+          case FieldType.time:
+            timeFieldCount += 1;
+            break;
+          case FieldType.string:
+            stringFieldCount += 1;
+            break;
+        }
+      }
+
+      if (frame.length > rowCountMax) {
+        rowCountMax = frame.length;
+      }
+    }
+
+    return {
+      numberFieldCount,
+      timeFieldCount,
+      stringFieldCount,
+      rowCountTotal,
+      rowCountMax,
+      fieldCount,
+      preferredVisualisationType,
+      frameCount: frames.length,
+      hasData: rowCountTotal > 0,
+      hasTimeField: timeFieldCount > 0,
+      hasNumberField: numberFieldCount > 0,
+      hasStringField: stringFieldCount > 0,
+    };
+  }
+
  getList() {
    return this.list;
  }
--- a/packages/grafana-i18n/src/types/dates.d.ts
+++ b/packages/grafana-i18n/src/types/dates.d.ts
@@ -1,4 +1,4 @@
-import type {
+import {
  DurationFormatConstructor,
  DurationFormatOptions as _DurationFormatOptions,
  DurationInput as _DurationInput,
--- a/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts
+++ b/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts
@@ -247,7 +247,7 @@ export interface CloudWatchLogsQuery extends common.DataQuery {
   */
  logGroups?: Array<LogGroup>;
  /**
-   * Whether a query is a Logs Insights or Log Anomalies query
+   * Whether a query is a Logs Insights or Logs Anomalies query
   */
  logsMode?: LogsMode;
  /**
@@ -275,7 +275,7 @@ export const defaultCloudWatchLogsQuery: Partial<CloudWatchLogsQuery> = {
 };

 /**
- * Shape of a Cloudwatch Log Anomalies query
+ * Shape of a Cloudwatch Logs Anomalies query
 */
 export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery {
  /**
@@ -284,7 +284,7 @@ export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery {
  anomalyDetectionARN?: string;
  id: string;
  /**
-   * Whether a query is a Logs Insights or Log Anomalies query
+   * Whether a query is a Logs Insights or Logs Anomalies query
   */
  logsMode?: LogsMode;
  /**
--- a/pkg/api/common_test.go
+++ b/pkg/api/common_test.go
@@ -273,7 +273,7 @@ func setupSimpleHTTPServer(features featuremgmt.FeatureToggles) *HTTPServer {
 		AccessControl:   acimpl.ProvideAccessControl(featuremgmt.WithFeatures()),
 		annotationsRepo: annotationstest.NewFakeAnnotationsRepo(),
 		authInfoService: &authinfotest.FakeService{
-			ExpectedRecentlyUsedLabel: map[int64]string{int64(1): login.GetAuthProviderLabel(login.LDAPAuthModule)},
+			ExpectedLabels: map[int64]string{int64(1): login.GetAuthProviderLabel(login.LDAPAuthModule)},
 		},
 		tracer: tracing.InitializeTracerForTest(),
 	}
--- a/pkg/api/dashboard.go
+++ b/pkg/api/dashboard.go
@@ -438,6 +438,7 @@ func (hs *HTTPServer) postDashboard(c *contextmodel.ReqContext, cmd dashboards.S
 	}

 	ctx = c.Req.Context()
+	var err error

 	var userID int64
 	if id, err := identity.UserIdentifier(c.GetID()); err == nil {
@@ -517,6 +518,12 @@ func (hs *HTTPServer) postDashboard(c *contextmodel.ReqContext, cmd dashboards.S
 		return apierrors.ToDashboardErrorResponse(ctx, hs.pluginStore, saveErr)
 	}

+	// connect library panels for this dashboard after the dashboard is stored and has an ID
+	err = hs.LibraryPanelService.ConnectLibraryPanelsForDashboard(ctx, c.SignedInUser, dashboard)
+	if err != nil {
+		return response.Error(http.StatusInternalServerError, "Error while connecting library panels", err)
+	}
+
 	c.TimeRequest(metrics.MApiDashboardSave)
 	return response.JSON(http.StatusOK, util.DynMap{
 		"status":    "success",
--- a/pkg/api/dashboard_test.go
+++ b/pkg/api/dashboard_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/db/dbtest"
@@ -38,6 +39,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/services/folder/foldertest"
 	libraryelementsfake "github.com/grafana/grafana/pkg/services/libraryelements/fake"
+	"github.com/grafana/grafana/pkg/services/librarypanels"
 	"github.com/grafana/grafana/pkg/services/licensing/licensingtest"
 	"github.com/grafana/grafana/pkg/services/live"
 	"github.com/grafana/grafana/pkg/services/org"
@@ -263,6 +265,7 @@ func TestHTTPServer_DeleteDashboardByUID_AccessControl(t *testing.T) {
 			hs.AccessControl = acimpl.ProvideAccessControl(featuremgmt.WithFeatures())
 			hs.starService = startest.NewStarServiceFake()

+			hs.LibraryPanelService = &mockLibraryPanelService{}
 			hs.LibraryElementService = &libraryelementsfake.LibraryElementService{}

 			middleware := publicdashboards.NewFakePublicDashboardMiddleware(t)
@@ -788,6 +791,7 @@ func TestIntegrationDashboardAPIEndpoint(t *testing.T) {
 					ProvisioningService:     provisioning.NewProvisioningServiceMock(context.Background()),
 					Live:                    newTestLive(t, db.InitTestDB(t)),
 					QuotaService:            quotatest.New(false, nil),
+					LibraryPanelService:     &mockLibraryPanelService{},
 					LibraryElementService:   &libraryelementsfake.LibraryElementService{},
 					DashboardService:        dashboardService,
 					SQLStore:                dbtest.NewFakeDB(),
@@ -849,6 +853,7 @@ func TestIntegrationDashboardAPIEndpoint(t *testing.T) {
 			hs := &HTTPServer{
 				Cfg:                          setting.NewCfg(),
 				ProvisioningService:          fakeProvisioningService,
+				LibraryPanelService:          &mockLibraryPanelService{},
 				LibraryElementService:        &libraryelementsfake.LibraryElementService{},
 				dashboardProvisioningService: dashboardProvisioningService,
 				SQLStore:                     mockSQLStore,
@@ -882,6 +887,7 @@ func TestIntegrationDashboardAPIEndpoint(t *testing.T) {
 			hs := &HTTPServer{
 				Cfg:                          setting.NewCfg(),
 				ProvisioningService:          fakeProvisioningService,
+				LibraryPanelService:          &mockLibraryPanelService{},
 				LibraryElementService:        &libraryelementsfake.LibraryElementService{},
 				dashboardProvisioningService: dashboardProvisioningService,
 				SQLStore:                     mockSQLStore,
@@ -922,6 +928,7 @@ func TestIntegrationDashboardAPIEndpoint(t *testing.T) {
 		loggedInUserScenarioWithRole(t, "When calling GET on", "GET", "/api/dashboards/uid/dash", "/api/dashboards/uid/:uid", org.RoleEditor, func(sc *scenarioContext) {
 			hs := &HTTPServer{
 				Cfg:                          setting.NewCfg(),
+				LibraryPanelService:          &mockLibraryPanelService{},
 				LibraryElementService:        &libraryelementsfake.LibraryElementService{},
 				SQLStore:                     mockSQLStore,
 				AccessControl:                actest.FakeAccessControl{ExpectedEvaluate: true},
@@ -1080,6 +1087,7 @@ func postDashboardScenario(t *testing.T, desc string, url string, routePattern s
 			Live:                  newTestLive(t, db.InitTestDB(t)),
 			QuotaService:          quotatest.New(false, nil),
 			pluginStore:           &pluginstore.FakePluginStore{},
+			LibraryPanelService:   &mockLibraryPanelService{},
 			LibraryElementService: &libraryelementsfake.LibraryElementService{},
 			DashboardService:      dashboardService,
 			folderService:         folderService,
@@ -1119,6 +1127,7 @@ func restoreDashboardVersionScenario(t *testing.T, desc string, url string, rout
 			ProvisioningService:     provisioning.NewProvisioningServiceMock(context.Background()),
 			Live:                    newTestLive(t, db.InitTestDB(t)),
 			QuotaService:            quotatest.New(false, nil),
+			LibraryPanelService:     &mockLibraryPanelService{},
 			LibraryElementService:   &libraryelementsfake.LibraryElementService{},
 			DashboardService:        mock,
 			SQLStore:                sqlStore,
@@ -1168,3 +1177,15 @@ func (s mockDashboardProvisioningService) GetProvisionedDashboardDataByDashboard
 ) {
 	return nil, nil
 }
+
+type mockLibraryPanelService struct{}
+
+var _ librarypanels.Service = (*mockLibraryPanelService)(nil)
+
+func (m *mockLibraryPanelService) ConnectLibraryPanelsForDashboard(c context.Context, signedInUser identity.Requester, dash *dashboards.Dashboard) error {
+	return nil
+}
+
+func (m *mockLibraryPanelService) ImportLibraryPanelsForDashboard(c context.Context, signedInUser identity.Requester, libraryPanels *simplejson.Json, panels []any, folderID int64, folderUID string) error {
+	return nil
+}
--- a/pkg/api/http_server.go
+++ b/pkg/api/http_server.go
@@ -164,6 +164,7 @@ type HTTPServer struct {
 	LoggerMiddleware             loggermw.Logger
 	SQLStore                     db.DB
 	AlertNG                      *ngalert.AlertNG
+	LibraryPanelService          librarypanels.Service
 	LibraryElementService        libraryelements.Service
 	SocialService                social.Service
 	Listener                     net.Listener
@@ -318,6 +319,7 @@ func ProvideHTTPServer(opts ServerOptions, cfg *setting.Cfg, routeRegister routi
 		ContextHandler:               contextHandler,
 		LoggerMiddleware:             loggerMiddleware,
 		AlertNG:                      alertNG,
+		LibraryPanelService:          libraryPanelService,
 		LibraryElementService:        libraryElementService,
 		QuotaService:                 quotaService,
 		tracer:                       tracer,
--- a/pkg/api/org_users.go
+++ b/pkg/api/org_users.go
@@ -314,7 +314,7 @@ func (hs *HTTPServer) searchOrgUsersHelper(c *contextmodel.ReqContext, query *or
 		filteredUsers = append(filteredUsers, user)
 	}

-	modules, err := hs.authInfoService.GetUsersRecentlyUsedLabel(c.Req.Context(), login.GetUserLabelsQuery{
+	modules, err := hs.authInfoService.GetUserLabels(c.Req.Context(), login.GetUserLabelsQuery{
 		UserIDs: authLabelsUserIDs,
 	})

--- a/pkg/api/user.go
+++ b/pkg/api/user.go
@@ -115,7 +115,6 @@ func (hs *HTTPServer) GetUserByLoginOrEmail(c *contextmodel.ReqContext) response
 		}
 		return response.Error(http.StatusInternalServerError, "Failed to get user", err)
 	}
-
 	result := user.UserProfileDTO{
 		ID:             usr.ID,
 		UID:            usr.UID,
@@ -129,11 +128,6 @@ func (hs *HTTPServer) GetUserByLoginOrEmail(c *contextmodel.ReqContext) response
 		UpdatedAt:      usr.Updated,
 		CreatedAt:      usr.Created,
 	}
-	// Populate AuthLabels using all historically used auth modules ordered by most recent.
-	if modules, err := hs.authInfoService.GetUserAuthModuleLabels(c.Req.Context(), usr.ID); err == nil {
-		result.AuthLabels = modules
-	}
-
 	return response.JSON(http.StatusOK, &result)
 }

--- a/pkg/api/user_test.go
+++ b/pkg/api/user_test.go
@@ -185,44 +185,6 @@ func TestIntegrationUserAPIEndpoint_userLoggedIn(t *testing.T) {
 		require.NoError(t, err)
 	}, mock)

-	// Multiple historical auth labels should appear ordered by recency
-	loggedInUserScenario(t, "When calling GET returns with multiple auth labels", "/api/users/lookup", "/api/users/lookup", func(sc *scenarioContext) {
-		createUserCmd := user.CreateUserCommand{
-			Email:   fmt.Sprint("multi", "@test.com"),
-			Name:    "multi",
-			Login:   "multi",
-			IsAdmin: true,
-		}
-		orgSvc, err := orgimpl.ProvideService(sqlStore, sc.cfg, quotatest.New(false, nil))
-		require.NoError(t, err)
-		userSvc, err := userimpl.ProvideService(
-			sqlStore, orgSvc, sc.cfg, nil, nil, tracing.InitializeTracerForTest(),
-			quotatest.New(false, nil), supportbundlestest.NewFakeBundleService(),
-		)
-		require.NoError(t, err)
-		usr, err := userSvc.Create(context.Background(), &createUserCmd)
-		require.Nil(t, err)
-
-		sc.handlerFunc = hs.GetUserByLoginOrEmail
-
-		userMock := usertest.NewUserServiceFake()
-		userMock.ExpectedUser = &user.User{ID: usr.ID, Email: usr.Email, Login: usr.Login, Name: usr.Name}
-		sc.userService = userMock
-		hs.userService = userMock
-
-		fakeAuth := &authinfotest.FakeService{ExpectedAuthModuleLabels: []string{login.GetAuthProviderLabel(login.OktaAuthModule), login.GetAuthProviderLabel(login.LDAPAuthModule), login.GetAuthProviderLabel(login.SAMLAuthModule)}}
-		hs.authInfoService = fakeAuth
-
-		sc.fakeReqWithParams("GET", sc.url, map[string]string{"loginOrEmail": usr.Email}).exec()
-
-		var resp user.UserProfileDTO
-		require.Equal(t, http.StatusOK, sc.resp.Code)
-		err = json.Unmarshal(sc.resp.Body.Bytes(), &resp)
-		require.NoError(t, err)
-		expected := []string{login.GetAuthProviderLabel(login.OktaAuthModule), login.GetAuthProviderLabel(login.LDAPAuthModule), login.GetAuthProviderLabel(login.SAMLAuthModule)}
-		require.Equal(t, expected, resp.AuthLabels)
-	}, mock)
-
 	loggedInUserScenario(t, "When calling GET on", "/api/users", "/api/users", func(sc *scenarioContext) {
 		userMock.ExpectedSearchUsers = mockResult

--- a/pkg/registry/apis/dashboard/legacysearcher/search_client.go
+++ b/pkg/registry/apis/dashboard/legacysearcher/search_client.go
@@ -229,32 +229,12 @@ func (c *DashboardSearchClient) Search(ctx context.Context, req *resourcepb.Reso
 				return nil, fmt.Errorf("only one repo name is supported")
 			}
 			query.ManagerIdentity = vals[0]
-
 		case unisearch.DASHBOARD_LIBRARY_PANEL_REFERENCE:
 			if len(vals) != 1 {
 				return nil, fmt.Errorf("only one library panel uid is supported")
 			}

-			// Make sure the query does not include incompatible combinations
-			for _, f := range req.Options.Fields {
-				switch f.Key {
-				case resource.SEARCH_FIELD_NAME:
-					return nil, fmt.Errorf("libraryPanel query must not include explicit names")
-				}
-			}
-
-			query.DashboardUIDs, err = c.getLibraryPanelConnections(ctx, user, vals[0])
-			if err != nil {
-				return nil, err
-			}
-			if len(query.DashboardUIDs) == 0 {
-				// Empty results
-				return &resourcepb.ResourceSearchResponse{
-					TotalHits: 0,
-					Results:   &resourcepb.ResourceTable{},
-				}, nil
-			}
-
+			return c.getLibraryPanelConnections(ctx, user, vals[0], req.Options.Key.Namespace)
 		case resource.SEARCH_FIELD_TITLE_PHRASE:
 			if len(vals) != 1 {
 				return nil, fmt.Errorf("only one title supported")
@@ -382,18 +362,32 @@ func getResourceKey(item *dashboards.DashboardSearchProjection, namespace string
 	}
 }

-// retrieves all dashboard UIDs connected to a given library panel
-func (c *DashboardSearchClient) getLibraryPanelConnections(ctx context.Context, user identity.Requester, libraryElementUID string) ([]string, error) {
+// retrieves all the dashboards that are connected to the given library panel
+func (c *DashboardSearchClient) getLibraryPanelConnections(ctx context.Context, user identity.Requester, libraryElementUID, namespace string) (*resourcepb.ResourceSearchResponse, error) {
 	connections, err := c.dashboardStore.GetDashboardsByLibraryPanelUID(ctx, libraryElementUID, user.GetOrgID())
 	if err != nil {
 		return nil, err
 	}

-	uids := make([]string, len(connections))
-	for i, dashboard := range connections {
-		uids[i] = dashboard.UID
+	columns := c.getColumns("", &dashboards.FindPersistedDashboardsQuery{})
+	list := &resourcepb.ResourceSearchResponse{
+		Results: &resourcepb.ResourceTable{
+			Columns: columns,
+		},
 	}
-	return uids, nil
+
+	for _, dashboard := range connections {
+		cells := c.createCommonCells("", dashboard.FolderUID, dashboard.ID, nil) // nolint:staticcheck
+		list.Results.Rows = append(list.Results.Rows, &resourcepb.ResourceTableRow{
+			Key: getResourceKey(&dashboards.DashboardSearchProjection{
+				UID: dashboard.UID,
+			}, namespace),
+			Cells: cells,
+		})
+	}
+
+	list.TotalHits = int64(len(list.Results.Rows))
+	return list, nil
 }

 func (c *DashboardSearchClient) GetStats(ctx context.Context, req *resourcepb.ResourceStatsRequest, _ ...grpc.CallOption) (*resourcepb.ResourceStatsResponse, error) {
--- a/pkg/registry/apis/dashboard/legacysearcher/search_client_test.go
+++ b/pkg/registry/apis/dashboard/legacysearcher/search_client_test.go
@@ -581,11 +581,6 @@ func TestDashboardSearchClient_Search(t *testing.T) {
 			{UID: "dashboard2", FolderUID: "folder2", ID: 2},
 		}, nil).Once()

-		mockStore.On("FindDashboards", mock.Anything, mock.Anything).Return([]dashboards.DashboardSearchProjection{
-			{UID: "dashboard1", FolderUID: "folder1", ID: 1},
-			{UID: "dashboard2", FolderUID: "folder2", ID: 2},
-		}, nil).Once()
-
 		req := &resourcepb.ResourceSearchRequest{
 			Options: &resourcepb.ListOptions{
 				Key: dashboardKey,
--- a/pkg/registry/apis/dashboard/search.go
+++ b/pkg/registry/apis/dashboard/search.go
@@ -121,15 +121,6 @@ func (s *SearchHandler) GetAPIRoutes(defs map[string]common.OpenAPIDefinition) *
 										Schema:      spec.ArrayProperty(spec.StringProperty()),
 									},
 								},
-								{
-									ParameterProps: spec3.ParameterProps{
-										Name:        "libraryPanel",
-										In:          "query",
-										Description: "find dashboards that reference a given libraryPanel",
-										Required:    false,
-										Schema:      spec.StringProperty(),
-									},
-								},
 								{
 									ParameterProps: spec3.ParameterProps{
 										Name:        "sort",
@@ -372,15 +363,6 @@ func (s *SearchHandler) DoSearch(w http.ResponseWriter, r *http.Request) {
 		}}
 	}

-	// The libraryPanel filter
-	if libraryPanel, ok := queryParams["libraryPanel"]; ok {
-		searchRequest.Options.Fields = []*resourcepb.Requirement{{
-			Key:      search.DASHBOARD_LIBRARY_PANEL_REFERENCE,
-			Operator: "=",
-			Values:   libraryPanel,
-		}}
-	}
-
 	// The names filter
 	names := queryParams["name"]

--- a/pkg/registry/apis/datasource/register.go
+++ b/pkg/registry/apis/datasource/register.go
@@ -3,8 +3,10 @@ package datasource
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"maps"
+	"path/filepath"

 	"github.com/prometheus/client_golang/prometheus"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -21,6 +23,7 @@ import (
 	datasourceV0 "github.com/grafana/grafana/pkg/apis/datasource/v0alpha1"
 	queryV0 "github.com/grafana/grafana/pkg/apis/query/v0alpha1"
 	grafanaregistry "github.com/grafana/grafana/pkg/apiserver/registry/generic"
+	"github.com/grafana/grafana/pkg/configprovider"
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/plugins/manager/sources"
 	"github.com/grafana/grafana/pkg/promlib/models"
@@ -28,6 +31,7 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/apiserver/builder"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/tsdb/grafana-testdata-datasource/kinds"
 )

@@ -49,6 +53,7 @@ type DataSourceAPIBuilder struct {
 }

 func RegisterAPIService(
+	cfgProvider configprovider.ConfigProvider,
 	features featuremgmt.FeatureToggles,
 	apiRegistrar builder.APIRegistrar,
 	pluginClient plugins.Client, // access to everything
@@ -56,7 +61,6 @@ func RegisterAPIService(
 	contextProvider PluginContextWrapper,
 	accessControl accesscontrol.AccessControl,
 	reg prometheus.Registerer,
-	pluginSources sources.Registry,
 ) (*DataSourceAPIBuilder, error) {
 	// We want to expose just a limited set of plugins
 	//nolint:staticcheck // not yet migrated to OpenFeature
@@ -71,9 +75,13 @@ func RegisterAPIService(
 	var err error
 	var builder *DataSourceAPIBuilder

-	pluginJSONs, err := getDatasourcePlugins(pluginSources)
+	cfg, err := cfgProvider.Get(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("error getting list of datasource plugins: %s", err)
+		return nil, err
+	}
+	pluginJSONs, err := getCorePlugins(cfg)
+	if err != nil {
+		return nil, err
 	}

 	ids := []string{
@@ -291,29 +299,21 @@ func (b *DataSourceAPIBuilder) GetOpenAPIDefinitions() openapi.GetOpenAPIDefinit
 	}
 }

-func getDatasourcePlugins(pluginSources sources.Registry) ([]plugins.JSONData, error) {
-	var pluginJSONs []plugins.JSONData
+func getCorePlugins(cfg *setting.Cfg) ([]plugins.JSONData, error) {
+	coreDataSourcesPath := filepath.Join(cfg.StaticRootPath, "app", "plugins", "datasource")
+	coreDataSourcesSrc := sources.NewLocalSource(
+		plugins.ClassCore,
+		[]string{coreDataSourcesPath},
+	)

-	// It's possible that the same plugin will be found in different sources.
-	// Registering the same plugin twice in the API is Probably A Bad Thing,
-	// so this map keeps track of uniques, so we can skip duplicates.
-	var uniquePlugins = map[string]bool{}
+	res, err := coreDataSourcesSrc.Discover(context.Background())
+	if err != nil {
+		return nil, errors.New("failed to load core data source plugins")
+	}

-	for _, pluginSource := range pluginSources.List(context.Background()) {
-		res, err := pluginSource.Discover(context.Background())
-		if err != nil {
-			return nil, err
-		}
-		for _, p := range res {
-			if p.Primary.JSONData.Type == plugins.TypeDataSource {
-				if _, found := uniquePlugins[p.Primary.JSONData.ID]; found {
-					backend.Logger.Info("Found duplicate plugin %s when registering API groups.", p.Primary.JSONData.ID)
-					continue
-				}
-				uniquePlugins[p.Primary.JSONData.ID] = true
-				pluginJSONs = append(pluginJSONs, p.Primary.JSONData)
-			}
-		}
+	pluginJSONs := make([]plugins.JSONData, 0, len(res))
+	for _, p := range res {
+		pluginJSONs = append(pluginJSONs, p.Primary.JSONData)
 	}
 	return pluginJSONs, nil
 }
--- a/pkg/registry/apis/datasource/sub_health.go
+++ b/pkg/registry/apis/datasource/sub_health.go
@@ -10,8 +10,6 @@ import (
 	"k8s.io/apiserver/pkg/registry/rest"

 	datasource "github.com/grafana/grafana/pkg/apis/datasource/v0alpha1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )

 type subHealthREST struct {
@@ -46,19 +44,7 @@ func (r *subHealthREST) NewConnectOptions() (runtime.Object, bool, string) {
 	return nil, false, ""
 }

-// FIXME: this endpoint has not been tested yet, so it is not enabled by default.
-var healthEnabled = false
-
 func (r *subHealthREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
-	if !healthEnabled {
-		return nil, &apierrors.StatusError{
-			ErrStatus: metav1.Status{
-				Status: metav1.StatusFailure,
-				Code:   http.StatusNotImplemented,
-			},
-		}
-	}
-
 	pluginCtx, err := r.builder.getPluginContext(ctx, name)
 	if err != nil {
 		return nil, err
--- a/pkg/registry/apis/datasource/sub_resource.go
+++ b/pkg/registry/apis/datasource/sub_resource.go
@@ -8,7 +8,6 @@ import (
 	"net/url"
 	"strings"

-	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apiserver/pkg/registry/rest"
@@ -47,21 +46,7 @@ func (r *subResourceREST) NewConnectOptions() (runtime.Object, bool, string) {
 	return nil, true, ""
 }

-// FIXME: this endpoint has not been tested yet, so it is not enabled by default.
-// It is especially important to make sure the `ClearAuthHeadersMiddleware` is active,
-// when using this endpoint.
-var resourceEnabled = false
-
 func (r *subResourceREST) Connect(ctx context.Context, name string, opts runtime.Object, responder rest.Responder) (http.Handler, error) {
-	if !resourceEnabled {
-		return nil, &apierrors.StatusError{
-			ErrStatus: metav1.Status{
-				Status: metav1.StatusFailure,
-				Code:   http.StatusNotImplemented,
-			},
-		}
-	}
-
 	pluginCtx, err := r.builder.getPluginContext(ctx, name)
 	if err != nil {
 		return nil, err
--- a/pkg/registry/apis/folders/validate.go
+++ b/pkg/registry/apis/folders/validate.go
@@ -120,14 +120,6 @@ func validateOnUpdate(ctx context.Context,
 		return err
 	}

-	// Check that the folder being moved is not an ancestor of the target parent.
-	// This prevents circular references (e.g., moving A under B when B is already under A).
-	for _, ancestor := range info.Items {
-		if ancestor.Name == obj.Name {
-			return fmt.Errorf("cannot move folder under its own descendant, this would create a circular reference")
-		}
-	}
-
 	// if by moving a folder we exceed the max depth, return an error
 	if len(info.Items) > maxDepth+1 {
 		return folder.ErrMaximumDepthReached.Errorf("maximum folder depth reached")
--- a/pkg/registry/apis/folders/validate_test.go
+++ b/pkg/registry/apis/folders/validate_test.go
@@ -264,71 +264,6 @@ func TestValidateUpdate(t *testing.T) {
 			maxDepth:    folder.MaxNestedFolderDepth,
 			expectedErr: "[folder.maximum-depth-reached]",
 		},
-		{
-			name: "error when moving folder under its own descendant (direct child)",
-			folder: &folders.Folder{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "parent",
-					Annotations: map[string]string{
-						utils.AnnoKeyFolder: "child",
-					},
-				},
-				Spec: folders.FolderSpec{
-					Title: "parent folder",
-				},
-			},
-			old: &folders.Folder{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "parent",
-				},
-				Spec: folders.FolderSpec{
-					Title: "parent folder",
-				},
-			},
-			// When querying parents of "child", we get the chain: child -> parent -> root
-			// This means "parent" is an ancestor of "child", so we can't move "parent" under "child"
-			parents: &folders.FolderInfoList{
-				Items: []folders.FolderInfo{
-					{Name: "child", Parent: "parent"},
-					{Name: "parent", Parent: folder.GeneralFolderUID},
-					{Name: folder.GeneralFolderUID},
-				},
-			},
-			expectedErr: "cannot move folder under its own descendant",
-		},
-		{
-			name: "error when moving folder under its grandchild",
-			folder: &folders.Folder{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "grandparent",
-					Annotations: map[string]string{
-						utils.AnnoKeyFolder: "grandchild",
-					},
-				},
-				Spec: folders.FolderSpec{
-					Title: "grandparent folder",
-				},
-			},
-			old: &folders.Folder{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "grandparent",
-				},
-				Spec: folders.FolderSpec{
-					Title: "grandparent folder",
-				},
-			},
-			// When querying parents of "grandchild", we get: grandchild -> child -> grandparent -> root
-			// This means "grandparent" is in the ancestry, so we can't move it under "grandchild"
-			parents: &folders.FolderInfoList{
-				Items: []folders.FolderInfo{
-					{Name: "grandchild", Parent: "child"},
-					{Name: "child", Parent: "grandparent"},
-					{Name: "grandparent", Parent: folder.GeneralFolderUID},
-					{Name: folder.GeneralFolderUID},
-				},
-			},
-			expectedErr: "cannot move folder under its own descendant",
-		},
 	}

 	for _, tt := range tests {
--- a/pkg/registry/apis/iam/register.go
+++ b/pkg/registry/apis/iam/register.go
@@ -350,59 +350,23 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 	}
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	if b.features.IsEnabledGlobally(featuremgmt.FlagKubernetesAuthzResourcePermissionApis) {
-		if err := b.UpdateResourcePermissionsAPIGroup(apiGroupInfo, opts, storage, b.enableDualWriter, enableZanzanaSync); err != nil {
+		resourcePermissionStore, err := NewLocalStore(iamv0.ResourcePermissionInfo, apiGroupInfo.Scheme, opts.OptsGetter, b.reg, b.accessClient, b.resourcePermissionsStorage)
+		if err != nil {
 			return err
 		}
+		if enableZanzanaSync {
+			b.logger.Info("Enabling AfterCreate, BeginUpdate, and AfterDelete hooks for ResourcePermission to sync to Zanzana")
+			resourcePermissionStore.AfterCreate = b.AfterResourcePermissionCreate
+			resourcePermissionStore.BeginUpdate = b.BeginResourcePermissionUpdate
+			resourcePermissionStore.AfterDelete = b.AfterResourcePermissionDelete
+		}
+		storage[iamv0.ResourcePermissionInfo.StoragePath()] = resourcePermissionStore
 	}

 	apiGroupInfo.VersionedResourcesStorageMap[legacyiamv0.VERSION] = storage
 	return nil
 }

-func (b *IdentityAccessManagementAPIBuilder) UpdateResourcePermissionsAPIGroup(
-	apiGroupInfo *genericapiserver.APIGroupInfo,
-	opts builder.APIGroupOptions,
-	storage map[string]rest.Storage,
-	enableDualWriter bool,
-	enableZanzanaSync bool,
-) error {
-	var store rest.Storage
-	// Create the legacy store first
-	legacyStore, err := NewLocalStore(iamv0.ResourcePermissionInfo, apiGroupInfo.Scheme, opts.OptsGetter, b.reg, b.accessClient, b.resourcePermissionsStorage)
-	if err != nil {
-		return err
-	}
-
-	// Register the hooks for Zanzana sync
-	// FIXME: The hooks are registered on the legacy store
-	// Once we fully migrate to unified storage, we can move these hooks to the unified store
-	if enableZanzanaSync {
-		b.logger.Info("Enabling AfterCreate, BeginUpdate, and AfterDelete hooks for ResourcePermission to sync to Zanzana")
-		legacyStore.AfterCreate = b.AfterResourcePermissionCreate
-		legacyStore.BeginUpdate = b.BeginResourcePermissionUpdate
-		legacyStore.AfterDelete = b.AfterResourcePermissionDelete
-	}
-
-	// Set the default store to the legacy store
-	store = legacyStore
-
-	if enableDualWriter {
-		// Create the dual write store (UniStore + LegacyStore)
-		uniStore, err := grafanaregistry.NewRegistryStore(apiGroupInfo.Scheme, iamv0.ResourcePermissionInfo, opts.OptsGetter)
-		if err != nil {
-			return err
-		}
-
-		store, err = opts.DualWriteBuilder(iamv0.ResourcePermissionInfo.GroupResource(), legacyStore, uniStore)
-		if err != nil {
-			return err
-		}
-	}
-
-	storage[iamv0.ResourcePermissionInfo.StoragePath()] = store
-	return nil
-}
-
 func (b *IdentityAccessManagementAPIBuilder) GetOpenAPIDefinitions() common.GetOpenAPIDefinitions {
 	return func(rc common.ReferenceCallback) map[string]common.OpenAPIDefinition {
 		dst := legacyiamv0.GetOpenAPIDefinitions(rc)
--- a/pkg/registry/apis/iam/resource_permission_hooks_test.go
+++ b/pkg/registry/apis/iam/resource_permission_hooks_test.go
@@ -16,9 +16,8 @@ import (

 type FakeZanzanaClient struct {
 	zanzana.Client
-	writeCallback  func(context.Context, *v1.WriteRequest) error
-	readCallback   func(context.Context, *v1.ReadRequest) (*v1.ReadResponse, error)
-	mutateCallback func(context.Context, *v1.MutateRequest) error
+	writeCallback func(context.Context, *v1.WriteRequest) error
+	readCallback  func(context.Context, *v1.ReadRequest) (*v1.ReadResponse, error)
 }

 // Read implements zanzana.Client.
@@ -34,14 +33,6 @@ func (f *FakeZanzanaClient) Write(ctx context.Context, req *v1.WriteRequest) err
 	return f.writeCallback(ctx, req)
 }

-// Mutate implements zanzana.Client.
-func (f *FakeZanzanaClient) Mutate(ctx context.Context, req *v1.MutateRequest) error {
-	if f.mutateCallback != nil {
-		return f.mutateCallback(ctx, req)
-	}
-	return nil
-}
-
 func requireTuplesMatch(t *testing.T, actual []*v1.TupleKey, expected []*v1.TupleKey, msgAndArgs ...interface{}) {
 	t.Helper()
 	for _, exp := range expected {
--- a/pkg/registry/apis/iam/user_org_hooks.go
+++ b/pkg/registry/apis/iam/user_org_hooks.go
@@ -10,8 +10,27 @@ import (

 	iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	v1 "github.com/grafana/grafana/pkg/services/authz/proto/v1"
+	"github.com/grafana/grafana/pkg/services/authz/zanzana"
 )

+// createUserBasicRoleTuple creates a tuple for a user's basic role assignment
+func createUserBasicRoleTuple(userUID, orgRole string) *v1.TupleKey {
+	if orgRole == "" {
+		return nil
+	}
+
+	basicRole := zanzana.TranslateBasicRole(orgRole)
+	if basicRole == "" {
+		return nil
+	}
+
+	return &v1.TupleKey{
+		User:     zanzana.NewTupleEntry(zanzana.TypeUser, userUID, ""),
+		Relation: zanzana.RelationAssignee,
+		Object:   zanzana.NewTupleEntry(zanzana.TypeRole, basicRole, ""),
+	}
+}
+
 // AfterUserCreate is a post-create hook that writes the user's basic role assignment to Zanzana (openFGA)
 func (b *IdentityAccessManagementAPIBuilder) AfterUserCreate(obj runtime.Object, _ *metav1.CreateOptions) {
 	if b.zClient == nil {
@@ -24,24 +43,24 @@ func (b *IdentityAccessManagementAPIBuilder) AfterUserCreate(obj runtime.Object,
 		return
 	}

+	resourceType := "user"
+	operation := "create"
+
 	// Skip if user has no role assigned
 	if user.Spec.Role == "" {
 		b.logger.Debug("user has no role assigned, skipping basic role sync",
 			"namespace", user.Namespace,
-			"name", user.Name,
+			"userUID", user.Name,
 		)
 		return
 	}

-	resourceType := "user"
-	operation := "create"
-
 	// Grab a ticket to write to Zanzana
 	wait := time.Now()
 	b.zTickets <- true
 	hooksWaitHistogram.WithLabelValues(resourceType, operation).Observe(time.Since(wait).Seconds())

-	go func(namespace, subjectName, role, resourceType, operation string) {
+	go func(u *iamv0.User) {
 		start := time.Now()
 		status := "success"

@@ -51,38 +70,44 @@ func (b *IdentityAccessManagementAPIBuilder) AfterUserCreate(obj runtime.Object,
 			hooksOperationCounter.WithLabelValues(resourceType, operation, status).Inc()
 		}()

+		tuple := createUserBasicRoleTuple(u.Name, u.Spec.Role)
+		if tuple == nil {
+			b.logger.Warn("failed to create user basic role tuple",
+				"namespace", u.Namespace,
+				"userUID", u.Name,
+				"role", u.Spec.Role,
+			)
+			status = "failure"
+			return
+		}
+
 		b.logger.Debug("writing user basic role to zanzana",
-			"namespace", namespace,
-			"name", subjectName,
-			"role", role,
+			"namespace", u.Namespace,
+			"userUID", u.Name,
+			"role", u.Spec.Role,
 		)

 		ctx, cancel := context.WithTimeout(context.Background(), defaultWriteTimeout)
 		defer cancel()

-		err := b.zClient.Mutate(ctx, &v1.MutateRequest{
-			Namespace: namespace,
-			Operations: []*v1.MutateOperation{
-				{
-					Operation: &v1.MutateOperation_UpdateUserOrgRole{
-						UpdateUserOrgRole: &v1.UpdateUserOrgRoleOperation{User: subjectName, Role: role},
-					},
-				},
+		err := b.zClient.Write(ctx, &v1.WriteRequest{
+			Namespace: u.Namespace,
+			Writes: &v1.WriteRequestWrites{
+				TupleKeys: []*v1.TupleKey{tuple},
 			},
 		})
-
 		if err != nil {
 			status = "failure"
 			b.logger.Error("failed to write user basic role to zanzana",
 				"err", err,
-				"namespace", namespace,
-				"name", subjectName,
-				"role", role,
+				"namespace", u.Namespace,
+				"userUID", u.Name,
+				"role", u.Spec.Role,
 			)
 		} else {
 			hooksTuplesCounter.WithLabelValues(resourceType, operation, "write").Inc()
 		}
-	}(user.Namespace, user.Name, user.Spec.Role, resourceType, operation)
+	}(user.DeepCopy())
 }

 // BeginUserUpdate is a pre-update hook that gets called on user updates
@@ -117,7 +142,7 @@ func (b *IdentityAccessManagementAPIBuilder) BeginUserUpdate(ctx context.Context
 		b.zTickets <- true
 		hooksWaitHistogram.WithLabelValues("user", "update").Observe(time.Since(wait).Seconds())

-		go func(namespace, subjectName, oldRole, newRole string) {
+		go func(old, new *iamv0.User) {
 			start := time.Now()
 			status := "success"

@@ -128,40 +153,72 @@ func (b *IdentityAccessManagementAPIBuilder) BeginUserUpdate(ctx context.Context
 			}()

 			b.logger.Debug("updating user basic role in zanzana",
-				"namespace", namespace,
-				"name", subjectName,
-				"oldRole", oldRole,
-				"newRole", newRole,
+				"namespace", new.Namespace,
+				"userUID", new.Name,
+				"oldRole", old.Spec.Role,
+				"newRole", new.Spec.Role,
 			)

 			ctx, cancel := context.WithTimeout(context.Background(), defaultWriteTimeout)
 			defer cancel()

-			err := b.zClient.Mutate(ctx, &v1.MutateRequest{
-				Namespace: namespace,
-				Operations: []*v1.MutateOperation{
-					{
-						Operation: &v1.MutateOperation_UpdateUserOrgRole{
-							UpdateUserOrgRole: &v1.UpdateUserOrgRoleOperation{User: subjectName, Role: newRole},
-						},
-					}, {
-						Operation: &v1.MutateOperation_DeleteUserOrgRole{
-							DeleteUserOrgRole: &v1.DeleteUserOrgRoleOperation{User: subjectName, Role: oldRole},
-						},
-					},
-				},
-			})
-			if err != nil {
-				status = "failure"
-				b.logger.Error("failed to update user basic role in zanzana",
-					"err", err,
-					"namespace", namespace,
-					"name", subjectName,
-					"role", newRole,
-					"oldRole", oldRole,
-				)
+			req := &v1.WriteRequest{
+				Namespace: new.Namespace,
 			}
-		}(oldUser.Namespace, oldUser.Name, oldUser.Spec.Role, newUser.Spec.Role)
+
+			// Delete old role tuple if it existed
+			if old.Spec.Role != "" {
+				oldTuple := createUserBasicRoleTuple(old.Name, old.Spec.Role)
+				if oldTuple != nil {
+					deleteTuple := tupleToTupleKeyWithoutCondition(oldTuple)
+					req.Deletes = &v1.WriteRequestDeletes{
+						TupleKeys: []*v1.TupleKeyWithoutCondition{deleteTuple},
+					}
+					b.logger.Debug("deleting old user basic role from zanzana",
+						"namespace", new.Namespace,
+						"userUID", new.Name,
+						"role", old.Spec.Role,
+					)
+				}
+			}
+
+			// Write new role tuple if it exists
+			if new.Spec.Role != "" {
+				newTuple := createUserBasicRoleTuple(new.Name, new.Spec.Role)
+				if newTuple != nil {
+					req.Writes = &v1.WriteRequestWrites{
+						TupleKeys: []*v1.TupleKey{newTuple},
+					}
+					b.logger.Debug("writing new user basic role to zanzana",
+						"namespace", new.Namespace,
+						"userUID", new.Name,
+						"role", new.Spec.Role,
+					)
+				}
+			}
+
+			// Only make the request if there are deletes or writes
+			if (req.Deletes != nil && len(req.Deletes.TupleKeys) > 0) || (req.Writes != nil && len(req.Writes.TupleKeys) > 0) {
+				err := b.zClient.Write(ctx, req)
+				if err != nil {
+					status = "failure"
+					b.logger.Error("failed to update user basic role in zanzana",
+						"err", err,
+						"namespace", new.Namespace,
+						"userUID", new.Name,
+					)
+				} else {
+					if req.Deletes != nil && len(req.Deletes.TupleKeys) > 0 {
+						hooksTuplesCounter.WithLabelValues("user", "update", "delete").Inc()
+					}
+					if req.Writes != nil && len(req.Writes.TupleKeys) > 0 {
+						hooksTuplesCounter.WithLabelValues("user", "update", "write").Inc()
+					}
+				}
+			} else {
+				b.logger.Debug("no tuples to update in zanzana", "namespace", new.Namespace)
+			}
+		}(oldUser.DeepCopy(), newUser.DeepCopy())
 	}, nil
 }

@@ -184,7 +241,7 @@ func (b *IdentityAccessManagementAPIBuilder) AfterUserDelete(obj runtime.Object,
 	if user.Spec.Role == "" {
 		b.logger.Debug("user had no role assigned, skipping basic role sync",
 			"namespace", user.Namespace,
-			"name", user.Name,
+			"userUID", user.Name,
 		)
 		return
 	}
@@ -193,7 +250,7 @@ func (b *IdentityAccessManagementAPIBuilder) AfterUserDelete(obj runtime.Object,
 	b.zTickets <- true
 	hooksWaitHistogram.WithLabelValues(resourceType, operation).Observe(time.Since(wait).Seconds())

-	go func(namespace, subjectName, role string) {
+	go func(u *iamv0.User) {
 		start := time.Now()
 		status := "success"

@@ -203,36 +260,44 @@ func (b *IdentityAccessManagementAPIBuilder) AfterUserDelete(obj runtime.Object,
 			hooksOperationCounter.WithLabelValues(resourceType, operation, status).Inc()
 		}()

+		tuple := createUserBasicRoleTuple(u.Name, u.Spec.Role)
+		if tuple == nil {
+			b.logger.Warn("failed to create user basic role tuple for deletion",
+				"namespace", u.Namespace,
+				"userUID", u.Name,
+				"role", u.Spec.Role,
+			)
+			status = "failure"
+			return
+		}
+
+		deleteTuple := tupleToTupleKeyWithoutCondition(tuple)
+
 		b.logger.Debug("deleting user basic role from zanzana",
-			"namespace", namespace,
-			"name", subjectName,
-			"role", role,
+			"namespace", u.Namespace,
+			"userUID", u.Name,
+			"role", u.Spec.Role,
 		)

 		ctx, cancel := context.WithTimeout(context.Background(), defaultWriteTimeout)
 		defer cancel()

-		err := b.zClient.Mutate(ctx, &v1.MutateRequest{
-			Namespace: namespace,
-			Operations: []*v1.MutateOperation{
-				{
-					Operation: &v1.MutateOperation_DeleteUserOrgRole{
-						DeleteUserOrgRole: &v1.DeleteUserOrgRoleOperation{User: subjectName, Role: role},
-					},
-				},
+		err := b.zClient.Write(ctx, &v1.WriteRequest{
+			Namespace: u.Namespace,
+			Deletes: &v1.WriteRequestDeletes{
+				TupleKeys: []*v1.TupleKeyWithoutCondition{deleteTuple},
 			},
 		})
-
 		if err != nil {
 			status = "failure"
 			b.logger.Error("failed to delete user basic role from zanzana",
 				"err", err,
-				"namespace", namespace,
-				"name", subjectName,
-				"role", role,
+				"namespace", u.Namespace,
+				"userUID", u.Name,
+				"role", u.Spec.Role,
 			)
 		} else {
 			hooksTuplesCounter.WithLabelValues(resourceType, operation, "delete").Inc()
 		}
-	}(user.Namespace, user.Name, user.Spec.Role)
+	}(user.DeepCopy())
 }
--- a/pkg/registry/apis/iam/user_org_hooks_test.go
+++ b/pkg/registry/apis/iam/user_org_hooks_test.go
@@ -33,22 +33,21 @@ func TestAfterUserCreate(t *testing.T) {
 			},
 		}

-		testAdminRole := func(ctx context.Context, req *v1.MutateRequest) error {
+		testAdminRole := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
+			require.NotNil(t, req.Writes)
+			require.Len(t, req.Writes.TupleKeys, 1)
 			require.Equal(t, "org-1", req.Namespace)
-			require.Len(t, req.Operations, 1)

-			op := req.Operations[0]
-			require.NotNil(t, op)
-			updateOp := op.GetUpdateUserOrgRole()
-			require.NotNil(t, updateOp)
-			require.Equal(t, "df2p421det1q8c", updateOp.User)
-			require.Equal(t, "Admin", updateOp.Role)
+			tuple := req.Writes.TupleKeys[0]
+			require.Equal(t, "user:df2p421det1q8c", tuple.User)
+			require.Equal(t, "assignee", tuple.Relation)
+			require.Equal(t, "role:basic_admin", tuple.Object)
 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testAdminRole}
+		b.zClient = &FakeZanzanaClient{writeCallback: testAdminRole}
 		b.AfterUserCreate(&user, nil)
 		wg.Wait()
 	})
@@ -65,22 +64,21 @@ func TestAfterUserCreate(t *testing.T) {
 			},
 		}

-		testEditorRole := func(ctx context.Context, req *v1.MutateRequest) error {
+		testEditorRole := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
+			require.NotNil(t, req.Writes)
+			require.Len(t, req.Writes.TupleKeys, 1)
 			require.Equal(t, "org-2", req.Namespace)
-			require.Len(t, req.Operations, 1)

-			op := req.Operations[0]
-			require.NotNil(t, op)
-			updateOp := op.GetUpdateUserOrgRole()
-			require.NotNil(t, updateOp)
-			require.Equal(t, "user123", updateOp.User)
-			require.Equal(t, "Editor", updateOp.Role)
+			tuple := req.Writes.TupleKeys[0]
+			require.Equal(t, "user:user123", tuple.User)
+			require.Equal(t, "assignee", tuple.Relation)
+			require.Equal(t, "role:basic_editor", tuple.Object)
 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testEditorRole}
+		b.zClient = &FakeZanzanaClient{writeCallback: testEditorRole}
 		b.AfterUserCreate(&user, nil)
 		wg.Wait()
 	})
@@ -97,22 +95,21 @@ func TestAfterUserCreate(t *testing.T) {
 			},
 		}

-		testViewerRole := func(ctx context.Context, req *v1.MutateRequest) error {
+		testViewerRole := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
+			require.NotNil(t, req.Writes)
+			require.Len(t, req.Writes.TupleKeys, 1)
 			require.Equal(t, "org-3", req.Namespace)
-			require.Len(t, req.Operations, 1)

-			op := req.Operations[0]
-			require.NotNil(t, op)
-			updateOp := op.GetUpdateUserOrgRole()
-			require.NotNil(t, updateOp)
-			require.Equal(t, "viewer456", updateOp.User)
-			require.Equal(t, "Viewer", updateOp.Role)
+			tuple := req.Writes.TupleKeys[0]
+			require.Equal(t, "user:viewer456", tuple.User)
+			require.Equal(t, "assignee", tuple.Relation)
+			require.Equal(t, "role:basic_viewer", tuple.Object)
 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testViewerRole}
+		b.zClient = &FakeZanzanaClient{writeCallback: testViewerRole}
 		b.AfterUserCreate(&user, nil)
 		wg.Wait()
 	})
@@ -187,28 +184,31 @@ func TestBeginUserUpdate(t *testing.T) {
 			},
 		}

-		testRoleChange := func(ctx context.Context, req *v1.MutateRequest) error {
+		testRoleChange := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
 			require.Equal(t, "org-1", req.Namespace)
-			require.Len(t, req.Operations, 2)

-			// First operation should be UpdateUserOrgRole with new role
-			updateOp := req.Operations[0].GetUpdateUserOrgRole()
-			require.NotNil(t, updateOp)
-			require.Equal(t, "testuser", updateOp.User)
-			require.Equal(t, "Admin", updateOp.Role)
+			// Should delete old role
+			require.NotNil(t, req.Deletes)
+			require.Len(t, req.Deletes.TupleKeys, 1)
+			deleteTuple := req.Deletes.TupleKeys[0]
+			require.Equal(t, "user:testuser", deleteTuple.User)
+			require.Equal(t, "assignee", deleteTuple.Relation)
+			require.Equal(t, "role:basic_viewer", deleteTuple.Object)

-			// Second operation should be DeleteUserOrgRole with old role
-			deleteOp := req.Operations[1].GetDeleteUserOrgRole()
-			require.NotNil(t, deleteOp)
-			require.Equal(t, "testuser", deleteOp.User)
-			require.Equal(t, "Viewer", deleteOp.Role)
+			// Should write new role
+			require.NotNil(t, req.Writes)
+			require.Len(t, req.Writes.TupleKeys, 1)
+			writeTuple := req.Writes.TupleKeys[0]
+			require.Equal(t, "user:testuser", writeTuple.User)
+			require.Equal(t, "assignee", writeTuple.Relation)
+			require.Equal(t, "role:basic_admin", writeTuple.Object)

 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testRoleChange}
+		b.zClient = &FakeZanzanaClient{writeCallback: testRoleChange}

 		finishFunc, err := b.BeginUserUpdate(context.Background(), &newUser, &oldUser, nil)
 		require.NoError(t, err)
@@ -218,7 +218,7 @@ func TestBeginUserUpdate(t *testing.T) {
 		wg.Wait()
 	})

-	t.Run("should update role when new role is empty", func(t *testing.T) {
+	t.Run("should delete old role when new role is empty", func(t *testing.T) {
 		wg.Add(1)
 		oldUser := iamv0.User{
 			ObjectMeta: metav1.ObjectMeta{
@@ -240,28 +240,26 @@ func TestBeginUserUpdate(t *testing.T) {
 			},
 		}

-		testRemoveRole := func(ctx context.Context, req *v1.MutateRequest) error {
+		testRemoveRole := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
 			require.Equal(t, "org-2", req.Namespace)
-			require.Len(t, req.Operations, 2)

-			// First operation should be UpdateUserOrgRole with empty role
-			updateOp := req.Operations[0].GetUpdateUserOrgRole()
-			require.NotNil(t, updateOp)
-			require.Equal(t, "testuser2", updateOp.User)
-			require.Equal(t, "", updateOp.Role)
+			// Should delete old role
+			require.NotNil(t, req.Deletes)
+			require.Len(t, req.Deletes.TupleKeys, 1)
+			deleteTuple := req.Deletes.TupleKeys[0]
+			require.Equal(t, "user:testuser2", deleteTuple.User)
+			require.Equal(t, "assignee", deleteTuple.Relation)
+			require.Equal(t, "role:basic_editor", deleteTuple.Object)

-			// Second operation should be DeleteUserOrgRole with old role
-			deleteOp := req.Operations[1].GetDeleteUserOrgRole()
-			require.NotNil(t, deleteOp)
-			require.Equal(t, "testuser2", deleteOp.User)
-			require.Equal(t, "Editor", deleteOp.Role)
+			// Should not write new role
+			require.Nil(t, req.Writes)

 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testRemoveRole}
+		b.zClient = &FakeZanzanaClient{writeCallback: testRemoveRole}

 		finishFunc, err := b.BeginUserUpdate(context.Background(), &newUser, &oldUser, nil)
 		require.NoError(t, err)
@@ -293,28 +291,26 @@ func TestBeginUserUpdate(t *testing.T) {
 			},
 		}

-		testAddRole := func(ctx context.Context, req *v1.MutateRequest) error {
+		testAddRole := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
 			require.Equal(t, "org-3", req.Namespace)
-			require.Len(t, req.Operations, 2)

-			// First operation should be UpdateUserOrgRole with new role
-			updateOp := req.Operations[0].GetUpdateUserOrgRole()
-			require.NotNil(t, updateOp)
-			require.Equal(t, "testuser3", updateOp.User)
-			require.Equal(t, "Admin", updateOp.Role)
+			// Should not delete old role (was empty)
+			require.Nil(t, req.Deletes)

-			// Second operation should be DeleteUserOrgRole with empty old role
-			deleteOp := req.Operations[1].GetDeleteUserOrgRole()
-			require.NotNil(t, deleteOp)
-			require.Equal(t, "testuser3", deleteOp.User)
-			require.Equal(t, "", deleteOp.Role)
+			// Should write new role
+			require.NotNil(t, req.Writes)
+			require.Len(t, req.Writes.TupleKeys, 1)
+			writeTuple := req.Writes.TupleKeys[0]
+			require.Equal(t, "user:testuser3", writeTuple.User)
+			require.Equal(t, "assignee", writeTuple.Relation)
+			require.Equal(t, "role:basic_admin", writeTuple.Object)

 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testAddRole}
+		b.zClient = &FakeZanzanaClient{writeCallback: testAddRole}

 		finishFunc, err := b.BeginUserUpdate(context.Background(), &newUser, &oldUser, nil)
 		require.NoError(t, err)
@@ -372,12 +368,12 @@ func TestBeginUserUpdate(t *testing.T) {
 		}

 		callCount := 0
-		testNoCall := func(ctx context.Context, req *v1.MutateRequest) error {
+		testNoCall := func(ctx context.Context, req *v1.WriteRequest) error {
 			callCount++
 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testNoCall}
+		b.zClient = &FakeZanzanaClient{writeCallback: testNoCall}

 		finishFunc, err := b.BeginUserUpdate(context.Background(), &newUser, &oldUser, nil)
 		require.NoError(t, err)
@@ -441,23 +437,25 @@ func TestAfterUserDelete(t *testing.T) {
 			},
 		}

-		testDeleteAdmin := func(ctx context.Context, req *v1.MutateRequest) error {
+		testDeleteAdmin := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
 			require.Equal(t, "org-1", req.Namespace)
-			require.Len(t, req.Operations, 1)

-			op := req.Operations[0]
-			require.NotNil(t, op)
-			deleteOp := op.GetDeleteUserOrgRole()
-			require.NotNil(t, deleteOp)
-			require.Equal(t, "df2p421det1q8c", deleteOp.User)
-			require.Equal(t, "Admin", deleteOp.Role)
+			// Should have deletes but no writes
+			require.NotNil(t, req.Deletes)
+			require.Len(t, req.Deletes.TupleKeys, 1)
+			require.Nil(t, req.Writes)
+
+			deleteTuple := req.Deletes.TupleKeys[0]
+			require.Equal(t, "user:df2p421det1q8c", deleteTuple.User)
+			require.Equal(t, "assignee", deleteTuple.Relation)
+			require.Equal(t, "role:basic_admin", deleteTuple.Object)

 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testDeleteAdmin}
+		b.zClient = &FakeZanzanaClient{writeCallback: testDeleteAdmin}
 		b.AfterUserDelete(&user, nil)
 		wg.Wait()
 	})
@@ -474,23 +472,22 @@ func TestAfterUserDelete(t *testing.T) {
 			},
 		}

-		testDeleteEditor := func(ctx context.Context, req *v1.MutateRequest) error {
+		testDeleteEditor := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
 			require.Equal(t, "org-2", req.Namespace)
-			require.Len(t, req.Operations, 1)

-			op := req.Operations[0]
-			require.NotNil(t, op)
-			deleteOp := op.GetDeleteUserOrgRole()
-			require.NotNil(t, deleteOp)
-			require.Equal(t, "editor123", deleteOp.User)
-			require.Equal(t, "Editor", deleteOp.Role)
+			require.NotNil(t, req.Deletes)
+			require.Len(t, req.Deletes.TupleKeys, 1)
+			deleteTuple := req.Deletes.TupleKeys[0]
+			require.Equal(t, "user:editor123", deleteTuple.User)
+			require.Equal(t, "assignee", deleteTuple.Relation)
+			require.Equal(t, "role:basic_editor", deleteTuple.Object)

 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testDeleteEditor}
+		b.zClient = &FakeZanzanaClient{writeCallback: testDeleteEditor}
 		b.AfterUserDelete(&user, nil)
 		wg.Wait()
 	})
@@ -507,23 +504,22 @@ func TestAfterUserDelete(t *testing.T) {
 			},
 		}

-		testDeleteViewer := func(ctx context.Context, req *v1.MutateRequest) error {
+		testDeleteViewer := func(ctx context.Context, req *v1.WriteRequest) error {
 			defer wg.Done()
 			require.NotNil(t, req)
 			require.Equal(t, "org-3", req.Namespace)
-			require.Len(t, req.Operations, 1)

-			op := req.Operations[0]
-			require.NotNil(t, op)
-			deleteOp := op.GetDeleteUserOrgRole()
-			require.NotNil(t, deleteOp)
-			require.Equal(t, "viewer456", deleteOp.User)
-			require.Equal(t, "Viewer", deleteOp.Role)
+			require.NotNil(t, req.Deletes)
+			require.Len(t, req.Deletes.TupleKeys, 1)
+			deleteTuple := req.Deletes.TupleKeys[0]
+			require.Equal(t, "user:viewer456", deleteTuple.User)
+			require.Equal(t, "assignee", deleteTuple.Relation)
+			require.Equal(t, "role:basic_viewer", deleteTuple.Object)

 			return nil
 		}

-		b.zClient = &FakeZanzanaClient{mutateCallback: testDeleteViewer}
+		b.zClient = &FakeZanzanaClient{writeCallback: testDeleteViewer}
 		b.AfterUserDelete(&user, nil)
 		wg.Wait()
 	})
@@ -567,3 +563,47 @@ func TestAfterUserDelete(t *testing.T) {
 		// If we get here without panic, the test passes
 	})
 }
+
+func TestCreateUserBasicRoleTuple(t *testing.T) {
+	t.Run("should create tuple for Admin role", func(t *testing.T) {
+		tuple := createUserBasicRoleTuple("user123", "Admin")
+		require.NotNil(t, tuple)
+		require.Equal(t, "user:user123", tuple.User)
+		require.Equal(t, "assignee", tuple.Relation)
+		require.Equal(t, "role:basic_admin", tuple.Object)
+	})
+
+	t.Run("should create tuple for Editor role", func(t *testing.T) {
+		tuple := createUserBasicRoleTuple("user456", "Editor")
+		require.NotNil(t, tuple)
+		require.Equal(t, "user:user456", tuple.User)
+		require.Equal(t, "assignee", tuple.Relation)
+		require.Equal(t, "role:basic_editor", tuple.Object)
+	})
+
+	t.Run("should create tuple for Viewer role", func(t *testing.T) {
+		tuple := createUserBasicRoleTuple("user789", "Viewer")
+		require.NotNil(t, tuple)
+		require.Equal(t, "user:user789", tuple.User)
+		require.Equal(t, "assignee", tuple.Relation)
+		require.Equal(t, "role:basic_viewer", tuple.Object)
+	})
+
+	t.Run("should create tuple for None role", func(t *testing.T) {
+		tuple := createUserBasicRoleTuple("user000", "None")
+		require.NotNil(t, tuple)
+		require.Equal(t, "user:user000", tuple.User)
+		require.Equal(t, "assignee", tuple.Relation)
+		require.Equal(t, "role:basic_none", tuple.Object)
+	})
+
+	t.Run("should return nil for empty role", func(t *testing.T) {
+		tuple := createUserBasicRoleTuple("user123", "")
+		require.Nil(t, tuple)
+	})
+
+	t.Run("should return nil for invalid role", func(t *testing.T) {
+		tuple := createUserBasicRoleTuple("user123", "InvalidRole")
+		require.Nil(t, tuple)
+	})
+}
--- a/pkg/registry/apis/provisioning/controller/repository.go
+++ b/pkg/registry/apis/provisioning/controller/repository.go
@@ -404,47 +404,32 @@ func (rc *RepositoryController) addSyncJob(ctx context.Context, obj *provisionin
 	return nil
 }

-func (rc *RepositoryController) determineSyncStatusOps(obj *provisioning.Repository, syncOptions *provisioning.SyncJobOptions, healthStatus provisioning.HealthStatus) []map[string]interface{} {
+func (rc *RepositoryController) determineSyncStatus(obj *provisioning.Repository, syncOptions *provisioning.SyncJobOptions, healthStatus provisioning.HealthStatus) *provisioning.SyncStatus {
 	const unhealthyMessage = "Repository is unhealthy"

 	hasUnhealthyMessage := len(obj.Status.Sync.Message) > 0 && obj.Status.Sync.Message[0] == unhealthyMessage
-	var patchOperations []map[string]interface{}
-
 	switch {
 	case syncOptions != nil:
-		// We will try to trigger a new sync job if we have sync options
-		patchOperations = append(patchOperations, map[string]interface{}{
-			"op":    "replace",
-			"path":  "/status/sync/state",
-			"value": provisioning.JobStatePending,
-		})
-		patchOperations = append(patchOperations, map[string]interface{}{
-			"op":    "replace",
-			"path":  "/status/sync/started",
-			"value": int64(0),
-		})
+		return &provisioning.SyncStatus{
+			State:   provisioning.JobStatePending,
+			LastRef: obj.Status.Sync.LastRef,
+			Started: time.Now().UnixMilli(),
+		}
 	case healthStatus.Healthy && hasUnhealthyMessage: // if the repository is healthy and the message is set, clear it
 		// FIXME: is this the clearest way to do this? Should we introduce another status or way of way of handling more
 		// specific errors?
-		patchOperations = append(patchOperations, map[string]interface{}{
-			"op":    "replace",
-			"path":  "/status/sync/message",
-			"value": []string{},
-		})
+		return &provisioning.SyncStatus{
+			LastRef: obj.Status.Sync.LastRef,
+		}
 	case !healthStatus.Healthy && !hasUnhealthyMessage: // if the repository is unhealthy and the message is not already set, set it
-		patchOperations = append(patchOperations, map[string]interface{}{
-			"op":    "replace",
-			"path":  "/status/sync/state",
-			"value": provisioning.JobStateError,
-		})
-		patchOperations = append(patchOperations, map[string]interface{}{
-			"op":    "replace",
-			"path":  "/status/sync/message",
-			"value": []string{unhealthyMessage},
-		})
+		return &provisioning.SyncStatus{
+			State:   provisioning.JobStateError,
+			Message: []string{unhealthyMessage},
+			LastRef: obj.Status.Sync.LastRef,
+		}
+	default:
+		return nil
 	}
-
-	return patchOperations
 }

 //nolint:gocyclo
@@ -524,7 +509,13 @@ func (rc *RepositoryController) process(item *queueItem) error {

 	// determine the sync strategy and sync status to apply
 	syncOptions := rc.determineSyncStrategy(ctx, obj, repo, shouldResync, healthStatus)
-	patchOperations = append(patchOperations, rc.determineSyncStatusOps(obj, syncOptions, healthStatus)...)
+	if syncStatus := rc.determineSyncStatus(obj, syncOptions, healthStatus); syncStatus != nil {
+		patchOperations = append(patchOperations, map[string]interface{}{
+			"op":    "replace",
+			"path":  "/status/sync",
+			"value": syncStatus,
+		})
+	}

 	// Apply all patch operations
 	if len(patchOperations) > 0 {
@@ -534,8 +525,6 @@ func (rc *RepositoryController) process(item *queueItem) error {
 		}
 	}

-	// QUESTION: should we trigger the sync job after we have applied all patch operations or before?
-	// Is there are risk of race condition here?
 	// Trigger sync job after we have applied all patch operations
 	if syncOptions != nil {
 		if err := rc.addSyncJob(ctx, obj, syncOptions); err != nil {
--- a/pkg/registry/apis/provisioning/jobs.go
+++ b/pkg/registry/apis/provisioning/jobs.go
@@ -132,36 +132,28 @@ func (c *jobsConnector) Connect(
 		}
 		spec.Repository = name

-		job, err := c.jobs.GetJobQueue().Insert(ctx, cfg.Namespace, spec)
-		if err != nil {
-			responder.Error(err)
-			return
-		}
-
-		// For pull jobs update the sync status
-		// patch the sync status 'state' to 'pending', and reset the 'started' field, leaving other fields unchanged.
-		// Intentionally maintain the previous job name until the jobs is picked up.
+		// If a sync job is being created, we should update its status to pending.
 		if spec.Pull != nil {
-			err = c.statusPatcherProvider.GetStatusPatcher().Patch(ctx, cfg,
-				map[string]interface{}{
-					"op":    "replace",
-					"path":  "/status/sync/state",
-					"value": provisioning.JobStatePending,
+			err = c.statusPatcherProvider.GetStatusPatcher().Patch(ctx, cfg, map[string]interface{}{
+				"op":   "replace",
+				"path": "/status/sync",
+				"value": &provisioning.SyncStatus{
+					State:   provisioning.JobStatePending,
+					LastRef: cfg.Status.Sync.LastRef,
+					Started: time.Now().UnixMilli(),
 				},
-				map[string]interface{}{
-					// Use "replace" instead of "remove" since "remove" fails if the path does not exist (RFC 6902).
-					// "started" field uses "omitempty", so it may be missing in the JSON.
-					"op":    "replace",
-					"path":  "/status/sync/started",
-					"value": int64(0),
-				},
-			)
+			})
 			if err != nil {
 				responder.Error(err)
 				return
 			}
 		}

+		job, err := c.jobs.GetJobQueue().Insert(ctx, cfg.Namespace, spec)
+		if err != nil {
+			responder.Error(err)
+			return
+		}
 		responder.Object(http.StatusAccepted, job)
 	}), 30*time.Second), nil
 }
--- a/pkg/registry/apis/provisioning/jobs/sync/worker.go
+++ b/pkg/registry/apis/provisioning/jobs/sync/worker.go
@@ -110,35 +110,25 @@ func (r *SyncWorker) Process(ctx context.Context, repo repository.Repository, jo
 	}

 	syncStatus := job.Status.ToSyncStatus(job.Name)
-	// Preserve last ref
+	// Preserve last ref as we use replace operation
 	lastRef := repo.Config().Status.Sync.LastRef
 	syncStatus.LastRef = lastRef

-	// Ensure the sync state is set to 'working' if not already set or still pending.
-	// FIXME: This should not be needed as the progress recorder should have set it to 'working' by now.
-	syncStatus.State = provisioning.JobStateWorking
+	if syncStatus.State == "" {
+		syncStatus.State = provisioning.JobStateWorking
+	}

-	// Update sync status at start using granular JSON patch operations
-	// Only patch fields that are actually being set to avoid overwriting with zero values
+	// Update sync status at start using JSON patch
 	patchOperations := []map[string]interface{}{
 		{
 			"op":    "replace",
-			"path":  "/status/sync/state",
-			"value": syncStatus.State,
-		},
-		{
-			"op":    "replace",
-			"path":  "/status/sync/job",
-			"value": syncStatus.JobID,
-		},
-		{
-			"op":    "replace",
-			"path":  "/status/sync/started",
-			"value": syncStatus.Started,
+			"path":  "/status/sync",
+			"value": syncStatus,
 		},
 	}

 	progress.SetMessage(ctx, "update sync status at start")
+
 	statusCtx, statusSpan := r.tracer.Start(ctx, "provisioning.sync.update_start_status")
 	if err := r.patchStatus(statusCtx, cfg, patchOperations...); err != nil {
 		statusSpan.End()
@@ -184,13 +174,14 @@ func (r *SyncWorker) Process(ctx context.Context, repo repository.Repository, jo
 	}
 	syncSpan.End()

-	if syncStatus.State != provisioning.JobStateError {
+	// Create sync status and set hash if successful
+	if syncStatus.State == provisioning.JobStateSuccess {
 		syncStatus.LastRef = currentRef
 	} else {
-		// Preserve the original lastRef on error
 		syncStatus.LastRef = lastRef
 	}

+	// Update final status using JSON patch
 	progress.SetMessage(ctx, "update status and stats")
 	patchOperations = []map[string]interface{}{
 		{
--- a/pkg/registry/apis/provisioning/jobs/sync/worker_test.go
+++ b/pkg/registry/apis/provisioning/jobs/sync/worker_test.go
@@ -115,18 +115,17 @@ func TestSyncWorker_Process(t *testing.T) {
 				rw.MockRepository.On("Config").Return(repoConfig)
 				pr.On("SetMessage", mock.Anything, "update sync status at start").Return()

-				// Expect granular patches for state, job, and started fields
-				rpf.On("Execute", mock.Anything, repoConfig,
-					mock.MatchedBy(func(patch map[string]interface{}) bool {
-						return patch["op"] == "replace" && patch["path"] == "/status/sync/state"
-					}),
-					mock.MatchedBy(func(patch map[string]interface{}) bool {
-						return patch["op"] == "replace" && patch["path"] == "/status/sync/job"
-					}),
-					mock.MatchedBy(func(patch map[string]interface{}) bool {
-						return patch["op"] == "replace" && patch["path"] == "/status/sync/started"
-					}),
-				).Return(errors.New("failed to patch status"))
+				rpf.On("Execute", mock.Anything, repoConfig, mock.MatchedBy(func(patch map[string]interface{}) bool {
+					if patch["op"] != "replace" || patch["path"] != "/status/sync" {
+						return false
+					}
+
+					if patch["value"].(provisioning.SyncStatus).LastRef != "existing-ref" || patch["value"].(provisioning.SyncStatus).JobID != "test-job" {
+						return false
+					}
+
+					return true
+				})).Return(errors.New("failed to patch status"))
 			},
 			expectedError: "update repo with job status at start: failed to patch status",
 		},
@@ -152,9 +151,9 @@ func TestSyncWorker_Process(t *testing.T) {
 				// Storage is migrated
 				ds.On("ReadFromUnified", mock.Anything, mock.Anything).Return(true, nil).Twice()

-				// Initial status update succeeds - expect granular patches
+				// Initial status update succeeds
 				pr.On("SetMessage", mock.Anything, "update sync status at start").Return()
-				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything).Return(nil).Once()

 				// Repository resources creation fails
 				rrf.On("Client", mock.Anything, mock.Anything).Return(nil, errors.New("failed to create repository resources client"))
@@ -189,9 +188,9 @@ func TestSyncWorker_Process(t *testing.T) {
 				// Storage is migrated
 				ds.On("ReadFromUnified", mock.Anything, mock.Anything).Return(true, nil).Twice()

-				// Initial status update succeeds - expect granular patches
+				// Initial status update succeeds
 				pr.On("SetMessage", mock.Anything, "update sync status at start").Return()
-				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything).Return(nil).Once()

 				// Repository resources creation succeeds
 				rrf.On("Client", mock.Anything, mock.Anything).Return(&resources.MockRepositoryResources{}, nil)
@@ -225,9 +224,9 @@ func TestSyncWorker_Process(t *testing.T) {
 				// Storage is migrated
 				ds.On("ReadFromUnified", mock.Anything, mock.Anything).Return(true, nil).Twice()

-				// Initial status update - expect granular patches
+				// Initial status update
 				pr.On("SetMessage", mock.Anything, "update sync status at start").Return()
-				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything).Return(nil)

 				// Setup resources and clients
 				mockRepoResources := resources.NewMockRepositoryResources(t)
@@ -255,7 +254,7 @@ func TestSyncWorker_Process(t *testing.T) {
 					}
 					syncStatus := patch["value"].(provisioning.SyncStatus)
 					return syncStatus.LastRef == "new-ref" && syncStatus.State == provisioning.JobStateSuccess
-				})).Return(nil).Once()
+				})).Return(nil)
 			},
 			expectedError: "",
 		},
@@ -278,9 +277,9 @@ func TestSyncWorker_Process(t *testing.T) {
 				// Storage is migrated
 				ds.On("ReadFromUnified", mock.Anything, mock.Anything).Return(true, nil).Twice()

-				// Initial status update - expect granular patches
+				// Initial status update
 				pr.On("SetMessage", mock.Anything, "update sync status at start").Return()
-				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+				rpf.On("Execute", mock.Anything, repoConfig, mock.Anything).Return(nil)

 				// Setup resources and clients
 				mockRepoResources := resources.NewMockRepositoryResources(t)
@@ -309,7 +308,7 @@ func TestSyncWorker_Process(t *testing.T) {
 						patch["path"] == "/status/sync" &&
 						syncStatus.LastRef == "existing-ref" && // LastRef should not change on failure
 						syncStatus.State == provisioning.JobStateError
-				})).Return(nil).Once()
+				})).Return(nil)
 			},
 			expectedError: "sync operation failed",
 		},
@@ -335,9 +334,7 @@ func TestSyncWorker_Process(t *testing.T) {
 				pr.On("SetMessage", mock.Anything, mock.Anything).Return()
 				pr.On("StrictMaxErrors", 20).Return()
 				pr.On("Complete", mock.Anything, mock.Anything).Return(provisioning.JobStatus{State: provisioning.JobStateSuccess})
-				// Initial patch with granular updates, final patch with full sync status
-				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
-				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything).Return(nil)
 				s.On("Sync", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return("new-ref", nil)
 			},
 			expectedError: "",
@@ -358,13 +355,10 @@ func TestSyncWorker_Process(t *testing.T) {
 				mockRepoResources.On("Stats", mock.Anything).Return(nil, nil)
 				rrf.On("Client", mock.Anything, mock.Anything).Return(mockRepoResources, nil)

-				// Initial patch with granular updates
-				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
-
-				// Verify only sync status is patched for final update
+				// Verify only sync status is patched
 				rpf.On("Execute", mock.Anything, mock.Anything, mock.MatchedBy(func(patch map[string]interface{}) bool {
 					return patch["path"] == "/status/sync"
-				})).Return(nil).Once()
+				})).Return(nil)

 				// Simple mocks for other calls
 				mockClients := resources.NewMockResourceClients(t)
@@ -387,8 +381,7 @@ func TestSyncWorker_Process(t *testing.T) {
 				}
 				rw.MockRepository.On("Config").Return(repoConfig)
 				ds.On("ReadFromUnified", mock.Anything, mock.Anything).Return(true, nil).Twice()
-				// Initial patch with granular updates
-				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()

 				mockRepoResources := resources.NewMockRepositoryResources(t)
 				stats := &provisioning.ResourceStats{
@@ -475,13 +468,10 @@ func TestSyncWorker_Process(t *testing.T) {
 				mockRepoResources.On("Stats", mock.Anything).Return(stats, nil)
 				rrf.On("Client", mock.Anything, mock.Anything).Return(mockRepoResources, nil)

-				// Initial patch with granular updates
-				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
-
 				// Verify only sync status is patched (multiple stats should be ignored)
 				rpf.On("Execute", mock.Anything, mock.Anything, mock.MatchedBy(func(patch map[string]interface{}) bool {
 					return patch["path"] == "/status/sync"
-				})).Return(nil).Once()
+				})).Return(nil)

 				// Simple mocks for other calls
 				mockClients := resources.NewMockResourceClients(t)
@@ -505,8 +495,8 @@ func TestSyncWorker_Process(t *testing.T) {
 				rw.MockRepository.On("Config").Return(repoConfig)
 				ds.On("ReadFromUnified", mock.Anything, mock.Anything).Return(true, nil).Twice()

-				// Initial status patch succeeds - expect granular patches
-				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()
+				// Initial status patch succeeds
+				rpf.On("Execute", mock.Anything, mock.Anything, mock.Anything).Return(nil).Once()

 				// Setup resources and clients
 				mockRepoResources := resources.NewMockRepositoryResources(t)
--- a/pkg/registry/apis/provisioning/register.go
+++ b/pkg/registry/apis/provisioning/register.go
@@ -35,7 +35,6 @@ import (
 	clientset "github.com/grafana/grafana/apps/provisioning/pkg/generated/clientset/versioned"
 	client "github.com/grafana/grafana/apps/provisioning/pkg/generated/clientset/versioned/typed/provisioning/v0alpha1"
 	informers "github.com/grafana/grafana/apps/provisioning/pkg/generated/informers/externalversions"
-	jobsvalidation "github.com/grafana/grafana/apps/provisioning/pkg/jobs"
 	"github.com/grafana/grafana/apps/provisioning/pkg/loki"
 	"github.com/grafana/grafana/apps/provisioning/pkg/repository"
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
@@ -577,10 +576,10 @@ func (b *APIBuilder) Validate(ctx context.Context, a admission.Attributes, o adm
 		return nil
 	}

-	// Validate Jobs
-	job, ok := obj.(*provisioning.Job)
+	// FIXME: Do nothing for Jobs for now
+	_, ok = obj.(*provisioning.Job)
 	if ok {
-		return jobsvalidation.ValidateJob(job)
+		return nil
 	}

 	repo, err := b.asRepository(ctx, obj, a.GetOldObject())
--- a/pkg/registry/apps/alerting/rules/alertrule/compat.go
+++ b/pkg/registry/apps/alerting/rules/alertrule/compat.go
@@ -128,10 +128,6 @@ func convertToK8sResource(
 		return nil, fmt.Errorf("failed to get metadata: %w", err)
 	}
 	meta.SetFolder(rule.NamespaceUID)
-	// Keep metadata label in sync with folder annotation for downstream consumers
-	if rule.NamespaceUID != "" {
-		k8sRule.Labels[model.FolderLabelKey] = rule.NamespaceUID
-	}
 	if rule.UpdatedBy != nil {
 		meta.SetUpdatedBy(string(*rule.UpdatedBy))
 		k8sRule.SetUpdatedBy(string(*rule.UpdatedBy))
--- a/pkg/registry/apps/alerting/rules/recordingrule/compat.go
+++ b/pkg/registry/apps/alerting/rules/recordingrule/compat.go
@@ -76,10 +76,6 @@ func convertToK8sResource(
 		return nil, fmt.Errorf("failed to get metadata: %w", err)
 	}
 	meta.SetFolder(rule.NamespaceUID)
-	// Keep metadata label in sync with folder annotation for downstream consumers
-	if rule.NamespaceUID != "" {
-		k8sRule.Labels[model.FolderLabelKey] = rule.NamespaceUID
-	}
 	if rule.UpdatedBy != nil {
 		meta.SetUpdatedBy(string(*rule.UpdatedBy))
 		k8sRule.SetUpdatedBy(string(*rule.UpdatedBy))
--- a/Show More
+++ b/Show More