[release-12.3.0] Docs: What's new and Upgrade guide v12.3 (#114129 )

[release-12.3.0] Docs: Add secrets management beta API docs #114114 (#114116 )
Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com> Co-authored-by: Anna Urbiztondo <anna.urbiztondo@grafana.com>
2025-12-23 05:04:29 +08:00 · 2025-11-18 21:01:26 -06:00 · 2025-11-18 17:54:24 +00:00 · 2025-11-18 11:39:02 +01:00 · 2025-11-17 17:26:10 +01:00 · 2025-11-16 19:06:56 +00:00
629 changed files with 13825 additions and 27844 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,6 +1 @@
 * text=auto eol=lf
-*.gen.ts linguist-generated
-*_gen.ts linguist-generated
-*_gen.go linguist-generated
-**/openapi_snapshots/*.json linguist-generated
-apps/**/pkg/apis/*_manifest.go linguist-generated
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -41,12 +41,14 @@
 /docs/sources/                                                                    @irenerl24

 /docs/sources/alerting/                                                           @JohnnyK-Grafana
+/docs/sources/as-code/                                                            @urbiz-grafana
+/docs/sources/developer-resources/                                                @urbiz-grafana
 /docs/sources/datasources/                                                        @lwandz13
 /docs/sources/upgrade-guide/                                                      @jtvdez
 /docs/sources/whatsnew/                                                           @jtvdez


-/docs/sources/developers/plugins/                                                 @grafana/plugins-platform-frontend @grafana/plugins-platform-backend
+/docs/sources/developer-resources/plugins/                                        @grafana/plugins-platform-frontend @grafana/plugins-platform-backend
 /docs/sources/visualizations/dashboards/                                          @imatwawana
 /docs/sources/visualizations/panels-visualizations/                               @imatwawana

@@ -98,7 +100,6 @@
 /apps/correlations @grafana/datapro
 /apps/example/ @grafana/grafana-app-platform-squad
 /apps/logsdrilldown/ @grafana/observability-logs
-/apps/annotation/ @grafana/grafana-backend-services-squad
 /pkg/api/ @grafana/grafana-backend-group
 /pkg/apis/ @grafana/grafana-app-platform-squad
 /pkg/apis/query @grafana/grafana-datasources-core-services
@@ -152,7 +153,7 @@
 /pkg/promlib @grafana/oss-big-tent
 /pkg/storage/ @grafana/grafana-search-and-storage
 /pkg/storage/secret/ @grafana/grafana-operator-experience-squad
-/pkg/services/annotations/ @grafana/grafana-backend-services-squad
+/pkg/services/annotations/ @grafana/grafana-search-and-storage
 /pkg/services/apikey/ @grafana/identity-squad
 /pkg/services/cleanup/ @grafana/grafana-backend-group
 /pkg/services/contexthandler/ @grafana/grafana-backend-group @grafana/grafana-app-platform-squad
@@ -182,7 +183,7 @@
 /pkg/services/search/ @grafana/grafana-search-and-storage
 /pkg/services/searchusers/ @grafana/grafana-search-and-storage
 /pkg/services/secrets/ @grafana/grafana-operator-experience-squad
-/pkg/services/shorturls/ @grafana/sharing-squad
+/pkg/services/shorturls/ @grafana/grafana-backend-group
 /pkg/services/sqlstore/ @grafana/grafana-search-and-storage
 /pkg/services/ssosettings/ @grafana/identity-squad
 /pkg/services/star/ @grafana/grafana-search-and-storage
@@ -200,7 +201,6 @@
 /pkg/tests/apis/features @grafana/grafana-backend-services-squad
 /pkg/tests/apis/folder @grafana/grafana-search-and-storage
 /pkg/tests/apis/iam @grafana/identity-access-team
-/pkg/tests/apis/shorturl @grafana/sharing-squad
 /pkg/tests/api/correlations/ @grafana/datapro
 /pkg/tsdb/grafanads/ @grafana/grafana-backend-group
 /pkg/tsdb/opentsdb/ @grafana/partner-datasources
@@ -227,7 +227,6 @@
 /devenv/datasources.yaml @grafana/grafana-backend-group
 /devenv/datasources_docker.yaml @grafana/grafana-backend-group
 /devenv/dev-dashboards-without-uid/ @grafana/dashboards-squad
-/devenv/scopes/ @grafana/grafana-operator-experience-squad

 /devenv/dev-dashboards/annotations @grafana/dataviz-squad
 /devenv/dev-dashboards/migrations @grafana/dataviz-squad
@@ -244,7 +243,6 @@
 /devenv/dev-dashboards/panel-library @grafana/dataviz-squad
 /devenv/dev-dashboards/panel-piechart @grafana/dataviz-squad
 /devenv/dev-dashboards/panel-stat @grafana/dataviz-squad
-/devenv/dev-dashboards/panel-status-history @grafana/dataviz-squad
 /devenv/dev-dashboards/panel-table @grafana/dataviz-squad
 /devenv/dev-dashboards/panel-timeline @grafana/dataviz-squad
 /devenv/dev-dashboards/panel-timeseries @grafana/dataviz-squad
@@ -254,6 +252,7 @@
 /devenv/dev-dashboards/all-panels.json @grafana/dataviz-squad
 /devenv/dev-dashboards/dashboards.go @grafana/dataviz-squad
 /devenv/dev-dashboards/home.json @grafana/dataviz-squad
+
 /devenv/dev-dashboards/datasource-elasticsearch/ @grafana/partner-datasources
 /devenv/dev-dashboards/datasource-opentsdb/ @grafana/partner-datasources
 /devenv/dev-dashboards/datasource-influxdb/ @grafana/partner-datasources
@@ -475,12 +474,24 @@ i18next.config.ts @grafana/grafana-frontend-platform
 /e2e-playwright/fixtures/long-trace-response.json @grafana/observability-traces-and-profiling
 /e2e-playwright/fixtures/tempo-response.json @grafana/oss-big-tent
 /e2e-playwright/fixtures/prometheus-response.json @grafana/datapro
-/e2e-playwright/panels-suite/ @grafana/dataviz-squad
+/e2e-playwright/panels-suite/canvas-scene.spec.ts @grafana/dataviz-squad
 /e2e-playwright/panels-suite/dashlist.spec.ts @grafana/grafana-search-navigate-organise
+/e2e-playwright/panels-suite/datagrid-data-change.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/datagrid-editing-features.spec.ts @grafana/dataviz-squad
 /e2e-playwright/panels-suite/frontend-sandbox-panel.spec.ts @grafana/plugins-platform-frontend
+/e2e-playwright/panels-suite/geomap-layer-types.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/geomap-map-controls.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/geomap-spatial-operations-transform.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/heatmap.spec.ts @grafana/dataviz-squad
 /e2e-playwright/panels-suite/panelEdit_base.spec.ts @grafana/dashboards-squad
 /e2e-playwright/panels-suite/panelEdit_queries.spec.ts @grafana/dashboards-squad
 /e2e-playwright/panels-suite/panelEdit_transforms.spec.ts @grafana/datapro
+/e2e-playwright/panels-suite/state-timeline.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/table-footer.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/table-kitchenSink.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/table-markdown.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/table-sparkline.spec.ts @grafana/dataviz-squad
+/e2e-playwright/panels-suite/table-utils.ts @grafana/dataviz-squad
 /e2e-playwright/plugin-e2e/ @grafana/oss-big-tent @grafana/partner-datasources
 /e2e-playwright/plugin-e2e/plugin-e2e-api-tests/ @grafana/plugins-platform-frontend
 /e2e-playwright/smoke-tests-suite/ @grafana/grafana-frontend-platform
@@ -549,7 +560,6 @@ i18next.config.ts @grafana/grafana-frontend-platform
 /packages/grafana-data/src/geo/ @grafana/dataviz-squad
 /packages/grafana-data/src/monaco/ @grafana/partner-datasources
 /packages/grafana-data/src/panel/ @grafana/dashboards-squad
-/packages/grafana-data/src/panel/suggestions/ @grafana/dataviz-squad
 /packages/grafana-data/src/query/ @grafana/grafana-datasources-core-services
 /packages/grafana-data/src/rbac/ @grafana/access-squad
 /packages/grafana-data/src/table/ @grafana/dataviz-squad
@@ -1168,7 +1178,6 @@ embed.go @grafana/grafana-as-code
 /pkg/registry/ @grafana/grafana-as-code
 /pkg/registry/apis/ @grafana/grafana-app-platform-squad
 /pkg/registry/apis/folders @grafana/grafana-search-and-storage
-/pkg/registry/apis/datasource @grafana/grafana-datasources-core-services
 /pkg/registry/apis/query @grafana/grafana-datasources-core-services
 /pkg/registry/apis/secret @grafana/grafana-operator-experience-squad
 /pkg/registry/apis/userstorage @grafana/grafana-app-platform-squad @grafana/plugins-platform-backend
--- a/.github/actions/change-detection/action.yml
+++ b/.github/actions/change-detection/action.yml
@@ -31,9 +31,6 @@ outputs:
  dockerfile:
    description: Whether the dockerfile or self have changed in any way
    value: ${{ steps.changed-files.outputs.dockerfile_any_changed || 'true' }}
-  devenv:
-    description: Whether the devenv or self have changed in any way
-    value: ${{ steps.changed-files.outputs.devenv_any_changed || 'true' }}
 runs:
  using: composite
  steps:
@@ -139,9 +136,6 @@ runs:
            - '.vale.ini'
            - '.github/actions/change-detection/**'
            - '${{ inputs.self }}'
-          devenv:
-            - 'devenv/**'
-            - '${{ inputs.self }}'
    - name: Print all change groups
      shell: bash
      run: |
@@ -163,5 +157,3 @@ runs:
        echo " --> ${{ steps.changed-files.outputs.docs_all_changed_files }}"
        echo "Dockerfile: ${{ steps.changed-files.outputs.dockerfile_any_changed || 'true' }}"
        echo " --> ${{ steps.changed-files.outputs.dockerfile_all_changed_files }}"
-        echo "devenv: ${{ steps.changed-files.outputs.devenv_any_changed || 'true' }}"
-        echo " --> ${{ steps.changed-files.outputs.devenv_all_changed_files }}"
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -1,6 +1,6 @@
 {
  extends: ["config:recommended"],
-  enabledManagers: ["npm", "docker-compose"],
+  enabledManagers: ["npm"],
  ignorePresets: [
    "github>grafana/grafana-renovate-config//presets/labels",
  ],
@@ -26,7 +26,7 @@
    "@types/slate-react", // we don't want to continue using this on the long run, use Monaco editor instead of Slate
    "@types/slate", // we don't want to continue using this on the long run, use Monaco editor instead of Slate
  ],
-  includePaths: ["package.json", "packages/**", "public/app/plugins/**", "devenv/frontend-service/docker-compose.yaml"],
+  includePaths: ["package.json", "packages/**", "public/app/plugins/**"],
  ignorePaths: ["emails/**", "**/mocks/**"],
  labels: ["area/frontend", "dependencies", "no-changelog"],
  postUpdateOptions: ["yarnDedupeHighest"],
--- a/.github/workflows/backend-code-checks.yml
+++ b/.github/workflows/backend-code-checks.yml
@@ -79,7 +79,7 @@ jobs:
          make swagger-clean && make openapi3-gen

          # Check if the generated specs differ from what's in the repository
-          for f in public/api-merged.json public/openapi3.json public/api-enterprise-spec.json; do git add $f; done
+          for f in public/api-merged.json public/openapi3.json; do git add $f; done
          if [ -z "$(git diff --name-only --cached)" ]; then
            echo "OpenAPI specs are up to date!"
          else
--- a/.github/workflows/backport-trigger.yml
+++ b/.github/workflows/backport-trigger.yml
@@ -40,7 +40,7 @@ jobs:
          }' "$GITHUB_EVENT_PATH" > /tmp/pr_info.json

      - name: Upload artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: pr_info
          path: /tmp/pr_info.json
--- a/.github/workflows/core-plugins-build-and-release.yml
+++ b/.github/workflows/core-plugins-build-and-release.yml
@@ -193,7 +193,7 @@ jobs:
            exit 1
          fi
      - name: store build artifacts
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: build-artifacts
          path: ${{ steps.get_dir.outputs.dir }}/ci/packages/*.zip
--- a/.github/workflows/detect-breaking-changes-levitate.yml
+++ b/.github/workflows/detect-breaking-changes-levitate.yml
@@ -64,7 +64,7 @@ jobs:
        run: zip -r ./pr_built_packages.zip ./packages/**/*.tgz

      - name: Upload build output as artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: buildPr
          path: './pr/pr_built_packages.zip'
@@ -116,7 +116,7 @@ jobs:
        run: zip -r ./base_built_packages.zip ./packages/**/*.tgz

      - name: Upload build output as artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: buildBase
          path: './base/base_built_packages.zip'
@@ -189,7 +189,7 @@ jobs:
          PR_NUMBER: ${{ github.event.pull_request.number }}

      - name: Upload check output as artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: levitate
          path: levitate/
--- a/.github/workflows/pr-e2e-tests.yml
+++ b/.github/workflows/pr-e2e-tests.yml
@@ -94,14 +94,14 @@ jobs:
        id: artifact

      - name: Upload grafana.tar.gz
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          retention-days: 1
          name: grafana-tar-gz
          path: build-dir/grafana.tar.gz

      - name: Upload grafana docker tarball
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          retention-days: 1
          name: grafana-docker-tar-gz
@@ -133,7 +133,7 @@ jobs:
          # We want a static binary, so we need to set CGO_ENABLED=0
          CGO_ENABLED=0 go build -o ./e2e-runner ./e2e/
          echo "artifact=e2e-runner-${{github.run_number}}" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v4
        id: upload
        with:
          retention-days: 1
@@ -245,7 +245,7 @@ jobs:
        run: |
          set -euo pipefail
          echo "suite=$(echo "$SUITE" | sed 's/\//-/g')" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: ${{ steps.set-suite-name.outputs.suite }}-${{ github.run_number }}
@@ -307,7 +307,7 @@ jobs:
          version: 0.18.8
          verb: run
          args: go run ./pkg/build/e2e-playwright --package=grafana.tar.gz --shard=${{ matrix.shard }}/${{ matrix.shardTotal }} --blob-dir=./blob-report
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: playwright-blob-${{ github.run_number }}-${{ matrix.shard }}
@@ -439,7 +439,7 @@ jobs:

      - name: Upload HTML report
        id: upload-html
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: playwright-html-${{ github.run_number }}
          path: playwright-report
@@ -498,7 +498,7 @@ jobs:
          args: go run ./pkg/build/a11y --package=grafana.tar.gz --no-threshold-fail --results=./pa11y-ci-results.json
      - name: Upload pa11y results
        if: github.event_name != 'pull_request'
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          retention-days: 1
          name: pa11y-ci-results
--- a/.github/workflows/pr-frontend-unit-tests.yml
+++ b/.github/workflows/pr-frontend-unit-tests.yml
@@ -18,7 +18,6 @@ jobs:
      contents: read
    outputs:
      changed: ${{ steps.detect-changes.outputs.frontend }}
-      devenv-changed: ${{ steps.detect-changes.outputs.devenv }}
    steps:
      - uses: actions/checkout@v5
        with:
@@ -170,26 +169,3 @@ jobs:
          needs: ${{ toJson(needs) }}
          failure-message: "One or more unit test jobs have failed"
          success-message: "All unit tests completed successfully"
-
-  devenv:
-    needs:
-      - detect-changes
-    if: needs.detect-changes.outputs.devenv-changed == 'true'
-    runs-on: ubuntu-x64-large
-    name: "Devenv frontend-service build"
-    steps:
-    - uses: actions/checkout@v5
-      with:
-        persist-credentials: false
-    - name: Setup Docker
-      uses: docker/setup-docker-action@3fb92d6d9c634363128c8cce4bc3b2826526370a # v4
-    - name: Setup Node.js
-      uses: ./.github/actions/setup-node
-    - name: Install Tilt
-      run: curl -fsSL https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh | bash
-    - name: Create empty config files # TODO: the tiltfile should conditionally mount these only if they exist, like the enterprise license
-      run: |
-        touch devenv/frontend-service/configs/grafana-api.local.ini
-        touch devenv/frontend-service/configs/frontend-service.local.ini
-    - name: Test frontend-service Tiltfile
-      run: tilt ci --file devenv/frontend-service/Tiltfile
--- a/.github/workflows/pr-test-integration.yml
+++ b/.github/workflows/pr-test-integration.yml
@@ -68,7 +68,7 @@ jobs:
        run: |
          set -euo pipefail
          readarray -t PACKAGES <<< "$(./scripts/ci/backend-tests/pkgs-with-tests-named.sh -b TestIntegration | ./scripts/ci/backend-tests/shard.sh -N"$SHARD" -d-)"
-          go test -tags=sqlite -timeout=12m -run '^TestIntegration' "${PACKAGES[@]}"
+          go test -tags=sqlite -timeout=8m -run '^TestIntegration' "${PACKAGES[@]}"

  sqlite_nocgo:
    needs: detect-changes
@@ -78,7 +78,6 @@ jobs:
        # We don't need more than this since it has to wait for the other tests.
        shard: [
          1/4, 2/4, 3/4, 4/4,
-          profiled,
        ]
      fail-fast: false

@@ -97,74 +96,13 @@ jobs:
          go-version-file: go.mod
          cache: true
      - name: Run tests
-        if: matrix.shard != 'profiled'
        env:
          SHARD: ${{ matrix.shard }}
-          CGO_ENABLED: 0
-          SKIP_PACKAGES: |-
-            pkg/tests/apis/folder
-            pkg/tests/apis/dashboard
        run: |
          set -euo pipefail
-          # Build regex pattern like: pkg1$|pkg2$|pkg3$
-          SKIP_PATTERN=$(echo "$SKIP_PACKAGES" | sed '/^$/d' | sed 's|.*|&$|' | paste -sd '|' -)
-          readarray -t PACKAGES <<< "$(./scripts/ci/backend-tests/pkgs-with-tests-named.sh -b TestIntegration | ./scripts/ci/backend-tests/shard.sh -N "$SHARD" -d - | grep -Ev "($SKIP_PATTERN)")"
-          go test -tags=sqlite -timeout=12m -run '^TestIntegration' "${PACKAGES[@]}"
-      - name: Run profiled tests
-        id: run-profiled-tests
-        if: matrix.shard == 'profiled'
-        env:
-          CGO_ENABLED: 0
-          PROFILED_PACKAGES: |-
-            pkg/tests/apis/folder
-            pkg/tests/apis/dashboard
-        run: |
-          set -euo pipefail
-          # Build regex pattern line: pkg1$|pkg2$|pkg3$
-          PROFILE_PATTERN=$(echo "$PROFILED_PACKAGES" | sed '/^$/d' | sed 's|.*|&$|' | paste -sd '|' -)
-          readarray -t PACKAGES <<< "$(./scripts/ci/backend-tests/pkgs-with-tests-named.sh -b TestIntegration | grep -E "($PROFILE_PATTERN)")"
-          if [ ${#PACKAGES[@]} -eq 0 ]; then
-            echo "⚠️  No profiled packages found"
-            exit 0
-          fi
-          mkdir -p profiles
-          EXIT_CODE=0
-          # Run each profiled package sequentially
-          for full_pkg in "${PACKAGES[@]}"; do
-            # Build valid file name
-            pkg_name=$(basename "$full_pkg" | tr '/' '_' | tr '.' '_')
-            echo "📦 Running $full_pkg"
-            set +e
-            go test -tags=sqlite -timeout=12m -run '^TestIntegration' \
-              -outputdir=profiles \
-              -cpuprofile="cpu_${pkg_name}.prof" \
-              -memprofile="mem_${pkg_name}.prof" \
-              -trace="trace_${pkg_name}.out" \
-              "$full_pkg" 2>&1 | tee "profiles/test_${pkg_name}.log"
-            TEST_EXIT=$?
-            set -e
-            if [ $TEST_EXIT -ne 0 ]; then
-              echo "❌ $full_pkg failed with exit code $TEST_EXIT"
-              EXIT_CODE=1
-            else
-              echo "✅ $full_pkg passed"
-            fi
-          done
-          # Set output for artifact upload
-          if [ $EXIT_CODE -ne 0 ]; then
-            echo "upload_artifacts=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "upload_artifacts=false" >> "$GITHUB_OUTPUT"
-          fi
-          exit $EXIT_CODE
-      - name: Output test profiles and traces
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v4
-        if: matrix.shard == 'profiled' && !cancelled() && steps.run-profiled-tests.outputs.upload_artifacts == 'true'
-        with:
-          name: integration-test-profiles-sqlite-nocgo-${{ github.run_number }}
-          path: profiles/
-          retention-days: 7
-          if-no-files-found: ignore
+          readarray -t PACKAGES <<< "$(./scripts/ci/backend-tests/pkgs-with-tests-named.sh -b TestIntegration | ./scripts/ci/backend-tests/shard.sh -N"$SHARD" -d-)"
+          # ionice since tests are IO intensive
+          CGO_ENABLED=0 ionice -c2 -n7 go test -p=4 -tags=sqlite -timeout=8m -run '^TestIntegration' "${PACKAGES[@]}"
  mysql:
    needs: detect-changes
    if: needs.detect-changes.outputs.changed == 'true'
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -187,12 +187,12 @@ jobs:
          output: artifacts-${{ matrix.name }}.txt
          verify: ${{ matrix.verify }}
          build-id: ${{ github.run_id }}
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: artifacts-list-${{ matrix.name }}
          path: ${{ steps.build.outputs.file }}
          retention-days: 1
-      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: artifacts-${{ matrix.name }}
          path: ${{ steps.build.outputs.dist-dir }}
@@ -212,6 +212,7 @@ jobs:
      run-id: ${{ github.run_id }}
      bucket-path: ${{ needs.setup.outputs.version }}_${{ github.run_id }}
      environment: prod
+      runs-on: ubuntu-x64-small

  publish-dockerhub:
    if: github.ref_name == 'main'
--- a/.github/workflows/storybook-a11y.yml
+++ b/.github/workflows/storybook-a11y.yml
@@ -34,7 +34,7 @@ jobs:
      id-token: write
    needs: detect-changes
    if: needs.detect-changes.outputs.changed == 'true'
-    name: "Run Storybook a11y tests (light theme)"
+    name: "Run Storybook a11y tests"
    steps:
    - uses: actions/checkout@v5
      with:
@@ -64,7 +64,7 @@ jobs:
      id-token: write
    needs: detect-changes
    if: needs.detect-changes.outputs.changed == 'true'
-    name: "Run Storybook a11y tests (dark theme)"
+    name: "Run Storybook a11y tests"
    steps:
    - uses: actions/checkout@v5
      with:
--- a/1
+++ b/1
@@ -95,7 +95,6 @@ COPY pkg/aggregator pkg/aggregator
 COPY apps/playlist apps/playlist
 COPY apps/plugins apps/plugins
 COPY apps/shorturl apps/shorturl
-COPY apps/annotation apps/annotation
 COPY apps/correlations apps/correlations
 COPY apps/preferences apps/preferences
 COPY apps/provisioning apps/provisioning
--- a/apps/advisor/Makefile
+++ b/apps/advisor/Makefile
@@ -1,9 +1,5 @@
 include ../sdk.mk

-.PHONY: etcd
-etcd:
-	@docker run -d --name etcd --env ALLOW_NONE_AUTHENTICATION=yes -p 22379:2379 bitnamilegacy/etcd:latest
-
 .PHONY: generate # Run Grafana App SDK code generation
 generate: install-app-sdk update-app-sdk
 	@$(APP_SDK_BIN) generate \
@@ -11,24 +7,3 @@ generate: install-app-sdk update-app-sdk
 		--gogenpath=./pkg/apis \
 		--grouping=group \
 		--defencoding=none
-
-.PHONY: run
-run:
-	@go run ./pkg/standalone/server.go --etcd-servers=http://127.0.0.1:22379 --secure-port 7445
-
-.PHONY: create-checks
-create-checks:
-	@echo "Creating plugin check..."
-	@curl -k -X POST https://localhost:7445/apis/advisor.grafana.app/v0alpha1/namespaces/stacks-1/checks \
-		-H "Content-Type: application/json" \
-		-d '{"kind":"Check","apiVersion":"advisor.grafana.app/v0alpha1","spec":{"data":{}},"metadata":{"generateName":"check-","labels":{"advisor.grafana.app/type":"plugin"},"namespace":"stacks-1"},"status":{"report":{"count":0,"failures":[]}}}' \
-		&& echo "Plugin check created successfully"
-	@echo "Creating datasource check..."
-	@curl -k -X POST https://localhost:7445/apis/advisor.grafana.app/v0alpha1/namespaces/stacks-1/checks \
-		-H "Content-Type: application/json" \
-		-d '{"kind":"Check","apiVersion":"advisor.grafana.app/v0alpha1","spec":{"data":{}},"metadata":{"generateName":"check-","labels":{"advisor.grafana.app/type":"datasource"},"namespace":"stacks-1"},"status":{"report":{"count":0,"failures":[]}}}' \
-		&& echo "Datasource check created successfully"
-
-delete-checks:
-	@curl -k -X DELETE https://localhost:7445/apis/advisor.grafana.app/v0alpha1/namespaces/stacks-1/checks \
-		&& echo "All checks deleted successfully"
--- a/apps/advisor/README.md
+++ b/apps/advisor/README.md
@@ -152,28 +152,3 @@ Check [`security_config_step.go`](./pkg/app/checks/configchecks/security_config_
 ## Testing

 Create tests for your check and its steps to ensure they work as expected. Test both successful and failure scenarios.
-
-## Running the Standalone Mode
-
-To run the standalone mode, you can use the `make run` command. This will start the advisor app in standalone mode, which means it will not be running in a Kubernetes cluster.
-
-```bash
-make etcd # Start etcd in a docker container
-make run  # Start the advisor app in standalone mode
-```
-
-This will start the advisor app on port 7445. You can then access the advisor app at `http://localhost:7445`.
-
-To see some sample checks, you can run the following command:
-
-```bash
-make create-checks
-```
-
-Then you can see list in the URL: `http://localhost:7445/apis/advisor.grafana.app/v0alpha1/namespaces/stacks-1/checks`
-
-To delete all checks, you can run the following command:
-
-```bash
-make delete-checks
-```
--- a/apps/advisor/go.mod
+++ b/apps/advisor/go.mod
@@ -15,8 +15,6 @@ require (
 	github.com/stretchr/testify v1.11.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/apiserver v0.34.1
-	k8s.io/client-go v0.34.1
-	k8s.io/component-base v0.34.1
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
 )

@@ -45,7 +43,6 @@ replace github.com/grafana/grafana/apps/plugins => ../plugins
 replace github.com/prometheus/alertmanager => github.com/grafana/prometheus-alertmanager v0.25.1-0.20250911094103-5456b6e45604

 require (
-	cel.dev/expr v0.24.0 // indirect
 	cloud.google.com/go/compute/metadata v0.7.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
@@ -58,7 +55,6 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
-	github.com/NYTimes/gziphandler v1.1.1 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f // indirect
 	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect
@@ -68,13 +64,13 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/at-wat/mqtt-go v0.19.4 // indirect
 	github.com/aws/aws-sdk-go v1.55.7 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.39.1 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.14 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.38.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 // indirect
 	github.com/aws/smithy-go v1.23.1 // indirect
 	github.com/barkimedes/go-deepcopy v0.0.0-20220514131651-17c30cfc62df // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
@@ -89,8 +85,8 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cheekybits/genny v1.0.0 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/diegoholiveira/jsonlogic/v3 v3.7.4 // indirect
@@ -105,7 +101,6 @@ require (
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gchaincl/sqlhooks v1.3.0 // indirect
 	github.com/getkin/kin-openapi v0.133.0 // indirect
@@ -113,7 +108,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
-	github.com/go-logfmt/logfmt v0.6.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.24.0 // indirect
@@ -148,7 +143,6 @@ require (
 	github.com/golang-migrate/migrate/v4 v4.7.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/cel-go v0.26.1 // indirect
 	github.com/google/flatbuffers v25.2.10+incompatible // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
@@ -158,7 +152,7 @@ require (
 	github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
 	github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4 // indirect
-	github.com/grafana/grafana-aws-sdk v1.3.0 // indirect
+	github.com/grafana/grafana-aws-sdk v1.2.0 // indirect
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 // indirect
 	github.com/grafana/grafana/apps/plugins v0.0.0 // indirect
 	github.com/grafana/grafana/apps/provisioning v0.0.0 // indirect
@@ -168,7 +162,6 @@ require (
 	github.com/grafana/sqlds/v4 v4.2.7 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
-	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20191002090509-6af20e3a5340 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
@@ -183,7 +176,6 @@ require (
 	github.com/hashicorp/memberlist v0.5.2 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jaegertracing/jaeger-idl v0.5.0 // indirect
 	github.com/jessevdk/go-flags v1.6.1 // indirect
 	github.com/jmespath-community/go-jmespath v1.1.1 // indirect
@@ -198,6 +190,7 @@ require (
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lestrrat-go/strftime v1.0.4 // indirect
 	github.com/lib/pq v1.10.9 // indirect
+	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattetti/filebuffer v1.0.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
@@ -250,25 +243,25 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/cors v1.11.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
 	github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
-	github.com/spf13/cobra v1.10.1 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/stoewer/go-strcase v1.3.1 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tetratelabs/wazero v1.8.2 // indirect
 	github.com/thomaspoignant/go-feature-flag v1.42.0 // indirect
-	github.com/tjhop/slog-gokit v0.1.5 // indirect
+	github.com/tjhop/slog-gokit v0.1.3 // indirect
+	github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 // indirect
+	github.com/unknwon/com v1.0.1 // indirect
+	github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a // indirect
+	github.com/urfave/cli v1.22.17 // indirect
 	github.com/woodsbury/decimal128 v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
 	go.mongodb.org/mongo-driver v1.17.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
@@ -287,8 +280,6 @@ require (
 	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/mock v0.6.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.43.0 // indirect
@@ -311,25 +302,24 @@ require (
 	google.golang.org/grpc v1.76.0 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/mail.v2 v2.3.1 // indirect
-	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/src-d/go-errors.v1 v1.0.0 // indirect
 	gopkg.in/telebot.v3 v3.3.8 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.34.1 // indirect
 	k8s.io/apiextensions-apiserver v0.34.1 // indirect
+	k8s.io/client-go v0.34.1 // indirect
+	k8s.io/component-base v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kms v0.34.1 // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
 	modernc.org/libc v1.66.10 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	modernc.org/sqlite v1.39.1 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
--- a/apps/advisor/go.sum
+++ b/apps/advisor/go.sum
@@ -173,42 +173,42 @@ github.com/aws/aws-sdk-go v1.17.7/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN
 github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
-github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.38.1 h1:j7sc33amE74Rz0M/PoCpsZQ6OunLqys/m5antM0J+Z8=
+github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
-github.com/aws/aws-sdk-go-v2/config v1.31.10 h1:7LllDZAegXU3yk41mwM6KcPu0wmjKGQB1bg99bNdQm4=
-github.com/aws/aws-sdk-go-v2/config v1.31.10/go.mod h1:Ge6gzXPjqu4v0oHvgAwvGzYcK921GU0hQM25WF/Kl+8=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14 h1:TxkI7QI+sFkTItN/6cJuMZEIVMFXeu2dI1ZffkXngKI=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14/go.mod h1:12x4Uw/vijC11XkctTjy92TNCQ+UnNJkT7fzX0Yd93E=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 h1:gLD09eaJUdiszm7vd1btiQUYE0Hj+0I2b8AS+75z9AY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8/go.mod h1:4RW3oMPt1POR74qVOC4SbubxAwdP4pCT0nSw3jycOU4=
+github.com/aws/aws-sdk-go-v2/config v1.31.2 h1:NOaSZpVGEH2Np/c1toSeW0jooNl+9ALmsUTZ8YvkJR0=
+github.com/aws/aws-sdk-go-v2/config v1.31.2/go.mod h1:17ft42Yb2lF6OigqSYiDAiUcX4RIkEMY6XxEMJsrAes=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6 h1:AmmvNEYrru7sYNJnp3pf57lGbiarX4T9qU/6AZ9SucU=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6/go.mod h1:/jdQkh1iVPa01xndfECInp1v1Wnp70v3K4MvtlLGVEc=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 h1:lpdMwTzmuDLkgW7086jE94HweHCqG+uOJwHf3LZs7T0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 h1:cTXRdLkpBanlDwISl+5chq5ui1d1YWg4PWMR9c3kXyw=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84/go.mod h1:kwSy5X7tfIHN39uucmjQVs2LvDdXEjQucgQQEqCggEo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 h1:IdCLsiiIj5YJ3AFevsewURCPV+YWUlOW8JiPhoAy8vg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 h1:j7vjtr1YIssWQOMeOWRbh3z8g2oY/xPjnZH2gLY4sGw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36/go.mod h1:gDhdAV6wL3PmPqBhiPbnlS447GoWs8HTTOYef9/9Inw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 h1:ueB2Te0NacDMnaC+68za9jLwkjzxGWm0KB5HTUHjLTI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4/go.mod h1:nLEfLnVMmLvyIG58/6gsSA03F1voKGaCfHV7+lR8S7s=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 h1:0reDqfEN+tB+sozj2r92Bep8MEwBZgtAXTND1Kk9OXg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 h1:FTdEN9dtWPB0EOURNtDPmwGp6GGvMqRJCAihkSl/1No=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4/go.mod h1:mYubxV9Ff42fZH4kexj43gFPhgc/LyC7KqvUKt1watc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 h1:I7ghctfGXrscr7r1Ga/mDqSJKm7Fkpl5Mwq79Z+rZqU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0/go.mod h1:Zo9id81XP6jbayIFWNuDpA6lMBWhsVy+3ou2jLa4JnA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 h1:+LVB0xBqEgjQoqr9bGZbRzvg212B0f17JdflleJRNR4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5/go.mod h1:xoaxeqnnUaZjPjaICgIy5B+MHCSb/ZSOn4MvkFNOUA0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 h1:ve9dYBB8CfJGTFqcQ3ZLAAb/KXWgYlgu/2R2TZL2Ko0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2/go.mod h1:n9bTZFZcBa9hGGqVz3i/a6+NG0zmZgtkB9qVVFDqPA8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 h1:pd9G9HQaM6UZAZh19pYOkpKSQkyQQ9ftnl/LttQOcGI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2/go.mod h1:eknndR9rU8UpE/OmFpqU78V1EcXPKFTTm5l/buZYgvM=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 h1:iV1Ko4Em/lkJIsoKyGfc0nQySi+v0Udxr6Igq+y9JZc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0/go.mod h1:bEPcjW7IbolPfK67G1nilqWyoxYMSPrDiIQ3RdIdKgo=
 github.com/aws/smithy-go v1.23.1 h1:sLvcH6dfAFwGkHLZ7dGiYF7aK6mg4CgKA/iDKjLDt9M=
 github.com/aws/smithy-go v1.23.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/axiomhq/hyperloglog v0.0.0-20240507144631-af9851f82b27 h1:60m4tnanN1ctzIu4V3bfCNJ39BiOPSm1gHFlFjTkRE0=
@@ -334,7 +334,9 @@ github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03V
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cznic/b v0.0.0-20180115125044-35e9bbe41f07/go.mod h1:URriBxXwVq5ijiJ12C7iIZqlA69nTlI+LgI6/pwftG8=
 github.com/cznic/fileutil v0.0.0-20180108211300-6a051e75936f/go.mod h1:8S58EK26zhXSxzv7NQFpnliaOQsmDUxvoQO3rt154Vg=
@@ -453,16 +455,14 @@ github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXg
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
-github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
-github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
 github.com/go-openapi/analysis v0.24.0 h1:vE/VFFkICKyYuTWYnplQ+aVr45vlG6NcZKC7BdIXhsA=
 github.com/go-openapi/analysis v0.24.0/go.mod h1:GLyoJA+bvmGGaHgpfeDh8ldpGo69fAJg7eeMDMRCIrw=
 github.com/go-openapi/errors v0.22.3 h1:k6Hxa5Jg1TUyZnOwV2Lh81j8ayNw5VVYLvKrp4zFKFs=
@@ -660,13 +660,14 @@ github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
+github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.1/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
-github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
-github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/grafana/alerting v0.0.0-20251009192429-9427c24835ae h1:NLPwY3tIP0lg0g9wTRiMcypm6VRXW6W+MOLBsq8JSVA=
 github.com/grafana/alerting v0.0.0-20251009192429-9427c24835ae/go.mod h1:VGjS5gDwWEADPP6pF/drqLxEImgeuHlEW5u8E5EfIrM=
 github.com/grafana/authlib v0.0.0-20250930082137-a40e2c2b094f h1:Cbm6OKkOcJ+7CSZsGsEJzktC/SIa5bxVeYKQLuYK86o=
@@ -683,8 +684,8 @@ github.com/grafana/grafana-app-sdk v0.48.1 h1:bKJadWH18WCpJ+Zk8AezRFXCcZgGredRv+
 github.com/grafana/grafana-app-sdk v0.48.1/go.mod h1:5LljCz+wvmGfkQ8ZKTOfserhtXNEF0cSFthoWShvN6c=
 github.com/grafana/grafana-app-sdk/logging v0.48.1 h1:veM0X5LAPyN3KsDLglWjIofndbGuf7MqnrDuDN+F/Ng=
 github.com/grafana/grafana-app-sdk/logging v0.48.1/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-aws-sdk v1.3.0 h1:/bfJzP93rCel1GbWoRSq0oUo424MZXt8jAp2BK9w8tM=
-github.com/grafana/grafana-aws-sdk v1.3.0/go.mod h1:VGycF0JkCGKND2O5je1ucOqPJ0ZNhZYzV3c2bNBAaGk=
+github.com/grafana/grafana-aws-sdk v1.2.0 h1:LLR4/g91WBuCRwm2cbWfCREq565+GxIFe08nqqIcIuw=
+github.com/grafana/grafana-aws-sdk v1.2.0/go.mod h1:bBo7qOmM3f61vO+2JxTolNUph1l2TmtzmWcU9/Im+8A=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 h1:FFcEA01tW+SmuJIuDbHOdgUBL+d7DPrZ2N4zwzPhfGk=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1/go.mod h1:Oi4anANlCuTCc66jCyqIzfVbgLXFll8Wja+Y4vfANlc=
 github.com/grafana/grafana-plugin-sdk-go v0.281.0 h1:V8dGyatzcOLQeivFhBV2JWMwTSZH/clDnpfKG9p3dTA=
@@ -810,8 +811,6 @@ github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGw
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
-github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
-github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
@@ -827,6 +826,9 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6 h1:SwcnSwBR7X/5EHJQlXBockkJVIMRVt5yKaesBPMtyZQ=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6/go.mod h1:WrYiIuiXUMIvTDAQw97C+9l0CnBmCcvosPjN3XDqS/o=
+github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
@@ -873,6 +875,8 @@ github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/madflojo/testcerts v1.4.0 h1:I09gN0C1ly9IgeVNcAqKk8RAKIJTe3QnFrrPBDyvzN4=
 github.com/madflojo/testcerts v1.4.0/go.mod h1:MW8sh39gLnkKh4K0Nc55AyHEDl9l/FBLDUsQhpmkuo0=
+github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
+github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
@@ -1044,7 +1048,6 @@ github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSg
 github.com/pressly/goose/v3 v3.25.0 h1:6WeYhMWGRCzpyd89SpODFnCBCKz41KrVbRT58nVjGng=
 github.com/pressly/goose/v3 v3.25.0/go.mod h1:4hC1KrritdCxtuFsqgs1R4AU5bWtTAf+cnWvfhf2DNY=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.2/go.mod h1:OsXs2jCmiKlQ1lTBmv21f2mNfw4xf/QclQDMrYNZzcM=
 github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
@@ -1062,7 +1065,6 @@ github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6T
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
@@ -1077,7 +1079,6 @@ github.com/prometheus/common/sigv4 v0.1.0/go.mod h1:2Jkxxk9yYvCkE5G1sQT7GuEXm57J
 github.com/prometheus/exporter-toolkit v0.14.0 h1:NMlswfibpcZZ+H0sZBiTjrA3/aBFHkNZqE+iCj5EmRg=
 github.com/prometheus/exporter-toolkit v0.14.0/go.mod h1:Gu5LnVvt7Nr/oqTBUC23WILZepW0nffNo10XdhQcwWA=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
@@ -1104,6 +1105,8 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/sagikazarmark/crypt v0.6.0/go.mod h1:U8+INwJo3nBv1m6A/8OBXAq7Jnpspk5AxSgDyEQcea8=
@@ -1119,6 +1122,7 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c h1:aqg5Vm5dwtvL+YgDpBcK1ITf3o96N/K7/wsRXQnUTEs=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c/go.mod h1:owqhoLW1qZoYLZzLnBw+QkPP9WZnjlSWihhxAJC1+/M=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 h1:OfRzdxCzDhp+rsKWXuOO2I/quKMJ/+TQwVbIP/gltZg=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92/go.mod h1:7/OT02F6S6I7v6WXb+IjhMuZEYfH/RJ5RwEWnEo5BMg=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -1127,8 +1131,10 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
-github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c h1:Ho+uVpkel/udgjbwB5Lktg9BtvJSh2DT0Hi6LPSyI2w=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
@@ -1142,7 +1148,6 @@ github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
 github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.13.0/go.mod h1:Icm2xNL3/8uyh/wFuB1jI7TiTNKp8632Nwegu+zgdYw=
@@ -1168,9 +1173,9 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
@@ -1183,10 +1188,8 @@ github.com/thejerf/slogassert v0.3.4/go.mod h1:0zn9ISLVKo1aPMTqcGfG1o6dWwt+Rk574
 github.com/thomaspoignant/go-feature-flag v1.42.0 h1:C7embmOTzaLyRki+OoU2RvtVjJE9IrvgBA2C1mRN1lc=
 github.com/thomaspoignant/go-feature-flag v1.42.0/go.mod h1:y0QiWH7chHWhGATb/+XqwAwErORmPSH2MUsQlCmmWlM=
 github.com/tidwall/pretty v0.0.0-20180105212114-65a9db5fad51/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tjhop/slog-gokit v0.1.5 h1:ayloIUi5EK2QYB8eY4DOPO95/mRtMW42lUkp3quJohc=
-github.com/tjhop/slog-gokit v0.1.5/go.mod h1:yA48zAHvV+Sg4z4VRyeFyFUNNXd3JY5Zg84u3USICq0=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
+github.com/tjhop/slog-gokit v0.1.3 h1:6SdexP3UIeg93KLFeiM1Wp1caRwdTLgsD/THxBUy1+o=
+github.com/tjhop/slog-gokit v0.1.3/go.mod h1:Bbu5v2748qpAWH7k6gse/kw3076IJf6owJmh7yArmJs=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaOOb6ThwMmTEbhRwtKR97o=
 github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
@@ -1194,6 +1197,16 @@ github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVK
 github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
 github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 h1:aVGB3YnaS/JNfOW3tiHIlmNmTDg618va+eT0mVomgyI=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8/go.mod h1:fVle4kNr08ydeohzYafr20oZzbAkhQT39gKK/pFQ5M4=
+github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
+github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
+github.com/unknwon/log v0.0.0-20150304194804-e617c87089d3/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a h1:vcrhXnj9g9PIE+cmZgaPSwOyJ8MAQTRmsgGrB0x5rF4=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
+github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo=
 github.com/wk8/go-ordered-map v1.0.0 h1:BV7z+2PaK8LTSd/mWgY12HyMAo5CEgkHqbkVq2thqr8=
 github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
 github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
@@ -1204,8 +1217,6 @@ github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcY
 github.com/xanzy/go-gitlab v0.15.0/go.mod h1:8zdQa/ri1dfn8eS3Ir1SyfvOKlw7WBJ8DVThkpGiXrs=
 github.com/xdg/scram v0.0.0-20180814205039-7eeb5667e42c/go.mod h1:lB8K/P019DLNhemzwFU4jHLhdvlE6uDZjXFejJXr49I=
 github.com/xdg/stringprep v1.0.0/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0HrGL1Y=
-github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 h1:S2dVYn90KE98chqDkyE9Z4N61UnQd+KOfgp5Iu53llk=
-github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -1230,12 +1241,6 @@ go.etcd.io/etcd/client/v2 v2.305.4/go.mod h1:Ud+VUwIi9/uQHOMA+4ekToJ12lTxlv0zB/+
 go.etcd.io/etcd/client/v3 v3.5.4/go.mod h1:ZaRkVgBZC+L+dLCjTcF1hRXpgZXQPOvnA/Ak/gq3kiY=
 go.etcd.io/etcd/client/v3 v3.6.4 h1:YOMrCfMhRzY8NgtzUsHl8hC2EBSnuqbR3dh84Uryl7A=
 go.etcd.io/etcd/client/v3 v3.6.4/go.mod h1:jaNNHCyg2FdALyKWnd7hxZXZxZANb0+KGY+YQaEMISo=
-go.etcd.io/etcd/pkg/v3 v3.6.4 h1:fy8bmXIec1Q35/jRZ0KOes8vuFxbvdN0aAFqmEfJZWA=
-go.etcd.io/etcd/pkg/v3 v3.6.4/go.mod h1:kKcYWP8gHuBRcteyv6MXWSN0+bVMnfgqiHueIZnKMtE=
-go.etcd.io/etcd/server/v3 v3.6.4 h1:LsCA7CzjVt+8WGrdsnh6RhC0XqCsLkBly3ve5rTxMAU=
-go.etcd.io/etcd/server/v3 v3.6.4/go.mod h1:aYCL/h43yiONOv0QIR82kH/2xZ7m+IWYjzRmyQfnCAg=
-go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ=
-go.etcd.io/raft/v3 v3.6.0/go.mod h1:nLvLevg6+xrVtHUmVaTcTz603gQPHfh7kUAwV6YpfGo=
 go.mongodb.org/mongo-driver v1.1.0/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
 go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
 go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
@@ -1388,7 +1393,6 @@ golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181108082009-03003ca0c849/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1499,6 +1503,7 @@ golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191020152052-9984515f0562/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1800,7 +1805,6 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 h1:CirRxTOwnRWVLKzDNrs0CXAaVozJoR4G9xvdRecrdpk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
 google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
-google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1862,6 +1866,8 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7 h1:XNNYLJHt73EyYiCZi6+xjupS9CpvmiDgjPTAjrBlQbo=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7/go.mod h1:Fyux9zXlo4rWoMSIzpn9fDAYjalPqJ/K1qJ27s+7ltE=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/checkregistry.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/checkregistry.go
@@ -1,59 +0,0 @@
-package mockchecks
-
-import (
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checks"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checks/datasourcecheck"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checks/plugincheck"
-	"github.com/grafana/grafana/pkg/plugins"
-	"github.com/grafana/grafana/pkg/plugins/repo"
-	"github.com/grafana/grafana/pkg/services/datasources"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginchecker"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
-)
-
-// mockchecks.CheckRegistry is a mock implementation of the checkregistry.CheckService interface
-// TODO: Add mocked checks here
-type CheckRegistry struct {
-	datasourceSvc         datasources.DataSourceService
-	pluginStore           pluginstore.Store
-	pluginClient          plugins.Client
-	pluginRepo            repo.Service
-	GrafanaVersion        string
-	pluginContextProvider datasourcecheck.PluginContextProvider
-	updateChecker         pluginchecker.PluginUpdateChecker
-	pluginErrorResolver   plugins.ErrorResolver
-}
-
-func (m *CheckRegistry) Checks() []checks.Check {
-	return []checks.Check{
-		datasourcecheck.New(
-			m.datasourceSvc,
-			m.pluginStore,
-			m.pluginContextProvider,
-			m.pluginClient,
-			m.pluginRepo,
-			m.GrafanaVersion,
-		),
-		plugincheck.New(
-			m.pluginStore,
-			m.pluginRepo,
-			m.updateChecker,
-			m.pluginErrorResolver,
-			m.GrafanaVersion,
-		),
-	}
-}
-
-func New() *CheckRegistry {
-	return &CheckRegistry{
-		datasourceSvc:         &mocksvcs.DatasourceSvc{},
-		pluginStore:           &mocksvcs.PluginStore{},
-		pluginClient:          &mocksvcs.PluginClient{},
-		pluginRepo:            &mocksvcs.PluginRepo{},
-		pluginContextProvider: &mocksvcs.PluginContextProvider{},
-		updateChecker:         &mocksvcs.UpdateChecker{},
-		pluginErrorResolver:   &mocksvcs.PluginErrorResolver{},
-		GrafanaVersion:        "1.0.0",
-	}
-}
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/datasourcesvc.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/datasourcesvc.go
@@ -1,44 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/services/datasources"
-)
-
-var dss = map[string]*datasources.DataSource{
-	"prometheus-uid": {
-		ID:   1,
-		UID:  "prometheus-uid",
-		Name: "Prometheus",
-		Type: "prometheus",
-	},
-	"mysql-uid": {
-		ID:   2,
-		UID:  "mysql-uid",
-		Name: "MySQL",
-		Type: "mysql",
-	},
-	"unknown-uid": {
-		ID:   3,
-		UID:  "unknown-uid",
-		Name: "Unknown",
-		Type: "unknown",
-	},
-}
-
-type DatasourceSvc struct {
-	datasources.DataSourceService
-}
-
-func (m *DatasourceSvc) GetDataSources(ctx context.Context, query *datasources.GetDataSourcesQuery) ([]*datasources.DataSource, error) {
-	sources := make([]*datasources.DataSource, 0, len(dss))
-	for _, ds := range dss {
-		sources = append(sources, ds)
-	}
-	return sources, nil
-}
-
-func (m *DatasourceSvc) GetDataSource(ctx context.Context, query *datasources.GetDataSourceQuery) (*datasources.DataSource, error) {
-	return dss[query.UID], nil
-}
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginclient.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginclient.go
@@ -1,19 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-	"github.com/grafana/grafana/pkg/plugins"
-)
-
-type PluginClient struct {
-	plugins.Client
-}
-
-func (m *PluginClient) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
-	return &backend.CheckHealthResult{
-		Status:  backend.HealthStatusOk,
-		Message: "Plugin is healthy",
-	}, nil
-}
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/plugincontextprovider.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/plugincontextprovider.go
@@ -1,53 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-plugin-sdk-go/backend"
-	"github.com/grafana/grafana/pkg/apimachinery/identity"
-	"github.com/grafana/grafana/pkg/services/datasources"
-)
-
-type PluginContextProvider struct {
-}
-
-// ACTUALLY USED by datasourcecheck
-func (m *PluginContextProvider) GetWithDataSource(ctx context.Context, pluginID string, user identity.Requester, ds *datasources.DataSource) (backend.PluginContext, error) {
-	// Create a plugin context with sample data based on the datasource
-	pluginContext := backend.PluginContext{
-		PluginID:      pluginID,
-		PluginVersion: "1.0.0",
-		OrgID:         1,
-		DataSourceInstanceSettings: &backend.DataSourceInstanceSettings{
-			ID:   ds.ID,
-			UID:  ds.UID,
-			Name: ds.Name,
-			URL:  ds.URL,
-			JSONData: []byte(`{
-				"httpMethod": "GET",
-				"timeout": "30s",
-				"keepCookies": []
-			}`),
-			DecryptedSecureJSONData: map[string]string{
-				"password": "sample-password",
-				"apiKey":   "sample-api-key",
-			},
-		},
-		GrafanaConfig: backend.NewGrafanaCfg(map[string]string{
-			"app_url":          "http://localhost:3000",
-			"default_timezone": "UTC",
-		}),
-	}
-
-	// Add user context if provided
-	if user != nil && !user.IsNil() {
-		pluginContext.User = &backend.User{
-			Login: user.GetLogin(),
-			Name:  user.GetName(),
-			Email: user.GetEmail(),
-			Role:  string(user.GetOrgRole()),
-		}
-	}
-
-	return pluginContext, nil
-}
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginerrorresolver.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginerrorresolver.go
@@ -1,19 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/plugins"
-)
-
-type PluginErrorResolver struct {
-}
-
-// Assume no plugin with errors
-func (m *PluginErrorResolver) PluginErrors(ctx context.Context) []*plugins.Error {
-	return nil
-}
-
-func (m *PluginErrorResolver) PluginError(ctx context.Context, pluginID string) *plugins.Error {
-	return nil
-}
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginrepo.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginrepo.go
@@ -1,26 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/plugins/repo"
-)
-
-type PluginRepo struct {
-	repo.Service
-}
-
-func (m *PluginRepo) GetPluginsInfo(ctx context.Context, options repo.GetPluginsInfoOptions, compatOpts repo.CompatOpts) ([]repo.PluginInfo, error) {
-	return []repo.PluginInfo{
-		{
-			ID:      1,
-			Slug:    "grafana-piechart-panel",
-			Version: "1.6.0",
-		},
-		{
-			ID:      2,
-			Slug:    "prometheus",
-			Version: "10.0.0",
-		},
-	}, nil
-}
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginstore.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/pluginstore.go
@@ -1,114 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/plugins"
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
-)
-
-type PluginStore struct {
-}
-
-var ps = map[string]pluginstore.Plugin{
-	"prometheus": {
-		JSONData: plugins.JSONData{
-			ID:   "prometheus",
-			Type: plugins.TypeDataSource,
-			Name: "Prometheus",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Grafana Labs",
-				},
-				Version: "10.0.0",
-			},
-			Category: "Time series databases",
-			State:    plugins.ReleaseStateAlpha,
-			Backend:  true,
-			Metrics:  true,
-			Logs:     true,
-			Alerting: true,
-			Explore:  true,
-		},
-		Class:         plugins.ClassCore,
-		Signature:     plugins.SignatureStatusInternal,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "grafana.com",
-	},
-	"test-datasource": {
-		JSONData: plugins.JSONData{
-			ID:   "grafana-piechart-panel",
-			Type: plugins.TypePanel,
-			Name: "Pie Chart",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Grafana Labs",
-				},
-				Version: "1.6.0",
-			},
-			Category: "Visualization",
-			State:    plugins.ReleaseStateAlpha,
-		},
-		Class:         plugins.ClassCore,
-		Signature:     plugins.SignatureStatusInternal,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "grafana.com",
-	},
-	"grafana-piechart-panel": {
-		JSONData: plugins.JSONData{
-			ID:   "prometheus",
-			Type: plugins.TypeDataSource,
-			Name: "Prometheus",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Grafana Labs",
-				},
-				Version: "10.0.0",
-			},
-			Category: "Time series databases",
-			State:    plugins.ReleaseStateAlpha,
-			Backend:  true,
-			Metrics:  true,
-			Logs:     true,
-			Alerting: true,
-			Explore:  true,
-		},
-		Class:         plugins.ClassCore,
-		Signature:     plugins.SignatureStatusInternal,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "grafana.com",
-	},
-	"test-app": {
-		JSONData: plugins.JSONData{
-			ID:   "test-app",
-			Type: plugins.TypeApp,
-			Name: "Test App",
-			Info: plugins.Info{
-				Author: plugins.InfoLink{
-					Name: "Test Author",
-				},
-				Version: "2.0.0",
-			},
-			Category:    "Application",
-			State:       plugins.ReleaseStateAlpha,
-			AutoEnabled: true,
-		},
-		Class:         plugins.ClassExternal,
-		Signature:     plugins.SignatureStatusValid,
-		SignatureType: plugins.SignatureTypeCommercial,
-		SignatureOrg:  "test.com",
-	},
-}
-
-func (s *PluginStore) Plugin(ctx context.Context, pluginID string) (pluginstore.Plugin, bool) {
-	p, ok := ps[pluginID]
-	return p, ok
-}
-
-func (s *PluginStore) Plugins(ctx context.Context, pluginTypes ...plugins.Type) []pluginstore.Plugin {
-	plugins := make([]pluginstore.Plugin, 0, len(ps))
-	for _, p := range ps {
-		plugins = append(plugins, p)
-	}
-	return plugins
-}
--- a/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/updatechecker.go
+++ b/apps/advisor/pkg/app/checkregistry/mockchecks/mocksvcs/updatechecker.go
@@ -1,18 +0,0 @@
-package mocksvcs
-
-import (
-	"context"
-
-	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
-)
-
-type UpdateChecker struct {
-}
-
-func (m *UpdateChecker) IsUpdatable(ctx context.Context, plugin pluginstore.Plugin) bool {
-	return true
-}
-
-func (m *UpdateChecker) CanUpdate(pluginId string, currentVersion string, targetVersion string, onlyMinor bool) bool {
-	return true
-}
--- a/apps/advisor/pkg/app/checks/datasourcecheck/check.go
+++ b/apps/advisor/pkg/app/checks/datasourcecheck/check.go
@@ -26,7 +26,7 @@ const (
 type check struct {
 	DatasourceSvc             datasources.DataSourceService
 	PluginStore               pluginstore.Store
-	PluginContextProvider     PluginContextProvider
+	PluginContextProvider     pluginContextProvider
 	PluginClient              plugins.Client
 	PluginRepo                repo.Service
 	GrafanaVersion            string
@@ -37,7 +37,7 @@ type check struct {
 func New(
 	datasourceSvc datasources.DataSourceService,
 	pluginStore pluginstore.Store,
-	pluginContextProvider PluginContextProvider,
+	pluginContextProvider pluginContextProvider,
 	pluginClient plugins.Client,
 	pluginRepo repo.Service,
 	grafanaVersion string,
@@ -168,6 +168,6 @@ func (c *check) canBeInstalled(ctx context.Context, pluginType string) (bool, er
 	return isAvailableInRepo, nil
 }

-type PluginContextProvider interface {
+type pluginContextProvider interface {
 	GetWithDataSource(ctx context.Context, pluginID string, user identity.Requester, ds *datasources.DataSource) (backend.PluginContext, error)
 }
--- a/apps/advisor/pkg/app/checks/datasourcecheck/health_check_step.go
+++ b/apps/advisor/pkg/app/checks/datasourcecheck/health_check_step.go
@@ -15,7 +15,7 @@ import (
 )

 type healthCheckStep struct {
-	PluginContextProvider PluginContextProvider
+	PluginContextProvider pluginContextProvider
 	PluginClient          plugins.Client
 }

--- a/apps/advisor/pkg/standalone/server.go
+++ b/apps/advisor/pkg/standalone/server.go
@@ -1,58 +0,0 @@
-package main
-
-import (
-	"log/slog"
-	"os"
-
-	"k8s.io/apiserver/pkg/admission"
-	genericapiserver "k8s.io/apiserver/pkg/server"
-	"k8s.io/client-go/rest"
-	"k8s.io/component-base/cli"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/k8s/apiserver"
-	"github.com/grafana/grafana-app-sdk/k8s/apiserver/cmd/server"
-	"github.com/grafana/grafana-app-sdk/logging"
-	"github.com/grafana/grafana-app-sdk/simple"
-	"github.com/grafana/grafana/apps/advisor/pkg/apis"
-	advisorapp "github.com/grafana/grafana/apps/advisor/pkg/app"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checkregistry"
-	"github.com/grafana/grafana/apps/advisor/pkg/app/checkregistry/mockchecks"
-)
-
-func main() {
-	logging.DefaultLogger = logging.NewSLogLogger(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
-		Level: slog.LevelDebug,
-	}))
-	provider := simple.NewAppProvider(apis.LocalManifest(), nil, advisorapp.New)
-	config := app.Config{
-		KubeConfig:   rest.Config{}, // this will be replaced by the apiserver loopback config
-		ManifestData: *apis.LocalManifest().ManifestData,
-		SpecificConfig: checkregistry.AdvisorAppConfig{
-			CheckRegistry: mockchecks.New(),
-			PluginConfig:  map[string]string{},
-			StackID:       "1", // Numeric stack ID for standalone mode
-			OrgService:    nil, // Not needed when StackID is set
-		},
-	}
-	installer, err := apiserver.NewDefaultAppInstaller(provider, config, &apis.GoTypeAssociator{})
-	if err != nil {
-		panic(err)
-	}
-	ctx := genericapiserver.SetupSignalContext()
-	opts := apiserver.NewOptions([]apiserver.AppInstaller{installer})
-	opts.RecommendedOptions.Authentication = nil
-	opts.RecommendedOptions.Authorization = nil
-	opts.RecommendedOptions.CoreAPI = nil
-	opts.RecommendedOptions.EgressSelector = nil
-	opts.RecommendedOptions.Admission.Plugins = admission.NewPlugins()
-	opts.RecommendedOptions.Admission.RecommendedPluginOrder = []string{}
-	opts.RecommendedOptions.Admission.EnablePlugins = []string{}
-	opts.RecommendedOptions.Features.EnablePriorityAndFairness = false
-	opts.RecommendedOptions.ExtraAdmissionInitializers = func(_ *genericapiserver.RecommendedConfig) ([]admission.PluginInitializer, error) {
-		return nil, nil
-	}
-	cmd := server.NewCommandStartServer(ctx, opts)
-	code := cli.Run(cmd)
-	os.Exit(code)
-}
--- a/apps/alerting/rules/definitions/alerting-manifest.yaml
+++ b/apps/alerting/rules/definitions/alerting-manifest.yaml
@@ -8,16 +8,7 @@ spec:
  preferredVersion: v0alpha1
  versions:
  - kinds:
-    - admission:
-        mutation:
-          operations:
-          - CREATE
-          - UPDATE
-        validation:
-          operations:
-          - CREATE
-          - UPDATE
-      conversion: false
+    - conversion: false
      kind: AlertRule
      plural: AlertRules
      schemas:
@@ -223,16 +214,7 @@ spec:
      - spec.panelRef.dashboardUID
      - spec.panelRef.panelID
      - spec.notificationSettings.receiver
-    - admission:
-        mutation:
-          operations:
-          - CREATE
-          - UPDATE
-        validation:
-          operations:
-          - CREATE
-          - UPDATE
-      conversion: false
+    - conversion: false
      kind: RecordingRule
      plural: RecordingRules
      schemas:
--- a/apps/alerting/rules/go.mod
+++ b/apps/alerting/rules/go.mod
@@ -5,7 +5,6 @@ go 1.25.3
 require (
 	github.com/grafana/grafana-app-sdk v0.48.1
 	github.com/grafana/grafana-app-sdk/logging v0.48.1
-	github.com/prometheus/common v0.67.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
 )
@@ -50,6 +49,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.67.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/puzpuzpuz/xsync/v2 v2.5.1 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
--- a/apps/alerting/rules/kinds/alertRule.cue
+++ b/apps/alerting/rules/kinds/alertRule.cue
@@ -13,18 +13,6 @@ alertRulev0alpha1: alertRuleKind & {
 	schema: {
 		spec: v0alpha1.AlertRuleSpec
 	}
-	validation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
-	mutation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
 	selectableFields: [
 		"spec.title",
 		"spec.paused",
--- a/apps/alerting/rules/kinds/recordingRule.cue
+++ b/apps/alerting/rules/kinds/recordingRule.cue
@@ -13,18 +13,6 @@ recordingRulev0alpha1: recordingRuleKind & {
 	schema: {
 		spec: v0alpha1.RecordingRuleSpec
 	}
-	validation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
-	mutation: {
-		operations: [
-			"CREATE",
-			"UPDATE",
-		]
-	}
 	selectableFields: [
 		"spec.title",
 		"spec.paused",
--- a/apps/alerting/rules/pkg/apis/alerting/v0alpha1/alertrule_ext.go
+++ b/apps/alerting/rules/pkg/apis/alerting/v0alpha1/alertrule_ext.go
@@ -3,7 +3,6 @@ package v0alpha1
 import (
 	"fmt"
 	"slices"
-	"time"
 )

 func (o *AlertRule) GetProvenanceStatus() string {
@@ -49,78 +48,4 @@ func (s *AlertRuleSpec) ExecErrStateOrDefault() string {
 	return s.ExecErrState
 }

-func (d *AlertRulePromDuration) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *AlertRulePromDurationWMillis) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *AlertRulePromDuration) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = AlertRulePromDuration(clampedDuration)
-	return nil
-}
-
-func (d *AlertRulePromDurationWMillis) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = AlertRulePromDurationWMillis(clampedDuration)
-	return nil
-}
-
-func (spec *AlertRuleSpec) ClampDurations() error {
-	// clamp all duration fields
-	if err := spec.Trigger.Interval.Clamp(); err != nil {
-		return err
-	}
-	if spec.For != nil {
-		clamped, err := ClampDuration(*spec.For)
-		if err != nil {
-			return err
-		}
-		spec.For = &clamped
-	}
-	if spec.KeepFiringFor != nil {
-		clamped, err := ClampDuration(*spec.KeepFiringFor)
-		if err != nil {
-			return err
-		}
-		spec.KeepFiringFor = &clamped
-	}
-	if spec.NotificationSettings != nil {
-		if spec.NotificationSettings.GroupWait != nil {
-			if err := spec.NotificationSettings.GroupWait.Clamp(); err != nil {
-				return err
-			}
-		}
-		if spec.NotificationSettings.GroupInterval != nil {
-			if err := spec.NotificationSettings.GroupInterval.Clamp(); err != nil {
-				return err
-			}
-		}
-		if spec.NotificationSettings.RepeatInterval != nil {
-			if err := spec.NotificationSettings.RepeatInterval.Clamp(); err != nil {
-				return err
-			}
-		}
-	}
-	for k, expr := range spec.Expressions {
-		if expr.RelativeTimeRange != nil {
-			if err := expr.RelativeTimeRange.From.Clamp(); err != nil {
-				return err
-			}
-			if err := expr.RelativeTimeRange.To.Clamp(); err != nil {
-				return err
-			}
-			spec.Expressions[k] = expr
-		}
-	}
-	return nil
-}
+// TODO: add duration clamping for the field types AlertRulePromDuration, AlertRulePromDurationWMillis, and the For and KeepFiringFor string pointers
--- a/apps/alerting/rules/pkg/apis/alerting/v0alpha1/ext.go
+++ b/apps/alerting/rules/pkg/apis/alerting/v0alpha1/ext.go
@@ -1,22 +1,10 @@
 package v0alpha1

-import (
-	"fmt"
-	"time"
-
-	prom_model "github.com/prometheus/common/model"
-)
-
 const (
 	InternalPrefix                = "grafana.com/"
 	GroupLabelKey                 = InternalPrefix + "group"
 	GroupIndexLabelKey            = GroupLabelKey + "-index"
 	ProvenanceStatusAnnotationKey = InternalPrefix + "provenance"
-	// Copy of the max title length used in legacy validation path
-	AlertRuleMaxTitleLength = 190
-	// Annotation key used to store the folder UID on resources
-	FolderAnnotationKey = "grafana.app/folder"
-	FolderLabelKey      = FolderAnnotationKey
 )

 const (
@@ -27,20 +15,3 @@ const (
 var (
 	AcceptedProvenanceStatuses = []string{ProvenanceStatusNone, ProvenanceStatusAPI}
 )
-
-func ToDuration(s string) (time.Duration, error) {
-	promDuration, err := prom_model.ParseDuration(s)
-	if err != nil {
-		return 0, fmt.Errorf("invalid duration format: %w", err)
-	}
-	return time.Duration(promDuration), nil
-}
-
-// Convert the string duration to the longest valid Prometheus duration format (e.g., "60s" -> "1m")
-func ClampDuration(s string) (string, error) {
-	promDuration, err := prom_model.ParseDuration(s)
-	if err != nil {
-		return "", fmt.Errorf("invalid duration format: %w", err)
-	}
-	return promDuration.String(), nil
-}
--- a/apps/alerting/rules/pkg/apis/alerting/v0alpha1/recordingrule_ext.go
+++ b/apps/alerting/rules/pkg/apis/alerting/v0alpha1/recordingrule_ext.go
@@ -3,7 +3,6 @@ package v0alpha1
 import (
 	"fmt"
 	"slices"
-	"time"
 )

 func (o *RecordingRule) GetProvenanceStatus() string {
@@ -28,47 +27,4 @@ func (o *RecordingRule) SetProvenanceStatus(status string) (err error) {
 	return
 }

-func (d *RecordingRulePromDuration) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *RecordingRulePromDurationWMillis) ToDuration() (time.Duration, error) {
-	return ToDuration(string(*d))
-}
-
-func (d *RecordingRulePromDuration) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = RecordingRulePromDuration(clampedDuration)
-	return nil
-}
-
-func (d *RecordingRulePromDurationWMillis) Clamp() error {
-	clampedDuration, err := ClampDuration(string(*d))
-	if err != nil {
-		return err
-	}
-	*d = RecordingRulePromDurationWMillis(clampedDuration)
-	return nil
-}
-
-func (spec *RecordingRuleSpec) ClampDurations() error {
-	// clamp all duration fields
-	if err := spec.Trigger.Interval.Clamp(); err != nil {
-		return err
-	}
-	for k, expr := range spec.Expressions {
-		if expr.RelativeTimeRange != nil {
-			if err := expr.RelativeTimeRange.From.Clamp(); err != nil {
-				return err
-			}
-			if err := expr.RelativeTimeRange.To.Clamp(); err != nil {
-				return err
-			}
-			spec.Expressions[k] = expr
-		}
-	}
-	return nil
-}
+// TODO: add duration clamping for the field types RecordingRulePromDurationWMillis and RecordingRulePromDuration
--- a/apps/alerting/rules/pkg/apis/alerting_manifest.go
+++ b/apps/alerting/rules/pkg/apis/alerting_manifest.go
@@ -42,21 +42,7 @@ var appManifestData = app.ManifestData{
 					Plural:     "AlertRules",
 					Scope:      "Namespaced",
 					Conversion: false,
-					Admission: &app.AdmissionCapabilities{
-						Validation: &app.ValidationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-						Mutation: &app.MutationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-					},
-					Schema: &versionSchemaAlertRulev0alpha1,
+					Schema:     &versionSchemaAlertRulev0alpha1,
 					SelectableFields: []string{
 						"spec.title",
 						"spec.paused",
@@ -71,21 +57,7 @@ var appManifestData = app.ManifestData{
 					Plural:     "RecordingRules",
 					Scope:      "Namespaced",
 					Conversion: false,
-					Admission: &app.AdmissionCapabilities{
-						Validation: &app.ValidationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-						Mutation: &app.MutationCapability{
-							Operations: []app.AdmissionOperation{
-								app.AdmissionOperationCreate,
-								app.AdmissionOperationUpdate,
-							},
-						},
-					},
-					Schema: &versionSchemaRecordingRulev0alpha1,
+					Schema:     &versionSchemaRecordingRulev0alpha1,
 					SelectableFields: []string{
 						"spec.title",
 						"spec.paused",
--- a/apps/alerting/rules/pkg/app/alertrule/mutator.go
+++ b/apps/alerting/rules/pkg/app/alertrule/mutator.go
@@ -1,45 +0,0 @@
-package alertrule
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/simple"
-	v1 "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-)
-
-func NewMutator(cfg config.RuntimeConfig) *simple.Mutator {
-	return &simple.Mutator{
-		MutateFunc: func(ctx context.Context, req *app.AdmissionRequest) (*app.MutatingResponse, error) {
-			// Mutate folder label to match folder UID from annotation
-			r, ok := req.Object.(*v1.AlertRule)
-			if !ok || r == nil {
-				// Nothing to do or wrong type; no mutation
-				return nil, nil
-			}
-
-			// Read folder UID from annotation
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[v1.FolderAnnotationKey]
-			}
-
-			// Ensure labels map exists and set the folder label if folderUID is present
-			if folderUID != "" {
-				if r.Labels == nil {
-					r.Labels = make(map[string]string)
-				}
-				// Maintain folder metadata label for downstream systems (alertmanager grouping etc.)
-				r.Labels[v1.FolderLabelKey] = folderUID
-			}
-
-			// clamp all duration fields
-			if err := r.Spec.ClampDurations(); err != nil {
-				return nil, err
-			}
-
-			return &app.MutatingResponse{UpdatedObject: r}, nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/alertrule/validator.go
+++ b/apps/alerting/rules/pkg/app/alertrule/validator.go
@@ -1,123 +0,0 @@
-package alertrule
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strconv"
-	"time"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"github.com/grafana/grafana-app-sdk/simple"
-	model "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/util"
-	prom_model "github.com/prometheus/common/model"
-)
-
-func NewValidator(cfg config.RuntimeConfig) *simple.Validator {
-	return &simple.Validator{
-		ValidateFunc: func(ctx context.Context, req *app.AdmissionRequest) error {
-			// Cast to specific type
-			r, ok := req.Object.(*model.AlertRule)
-			if !ok {
-				return fmt.Errorf("object is not of type *v0alpha1.AlertRule")
-			}
-
-			// 1) Validate provenance status annotation
-			sourceProv := r.GetProvenanceStatus()
-			if !slices.Contains(model.AcceptedProvenanceStatuses, sourceProv) {
-				return fmt.Errorf("invalid provenance status: %s", sourceProv)
-			}
-
-			// 2) Validate group labels rules
-			group := r.Labels[model.GroupLabelKey]
-			groupIndexStr := r.Labels[model.GroupIndexLabelKey]
-			if req.Action == resource.AdmissionActionCreate {
-				if group != "" || groupIndexStr != "" {
-					return fmt.Errorf("cannot set group when creating alert rule")
-				}
-			}
-			if group != "" { // if group is set, group-index must be set and numeric
-				if groupIndexStr == "" {
-					return fmt.Errorf("%s must be set when %s is set", model.GroupIndexLabelKey, model.GroupLabelKey)
-				}
-				if _, err := strconv.Atoi(groupIndexStr); err != nil {
-					return fmt.Errorf("invalid %s: %w", model.GroupIndexLabelKey, err)
-				}
-			}
-
-			// 3) Validate folder is set and exists
-			// Read folder UID directly from annotations
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[model.FolderAnnotationKey]
-			}
-			if folderUID == "" {
-				return fmt.Errorf("folder is required")
-			}
-			if cfg.FolderValidator != nil {
-				ok, verr := cfg.FolderValidator(ctx, folderUID)
-				if verr != nil {
-					return fmt.Errorf("failed to validate folder: %w", verr)
-				}
-				if !ok {
-					return fmt.Errorf("folder does not exist: %s", folderUID)
-				}
-			}
-
-			// 4) Validate notification settings receiver if provided
-			if r.Spec.NotificationSettings != nil && r.Spec.NotificationSettings.Receiver != "" && cfg.NotificationSettingsValidator != nil {
-				ok, nerr := cfg.NotificationSettingsValidator(ctx, r.Spec.NotificationSettings.Receiver)
-				if nerr != nil {
-					return fmt.Errorf("failed to validate notification settings: %w", nerr)
-				}
-				if !ok {
-					return fmt.Errorf("invalid notification receiver: %s", r.Spec.NotificationSettings.Receiver)
-				}
-			}
-
-			// 5) Enforce max title length
-			if len(r.Spec.Title) > model.AlertRuleMaxTitleLength {
-				return fmt.Errorf("alert rule title is too long. Max length is %d", model.AlertRuleMaxTitleLength)
-			}
-
-			// 6) Validate evaluation interval against base interval
-			if err := util.ValidateInterval(cfg.BaseEvaluationInterval, &r.Spec.Trigger.Interval); err != nil {
-				return err
-			}
-
-			// 7) Disallow reserved/spec system label keys
-			if r.Spec.Labels != nil {
-				for key := range r.Spec.Labels {
-					if _, bad := cfg.ReservedLabelKeys[key]; bad {
-						return fmt.Errorf("label key is reserved and cannot be specified: %s", key)
-					}
-				}
-			}
-
-			// 8) For and KeepFiringFor must be >= 0 if set
-			if r.Spec.For != nil {
-				d, err := prom_model.ParseDuration(*r.Spec.For)
-				if err != nil {
-					return fmt.Errorf("invalid 'for' duration: %w", err)
-				}
-				if time.Duration(d) < 0 {
-					return fmt.Errorf("'for' cannot be less than 0")
-				}
-			}
-			if r.Spec.KeepFiringFor != nil {
-				d, err := prom_model.ParseDuration(*r.Spec.KeepFiringFor)
-				if err != nil {
-					return fmt.Errorf("invalid 'keepFiringFor' duration: %w", err)
-				}
-				if time.Duration(d) < 0 {
-					return fmt.Errorf("'keepFiringFor' cannot be less than 0")
-				}
-			}
-
-			return nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/app.go
+++ b/apps/alerting/rules/pkg/app/app.go
@@ -6,29 +6,16 @@ import (
 	"github.com/grafana/grafana-app-sdk/app"
 	"github.com/grafana/grafana-app-sdk/logging"
 	"github.com/grafana/grafana-app-sdk/operator"
-	"github.com/grafana/grafana-app-sdk/resource"
 	"github.com/grafana/grafana-app-sdk/simple"

 	"github.com/grafana/grafana/apps/alerting/rules/pkg/apis"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/alertrule"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/recordingrule"
 )

 func New(cfg app.Config) (app.App, error) {
 	managedKinds := make([]simple.AppManagedKind, 0)
-	runtimeCfg, ok := cfg.SpecificConfig.(config.RuntimeConfig)
-	if !ok {
-		return nil, config.ErrInvalidRuntimeConfig
-	}
 	for _, kinds := range apis.GetKinds() {
 		for _, kind := range kinds {
-			managedKind := simple.AppManagedKind{
-				Kind:      kind,
-				Validator: buildKindValidator(kind, runtimeCfg),
-				Mutator:   buildKindMutator(kind, runtimeCfg),
-			}
-			managedKinds = append(managedKinds, managedKind)
+			managedKinds = append(managedKinds, simple.AppManagedKind{Kind: kind})
 		}
 	}

@@ -57,23 +44,3 @@ func New(cfg app.Config) (app.App, error) {

 	return a, nil
 }
-
-func buildKindValidator(kind resource.Kind, cfg config.RuntimeConfig) *simple.Validator {
-	switch kind.Kind() {
-	case "AlertRule":
-		return alertrule.NewValidator(cfg)
-	case "RecordingRule":
-		return recordingrule.NewValidator(cfg)
-	}
-	return nil
-}
-
-func buildKindMutator(kind resource.Kind, cfg config.RuntimeConfig) *simple.Mutator {
-	switch kind.Kind() {
-	case "AlertRule":
-		return alertrule.NewMutator(cfg)
-	case "RecordingRule":
-		return recordingrule.NewMutator(cfg)
-	}
-	return nil
-}
--- a/apps/alerting/rules/pkg/app/app_test.go
+++ b/apps/alerting/rules/pkg/app/app_test.go
@@ -1,175 +0,0 @@
-package app_test
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	appsdk "github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-
-	v1 "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/alertrule"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/recordingrule"
-)
-
-func makeDefaultRuntimeConfig() config.RuntimeConfig {
-	return config.RuntimeConfig{
-		FolderValidator:               func(ctx context.Context, folderUID string) (bool, error) { return folderUID == "f1", nil },
-		BaseEvaluationInterval:        60 * time.Second, // seconds
-		ReservedLabelKeys:             map[string]struct{}{"__reserved__": {}, "grafana_folder": {}},
-		NotificationSettingsValidator: func(ctx context.Context, receiver string) (bool, error) { return receiver == "notif-ok", nil },
-	}
-}
-
-func TestAlertRuleValidation_Success(t *testing.T) {
-	r := &v1.AlertRule{}
-	r.SetGroupVersionKind(v1.AlertRuleKind().GroupVersionKind())
-	r.Name = "uid-1"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.AlertRuleSpec{
-		Title:                "ok",
-		Trigger:              v1.AlertRuleIntervalTrigger{Interval: v1.AlertRulePromDuration("60s")},
-		Expressions:          v1.AlertRuleExpressionMap{"A": v1.AlertRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		NoDataState:          v1.DefaultNoDataState,
-		ExecErrState:         v1.DefaultExecErrState,
-		NotificationSettings: &v1.AlertRuleV0alpha1SpecNotificationSettings{Receiver: "notif-ok"},
-	}
-
-	req := &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r}
-	validator := alertrule.NewValidator(makeDefaultRuntimeConfig())
-	if err := validator.Validate(context.Background(), req); err != nil {
-		t.Fatalf("expected success, got error: %v", err)
-	}
-}
-
-func TestAlertRuleValidation_Errors(t *testing.T) {
-	mk := func(mut func(r *v1.AlertRule)) error {
-		r := baseAlertRule()
-		mut(r)
-		return alertrule.NewValidator(makeDefaultRuntimeConfig()).Validate(context.Background(), &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r})
-	}
-
-	if err := mk(func(r *v1.AlertRule) { r.Annotations = nil }); err == nil {
-		t.Errorf("want folder required error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Annotations[v1.FolderAnnotationKey] = "bad" }); err == nil {
-		t.Errorf("want folder not exist error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Spec.Trigger.Interval = v1.AlertRulePromDuration("30s") }); err == nil {
-		t.Errorf("want base interval multiple error")
-	}
-	if err := mk(func(r *v1.AlertRule) {
-		r.Spec.NotificationSettings = &v1.AlertRuleV0alpha1SpecNotificationSettings{Receiver: "bad"}
-	}); err == nil {
-		t.Errorf("want invalid receiver error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Labels[v1.GroupLabelKey] = "grp" }); err == nil {
-		t.Errorf("want group set on create error")
-	}
-	if err := mk(func(r *v1.AlertRule) { r.Spec.For = strPtr("-10s") }); err == nil {
-		t.Errorf("want for>=0 error")
-	}
-	if err := mk(func(r *v1.AlertRule) {
-		if r.Spec.Labels == nil {
-			r.Spec.Labels = map[string]v1.AlertRuleTemplateString{}
-		}
-		r.Spec.Labels["__reserved__"] = v1.AlertRuleTemplateString("x")
-	}); err == nil {
-		t.Errorf("want reserved label key error")
-	}
-}
-
-func baseAlertRule() *v1.AlertRule {
-	r := &v1.AlertRule{}
-	r.SetGroupVersionKind(v1.AlertRuleKind().GroupVersionKind())
-	r.Name = "uid-1"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.AlertRuleSpec{
-		Title:        "ok",
-		Trigger:      v1.AlertRuleIntervalTrigger{Interval: v1.AlertRulePromDuration("60s")},
-		Expressions:  v1.AlertRuleExpressionMap{"A": v1.AlertRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		NoDataState:  v1.DefaultNoDataState,
-		ExecErrState: v1.DefaultExecErrState,
-	}
-	return r
-}
-
-func TestRecordingRuleValidation_Success(t *testing.T) {
-	r := &v1.RecordingRule{}
-	r.SetGroupVersionKind(v1.RecordingRuleKind().GroupVersionKind())
-	r.Name = "uid-2"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.RecordingRuleSpec{
-		Title:               "ok",
-		Trigger:             v1.RecordingRuleIntervalTrigger{Interval: v1.RecordingRulePromDuration("60s")},
-		Expressions:         v1.RecordingRuleExpressionMap{"A": v1.RecordingRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		Metric:              "test_metric",
-		TargetDatasourceUID: "ds1",
-	}
-
-	req := &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r}
-	validator := recordingrule.NewValidator(makeDefaultRuntimeConfig())
-	if err := validator.Validate(context.Background(), req); err != nil {
-		t.Fatalf("expected success, got error: %v", err)
-	}
-}
-
-func TestRecordingRuleValidation_Errors(t *testing.T) {
-	mk := func(mut func(r *v1.RecordingRule)) error {
-		r := baseRecordingRule()
-		mut(r)
-		return recordingrule.NewValidator(makeDefaultRuntimeConfig()).Validate(context.Background(), &appsdk.AdmissionRequest{Action: resource.AdmissionActionCreate, Object: r})
-	}
-
-	if err := mk(func(r *v1.RecordingRule) { r.Annotations = nil }); err == nil {
-		t.Errorf("want folder required error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Annotations[v1.FolderAnnotationKey] = "bad" }); err == nil {
-		t.Errorf("want folder not exist error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Spec.Trigger.Interval = v1.RecordingRulePromDuration("30s") }); err == nil {
-		t.Errorf("want base interval multiple error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Labels[v1.GroupLabelKey] = "grp" }); err == nil {
-		t.Errorf("want group set on create error")
-	}
-	if err := mk(func(r *v1.RecordingRule) { r.Spec.Metric = "" }); err == nil {
-		t.Errorf("want metric required error")
-	}
-	if err := mk(func(r *v1.RecordingRule) {
-		if r.Spec.Labels == nil {
-			r.Spec.Labels = map[string]v1.RecordingRuleTemplateString{}
-		}
-		r.Spec.Labels["__reserved__"] = v1.RecordingRuleTemplateString("x")
-	}); err == nil {
-		t.Errorf("want reserved label key error")
-	}
-}
-
-func baseRecordingRule() *v1.RecordingRule {
-	r := &v1.RecordingRule{}
-	r.SetGroupVersionKind(v1.RecordingRuleKind().GroupVersionKind())
-	r.Name = "uid-1"
-	r.Namespace = "ns1"
-	r.Annotations = map[string]string{v1.FolderAnnotationKey: "f1"}
-	r.Labels = map[string]string{}
-	r.Spec = v1.RecordingRuleSpec{
-		Title:               "ok",
-		Trigger:             v1.RecordingRuleIntervalTrigger{Interval: v1.RecordingRulePromDuration("60s")},
-		Expressions:         v1.RecordingRuleExpressionMap{"A": v1.RecordingRuleExpression{Model: map[string]any{"expr": "1"}, Source: boolPtr(true)}},
-		Metric:              "test_metric",
-		TargetDatasourceUID: "ds1",
-	}
-	return r
-}
-
-func boolPtr(b bool) *bool    { return &b }
-func strPtr(s string) *string { return &s }
--- a/apps/alerting/rules/pkg/app/config/runtime.go
+++ b/apps/alerting/rules/pkg/app/config/runtime.go
@@ -1,22 +0,0 @@
-package config
-
-import (
-	"context"
-	"errors"
-	"time"
-)
-
-var (
-	ErrInvalidRuntimeConfig = errors.New("invalid runtime config provided to alerting/rules app")
-)
-
-// RuntimeConfig holds configuration values needed at runtime by the alerting/rules app from the running Grafana instance.
-type RuntimeConfig struct {
-	// function to check folder existence given its uid
-	FolderValidator func(ctx context.Context, folderUID string) (bool, error)
-	// base evaluation interval
-	BaseEvaluationInterval time.Duration
-	// set of strings which are illegal for label keys on rules
-	ReservedLabelKeys             map[string]struct{}
-	NotificationSettingsValidator func(ctx context.Context, receiver string) (bool, error)
-}
--- a/apps/alerting/rules/pkg/app/recordingrule/mutator.go
+++ b/apps/alerting/rules/pkg/app/recordingrule/mutator.go
@@ -1,37 +0,0 @@
-package recordingrule
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/simple"
-	v1 "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-)
-
-func NewMutator(cfg config.RuntimeConfig) *simple.Mutator {
-	return &simple.Mutator{
-		MutateFunc: func(ctx context.Context, req *app.AdmissionRequest) (*app.MutatingResponse, error) {
-			r, ok := req.Object.(*v1.RecordingRule)
-			if !ok || r == nil {
-				return nil, nil
-			}
-
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[v1.FolderAnnotationKey]
-			}
-
-			if folderUID != "" {
-				if r.Labels == nil {
-					r.Labels = make(map[string]string)
-				}
-				r.Labels[v1.FolderLabelKey] = folderUID
-			}
-			if err := r.Spec.ClampDurations(); err != nil {
-				return nil, err
-			}
-			return &app.MutatingResponse{UpdatedObject: r}, nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/recordingrule/validator.go
+++ b/apps/alerting/rules/pkg/app/recordingrule/validator.go
@@ -1,95 +0,0 @@
-package recordingrule
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strconv"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"github.com/grafana/grafana-app-sdk/simple"
-	model "github.com/grafana/grafana/apps/alerting/rules/pkg/apis/alerting/v0alpha1"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/config"
-	"github.com/grafana/grafana/apps/alerting/rules/pkg/app/util"
-	prom_model "github.com/prometheus/common/model"
-)
-
-func NewValidator(cfg config.RuntimeConfig) *simple.Validator {
-	return &simple.Validator{
-		ValidateFunc: func(ctx context.Context, req *app.AdmissionRequest) error {
-			// Cast to specific type
-			r, ok := req.Object.(*model.RecordingRule)
-			if !ok {
-				return fmt.Errorf("object is not of type *v0alpha1.RecordingRule")
-			}
-
-			sourceProv := r.GetProvenanceStatus()
-			if !slices.Contains(model.AcceptedProvenanceStatuses, sourceProv) {
-				return fmt.Errorf("invalid provenance status: %s", sourceProv)
-			}
-
-			group := r.Labels[model.GroupLabelKey]
-			groupIndexStr := r.Labels[model.GroupIndexLabelKey]
-			if req.Action == resource.AdmissionActionCreate {
-				if group != "" || groupIndexStr != "" {
-					return fmt.Errorf("cannot set group when creating recording rule")
-				}
-			}
-			if group != "" {
-				if groupIndexStr == "" {
-					return fmt.Errorf("%s must be set when %s is set", model.GroupIndexLabelKey, model.GroupLabelKey)
-				}
-				if _, err := strconv.Atoi(groupIndexStr); err != nil {
-					return fmt.Errorf("invalid %s: %w", model.GroupIndexLabelKey, err)
-				}
-			}
-
-			folderUID := ""
-			if r.Annotations != nil {
-				folderUID = r.Annotations[model.FolderAnnotationKey]
-			}
-			if folderUID == "" {
-				return fmt.Errorf("folder is required")
-			}
-			if cfg.FolderValidator != nil {
-				ok, verr := cfg.FolderValidator(ctx, folderUID)
-				if verr != nil {
-					return fmt.Errorf("failed to validate folder: %w", verr)
-				}
-				if !ok {
-					return fmt.Errorf("folder does not exist: %s", folderUID)
-				}
-			}
-
-			if len(r.Spec.Title) > model.AlertRuleMaxTitleLength {
-				return fmt.Errorf("recording rule title is too long. Max length is %d", model.AlertRuleMaxTitleLength)
-			}
-
-			if err := util.ValidateInterval(cfg.BaseEvaluationInterval, &r.Spec.Trigger.Interval); err != nil {
-				return err
-			}
-
-			if r.Spec.Labels != nil {
-				for key := range r.Spec.Labels {
-					if _, bad := cfg.ReservedLabelKeys[key]; bad {
-						return fmt.Errorf("label key is reserved and cannot be specified: %s", key)
-					}
-				}
-			}
-
-			if r.Spec.Metric == "" {
-				return fmt.Errorf("metric must be specified")
-			}
-			metric := prom_model.LabelValue(r.Spec.Metric)
-			if !metric.IsValid() {
-				return fmt.Errorf("metric contains invalid characters")
-			}
-			if !prom_model.IsValidMetricName(metric) { // nolint:staticcheck
-				return fmt.Errorf("invalid metric name")
-			}
-
-			return nil
-		},
-	}
-}
--- a/apps/alerting/rules/pkg/app/util/validator.go
+++ b/apps/alerting/rules/pkg/app/util/validator.go
@@ -1,27 +0,0 @@
-package util
-
-import (
-	"fmt"
-	"time"
-)
-
-type DurationLike interface {
-	ToDuration() (time.Duration, error)
-}
-
-func ValidateInterval(baseInterval time.Duration, d DurationLike) error {
-	interval, err := d.ToDuration()
-	if err != nil {
-		return fmt.Errorf("invalid trigger interval: %w", err)
-	}
-	// Ensure interval is positive and an integer multiple of BaseEvaluationInterval (if provided)
-	if interval <= 0 {
-		return fmt.Errorf("trigger interval must be greater than 0")
-	}
-	if baseInterval > 0 {
-		if (interval % baseInterval) != 0 {
-			return fmt.Errorf("trigger interval must be a multiple of base evaluation interval (%s)", baseInterval.String())
-		}
-	}
-	return nil
-}
--- a/apps/annotation/Makefile
+++ b/apps/annotation/Makefile
@@ -1,9 +0,0 @@
-include ../sdk.mk
-
-.PHONY: generate # Run Grafana App SDK code generation
-generate: install-app-sdk update-app-sdk
-	@$(APP_SDK_BIN) generate \
-		--source=./kinds/ \
-		--gogenpath=./pkg/apis \
-		--grouping=group \
-		--defencoding=none
--- a/apps/annotation/go.mod
+++ b/apps/annotation/go.mod
@@ -1,93 +0,0 @@
-module github.com/grafana/grafana/apps/annotation
-
-go 1.24.0
-
-require (
-	github.com/grafana/grafana-app-sdk v0.48.1
-	github.com/grafana/grafana-app-sdk/logging v0.48.1
-	k8s.io/apimachinery v0.34.1
-	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
-)
-
-require (
-	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
-	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/getkin/kin-openapi v0.133.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.22.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.2 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.1 // indirect
-	github.com/go-test/deep v1.1.1 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
-	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
-	github.com/onsi/ginkgo/v2 v2.22.2 // indirect
-	github.com/onsi/gomega v1.36.2 // indirect
-	github.com/perimeterx/marshmallow v1.1.5 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.1 // indirect
-	github.com/prometheus/procfs v0.16.1 // indirect
-	github.com/puzpuzpuz/xsync/v2 v2.5.1 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/woodsbury/decimal128 v1.3.0 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/otel v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
-	go.opentelemetry.io/otel/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
-	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.46.0 // indirect
-	golang.org/x/oauth2 v0.32.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.37.0 // indirect
-	golang.org/x/term v0.36.0 // indirect
-	golang.org/x/text v0.30.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 // indirect
-	google.golang.org/grpc v1.76.0 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.34.1 // indirect
-	k8s.io/apiextensions-apiserver v0.34.1 // indirect
-	k8s.io/client-go v0.34.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
-)
--- a/apps/annotation/go.sum
+++ b/apps/annotation/go.sum
@@ -1,240 +0,0 @@
-github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 h1:N7oVaKyGp8bttX0bfZGmcGkjz7DLQXhAn3DNd3T0ous=
-github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874/go.mod h1:r5xuitiExdLAJ09PR7vBVENGvp4ZuTBeWTGtxuX3K+c=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
-github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
-github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/getkin/kin-openapi v0.133.0 h1:pJdmNohVIJ97r4AUFtEXRXwESr8b0bD721u/Tz6k8PQ=
-github.com/getkin/kin-openapi v0.133.0/go.mod h1:boAciF6cXk5FhPqe/NQeBTeenbjqU4LhWBf09ILVvWE=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/jsonpointer v0.22.1 h1:sHYI1He3b9NqJ4wXLoJDKmUmHkWy/L7rtEo92JUxBNk=
-github.com/go-openapi/jsonpointer v0.22.1/go.mod h1:pQT9OsLkfz1yWoMgYFy4x3U5GY5nUlsOn1qSBH5MkCM=
-github.com/go-openapi/jsonreference v0.21.2 h1:Wxjda4M/BBQllegefXrY/9aq1fxBA8sI5M/lFU6tSWU=
-github.com/go-openapi/jsonreference v0.21.2/go.mod h1:pp3PEjIsJ9CZDGCNOyXIQxsNuroxm8FAJ/+quA0yKzQ=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
-github.com/go-openapi/swag/jsonname v0.25.1 h1:Sgx+qbwa4ej6AomWC6pEfXrA6uP2RkaNjA9BR8a1RJU=
-github.com/go-openapi/swag/jsonname v0.25.1/go.mod h1:71Tekow6UOLBD3wS7XhdT98g5J5GR13NOTQ9/6Q11Zo=
-github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
-github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
-github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
-github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grafana/grafana-app-sdk v0.48.1 h1:bKJadWH18WCpJ+Zk8AezRFXCcZgGredRv+fRS+8zkek=
-github.com/grafana/grafana-app-sdk v0.48.1/go.mod h1:5LljCz+wvmGfkQ8ZKTOfserhtXNEF0cSFthoWShvN6c=
-github.com/grafana/grafana-app-sdk/logging v0.48.1 h1:veM0X5LAPyN3KsDLglWjIofndbGuf7MqnrDuDN+F/Ng=
-github.com/grafana/grafana-app-sdk/logging v0.48.1/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
-github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
-github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
-github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
-github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
-github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU=
-github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk=
-github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
-github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
-github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
-github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.1 h1:OTSON1P4DNxzTg4hmKCc37o4ZAZDv0cfXLkOt0oEowI=
-github.com/prometheus/common v0.67.1/go.mod h1:RpmT9v35q2Y+lsieQsdOh5sXZ6ajUGC8NjZAmr8vb0Q=
-github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg=
-github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
-github.com/puzpuzpuz/xsync/v2 v2.5.1 h1:mVGYAvzDSu52+zaGyNjC+24Xw2bQi3kTr4QJ6N9pIIU=
-github.com/puzpuzpuz/xsync/v2 v2.5.1/go.mod h1:gD2H2krq/w52MfPLE+Uy64TzJDVY7lP2znR9qmR35kU=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
-github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
-github.com/woodsbury/decimal128 v1.3.0 h1:8pffMNWIlC0O5vbyHWFZAt5yWvWcrHA+3ovIIjVWss0=
-github.com/woodsbury/decimal128 v1.3.0/go.mod h1:C5UTmyTjW3JftjUFzOVhC20BEQa2a4ZKOB5I6Zjb+ds=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
-go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 h1:aTL7F04bJHUlztTsNGJ2l+6he8c+y/b//eR0jjjemT4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0/go.mod h1:kldtb7jDTeol0l3ewcmd8SDvx3EmIE7lyvqbasU3QC4=
-go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
-go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
-go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
-go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
-go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
-go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
-go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
-go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
-go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
-go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
-golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
-golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
-golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
-golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
-golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
-golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
-gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090 h1:d8Nakh1G+ur7+P3GcMjpRDEkoLUcLW2iU92XVqR+XMQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20250908214217-97024824d090/go.mod h1:U8EXRNSd8sUYyDfs/It7KVWodQr+Hf9xtxyxWudSwEw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 h1:CirRxTOwnRWVLKzDNrs0CXAaVozJoR4G9xvdRecrdpk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
-google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
-google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
-gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
-k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
-k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
-k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
-k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
-k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
-k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
-k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
-sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
-sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
--- a/apps/annotation/kinds/annotation.cue
+++ b/apps/annotation/kinds/annotation.cue
@@ -1,17 +0,0 @@
-package kinds
-
-annotationv0alpha1: {
-	kind:       "Annotation"
-  pluralName: "Annotations"
-	schema: {
-		spec: {
-			text: string
-      time: int64
-      timeEnd?: int64
-      dashboardUID?: string
-      panelID?: int64
-      tags?: [...string]
-		}
-	}
-}
-
--- a/apps/annotation/kinds/cue.mod/module.cue
+++ b/apps/annotation/kinds/cue.mod/module.cue
@@ -1,2 +0,0 @@
-module: "github.com/grafana/grafana/apps/annotation/kinds"
-language: version: "v0.8.2"
--- a/apps/annotation/kinds/manifest.cue
+++ b/apps/annotation/kinds/manifest.cue
@@ -1,21 +0,0 @@
-package kinds
-
-manifest: {
-	appName: "annotation"
-  groupOverride: "annotation.grafana.app"
-	versions: {
-	    "v0alpha1": v0alpha1
-	}
-}
-
-v0alpha1: {
-    kinds: [annotationv0alpha1]
-    codegen: {
-        ts: {
-            enabled: true
-        }
-        go: {
-            enabled: true
-        }
-    }
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_client_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_client_gen.go
@@ -1,99 +0,0 @@
-package v0alpha1
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-type AnnotationClient struct {
-	client *resource.TypedClient[*Annotation, *AnnotationList]
-}
-
-func NewAnnotationClient(client resource.Client) *AnnotationClient {
-	return &AnnotationClient{
-		client: resource.NewTypedClient[*Annotation, *AnnotationList](client, AnnotationKind()),
-	}
-}
-
-func NewAnnotationClientFromGenerator(generator resource.ClientGenerator) (*AnnotationClient, error) {
-	c, err := generator.ClientFor(AnnotationKind())
-	if err != nil {
-		return nil, err
-	}
-	return NewAnnotationClient(c), nil
-}
-
-func (c *AnnotationClient) Get(ctx context.Context, identifier resource.Identifier) (*Annotation, error) {
-	return c.client.Get(ctx, identifier)
-}
-
-func (c *AnnotationClient) List(ctx context.Context, namespace string, opts resource.ListOptions) (*AnnotationList, error) {
-	return c.client.List(ctx, namespace, opts)
-}
-
-func (c *AnnotationClient) ListAll(ctx context.Context, namespace string, opts resource.ListOptions) (*AnnotationList, error) {
-	resp, err := c.client.List(ctx, namespace, resource.ListOptions{
-		ResourceVersion: opts.ResourceVersion,
-		Limit:           opts.Limit,
-		LabelFilters:    opts.LabelFilters,
-		FieldSelectors:  opts.FieldSelectors,
-	})
-	if err != nil {
-		return nil, err
-	}
-	for resp.GetContinue() != "" {
-		page, err := c.client.List(ctx, namespace, resource.ListOptions{
-			Continue:        resp.GetContinue(),
-			ResourceVersion: opts.ResourceVersion,
-			Limit:           opts.Limit,
-			LabelFilters:    opts.LabelFilters,
-			FieldSelectors:  opts.FieldSelectors,
-		})
-		if err != nil {
-			return nil, err
-		}
-		resp.SetContinue(page.GetContinue())
-		resp.SetResourceVersion(page.GetResourceVersion())
-		resp.SetItems(append(resp.GetItems(), page.GetItems()...))
-	}
-	return resp, nil
-}
-
-func (c *AnnotationClient) Create(ctx context.Context, obj *Annotation, opts resource.CreateOptions) (*Annotation, error) {
-	// Make sure apiVersion and kind are set
-	obj.APIVersion = GroupVersion.Identifier()
-	obj.Kind = AnnotationKind().Kind()
-	return c.client.Create(ctx, obj, opts)
-}
-
-func (c *AnnotationClient) Update(ctx context.Context, obj *Annotation, opts resource.UpdateOptions) (*Annotation, error) {
-	return c.client.Update(ctx, obj, opts)
-}
-
-func (c *AnnotationClient) Patch(ctx context.Context, identifier resource.Identifier, req resource.PatchRequest, opts resource.PatchOptions) (*Annotation, error) {
-	return c.client.Patch(ctx, identifier, req, opts)
-}
-
-func (c *AnnotationClient) UpdateStatus(ctx context.Context, identifier resource.Identifier, newStatus AnnotationStatus, opts resource.UpdateOptions) (*Annotation, error) {
-	return c.client.Update(ctx, &Annotation{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       AnnotationKind().Kind(),
-			APIVersion: GroupVersion.Identifier(),
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			ResourceVersion: opts.ResourceVersion,
-			Namespace:       identifier.Namespace,
-			Name:            identifier.Name,
-		},
-		Status: newStatus,
-	}, resource.UpdateOptions{
-		Subresource:     "status",
-		ResourceVersion: opts.ResourceVersion,
-	})
-}
-
-func (c *AnnotationClient) Delete(ctx context.Context, identifier resource.Identifier, opts resource.DeleteOptions) error {
-	return c.client.Delete(ctx, identifier, opts)
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_codec_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_codec_gen.go
@@ -1,28 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/grafana/grafana-app-sdk/resource"
-)
-
-// AnnotationJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
-type AnnotationJSONCodec struct{}
-
-// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
-func (*AnnotationJSONCodec) Read(reader io.Reader, into resource.Object) error {
-	return json.NewDecoder(reader).Decode(into)
-}
-
-// Write writes JSON-encoded bytes into `writer` marshaled from `from`
-func (*AnnotationJSONCodec) Write(writer io.Writer, from resource.Object) error {
-	return json.NewEncoder(writer).Encode(from)
-}
-
-// Interface compliance checks
-var _ resource.Codec = &AnnotationJSONCodec{}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_metadata_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_metadata_gen.go
@@ -1,31 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-import (
-	time "time"
-)
-
-// metadata contains embedded CommonMetadata and can be extended with custom string fields
-// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
-// without external reference as using the CommonMetadata reference breaks thema codegen.
-type AnnotationMetadata struct {
-	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
-	CreatedBy         string            `json:"createdBy"`
-	Uid               string            `json:"uid"`
-	CreationTimestamp time.Time         `json:"creationTimestamp"`
-	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
-	Finalizers        []string          `json:"finalizers"`
-	ResourceVersion   string            `json:"resourceVersion"`
-	Generation        int64             `json:"generation"`
-	UpdatedBy         string            `json:"updatedBy"`
-	Labels            map[string]string `json:"labels"`
-}
-
-// NewAnnotationMetadata creates a new AnnotationMetadata object.
-func NewAnnotationMetadata() *AnnotationMetadata {
-	return &AnnotationMetadata{
-		Finalizers: []string{},
-		Labels:     map[string]string{},
-	}
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_object_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_object_gen.go
@@ -1,319 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"fmt"
-	"github.com/grafana/grafana-app-sdk/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"time"
-)
-
-// +k8s:openapi-gen=true
-type Annotation struct {
-	metav1.TypeMeta   `json:",inline" yaml:",inline"`
-	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
-
-	// Spec is the spec of the Annotation
-	Spec AnnotationSpec `json:"spec" yaml:"spec"`
-
-	Status AnnotationStatus `json:"status" yaml:"status"`
-}
-
-func (o *Annotation) GetSpec() any {
-	return o.Spec
-}
-
-func (o *Annotation) SetSpec(spec any) error {
-	cast, ok := spec.(AnnotationSpec)
-	if !ok {
-		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
-	}
-	o.Spec = cast
-	return nil
-}
-
-func (o *Annotation) GetSubresources() map[string]any {
-	return map[string]any{
-		"status": o.Status,
-	}
-}
-
-func (o *Annotation) GetSubresource(name string) (any, bool) {
-	switch name {
-	case "status":
-		return o.Status, true
-	default:
-		return nil, false
-	}
-}
-
-func (o *Annotation) SetSubresource(name string, value any) error {
-	switch name {
-	case "status":
-		cast, ok := value.(AnnotationStatus)
-		if !ok {
-			return fmt.Errorf("cannot set status type %#v, not of type AnnotationStatus", value)
-		}
-		o.Status = cast
-		return nil
-	default:
-		return fmt.Errorf("subresource '%s' does not exist", name)
-	}
-}
-
-func (o *Annotation) GetStaticMetadata() resource.StaticMetadata {
-	gvk := o.GroupVersionKind()
-	return resource.StaticMetadata{
-		Name:      o.ObjectMeta.Name,
-		Namespace: o.ObjectMeta.Namespace,
-		Group:     gvk.Group,
-		Version:   gvk.Version,
-		Kind:      gvk.Kind,
-	}
-}
-
-func (o *Annotation) SetStaticMetadata(metadata resource.StaticMetadata) {
-	o.Name = metadata.Name
-	o.Namespace = metadata.Namespace
-	o.SetGroupVersionKind(schema.GroupVersionKind{
-		Group:   metadata.Group,
-		Version: metadata.Version,
-		Kind:    metadata.Kind,
-	})
-}
-
-func (o *Annotation) GetCommonMetadata() resource.CommonMetadata {
-	dt := o.DeletionTimestamp
-	var deletionTimestamp *time.Time
-	if dt != nil {
-		deletionTimestamp = &dt.Time
-	}
-	// Legacy ExtraFields support
-	extraFields := make(map[string]any)
-	if o.Annotations != nil {
-		extraFields["annotations"] = o.Annotations
-	}
-	if o.ManagedFields != nil {
-		extraFields["managedFields"] = o.ManagedFields
-	}
-	if o.OwnerReferences != nil {
-		extraFields["ownerReferences"] = o.OwnerReferences
-	}
-	return resource.CommonMetadata{
-		UID:               string(o.UID),
-		ResourceVersion:   o.ResourceVersion,
-		Generation:        o.Generation,
-		Labels:            o.Labels,
-		CreationTimestamp: o.CreationTimestamp.Time,
-		DeletionTimestamp: deletionTimestamp,
-		Finalizers:        o.Finalizers,
-		UpdateTimestamp:   o.GetUpdateTimestamp(),
-		CreatedBy:         o.GetCreatedBy(),
-		UpdatedBy:         o.GetUpdatedBy(),
-		ExtraFields:       extraFields,
-	}
-}
-
-func (o *Annotation) SetCommonMetadata(metadata resource.CommonMetadata) {
-	o.UID = types.UID(metadata.UID)
-	o.ResourceVersion = metadata.ResourceVersion
-	o.Generation = metadata.Generation
-	o.Labels = metadata.Labels
-	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
-	if metadata.DeletionTimestamp != nil {
-		dt := metav1.NewTime(*metadata.DeletionTimestamp)
-		o.DeletionTimestamp = &dt
-	} else {
-		o.DeletionTimestamp = nil
-	}
-	o.Finalizers = metadata.Finalizers
-	if o.Annotations == nil {
-		o.Annotations = make(map[string]string)
-	}
-	if !metadata.UpdateTimestamp.IsZero() {
-		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
-	}
-	if metadata.CreatedBy != "" {
-		o.SetCreatedBy(metadata.CreatedBy)
-	}
-	if metadata.UpdatedBy != "" {
-		o.SetUpdatedBy(metadata.UpdatedBy)
-	}
-	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
-	if metadata.ExtraFields != nil {
-		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
-			if cast, ok := annotations.(map[string]string); ok {
-				o.Annotations = cast
-			}
-		}
-		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
-			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
-				o.ManagedFields = cast
-			}
-		}
-		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
-			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
-				o.OwnerReferences = cast
-			}
-		}
-	}
-}
-
-func (o *Annotation) GetCreatedBy() string {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
-}
-
-func (o *Annotation) SetCreatedBy(createdBy string) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
-}
-
-func (o *Annotation) GetUpdateTimestamp() time.Time {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
-	return parsed
-}
-
-func (o *Annotation) SetUpdateTimestamp(updateTimestamp time.Time) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
-}
-
-func (o *Annotation) GetUpdatedBy() string {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
-}
-
-func (o *Annotation) SetUpdatedBy(updatedBy string) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
-}
-
-func (o *Annotation) Copy() resource.Object {
-	return resource.CopyObject(o)
-}
-
-func (o *Annotation) DeepCopyObject() runtime.Object {
-	return o.Copy()
-}
-
-func (o *Annotation) DeepCopy() *Annotation {
-	cpy := &Annotation{}
-	o.DeepCopyInto(cpy)
-	return cpy
-}
-
-func (o *Annotation) DeepCopyInto(dst *Annotation) {
-	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
-	dst.TypeMeta.Kind = o.TypeMeta.Kind
-	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
-	o.Spec.DeepCopyInto(&dst.Spec)
-	o.Status.DeepCopyInto(&dst.Status)
-}
-
-// Interface compliance compile-time check
-var _ resource.Object = &Annotation{}
-
-// +k8s:openapi-gen=true
-type AnnotationList struct {
-	metav1.TypeMeta `json:",inline" yaml:",inline"`
-	metav1.ListMeta `json:"metadata" yaml:"metadata"`
-	Items           []Annotation `json:"items" yaml:"items"`
-}
-
-func (o *AnnotationList) DeepCopyObject() runtime.Object {
-	return o.Copy()
-}
-
-func (o *AnnotationList) Copy() resource.ListObject {
-	cpy := &AnnotationList{
-		TypeMeta: o.TypeMeta,
-		Items:    make([]Annotation, len(o.Items)),
-	}
-	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
-	for i := 0; i < len(o.Items); i++ {
-		if item, ok := o.Items[i].Copy().(*Annotation); ok {
-			cpy.Items[i] = *item
-		}
-	}
-	return cpy
-}
-
-func (o *AnnotationList) GetItems() []resource.Object {
-	items := make([]resource.Object, len(o.Items))
-	for i := 0; i < len(o.Items); i++ {
-		items[i] = &o.Items[i]
-	}
-	return items
-}
-
-func (o *AnnotationList) SetItems(items []resource.Object) {
-	o.Items = make([]Annotation, len(items))
-	for i := 0; i < len(items); i++ {
-		o.Items[i] = *items[i].(*Annotation)
-	}
-}
-
-func (o *AnnotationList) DeepCopy() *AnnotationList {
-	cpy := &AnnotationList{}
-	o.DeepCopyInto(cpy)
-	return cpy
-}
-
-func (o *AnnotationList) DeepCopyInto(dst *AnnotationList) {
-	resource.CopyObjectInto(dst, o)
-}
-
-// Interface compliance compile-time check
-var _ resource.ListObject = &AnnotationList{}
-
-// Copy methods for all subresource types
-
-// DeepCopy creates a full deep copy of Spec
-func (s *AnnotationSpec) DeepCopy() *AnnotationSpec {
-	cpy := &AnnotationSpec{}
-	s.DeepCopyInto(cpy)
-	return cpy
-}
-
-// DeepCopyInto deep copies Spec into another Spec object
-func (s *AnnotationSpec) DeepCopyInto(dst *AnnotationSpec) {
-	resource.CopyObjectInto(dst, s)
-}
-
-// DeepCopy creates a full deep copy of AnnotationStatus
-func (s *AnnotationStatus) DeepCopy() *AnnotationStatus {
-	cpy := &AnnotationStatus{}
-	s.DeepCopyInto(cpy)
-	return cpy
-}
-
-// DeepCopyInto deep copies AnnotationStatus into another AnnotationStatus object
-func (s *AnnotationStatus) DeepCopyInto(dst *AnnotationStatus) {
-	resource.CopyObjectInto(dst, s)
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_schema_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_schema_gen.go
@@ -1,34 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"github.com/grafana/grafana-app-sdk/resource"
-)
-
-// schema is unexported to prevent accidental overwrites
-var (
-	schemaAnnotation = resource.NewSimpleSchema("annotation.grafana.app", "v0alpha1", &Annotation{}, &AnnotationList{}, resource.WithKind("Annotation"),
-		resource.WithPlural("annotations"), resource.WithScope(resource.NamespacedScope))
-	kindAnnotation = resource.Kind{
-		Schema: schemaAnnotation,
-		Codecs: map[resource.KindEncoding]resource.Codec{
-			resource.KindEncodingJSON: &AnnotationJSONCodec{},
-		},
-	}
-)
-
-// Kind returns a resource.Kind for this Schema with a JSON codec
-func AnnotationKind() resource.Kind {
-	return kindAnnotation
-}
-
-// Schema returns a resource.SimpleSchema representation of Annotation
-func AnnotationSchema() *resource.SimpleSchema {
-	return schemaAnnotation
-}
-
-// Interface compliance checks
-var _ resource.Schema = kindAnnotation
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_spec_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_spec_gen.go
@@ -1,18 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-// +k8s:openapi-gen=true
-type AnnotationSpec struct {
-	Text         string   `json:"text"`
-	Time         int64    `json:"time"`
-	TimeEnd      *int64   `json:"timeEnd,omitempty"`
-	DashboardUID *string  `json:"dashboardUID,omitempty"`
-	PanelID      *int64   `json:"panelID,omitempty"`
-	Tags         []string `json:"tags,omitempty"`
-}
-
-// NewAnnotationSpec creates a new AnnotationSpec object.
-func NewAnnotationSpec() *AnnotationSpec {
-	return &AnnotationSpec{}
-}
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_status_gen.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/annotation_status_gen.go
@@ -1,44 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-// +k8s:openapi-gen=true
-type AnnotationstatusOperatorState struct {
-	// lastEvaluation is the ResourceVersion last evaluated
-	LastEvaluation string `json:"lastEvaluation"`
-	// state describes the state of the lastEvaluation.
-	// It is limited to three possible states for machine evaluation.
-	State AnnotationStatusOperatorStateState `json:"state"`
-	// descriptiveState is an optional more descriptive state field which has no requirements on format
-	DescriptiveState *string `json:"descriptiveState,omitempty"`
-	// details contains any extra information that is operator-specific
-	Details map[string]interface{} `json:"details,omitempty"`
-}
-
-// NewAnnotationstatusOperatorState creates a new AnnotationstatusOperatorState object.
-func NewAnnotationstatusOperatorState() *AnnotationstatusOperatorState {
-	return &AnnotationstatusOperatorState{}
-}
-
-// +k8s:openapi-gen=true
-type AnnotationStatus struct {
-	// operatorStates is a map of operator ID to operator state evaluations.
-	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
-	OperatorStates map[string]AnnotationstatusOperatorState `json:"operatorStates,omitempty"`
-	// additionalFields is reserved for future use
-	AdditionalFields map[string]interface{} `json:"additionalFields,omitempty"`
-}
-
-// NewAnnotationStatus creates a new AnnotationStatus object.
-func NewAnnotationStatus() *AnnotationStatus {
-	return &AnnotationStatus{}
-}
-
-// +k8s:openapi-gen=true
-type AnnotationStatusOperatorStateState string
-
-const (
-	AnnotationStatusOperatorStateStateSuccess    AnnotationStatusOperatorStateState = "success"
-	AnnotationStatusOperatorStateStateInProgress AnnotationStatusOperatorStateState = "in_progress"
-	AnnotationStatusOperatorStateStateFailed     AnnotationStatusOperatorStateState = "failed"
-)
--- a/apps/annotation/pkg/apis/annotation/v0alpha1/constants.go
+++ b/apps/annotation/pkg/apis/annotation/v0alpha1/constants.go
@@ -1,18 +0,0 @@
-package v0alpha1
-
-import "k8s.io/apimachinery/pkg/runtime/schema"
-
-const (
-	// APIGroup is the API group used by all kinds in this package
-	APIGroup = "annotation.grafana.app"
-	// APIVersion is the API version used by all kinds in this package
-	APIVersion = "v0alpha1"
-)
-
-var (
-	// GroupVersion is a schema.GroupVersion consisting of the Group and Version constants for this package
-	GroupVersion = schema.GroupVersion{
-		Group:   APIGroup,
-		Version: APIVersion,
-	}
-)
--- a/apps/annotation/pkg/apis/annotation_manifest.go
+++ b/apps/annotation/pkg/apis/annotation_manifest.go
@@ -1,124 +0,0 @@
-//
-// This file is generated by grafana-app-sdk
-// DO NOT EDIT
-//
-
-package apis
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/kube-openapi/pkg/spec3"
-	"k8s.io/kube-openapi/pkg/validation/spec"
-
-	v0alpha1 "github.com/grafana/grafana/apps/annotation/pkg/apis/annotation/v0alpha1"
-)
-
-var (
-	rawSchemaAnnotationv0alpha1     = []byte(`{"Annotation":{"properties":{"spec":{"$ref":"#/components/schemas/spec"},"status":{"$ref":"#/components/schemas/status"}},"required":["spec"]},"OperatorState":{"additionalProperties":false,"properties":{"descriptiveState":{"description":"descriptiveState is an optional more descriptive state field which has no requirements on format","type":"string"},"details":{"additionalProperties":{"additionalProperties":{},"type":"object"},"description":"details contains any extra information that is operator-specific","type":"object"},"lastEvaluation":{"description":"lastEvaluation is the ResourceVersion last evaluated","type":"string"},"state":{"description":"state describes the state of the lastEvaluation.\nIt is limited to three possible states for machine evaluation.","enum":["success","in_progress","failed"],"type":"string"}},"required":["lastEvaluation","state"],"type":"object"},"spec":{"additionalProperties":false,"properties":{"dashboardUID":{"type":"string"},"panelID":{"type":"integer"},"tags":{"items":{"type":"string"},"type":"array"},"text":{"type":"string"},"time":{"type":"integer"},"timeEnd":{"type":"integer"}},"required":["text","time"],"type":"object"},"status":{"additionalProperties":false,"properties":{"additionalFields":{"additionalProperties":{"additionalProperties":{},"type":"object"},"description":"additionalFields is reserved for future use","type":"object"},"operatorStates":{"additionalProperties":{"$ref":"#/components/schemas/OperatorState"},"description":"operatorStates is a map of operator ID to operator state evaluations.\nAny operator which consumes this kind SHOULD add its state evaluation information to this field.","type":"object"}},"type":"object"}}`)
-	versionSchemaAnnotationv0alpha1 app.VersionSchema
-	_                               = json.Unmarshal(rawSchemaAnnotationv0alpha1, &versionSchemaAnnotationv0alpha1)
-)
-
-var appManifestData = app.ManifestData{
-	AppName:          "annotation",
-	Group:            "annotation.grafana.app",
-	PreferredVersion: "v0alpha1",
-	Versions: []app.ManifestVersion{
-		{
-			Name:   "v0alpha1",
-			Served: true,
-			Kinds: []app.ManifestVersionKind{
-				{
-					Kind:       "Annotation",
-					Plural:     "Annotations",
-					Scope:      "Namespaced",
-					Conversion: false,
-					Schema:     &versionSchemaAnnotationv0alpha1,
-				},
-			},
-			Routes: app.ManifestVersionRoutes{
-				Namespaced: map[string]spec3.PathProps{},
-				Cluster:    map[string]spec3.PathProps{},
-				Schemas:    map[string]spec.Schema{},
-			},
-		},
-	},
-}
-
-func LocalManifest() app.Manifest {
-	return app.NewEmbeddedManifest(appManifestData)
-}
-
-func RemoteManifest() app.Manifest {
-	return app.NewAPIServerManifest("annotation")
-}
-
-var kindVersionToGoType = map[string]resource.Kind{
-	"Annotation/v0alpha1": v0alpha1.AnnotationKind(),
-}
-
-// ManifestGoTypeAssociator returns the associated resource.Kind instance for a given Kind and Version, if one exists.
-// If there is no association for the provided Kind and Version, exists will return false.
-func ManifestGoTypeAssociator(kind, version string) (goType resource.Kind, exists bool) {
-	goType, exists = kindVersionToGoType[fmt.Sprintf("%s/%s", kind, version)]
-	return goType, exists
-}
-
-var customRouteToGoResponseType = map[string]any{}
-
-// ManifestCustomRouteResponsesAssociator returns the associated response go type for a given kind, version, custom route path, and method, if one exists.
-// kind may be empty for custom routes which are not kind subroutes. Leading slashes are removed from subroute paths.
-// If there is no association for the provided kind, version, custom route path, and method, exists will return false.
-// Resource routes (those without a kind) should prefix their route with "<namespace>/" if the route is namespaced (otherwise the route is assumed to be cluster-scope)
-func ManifestCustomRouteResponsesAssociator(kind, version, path, verb string) (goType any, exists bool) {
-	if len(path) > 0 && path[0] == '/' {
-		path = path[1:]
-	}
-	goType, exists = customRouteToGoResponseType[fmt.Sprintf("%s|%s|%s|%s", version, kind, path, strings.ToUpper(verb))]
-	return goType, exists
-}
-
-var customRouteToGoParamsType = map[string]runtime.Object{}
-
-func ManifestCustomRouteQueryAssociator(kind, version, path, verb string) (goType runtime.Object, exists bool) {
-	if len(path) > 0 && path[0] == '/' {
-		path = path[1:]
-	}
-	goType, exists = customRouteToGoParamsType[fmt.Sprintf("%s|%s|%s|%s", version, kind, path, strings.ToUpper(verb))]
-	return goType, exists
-}
-
-var customRouteToGoRequestBodyType = map[string]any{}
-
-func ManifestCustomRouteRequestBodyAssociator(kind, version, path, verb string) (goType any, exists bool) {
-	if len(path) > 0 && path[0] == '/' {
-		path = path[1:]
-	}
-	goType, exists = customRouteToGoRequestBodyType[fmt.Sprintf("%s|%s|%s|%s", version, kind, path, strings.ToUpper(verb))]
-	return goType, exists
-}
-
-type GoTypeAssociator struct{}
-
-func NewGoTypeAssociator() *GoTypeAssociator {
-	return &GoTypeAssociator{}
-}
-
-func (g *GoTypeAssociator) KindToGoType(kind, version string) (goType resource.Kind, exists bool) {
-	return ManifestGoTypeAssociator(kind, version)
-}
-func (g *GoTypeAssociator) CustomRouteReturnGoType(kind, version, path, verb string) (goType any, exists bool) {
-	return ManifestCustomRouteResponsesAssociator(kind, version, path, verb)
-}
-func (g *GoTypeAssociator) CustomRouteQueryGoType(kind, version, path, verb string) (goType runtime.Object, exists bool) {
-	return ManifestCustomRouteQueryAssociator(kind, version, path, verb)
-}
-func (g *GoTypeAssociator) CustomRouteRequestBodyGoType(kind, version, path, verb string) (goType any, exists bool) {
-	return ManifestCustomRouteRequestBodyAssociator(kind, version, path, verb)
-}
--- a/apps/annotation/pkg/app/app.go
+++ b/apps/annotation/pkg/app/app.go
@@ -1,54 +0,0 @@
-package app
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/app"
-	"github.com/grafana/grafana-app-sdk/logging"
-	"github.com/grafana/grafana-app-sdk/operator"
-	"github.com/grafana/grafana-app-sdk/resource"
-	"github.com/grafana/grafana-app-sdk/simple"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-
-	annotationv0alpha1 "github.com/grafana/grafana/apps/annotation/pkg/apis/annotation/v0alpha1"
-)
-
-func New(cfg app.Config) (app.App, error) {
-	simpleConfig := simple.AppConfig{
-		Name:       "annotation",
-		KubeConfig: cfg.KubeConfig,
-		InformerConfig: simple.AppInformerConfig{
-			InformerOptions: operator.InformerOptions{
-				ErrorHandler: func(ctx context.Context, err error) {
-					logging.FromContext(ctx).Error("Informer processing error", "error", err)
-				},
-			},
-		},
-		ManagedKinds: []simple.AppManagedKind{{
-			Kind: annotationv0alpha1.AnnotationKind(),
-		},
-		},
-	}
-
-	a, err := simple.NewApp(simpleConfig)
-	if err != nil {
-		return nil, err
-	}
-
-	err = a.ValidateManifest(cfg.ManifestData)
-	if err != nil {
-		return nil, err
-	}
-
-	return a, nil
-}
-
-func GetKinds() map[schema.GroupVersion][]resource.Kind {
-	gv := schema.GroupVersion{
-		Group:   annotationv0alpha1.AnnotationKind().Group(),
-		Version: annotationv0alpha1.AnnotationKind().Version(),
-	}
-	return map[schema.GroupVersion][]resource.Kind{
-		gv: {annotationv0alpha1.AnnotationKind()},
-	}
-}
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/annotation_object_gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/annotation_object_gen.ts
@@ -1,49 +0,0 @@
-/*
- * This file was generated by grafana-app-sdk. DO NOT EDIT.
- */
-import { Spec } from './types.spec.gen';
-import { Status } from './types.status.gen';
-
-export interface Metadata {
-    name: string;
-    namespace: string;
-    generateName?: string;
-    selfLink?: string;
-    uid?: string;
-    resourceVersion?: string;
-    generation?: number;
-    creationTimestamp?: string;
-    deletionTimestamp?: string;
-    deletionGracePeriodSeconds?: number;
-    labels?: Record<string, string>;
-    annotations?: Record<string, string>;
-    ownerReferences?: OwnerReference[];
-    finalizers?: string[];
-    managedFields?: ManagedFieldsEntry[];
-}
-
-export interface OwnerReference {
-    apiVersion: string;
-    kind: string;
-    name: string;
-    uid: string;
-    controller?: boolean;
-    blockOwnerDeletion?: boolean;
-}
-
-export interface ManagedFieldsEntry {
-    manager?: string;
-    operation?: string;
-    apiVersion?: string;
-    time?: string;
-    fieldsType?: string;
-    subresource?: string;
-}
-
-export interface Annotation {
-    kind: string;
-    apiVersion: string;
-    metadata: Metadata;
-    spec: Spec;
-    status: Status;
-}
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.metadata.gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.metadata.gen.ts
@@ -1,30 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-// metadata contains embedded CommonMetadata and can be extended with custom string fields
-// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
-// without external reference as using the CommonMetadata reference breaks thema codegen.
-export interface Metadata {
-	updateTimestamp: string;
-	createdBy: string;
-	uid: string;
-	creationTimestamp: string;
-	deletionTimestamp?: string;
-	finalizers: string[];
-	resourceVersion: string;
-	generation: number;
-	updatedBy: string;
-	labels: Record<string, string>;
-}
-
-export const defaultMetadata = (): Metadata => ({
-	updateTimestamp: "",
-	createdBy: "",
-	uid: "",
-	creationTimestamp: "",
-	finalizers: [],
-	resourceVersion: "",
-	generation: 0,
-	updatedBy: "",
-	labels: {},
-});
-
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.spec.gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.spec.gen.ts
@@ -1,16 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-export interface Spec {
-	text: string;
-	time: number;
-	timeEnd?: number;
-	dashboardUID?: string;
-	panelID?: number;
-	tags?: string[];
-}
-
-export const defaultSpec = (): Spec => ({
-	text: "",
-	time: 0,
-});
-
--- a/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.status.gen.ts
+++ b/apps/annotation/plugin/src/generated/annotation/v0alpha1/types.status.gen.ts
@@ -1,30 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-export interface OperatorState {
-	// lastEvaluation is the ResourceVersion last evaluated
-	lastEvaluation: string;
-	// state describes the state of the lastEvaluation.
-	// It is limited to three possible states for machine evaluation.
-	state: "success" | "in_progress" | "failed";
-	// descriptiveState is an optional more descriptive state field which has no requirements on format
-	descriptiveState?: string;
-	// details contains any extra information that is operator-specific
-	details?: Record<string, any>;
-}
-
-export const defaultOperatorState = (): OperatorState => ({
-	lastEvaluation: "",
-	state: "success",
-});
-
-export interface Status {
-	// operatorStates is a map of operator ID to operator state evaluations.
-	// Any operator which consumes this kind SHOULD add its state evaluation information to this field.
-	operatorStates?: Record<string, OperatorState>;
-	// additionalFields is reserved for future use
-	additionalFields?: Record<string, any>;
-}
-
-export const defaultStatus = (): Status => ({
-});
-
--- a/apps/dashboard/pkg/apis/dashboard/types.go
+++ b/apps/dashboard/pkg/apis/dashboard/types.go
@@ -3,9 +3,8 @@ package dashboard
 // Information about how the requesting user can use a given dashboard
 type DashboardAccess struct {
 	// Metadata fields
-	Slug     string `json:"slug,omitempty"`
-	Url      string `json:"url,omitempty"`
-	IsPublic bool   `json:"isPublic"`
+	Slug string `json:"slug,omitempty"`
+	Url  string `json:"url,omitempty"`

 	// The permissions part
 	CanSave                bool                  `json:"canSave"`
--- a/apps/dashboard/pkg/apis/dashboard/v0alpha1/types.go
+++ b/apps/dashboard/pkg/apis/dashboard/v0alpha1/types.go
@@ -12,9 +12,8 @@ type DashboardWithAccessInfo struct {
 // +k8s:deepcopy-gen=true
 type DashboardAccess struct {
 	// Metadata fields
-	Slug     string `json:"slug,omitempty"`
-	Url      string `json:"url,omitempty"`
-	IsPublic bool   `json:"isPublic"`
+	Slug string `json:"slug,omitempty"`
+	Url  string `json:"url,omitempty"`

 	// The permissions part
 	CanSave                bool                  `json:"canSave"`
--- a/apps/dashboard/pkg/apis/dashboard/v0alpha1/zz_generated.conversion.go
+++ b/apps/dashboard/pkg/apis/dashboard/v0alpha1/zz_generated.conversion.go
@@ -112,7 +112,6 @@ func Convert_dashboard_AnnotationPermission_To_v0alpha1_AnnotationPermission(in
 func autoConvert_v0alpha1_DashboardAccess_To_dashboard_DashboardAccess(in *DashboardAccess, out *dashboard.DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
@@ -130,7 +129,6 @@ func Convert_v0alpha1_DashboardAccess_To_dashboard_DashboardAccess(in *Dashboard
 func autoConvert_dashboard_DashboardAccess_To_v0alpha1_DashboardAccess(in *dashboard.DashboardAccess, out *DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
--- a/apps/dashboard/pkg/apis/dashboard/v0alpha1/zz_generated.openapi.go
+++ b/apps/dashboard/pkg/apis/dashboard/v0alpha1/zz_generated.openapi.go
@@ -170,13 +170,6 @@ func schema_pkg_apis_dashboard_v0alpha1_DashboardAccess(ref common.ReferenceCall
 							Format: "",
 						},
 					},
-					"isPublic": {
-						SchemaProps: spec.SchemaProps{
-							Default: false,
-							Type:    []string{"boolean"},
-							Format:  "",
-						},
-					},
 					"canSave": {
 						SchemaProps: spec.SchemaProps{
 							Description: "The permissions part",
@@ -219,7 +212,7 @@ func schema_pkg_apis_dashboard_v0alpha1_DashboardAccess(ref common.ReferenceCall
 						},
 					},
 				},
-				Required: []string{"isPublic", "canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
+				Required: []string{"canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
 			},
 		},
 		Dependencies: []string{
--- a/apps/dashboard/pkg/apis/dashboard/v1beta1/types.go
+++ b/apps/dashboard/pkg/apis/dashboard/v1beta1/types.go
@@ -123,9 +123,8 @@ type DashboardWithAccessInfo struct {
 // +k8s:deepcopy-gen=true
 type DashboardAccess struct {
 	// Metadata fields
-	Slug     string `json:"slug,omitempty"`
-	Url      string `json:"url,omitempty"`
-	IsPublic bool   `json:"isPublic"`
+	Slug string `json:"slug,omitempty"`
+	Url  string `json:"url,omitempty"`

 	// The permissions part
 	CanSave                bool                  `json:"canSave"`
--- a/apps/dashboard/pkg/apis/dashboard/v1beta1/zz_generated.conversion.go
+++ b/apps/dashboard/pkg/apis/dashboard/v1beta1/zz_generated.conversion.go
@@ -118,7 +118,6 @@ func Convert_dashboard_AnnotationPermission_To_v1beta1_AnnotationPermission(in *
 func autoConvert_v1beta1_DashboardAccess_To_dashboard_DashboardAccess(in *DashboardAccess, out *dashboard.DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
@@ -136,7 +135,6 @@ func Convert_v1beta1_DashboardAccess_To_dashboard_DashboardAccess(in *DashboardA
 func autoConvert_dashboard_DashboardAccess_To_v1beta1_DashboardAccess(in *dashboard.DashboardAccess, out *DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
--- a/apps/dashboard/pkg/apis/dashboard/v1beta1/zz_generated.openapi.go
+++ b/apps/dashboard/pkg/apis/dashboard/v1beta1/zz_generated.openapi.go
@@ -165,13 +165,6 @@ func schema_pkg_apis_dashboard_v1beta1_DashboardAccess(ref common.ReferenceCallb
 							Format: "",
 						},
 					},
-					"isPublic": {
-						SchemaProps: spec.SchemaProps{
-							Default: false,
-							Type:    []string{"boolean"},
-							Format:  "",
-						},
-					},
 					"canSave": {
 						SchemaProps: spec.SchemaProps{
 							Description: "The permissions part",
@@ -214,7 +207,7 @@ func schema_pkg_apis_dashboard_v1beta1_DashboardAccess(ref common.ReferenceCallb
 						},
 					},
 				},
-				Required: []string{"isPublic", "canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
+				Required: []string{"canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
 			},
 		},
 		Dependencies: []string{
--- a/apps/dashboard/pkg/apis/dashboard/v2alpha1/types.go
+++ b/apps/dashboard/pkg/apis/dashboard/v2alpha1/types.go
@@ -123,9 +123,8 @@ type DashboardWithAccessInfo struct {
 // +k8s:deepcopy-gen=true
 type DashboardAccess struct {
 	// Metadata fields
-	Slug     string `json:"slug,omitempty"`
-	Url      string `json:"url,omitempty"`
-	IsPublic bool   `json:"isPublic"`
+	Slug string `json:"slug,omitempty"`
+	Url  string `json:"url,omitempty"`

 	// The permissions part
 	CanSave                bool                  `json:"canSave"`
--- a/apps/dashboard/pkg/apis/dashboard/v2alpha1/zz_generated.conversion.go
+++ b/apps/dashboard/pkg/apis/dashboard/v2alpha1/zz_generated.conversion.go
@@ -118,7 +118,6 @@ func Convert_dashboard_AnnotationPermission_To_v2alpha1_AnnotationPermission(in
 func autoConvert_v2alpha1_DashboardAccess_To_dashboard_DashboardAccess(in *DashboardAccess, out *dashboard.DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
@@ -136,7 +135,6 @@ func Convert_v2alpha1_DashboardAccess_To_dashboard_DashboardAccess(in *Dashboard
 func autoConvert_dashboard_DashboardAccess_To_v2alpha1_DashboardAccess(in *dashboard.DashboardAccess, out *DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
--- a/apps/dashboard/pkg/apis/dashboard/v2alpha1/zz_generated.openapi.go
+++ b/apps/dashboard/pkg/apis/dashboard/v2alpha1/zz_generated.openapi.go
@@ -265,13 +265,6 @@ func schema_pkg_apis_dashboard_v2alpha1_DashboardAccess(ref common.ReferenceCall
 							Format: "",
 						},
 					},
-					"isPublic": {
-						SchemaProps: spec.SchemaProps{
-							Default: false,
-							Type:    []string{"boolean"},
-							Format:  "",
-						},
-					},
 					"canSave": {
 						SchemaProps: spec.SchemaProps{
 							Description: "The permissions part",
@@ -314,7 +307,7 @@ func schema_pkg_apis_dashboard_v2alpha1_DashboardAccess(ref common.ReferenceCall
 						},
 					},
 				},
-				Required: []string{"isPublic", "canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
+				Required: []string{"canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
 			},
 		},
 		Dependencies: []string{
--- a/apps/dashboard/pkg/apis/dashboard/v2beta1/types.go
+++ b/apps/dashboard/pkg/apis/dashboard/v2beta1/types.go
@@ -123,9 +123,8 @@ type DashboardWithAccessInfo struct {
 // +k8s:deepcopy-gen=true
 type DashboardAccess struct {
 	// Metadata fields
-	Slug     string `json:"slug,omitempty"`
-	Url      string `json:"url,omitempty"`
-	IsPublic bool   `json:"isPublic"`
+	Slug string `json:"slug,omitempty"`
+	Url  string `json:"url,omitempty"`

 	// The permissions part
 	CanSave                bool                  `json:"canSave"`
--- a/apps/dashboard/pkg/apis/dashboard/v2beta1/zz_generated.conversion.go
+++ b/apps/dashboard/pkg/apis/dashboard/v2beta1/zz_generated.conversion.go
@@ -118,7 +118,6 @@ func Convert_dashboard_AnnotationPermission_To_v2beta1_AnnotationPermission(in *
 func autoConvert_v2beta1_DashboardAccess_To_dashboard_DashboardAccess(in *DashboardAccess, out *dashboard.DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
@@ -136,7 +135,6 @@ func Convert_v2beta1_DashboardAccess_To_dashboard_DashboardAccess(in *DashboardA
 func autoConvert_dashboard_DashboardAccess_To_v2beta1_DashboardAccess(in *dashboard.DashboardAccess, out *DashboardAccess, s conversion.Scope) error {
 	out.Slug = in.Slug
 	out.Url = in.Url
-	out.IsPublic = in.IsPublic
 	out.CanSave = in.CanSave
 	out.CanEdit = in.CanEdit
 	out.CanAdmin = in.CanAdmin
--- a/apps/dashboard/pkg/apis/dashboard/v2beta1/zz_generated.openapi.go
+++ b/apps/dashboard/pkg/apis/dashboard/v2beta1/zz_generated.openapi.go
@@ -269,13 +269,6 @@ func schema_pkg_apis_dashboard_v2beta1_DashboardAccess(ref common.ReferenceCallb
 							Format: "",
 						},
 					},
-					"isPublic": {
-						SchemaProps: spec.SchemaProps{
-							Default: false,
-							Type:    []string{"boolean"},
-							Format:  "",
-						},
-					},
 					"canSave": {
 						SchemaProps: spec.SchemaProps{
 							Description: "The permissions part",
@@ -318,7 +311,7 @@ func schema_pkg_apis_dashboard_v2beta1_DashboardAccess(ref common.ReferenceCallb
 						},
 					},
 				},
-				Required: []string{"isPublic", "canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
+				Required: []string{"canSave", "canEdit", "canAdmin", "canStar", "canDelete", "annotationsPermissions"},
 			},
 		},
 		Dependencies: []string{
--- a/apps/dashboard/pkg/migration/testdata/dev-dashboards-output/annotations/multi-lane-annotations.v42.json
+++ b/apps/dashboard/pkg/migration/testdata/dev-dashboards-output/annotations/multi-lane-annotations.v42.json
--- a/apps/dashboard/pkg/migration/testdata/dev-dashboards-output/panel-status-history/status-history-thresholds-mappings.v42.json
+++ b/apps/dashboard/pkg/migration/testdata/dev-dashboards-output/panel-status-history/status-history-thresholds-mappings.v42.json
--- a/apps/iam/go.mod
+++ b/apps/iam/go.mod
@@ -100,24 +100,24 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/at-wat/mqtt-go v0.19.4 // indirect
 	github.com/aws/aws-sdk-go v1.55.7 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.39.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.38.1 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.31.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.14 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.2 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 // indirect
 	github.com/aws/smithy-go v1.23.1 // indirect
 	github.com/axiomhq/hyperloglog v0.0.0-20240507144631-af9851f82b27 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
@@ -151,6 +151,7 @@ require (
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dennwc/varint v1.0.0 // indirect
 	github.com/dgraph-io/badger/v4 v4.7.0 // indirect
@@ -181,7 +182,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
-	github.com/go-logfmt/logfmt v0.6.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.24.0 // indirect
@@ -234,7 +235,7 @@ require (
 	github.com/grafana/authlib/types v0.0.0-20250926065801-df98203cff37 // indirect
 	github.com/grafana/dataplane/sdata v0.0.9 // indirect
 	github.com/grafana/dskit v0.0.0-20250908063411-6b6da59b5cc4 // indirect
-	github.com/grafana/grafana-aws-sdk v1.3.0 // indirect
+	github.com/grafana/grafana-aws-sdk v1.2.0 // indirect
 	github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 // indirect
 	github.com/grafana/grafana-plugin-sdk-go v0.281.0 // indirect
 	github.com/grafana/grafana/apps/dashboard v0.0.0 // indirect
@@ -294,6 +295,7 @@ require (
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lestrrat-go/strftime v1.0.4 // indirect
 	github.com/lib/pq v1.10.9 // indirect
+	github.com/magefile/mage v1.15.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38 // indirect
 	github.com/mattetti/filebuffer v1.0.1 // indirect
@@ -359,6 +361,7 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/cors v1.11.1 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/sethvargo/go-retry v0.3.0 // indirect
@@ -379,9 +382,13 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tetratelabs/wazero v1.8.2 // indirect
 	github.com/thomaspoignant/go-feature-flag v1.42.0 // indirect
-	github.com/tjhop/slog-gokit v0.1.5 // indirect
+	github.com/tjhop/slog-gokit v0.1.3 // indirect
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
 	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
+	github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 // indirect
+	github.com/unknwon/com v1.0.1 // indirect
+	github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a // indirect
+	github.com/urfave/cli v1.22.17 // indirect
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/woodsbury/decimal128 v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -448,6 +455,7 @@ require (
 	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/mail.v2 v2.3.1 // indirect
--- a/apps/iam/go.sum
+++ b/apps/iam/go.sum
@@ -122,8 +122,6 @@ github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.1/go.mod h1:8cl44BDmi+
 github.com/Azure/azure-storage-blob-go v0.15.0 h1:rXtgp8tN1p29GvpGgfJetavIG0V7OgcSXPpwp3tx6qk=
 github.com/Azure/azure-storage-blob-go v0.15.0/go.mod h1:vbjsVbX0dlxnRc4FFMPsS9BsJWPcne7GB7onqlPvz58=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest/autorest v0.11.29 h1:I4+HL/JDvErx2LjyzaVxllw2lRDB5/BT2Bm4g20iqYw=
@@ -237,22 +235,22 @@ github.com/aws/aws-sdk-go v1.17.7/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN
 github.com/aws/aws-sdk-go v1.38.35/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
-github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.38.1 h1:j7sc33amE74Rz0M/PoCpsZQ6OunLqys/m5antM0J+Z8=
+github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
-github.com/aws/aws-sdk-go-v2/config v1.31.10 h1:7LllDZAegXU3yk41mwM6KcPu0wmjKGQB1bg99bNdQm4=
-github.com/aws/aws-sdk-go-v2/config v1.31.10/go.mod h1:Ge6gzXPjqu4v0oHvgAwvGzYcK921GU0hQM25WF/Kl+8=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14 h1:TxkI7QI+sFkTItN/6cJuMZEIVMFXeu2dI1ZffkXngKI=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.14/go.mod h1:12x4Uw/vijC11XkctTjy92TNCQ+UnNJkT7fzX0Yd93E=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 h1:gLD09eaJUdiszm7vd1btiQUYE0Hj+0I2b8AS+75z9AY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8/go.mod h1:4RW3oMPt1POR74qVOC4SbubxAwdP4pCT0nSw3jycOU4=
+github.com/aws/aws-sdk-go-v2/config v1.31.2 h1:NOaSZpVGEH2Np/c1toSeW0jooNl+9ALmsUTZ8YvkJR0=
+github.com/aws/aws-sdk-go-v2/config v1.31.2/go.mod h1:17ft42Yb2lF6OigqSYiDAiUcX4RIkEMY6XxEMJsrAes=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6 h1:AmmvNEYrru7sYNJnp3pf57lGbiarX4T9qU/6AZ9SucU=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.6/go.mod h1:/jdQkh1iVPa01xndfECInp1v1Wnp70v3K4MvtlLGVEc=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 h1:lpdMwTzmuDLkgW7086jE94HweHCqG+uOJwHf3LZs7T0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84 h1:cTXRdLkpBanlDwISl+5chq5ui1d1YWg4PWMR9c3kXyw=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.84/go.mod h1:kwSy5X7tfIHN39uucmjQVs2LvDdXEjQucgQQEqCggEo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 h1:IdCLsiiIj5YJ3AFevsewURCPV+YWUlOW8JiPhoAy8vg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 h1:j7vjtr1YIssWQOMeOWRbh3z8g2oY/xPjnZH2gLY4sGw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.36 h1:GMYy2EOWfzdP3wfVAGXBNKY5vK4K8vMET4sYOYltmqs=
@@ -263,12 +261,12 @@ github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.51.0 h1:e5cbPZYTIY2nUEFie
 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.51.0/go.mod h1:UseIHRfrm7PqeZo6fcTb6FUCXzCnh1KJbQbmOfxArGM=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.225.2 h1:IfMb3Ar8xEaWjgH/zeVHYD8izwJdQgRP5mKCTDt4GNk=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.225.2/go.mod h1:35jGWx7ECvCwTsApqicFYzZ7JFEnBc6oHUuOQ3xIS54=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0/go.mod h1:eb3gfbVIxIoGgJsi9pGne19dhCBpK6opTYpQqAmdy44=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4 h1:nAP2GYbfh8dd2zGZqFRSMlq+/F6cMPBUuCsGAMkN074=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.4/go.mod h1:LT10DsiGjLWh4GbjInf9LQejkYEhBgBCjLG5+lvk4EE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 h1:ueB2Te0NacDMnaC+68za9jLwkjzxGWm0KB5HTUHjLTI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4/go.mod h1:nLEfLnVMmLvyIG58/6gsSA03F1voKGaCfHV7+lR8S7s=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17 h1:qcLWgdhq45sDM9na4cvXax9dyLitn8EYBRl8Ak4XtG4=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.17/go.mod h1:M+jkjBFZ2J6DJrjMv2+vkBbuht6kxJYtJiwoVgX4p4U=
 github.com/aws/aws-sdk-go-v2/service/kms v1.41.2 h1:zJeUxFP7+XP52u23vrp4zMcVhShTWbNO8dHV6xCSvFo=
@@ -279,12 +277,12 @@ github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.6 h1:Pwbxovp
 github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi v1.26.6/go.mod h1:Z4xLt5mXspLKjBV92i165wAJ/3T6TIv4n7RtIS8pWV0=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0 h1:0reDqfEN+tB+sozj2r92Bep8MEwBZgtAXTND1Kk9OXg=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.84.0/go.mod h1:kUklwasNoCn5YpyAqC/97r6dzTA1SRKJfKq16SXeoDU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 h1:FTdEN9dtWPB0EOURNtDPmwGp6GGvMqRJCAihkSl/1No=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.4/go.mod h1:mYubxV9Ff42fZH4kexj43gFPhgc/LyC7KqvUKt1watc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 h1:I7ghctfGXrscr7r1Ga/mDqSJKm7Fkpl5Mwq79Z+rZqU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0/go.mod h1:Zo9id81XP6jbayIFWNuDpA6lMBWhsVy+3ou2jLa4JnA=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 h1:+LVB0xBqEgjQoqr9bGZbRzvg212B0f17JdflleJRNR4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.5/go.mod h1:xoaxeqnnUaZjPjaICgIy5B+MHCSb/ZSOn4MvkFNOUA0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 h1:ve9dYBB8CfJGTFqcQ3ZLAAb/KXWgYlgu/2R2TZL2Ko0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.28.2/go.mod h1:n9bTZFZcBa9hGGqVz3i/a6+NG0zmZgtkB9qVVFDqPA8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2 h1:pd9G9HQaM6UZAZh19pYOkpKSQkyQQ9ftnl/LttQOcGI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.33.2/go.mod h1:eknndR9rU8UpE/OmFpqU78V1EcXPKFTTm5l/buZYgvM=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 h1:iV1Ko4Em/lkJIsoKyGfc0nQySi+v0Udxr6Igq+y9JZc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.0/go.mod h1:bEPcjW7IbolPfK67G1nilqWyoxYMSPrDiIQ3RdIdKgo=
 github.com/aws/smithy-go v1.23.1 h1:sLvcH6dfAFwGkHLZ7dGiYF7aK6mg4CgKA/iDKjLDt9M=
 github.com/aws/smithy-go v1.23.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/axiomhq/hyperloglog v0.0.0-20191112132149-a4c4c47bc57f/go.mod h1:2stgcRjl6QmW+gU2h5E7BQXg4HU0gzxKWDuT5HviN9s=
@@ -429,10 +427,6 @@ github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
-github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
-github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
-github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
@@ -442,10 +436,8 @@ github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03V
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
-github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
-github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -515,8 +507,6 @@ github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+m
 github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
 github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
-github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
-github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/edsrzf/mmap-go v0.0.0-20170320065105-0bce6a688712/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
 github.com/edsrzf/mmap-go v1.2.0 h1:hXLYlkbaPzt1SaQk+anYwKSRNhufIDCchSPkUD6dD84=
 github.com/edsrzf/mmap-go v1.2.0/go.mod h1:19H/e8pUPLicwkyNgOykDXkJ9F0MHE+Z52B8EIth78Q=
@@ -595,8 +585,8 @@ github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXg
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
-github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
@@ -605,8 +595,6 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-openapi/analysis v0.24.0 h1:vE/VFFkICKyYuTWYnplQ+aVr45vlG6NcZKC7BdIXhsA=
 github.com/go-openapi/analysis v0.24.0/go.mod h1:GLyoJA+bvmGGaHgpfeDh8ldpGo69fAJg7eeMDMRCIrw=
 github.com/go-openapi/errors v0.22.3 h1:k6Hxa5Jg1TUyZnOwV2Lh81j8ayNw5VVYLvKrp4zFKFs=
@@ -826,6 +814,9 @@ github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
+github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.1/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
@@ -855,8 +846,8 @@ github.com/grafana/grafana-app-sdk v0.48.1 h1:bKJadWH18WCpJ+Zk8AezRFXCcZgGredRv+
 github.com/grafana/grafana-app-sdk v0.48.1/go.mod h1:5LljCz+wvmGfkQ8ZKTOfserhtXNEF0cSFthoWShvN6c=
 github.com/grafana/grafana-app-sdk/logging v0.48.1 h1:veM0X5LAPyN3KsDLglWjIofndbGuf7MqnrDuDN+F/Ng=
 github.com/grafana/grafana-app-sdk/logging v0.48.1/go.mod h1:Gh/nBWnspK3oDNWtiM5qUF/fardHzOIEez+SPI3JeHA=
-github.com/grafana/grafana-aws-sdk v1.3.0 h1:/bfJzP93rCel1GbWoRSq0oUo424MZXt8jAp2BK9w8tM=
-github.com/grafana/grafana-aws-sdk v1.3.0/go.mod h1:VGycF0JkCGKND2O5je1ucOqPJ0ZNhZYzV3c2bNBAaGk=
+github.com/grafana/grafana-aws-sdk v1.2.0 h1:LLR4/g91WBuCRwm2cbWfCREq565+GxIFe08nqqIcIuw=
+github.com/grafana/grafana-aws-sdk v1.2.0/go.mod h1:bBo7qOmM3f61vO+2JxTolNUph1l2TmtzmWcU9/Im+8A=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1 h1:FFcEA01tW+SmuJIuDbHOdgUBL+d7DPrZ2N4zwzPhfGk=
 github.com/grafana/grafana-azure-sdk-go/v2 v2.3.1/go.mod h1:Oi4anANlCuTCc66jCyqIzfVbgLXFll8Wja+Y4vfANlc=
 github.com/grafana/grafana-cloud-migration-snapshot v1.9.0 h1:JOzchPgptwJdruYoed7x28lFDwhzs7kssResYsnC0iI=
@@ -879,8 +870,8 @@ github.com/grafana/loki/pkg/push v0.0.0-20250823105456-332df2b20000 h1:/5LKSYgLm
 github.com/grafana/loki/pkg/push v0.0.0-20250823105456-332df2b20000/go.mod h1:/ZklAgE1i4f3Z8uriXwESmCr1VLF8lBGaJspuaGuf78=
 github.com/grafana/loki/v3 v3.2.1 h1:VB7u+KHfvL5aHAxgoVBvz5wVhsdGuqKC7uuOFOOe7jw=
 github.com/grafana/loki/v3 v3.2.1/go.mod h1:WvdLl6wOS+yahaeQY+xhD2m2XzkHDfKr5FZaX7D/X2Y=
-github.com/grafana/nanogit v0.0.0-20251106115617-c622d3e0fc4b h1:rFjoqJFb2KxJ29K9ltuWRSsdA46SbN0GCxoQc36h5kg=
-github.com/grafana/nanogit v0.0.0-20251106115617-c622d3e0fc4b/go.mod h1:ToqLjIdvV3AZQa3K6e5m9hy/nsGaUByc2dWQlctB9iA=
+github.com/grafana/nanogit v0.0.0-20250723104447-68f58f5ecec0 h1:cS0SlJGIlZbmDLctNj5vIYGemrJDLy25wwoiIyZWVN8=
+github.com/grafana/nanogit v0.0.0-20250723104447-68f58f5ecec0/go.mod h1:ToqLjIdvV3AZQa3K6e5m9hy/nsGaUByc2dWQlctB9iA=
 github.com/grafana/otel-profiling-go v0.5.1 h1:stVPKAFZSa7eGiqbYuG25VcqYksR6iWvF3YH66t4qL8=
 github.com/grafana/otel-profiling-go v0.5.1/go.mod h1:ftN/t5A/4gQI19/8MoWurBEtC6gFw8Dns1sJZ9W4Tls=
 github.com/grafana/prometheus-alertmanager v0.25.1-0.20250911094103-5456b6e45604 h1:aXfUhVN/Ewfpbko2CCtL65cIiGgwStOo4lWH2b6gw2U=
@@ -1064,6 +1055,9 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6 h1:SwcnSwBR7X/5EHJQlXBockkJVIMRVt5yKaesBPMtyZQ=
 github.com/jszwedko/go-datemath v0.1.1-0.20230526204004-640a500621d6/go.mod h1:WrYiIuiXUMIvTDAQw97C+9l0CnBmCcvosPjN3XDqS/o=
+github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
@@ -1112,16 +1106,14 @@ github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683 h1:7UMa6KCCMjZEMDtTVdcGu0B1GmmC7QJKiCCjyTAWQy0=
-github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683/go.mod h1:ilwx/Dta8jXAgpFYFvSWEMwxmbWXyiUHkd5FwyKhb5k=
 github.com/m3db/prometheus_remote_client_golang v0.4.4 h1:DsAIjVKoCp7Ym35tAOFL1OuMLIdIikAEHeNPHY+yyM8=
 github.com/m3db/prometheus_remote_client_golang v0.4.4/go.mod h1:wHfVbA3eAK6dQvKjCkHhusWYegCk3bDGkA15zymSHdc=
 github.com/madflojo/testcerts v1.4.0 h1:I09gN0C1ly9IgeVNcAqKk8RAKIJTe3QnFrrPBDyvzN4=
 github.com/madflojo/testcerts v1.4.0/go.mod h1:MW8sh39gLnkKh4K0Nc55AyHEDl9l/FBLDUsQhpmkuo0=
+github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
+github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
-github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38 h1:hQWBtNqRYrI7CWIaUSXXtNKR90KzcUA5uiuxFVWw7sU=
@@ -1205,20 +1197,8 @@ github.com/mithrandie/ternary v1.1.1 h1:k/joD6UGVYxHixYmSR8EGgDFNONBMqyD373xT4QR
 github.com/mithrandie/ternary v1.1.1/go.mod h1:0D9Ba3+09K2TdSZO7/bFCC0GjSXetCvYuYq0u8FY/1g=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
-github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
-github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
-github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
-github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
-github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
-github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
-github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/mocktools/go-smtp-mock/v2 v2.5.1 h1:QcMJMChSgG1olVj4o6xxQFdrWzRjYNrcq660HAjd0wA=
 github.com/mocktools/go-smtp-mock/v2 v2.5.1/go.mod h1:Rr8M2njlxx//l5INl2+uESnsL2lDsL24teEykCrGfmE=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -1232,8 +1212,6 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWu
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
-github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -1341,8 +1319,6 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/pressly/goose/v3 v3.25.0 h1:6WeYhMWGRCzpyd89SpODFnCBCKz41KrVbRT58nVjGng=
 github.com/pressly/goose/v3 v3.25.0/go.mod h1:4hC1KrritdCxtuFsqgs1R4AU5bWtTAf+cnWvfhf2DNY=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
@@ -1418,8 +1394,8 @@ github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
 github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
-github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
@@ -1443,13 +1419,12 @@ github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah
 github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
 github.com/shadowspore/fossil-delta v0.0.0-20241213113458-1d797d70cbe3 h1:/4/IJi5iyTdh6mqOUaASW148HQpujYiHl0Wl78dSOSc=
 github.com/shadowspore/fossil-delta v0.0.0-20241213113458-1d797d70cbe3/go.mod h1:aJIMhRsunltJR926EB2MUg8qHemFQDreSB33pyto2Ps=
-github.com/shirou/gopsutil/v4 v4.25.6 h1:kLysI2JsKorfaFPcYmcJqbzROzsBWEOAtw6A7dIfqXs=
-github.com/shirou/gopsutil/v4 v4.25.6/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c h1:aqg5Vm5dwtvL+YgDpBcK1ITf3o96N/K7/wsRXQnUTEs=
 github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c/go.mod h1:owqhoLW1qZoYLZzLnBw+QkPP9WZnjlSWihhxAJC1+/M=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 h1:OfRzdxCzDhp+rsKWXuOO2I/quKMJ/+TQwVbIP/gltZg=
 github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92/go.mod h1:7/OT02F6S6I7v6WXb+IjhMuZEYfH/RJ5RwEWnEo5BMg=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -1458,6 +1433,11 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
 github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
@@ -1512,13 +1492,12 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/testcontainers/testcontainers-go v0.36.0 h1:YpffyLuHtdp5EUsI5mT4sRw8GZhO/5ozyDT1xWGXt00=
-github.com/testcontainers/testcontainers-go v0.36.0/go.mod h1:yk73GVJ0KUZIHUtFna6MO7QS144qYpoY8lEEtU9Hed0=
 github.com/tetratelabs/wazero v1.8.2 h1:yIgLR/b2bN31bjxwXHD8a3d+BogigR952csSDdLYEv4=
 github.com/tetratelabs/wazero v1.8.2/go.mod h1:yAI0XTsMBhREkM/YDAK/zNou3GoiAce1P6+rp/wQhjs=
 github.com/thejerf/slogassert v0.3.4 h1:VoTsXixRbXMrRSSxDjYTiEDCM4VWbsYPW5rB/hX24kM=
@@ -1526,12 +1505,8 @@ github.com/thejerf/slogassert v0.3.4/go.mod h1:0zn9ISLVKo1aPMTqcGfG1o6dWwt+Rk574
 github.com/thomaspoignant/go-feature-flag v1.42.0 h1:C7embmOTzaLyRki+OoU2RvtVjJE9IrvgBA2C1mRN1lc=
 github.com/thomaspoignant/go-feature-flag v1.42.0/go.mod h1:y0QiWH7chHWhGATb/+XqwAwErORmPSH2MUsQlCmmWlM=
 github.com/tidwall/pretty v0.0.0-20180105212114-65a9db5fad51/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
-github.com/tjhop/slog-gokit v0.1.5 h1:ayloIUi5EK2QYB8eY4DOPO95/mRtMW42lUkp3quJohc=
-github.com/tjhop/slog-gokit v0.1.5/go.mod h1:yA48zAHvV+Sg4z4VRyeFyFUNNXd3JY5Zg84u3USICq0=
-github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
-github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
-github.com/tklauser/numcpus v0.8.0 h1:Mx4Wwe/FjZLeQsK/6kt2EOepwwSl7SmJrK5bV/dXYgY=
-github.com/tklauser/numcpus v0.8.0/go.mod h1:ZJZlAY+dmR4eut8epnzf0u/VwodKmryxR8txiloSqBE=
+github.com/tjhop/slog-gokit v0.1.3 h1:6SdexP3UIeg93KLFeiM1Wp1caRwdTLgsD/THxBUy1+o=
+github.com/tjhop/slog-gokit v0.1.3/go.mod h1:Bbu5v2748qpAWH7k6gse/kw3076IJf6owJmh7yArmJs=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
@@ -1544,7 +1519,16 @@ github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
 github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8 h1:aVGB3YnaS/JNfOW3tiHIlmNmTDg618va+eT0mVomgyI=
+github.com/unknwon/bra v0.0.0-20200517080246-1e3013ecaff8/go.mod h1:fVle4kNr08ydeohzYafr20oZzbAkhQT39gKK/pFQ5M4=
+github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
+github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
+github.com/unknwon/log v0.0.0-20150304194804-e617c87089d3/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a h1:vcrhXnj9g9PIE+cmZgaPSwOyJ8MAQTRmsgGrB0x5rF4=
+github.com/unknwon/log v0.0.0-20200308114134-929b1006e34a/go.mod h1:1xEUf2abjfP92w2GZTV+GgaRxXErwRXcClbUwrNJffU=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ=
+github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo=
 github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
 github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
@@ -1578,8 +1562,6 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
-github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk=
 github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
@@ -1892,6 +1874,7 @@ golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191020152052-9984515f0562/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2268,6 +2251,8 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7 h1:XNNYLJHt73EyYiCZi6+xjupS9CpvmiDgjPTAjrBlQbo=
+gopkg.in/fsnotify/fsnotify.v1 v1.4.7/go.mod h1:Fyux9zXlo4rWoMSIzpn9fDAYjalPqJ/K1qJ27s+7ltE=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
--- a/apps/iam/kinds/externalgroupmapping.cue
+++ b/apps/iam/kinds/externalgroupmapping.cue
@@ -1,20 +0,0 @@
-package kinds
-
-import (
-	"github.com/grafana/grafana/apps/iam/kinds/v0alpha1"
-)
-
-externalGroupMappingKind: {
-	kind:       "ExternalGroupMapping"
-	pluralName: "ExternalGroupMappings"
-	codegen: {
-		ts: {enabled: false}
-		go: {enabled: true}
-	}
-}
-
-externalGroupMappingv0alpha1: externalGroupMappingKind & {
-	schema: {
-		spec: v0alpha1.ExternalGroupMappingSpec
-	}
-}
--- a/apps/iam/kinds/manifest.cue
+++ b/apps/iam/kinds/manifest.cue
@@ -20,6 +20,5 @@ v0alpha1: {
 		teamv0alpha1,
 		teambindingv0alpha1,
 		serviceaccountv0alpha1,
-		externalGroupMappingv0alpha1
 	]
 }
--- a/apps/iam/kinds/v0alpha1/externalgroupmappingspec.cue
+++ b/apps/iam/kinds/v0alpha1/externalgroupmappingspec.cue
@@ -1,6 +0,0 @@
-package v0alpha1
-
-ExternalGroupMappingSpec: {
-	teamRef:         TeamRef
-	externalGroupId: string
-}
--- a/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_client_gen.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_client_gen.go
@@ -1,80 +0,0 @@
-package v0alpha1
-
-import (
-	"context"
-
-	"github.com/grafana/grafana-app-sdk/resource"
-)
-
-type ExternalGroupMappingClient struct {
-	client *resource.TypedClient[*ExternalGroupMapping, *ExternalGroupMappingList]
-}
-
-func NewExternalGroupMappingClient(client resource.Client) *ExternalGroupMappingClient {
-	return &ExternalGroupMappingClient{
-		client: resource.NewTypedClient[*ExternalGroupMapping, *ExternalGroupMappingList](client, ExternalGroupMappingKind()),
-	}
-}
-
-func NewExternalGroupMappingClientFromGenerator(generator resource.ClientGenerator) (*ExternalGroupMappingClient, error) {
-	c, err := generator.ClientFor(ExternalGroupMappingKind())
-	if err != nil {
-		return nil, err
-	}
-	return NewExternalGroupMappingClient(c), nil
-}
-
-func (c *ExternalGroupMappingClient) Get(ctx context.Context, identifier resource.Identifier) (*ExternalGroupMapping, error) {
-	return c.client.Get(ctx, identifier)
-}
-
-func (c *ExternalGroupMappingClient) List(ctx context.Context, namespace string, opts resource.ListOptions) (*ExternalGroupMappingList, error) {
-	return c.client.List(ctx, namespace, opts)
-}
-
-func (c *ExternalGroupMappingClient) ListAll(ctx context.Context, namespace string, opts resource.ListOptions) (*ExternalGroupMappingList, error) {
-	resp, err := c.client.List(ctx, namespace, resource.ListOptions{
-		ResourceVersion: opts.ResourceVersion,
-		Limit:           opts.Limit,
-		LabelFilters:    opts.LabelFilters,
-		FieldSelectors:  opts.FieldSelectors,
-	})
-	if err != nil {
-		return nil, err
-	}
-	for resp.GetContinue() != "" {
-		page, err := c.client.List(ctx, namespace, resource.ListOptions{
-			Continue:        resp.GetContinue(),
-			ResourceVersion: opts.ResourceVersion,
-			Limit:           opts.Limit,
-			LabelFilters:    opts.LabelFilters,
-			FieldSelectors:  opts.FieldSelectors,
-		})
-		if err != nil {
-			return nil, err
-		}
-		resp.SetContinue(page.GetContinue())
-		resp.SetResourceVersion(page.GetResourceVersion())
-		resp.SetItems(append(resp.GetItems(), page.GetItems()...))
-	}
-	return resp, nil
-}
-
-func (c *ExternalGroupMappingClient) Create(ctx context.Context, obj *ExternalGroupMapping, opts resource.CreateOptions) (*ExternalGroupMapping, error) {
-	// Make sure apiVersion and kind are set
-	obj.APIVersion = GroupVersion.Identifier()
-	obj.Kind = ExternalGroupMappingKind().Kind()
-	return c.client.Create(ctx, obj, opts)
-}
-
-func (c *ExternalGroupMappingClient) Update(ctx context.Context, obj *ExternalGroupMapping, opts resource.UpdateOptions) (*ExternalGroupMapping, error) {
-	return c.client.Update(ctx, obj, opts)
-}
-
-func (c *ExternalGroupMappingClient) Patch(ctx context.Context, identifier resource.Identifier, req resource.PatchRequest, opts resource.PatchOptions) (*ExternalGroupMapping, error) {
-	return c.client.Patch(ctx, identifier, req, opts)
-}
-
-func (c *ExternalGroupMappingClient) Delete(ctx context.Context, identifier resource.Identifier, opts resource.DeleteOptions) error {
-	return c.client.Delete(ctx, identifier, opts)
-}
--- a/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_codec_gen.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_codec_gen.go
@@ -1,28 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"encoding/json"
-	"io"
-
-	"github.com/grafana/grafana-app-sdk/resource"
-)
-
-// ExternalGroupMappingJSONCodec is an implementation of resource.Codec for kubernetes JSON encoding
-type ExternalGroupMappingJSONCodec struct{}
-
-// Read reads JSON-encoded bytes from `reader` and unmarshals them into `into`
-func (*ExternalGroupMappingJSONCodec) Read(reader io.Reader, into resource.Object) error {
-	return json.NewDecoder(reader).Decode(into)
-}
-
-// Write writes JSON-encoded bytes into `writer` marshaled from `from`
-func (*ExternalGroupMappingJSONCodec) Write(writer io.Writer, from resource.Object) error {
-	return json.NewEncoder(writer).Encode(from)
-}
-
-// Interface compliance checks
-var _ resource.Codec = &ExternalGroupMappingJSONCodec{}
--- a/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_metadata_gen.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_metadata_gen.go
@@ -1,31 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-import (
-	time "time"
-)
-
-// metadata contains embedded CommonMetadata and can be extended with custom string fields
-// TODO: use CommonMetadata instead of redefining here; currently needs to be defined here
-// without external reference as using the CommonMetadata reference breaks thema codegen.
-type ExternalGroupMappingMetadata struct {
-	UpdateTimestamp   time.Time         `json:"updateTimestamp"`
-	CreatedBy         string            `json:"createdBy"`
-	Uid               string            `json:"uid"`
-	CreationTimestamp time.Time         `json:"creationTimestamp"`
-	DeletionTimestamp *time.Time        `json:"deletionTimestamp,omitempty"`
-	Finalizers        []string          `json:"finalizers"`
-	ResourceVersion   string            `json:"resourceVersion"`
-	Generation        int64             `json:"generation"`
-	UpdatedBy         string            `json:"updatedBy"`
-	Labels            map[string]string `json:"labels"`
-}
-
-// NewExternalGroupMappingMetadata creates a new ExternalGroupMappingMetadata object.
-func NewExternalGroupMappingMetadata() *ExternalGroupMappingMetadata {
-	return &ExternalGroupMappingMetadata{
-		Finalizers: []string{},
-		Labels:     map[string]string{},
-	}
-}
--- a/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_object_gen.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_object_gen.go
@@ -1,293 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"fmt"
-	"github.com/grafana/grafana-app-sdk/resource"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"time"
-)
-
-// +k8s:openapi-gen=true
-type ExternalGroupMapping struct {
-	metav1.TypeMeta   `json:",inline" yaml:",inline"`
-	metav1.ObjectMeta `json:"metadata" yaml:"metadata"`
-
-	// Spec is the spec of the ExternalGroupMapping
-	Spec ExternalGroupMappingSpec `json:"spec" yaml:"spec"`
-}
-
-func (o *ExternalGroupMapping) GetSpec() any {
-	return o.Spec
-}
-
-func (o *ExternalGroupMapping) SetSpec(spec any) error {
-	cast, ok := spec.(ExternalGroupMappingSpec)
-	if !ok {
-		return fmt.Errorf("cannot set spec type %#v, not of type Spec", spec)
-	}
-	o.Spec = cast
-	return nil
-}
-
-func (o *ExternalGroupMapping) GetSubresources() map[string]any {
-	return map[string]any{}
-}
-
-func (o *ExternalGroupMapping) GetSubresource(name string) (any, bool) {
-	switch name {
-	default:
-		return nil, false
-	}
-}
-
-func (o *ExternalGroupMapping) SetSubresource(name string, value any) error {
-	switch name {
-	default:
-		return fmt.Errorf("subresource '%s' does not exist", name)
-	}
-}
-
-func (o *ExternalGroupMapping) GetStaticMetadata() resource.StaticMetadata {
-	gvk := o.GroupVersionKind()
-	return resource.StaticMetadata{
-		Name:      o.ObjectMeta.Name,
-		Namespace: o.ObjectMeta.Namespace,
-		Group:     gvk.Group,
-		Version:   gvk.Version,
-		Kind:      gvk.Kind,
-	}
-}
-
-func (o *ExternalGroupMapping) SetStaticMetadata(metadata resource.StaticMetadata) {
-	o.Name = metadata.Name
-	o.Namespace = metadata.Namespace
-	o.SetGroupVersionKind(schema.GroupVersionKind{
-		Group:   metadata.Group,
-		Version: metadata.Version,
-		Kind:    metadata.Kind,
-	})
-}
-
-func (o *ExternalGroupMapping) GetCommonMetadata() resource.CommonMetadata {
-	dt := o.DeletionTimestamp
-	var deletionTimestamp *time.Time
-	if dt != nil {
-		deletionTimestamp = &dt.Time
-	}
-	// Legacy ExtraFields support
-	extraFields := make(map[string]any)
-	if o.Annotations != nil {
-		extraFields["annotations"] = o.Annotations
-	}
-	if o.ManagedFields != nil {
-		extraFields["managedFields"] = o.ManagedFields
-	}
-	if o.OwnerReferences != nil {
-		extraFields["ownerReferences"] = o.OwnerReferences
-	}
-	return resource.CommonMetadata{
-		UID:               string(o.UID),
-		ResourceVersion:   o.ResourceVersion,
-		Generation:        o.Generation,
-		Labels:            o.Labels,
-		CreationTimestamp: o.CreationTimestamp.Time,
-		DeletionTimestamp: deletionTimestamp,
-		Finalizers:        o.Finalizers,
-		UpdateTimestamp:   o.GetUpdateTimestamp(),
-		CreatedBy:         o.GetCreatedBy(),
-		UpdatedBy:         o.GetUpdatedBy(),
-		ExtraFields:       extraFields,
-	}
-}
-
-func (o *ExternalGroupMapping) SetCommonMetadata(metadata resource.CommonMetadata) {
-	o.UID = types.UID(metadata.UID)
-	o.ResourceVersion = metadata.ResourceVersion
-	o.Generation = metadata.Generation
-	o.Labels = metadata.Labels
-	o.CreationTimestamp = metav1.NewTime(metadata.CreationTimestamp)
-	if metadata.DeletionTimestamp != nil {
-		dt := metav1.NewTime(*metadata.DeletionTimestamp)
-		o.DeletionTimestamp = &dt
-	} else {
-		o.DeletionTimestamp = nil
-	}
-	o.Finalizers = metadata.Finalizers
-	if o.Annotations == nil {
-		o.Annotations = make(map[string]string)
-	}
-	if !metadata.UpdateTimestamp.IsZero() {
-		o.SetUpdateTimestamp(metadata.UpdateTimestamp)
-	}
-	if metadata.CreatedBy != "" {
-		o.SetCreatedBy(metadata.CreatedBy)
-	}
-	if metadata.UpdatedBy != "" {
-		o.SetUpdatedBy(metadata.UpdatedBy)
-	}
-	// Legacy support for setting Annotations, ManagedFields, and OwnerReferences via ExtraFields
-	if metadata.ExtraFields != nil {
-		if annotations, ok := metadata.ExtraFields["annotations"]; ok {
-			if cast, ok := annotations.(map[string]string); ok {
-				o.Annotations = cast
-			}
-		}
-		if managedFields, ok := metadata.ExtraFields["managedFields"]; ok {
-			if cast, ok := managedFields.([]metav1.ManagedFieldsEntry); ok {
-				o.ManagedFields = cast
-			}
-		}
-		if ownerReferences, ok := metadata.ExtraFields["ownerReferences"]; ok {
-			if cast, ok := ownerReferences.([]metav1.OwnerReference); ok {
-				o.OwnerReferences = cast
-			}
-		}
-	}
-}
-
-func (o *ExternalGroupMapping) GetCreatedBy() string {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	return o.ObjectMeta.Annotations["grafana.com/createdBy"]
-}
-
-func (o *ExternalGroupMapping) SetCreatedBy(createdBy string) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/createdBy"] = createdBy
-}
-
-func (o *ExternalGroupMapping) GetUpdateTimestamp() time.Time {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	parsed, _ := time.Parse(time.RFC3339, o.ObjectMeta.Annotations["grafana.com/updateTimestamp"])
-	return parsed
-}
-
-func (o *ExternalGroupMapping) SetUpdateTimestamp(updateTimestamp time.Time) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/updateTimestamp"] = updateTimestamp.Format(time.RFC3339)
-}
-
-func (o *ExternalGroupMapping) GetUpdatedBy() string {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	return o.ObjectMeta.Annotations["grafana.com/updatedBy"]
-}
-
-func (o *ExternalGroupMapping) SetUpdatedBy(updatedBy string) {
-	if o.ObjectMeta.Annotations == nil {
-		o.ObjectMeta.Annotations = make(map[string]string)
-	}
-
-	o.ObjectMeta.Annotations["grafana.com/updatedBy"] = updatedBy
-}
-
-func (o *ExternalGroupMapping) Copy() resource.Object {
-	return resource.CopyObject(o)
-}
-
-func (o *ExternalGroupMapping) DeepCopyObject() runtime.Object {
-	return o.Copy()
-}
-
-func (o *ExternalGroupMapping) DeepCopy() *ExternalGroupMapping {
-	cpy := &ExternalGroupMapping{}
-	o.DeepCopyInto(cpy)
-	return cpy
-}
-
-func (o *ExternalGroupMapping) DeepCopyInto(dst *ExternalGroupMapping) {
-	dst.TypeMeta.APIVersion = o.TypeMeta.APIVersion
-	dst.TypeMeta.Kind = o.TypeMeta.Kind
-	o.ObjectMeta.DeepCopyInto(&dst.ObjectMeta)
-	o.Spec.DeepCopyInto(&dst.Spec)
-}
-
-// Interface compliance compile-time check
-var _ resource.Object = &ExternalGroupMapping{}
-
-// +k8s:openapi-gen=true
-type ExternalGroupMappingList struct {
-	metav1.TypeMeta `json:",inline" yaml:",inline"`
-	metav1.ListMeta `json:"metadata" yaml:"metadata"`
-	Items           []ExternalGroupMapping `json:"items" yaml:"items"`
-}
-
-func (o *ExternalGroupMappingList) DeepCopyObject() runtime.Object {
-	return o.Copy()
-}
-
-func (o *ExternalGroupMappingList) Copy() resource.ListObject {
-	cpy := &ExternalGroupMappingList{
-		TypeMeta: o.TypeMeta,
-		Items:    make([]ExternalGroupMapping, len(o.Items)),
-	}
-	o.ListMeta.DeepCopyInto(&cpy.ListMeta)
-	for i := 0; i < len(o.Items); i++ {
-		if item, ok := o.Items[i].Copy().(*ExternalGroupMapping); ok {
-			cpy.Items[i] = *item
-		}
-	}
-	return cpy
-}
-
-func (o *ExternalGroupMappingList) GetItems() []resource.Object {
-	items := make([]resource.Object, len(o.Items))
-	for i := 0; i < len(o.Items); i++ {
-		items[i] = &o.Items[i]
-	}
-	return items
-}
-
-func (o *ExternalGroupMappingList) SetItems(items []resource.Object) {
-	o.Items = make([]ExternalGroupMapping, len(items))
-	for i := 0; i < len(items); i++ {
-		o.Items[i] = *items[i].(*ExternalGroupMapping)
-	}
-}
-
-func (o *ExternalGroupMappingList) DeepCopy() *ExternalGroupMappingList {
-	cpy := &ExternalGroupMappingList{}
-	o.DeepCopyInto(cpy)
-	return cpy
-}
-
-func (o *ExternalGroupMappingList) DeepCopyInto(dst *ExternalGroupMappingList) {
-	resource.CopyObjectInto(dst, o)
-}
-
-// Interface compliance compile-time check
-var _ resource.ListObject = &ExternalGroupMappingList{}
-
-// Copy methods for all subresource types
-
-// DeepCopy creates a full deep copy of Spec
-func (s *ExternalGroupMappingSpec) DeepCopy() *ExternalGroupMappingSpec {
-	cpy := &ExternalGroupMappingSpec{}
-	s.DeepCopyInto(cpy)
-	return cpy
-}
-
-// DeepCopyInto deep copies Spec into another Spec object
-func (s *ExternalGroupMappingSpec) DeepCopyInto(dst *ExternalGroupMappingSpec) {
-	resource.CopyObjectInto(dst, s)
-}
--- a/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_schema_gen.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_schema_gen.go
@@ -1,34 +0,0 @@
-//
-// Code generated by grafana-app-sdk. DO NOT EDIT.
-//
-
-package v0alpha1
-
-import (
-	"github.com/grafana/grafana-app-sdk/resource"
-)
-
-// schema is unexported to prevent accidental overwrites
-var (
-	schemaExternalGroupMapping = resource.NewSimpleSchema("iam.grafana.app", "v0alpha1", &ExternalGroupMapping{}, &ExternalGroupMappingList{}, resource.WithKind("ExternalGroupMapping"),
-		resource.WithPlural("externalgroupmappings"), resource.WithScope(resource.NamespacedScope))
-	kindExternalGroupMapping = resource.Kind{
-		Schema: schemaExternalGroupMapping,
-		Codecs: map[resource.KindEncoding]resource.Codec{
-			resource.KindEncodingJSON: &ExternalGroupMappingJSONCodec{},
-		},
-	}
-)
-
-// Kind returns a resource.Kind for this Schema with a JSON codec
-func ExternalGroupMappingKind() resource.Kind {
-	return kindExternalGroupMapping
-}
-
-// Schema returns a resource.SimpleSchema representation of ExternalGroupMapping
-func ExternalGroupMappingSchema() *resource.SimpleSchema {
-	return schemaExternalGroupMapping
-}
-
-// Interface compliance checks
-var _ resource.Schema = kindExternalGroupMapping
--- a/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_spec_gen.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/externalgroupmapping_spec_gen.go
@@ -1,27 +0,0 @@
-// Code generated - EDITING IS FUTILE. DO NOT EDIT.
-
-package v0alpha1
-
-// +k8s:openapi-gen=true
-type ExternalGroupMappingTeamRef struct {
-	// Name is the unique identifier for a team.
-	Name string `json:"name"`
-}
-
-// NewExternalGroupMappingTeamRef creates a new ExternalGroupMappingTeamRef object.
-func NewExternalGroupMappingTeamRef() *ExternalGroupMappingTeamRef {
-	return &ExternalGroupMappingTeamRef{}
-}
-
-// +k8s:openapi-gen=true
-type ExternalGroupMappingSpec struct {
-	TeamRef         ExternalGroupMappingTeamRef `json:"teamRef"`
-	ExternalGroupId string                      `json:"externalGroupId"`
-}
-
-// NewExternalGroupMappingSpec creates a new ExternalGroupMappingSpec object.
-func NewExternalGroupMappingSpec() *ExternalGroupMappingSpec {
-	return &ExternalGroupMappingSpec{
-		TeamRef: *NewExternalGroupMappingTeamRef(),
-	}
-}
--- a/apps/iam/pkg/apis/iam/v0alpha1/register.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/register.go
@@ -206,30 +206,6 @@ var TeamBindingResourceInfo = utils.NewResourceInfo(
 	},
 )

-var ExternalGroupMappingResourceInfo = utils.NewResourceInfo(GROUP, VERSION,
-	"externalgroupmappings", "externalgroupmapping", "ExternalGroupMapping",
-	func() runtime.Object { return &ExternalGroupMapping{} },
-	func() runtime.Object { return &ExternalGroupMappingList{} },
-	utils.TableColumns{
-		Definition: []metav1.TableColumnDefinition{
-			{Name: "Name", Type: "string", Format: "name"},
-			{Name: "Created At", Type: "date"},
-		},
-		Reader: func(obj any) ([]interface{}, error) {
-			mapping, ok := obj.(*ExternalGroupMapping)
-			if ok {
-				if mapping != nil {
-					return []interface{}{
-						mapping.Name,
-						mapping.CreationTimestamp.UTC().Format(time.RFC3339),
-					}, nil
-				}
-			}
-			return nil, fmt.Errorf("expected external group mapping")
-		},
-	},
-)
-
 var RoleBindingInfo = utils.NewResourceInfo(GROUP, VERSION,
 	"rolebindings", "rolebinding", "RoleBinding",
 	func() runtime.Object { return &RoleBinding{} },
@@ -319,8 +295,6 @@ func AddAuthNKnownTypes(scheme *runtime.Scheme) error {
 		&TeamList{},
 		&TeamBinding{},
 		&TeamBindingList{},
-		&ExternalGroupMapping{},
-		&ExternalGroupMappingList{},
 		// For now these are registered in pkg/apis/iam/v0alpha1/register.go
 		// &UserTeamList{},
 		// &ServiceAccountTokenList{},
--- a/apps/iam/pkg/apis/iam/v0alpha1/zz_openapi_gen.go
+++ b/apps/iam/pkg/apis/iam/v0alpha1/zz_openapi_gen.go
@@ -18,10 +18,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.CoreRoleStatus":                        schema_pkg_apis_iam_v0alpha1_CoreRoleStatus(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.CoreRolespecPermission":                schema_pkg_apis_iam_v0alpha1_CoreRolespecPermission(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.CoreRolestatusOperatorState":           schema_pkg_apis_iam_v0alpha1_CoreRolestatusOperatorState(ref),
-		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMapping":                  schema_pkg_apis_iam_v0alpha1_ExternalGroupMapping(ref),
-		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingList":              schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingList(ref),
-		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingSpec":              schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingSpec(ref),
-		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingTeamRef":           schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingTeamRef(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.GlobalRole":                            schema_pkg_apis_iam_v0alpha1_GlobalRole(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.GlobalRoleBinding":                     schema_pkg_apis_iam_v0alpha1_GlobalRoleBinding(ref),
 		"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.GlobalRoleBindingList":                 schema_pkg_apis_iam_v0alpha1_GlobalRoleBindingList(ref),
@@ -352,145 +348,6 @@ func schema_pkg_apis_iam_v0alpha1_CoreRolestatusOperatorState(ref common.Referen
 	}
 }

-func schema_pkg_apis_iam_v0alpha1_ExternalGroupMapping(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Spec is the spec of the ExternalGroupMapping",
-							Default:     map[string]interface{}{},
-							Ref:         ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingSpec"),
-						},
-					},
-				},
-				Required: []string{"metadata", "spec"},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingSpec", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMapping"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"metadata", "items"},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMapping", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"teamRef": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingTeamRef"),
-						},
-					},
-					"externalGroupId": {
-						SchemaProps: spec.SchemaProps{
-							Default: "",
-							Type:    []string{"string"},
-							Format:  "",
-						},
-					},
-				},
-				Required: []string{"teamRef", "externalGroupId"},
-			},
-		},
-		Dependencies: []string{
-			"github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingTeamRef"},
-	}
-}
-
-func schema_pkg_apis_iam_v0alpha1_ExternalGroupMappingTeamRef(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"name": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Name is the unique identifier for a team.",
-							Default:     "",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-				},
-				Required: []string{"name"},
-			},
-		},
-	}
-}
-
 func schema_pkg_apis_iam_v0alpha1_GlobalRole(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
--- a/apps/iam/pkg/apis/iam_manifest.go
+++ b/apps/iam/pkg/apis/iam_manifest.go
@@ -96,13 +96,6 @@ var appManifestData = app.ManifestData{
 					Scope:      "Namespaced",
 					Conversion: false,
 				},
-
-				{
-					Kind:       "ExternalGroupMapping",
-					Plural:     "ExternalGroupMappings",
-					Scope:      "Namespaced",
-					Conversion: false,
-				},
 			},
 			Routes: app.ManifestVersionRoutes{
 				Namespaced: map[string]spec3.PathProps{},
@@ -122,17 +115,16 @@ func RemoteManifest() app.Manifest {
 }

 var kindVersionToGoType = map[string]resource.Kind{
-	"GlobalRole/v0alpha1":           v0alpha1.GlobalRoleKind(),
-	"GlobalRoleBinding/v0alpha1":    v0alpha1.GlobalRoleBindingKind(),
-	"CoreRole/v0alpha1":             v0alpha1.CoreRoleKind(),
-	"Role/v0alpha1":                 v0alpha1.RoleKind(),
-	"RoleBinding/v0alpha1":          v0alpha1.RoleBindingKind(),
-	"ResourcePermission/v0alpha1":   v0alpha1.ResourcePermissionKind(),
-	"User/v0alpha1":                 v0alpha1.UserKind(),
-	"Team/v0alpha1":                 v0alpha1.TeamKind(),
-	"TeamBinding/v0alpha1":          v0alpha1.TeamBindingKind(),
-	"ServiceAccount/v0alpha1":       v0alpha1.ServiceAccountKind(),
-	"ExternalGroupMapping/v0alpha1": v0alpha1.ExternalGroupMappingKind(),
+	"GlobalRole/v0alpha1":         v0alpha1.GlobalRoleKind(),
+	"GlobalRoleBinding/v0alpha1":  v0alpha1.GlobalRoleBindingKind(),
+	"CoreRole/v0alpha1":           v0alpha1.CoreRoleKind(),
+	"Role/v0alpha1":               v0alpha1.RoleKind(),
+	"RoleBinding/v0alpha1":        v0alpha1.RoleBindingKind(),
+	"ResourcePermission/v0alpha1": v0alpha1.ResourcePermissionKind(),
+	"User/v0alpha1":               v0alpha1.UserKind(),
+	"Team/v0alpha1":               v0alpha1.TeamKind(),
+	"TeamBinding/v0alpha1":        v0alpha1.TeamBindingKind(),
+	"ServiceAccount/v0alpha1":     v0alpha1.ServiceAccountKind(),
 }

 // ManifestGoTypeAssociator returns the associated resource.Kind instance for a given Kind and Version, if one exists.
--- a/apps/plugins/go.mod
+++ b/apps/plugins/go.mod
@@ -6,7 +6,6 @@ require (
 	github.com/grafana/grafana-app-sdk v0.48.1
 	github.com/grafana/grafana-app-sdk/logging v0.48.1
 	github.com/grafana/grafana/pkg/apimachinery v0.0.0-20250428110029-a8ea72012bde
-	github.com/stretchr/testify v1.11.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/apiserver v0.34.1
 	k8s.io/klog/v2 v2.130.1
--- a/apps/plugins/pkg/app/install/registrar.go
+++ b/apps/plugins/pkg/app/install/registrar.go
@@ -93,7 +93,6 @@ func equalStringPointers(a, b *string) bool {
 type InstallRegistrar struct {
 	clientGenerator resource.ClientGenerator
 	client          *pluginsv0alpha1.PluginClient
-	clientErr       error
 	clientOnce      sync.Once
 }

@@ -108,21 +107,20 @@ func (r *InstallRegistrar) GetClient() (*pluginsv0alpha1.PluginClient, error) {
 	r.clientOnce.Do(func() {
 		client, err := pluginsv0alpha1.NewPluginClientFromGenerator(r.clientGenerator)
 		if err != nil {
-			r.clientErr = err
 			r.client = nil
 			return
 		}
 		r.client = client
 	})

-	return r.client, r.clientErr
+	return r.client, nil
 }

 // Register creates or updates a plugin install in the registry.
 func (r *InstallRegistrar) Register(ctx context.Context, namespace string, install *PluginInstall) error {
 	client, err := r.GetClient()
 	if err != nil {
-		return err
+		return nil
 	}
 	identifier := resource.Identifier{
 		Namespace: namespace,
@@ -134,12 +132,9 @@ func (r *InstallRegistrar) Register(ctx context.Context, namespace string, insta
 		return err
 	}

-	if existing != nil {
-		if install.ShouldUpdate(existing) {
-			_, err = client.Update(ctx, install.ToPluginInstallV0Alpha1(namespace), resource.UpdateOptions{ResourceVersion: existing.ResourceVersion})
-			return err
-		}
-		return nil
+	if existing != nil && install.ShouldUpdate(existing) {
+		_, err = client.Update(ctx, install.ToPluginInstallV0Alpha1(namespace), resource.UpdateOptions{ResourceVersion: existing.ResourceVersion})
+		return err
 	}

 	_, err = client.Create(ctx, install.ToPluginInstallV0Alpha1(namespace), resource.CreateOptions{})
@@ -160,10 +155,6 @@ func (r *InstallRegistrar) Unregister(ctx context.Context, namespace string, nam
 	if err != nil && !errorsK8s.IsNotFound(err) {
 		return err
 	}
-	// if the plugin doesn't exist, nothing to unregister
-	if existing == nil {
-		return nil
-	}
 	// if the source is different, do not unregister
 	if existingSource, ok := existing.Annotations[PluginInstallSourceAnnotation]; ok && existingSource != source {
 		return nil
--- a/apps/plugins/pkg/app/install/registrar_test.go
+++ b/apps/plugins/pkg/app/install/registrar_test.go
@@ -1,908 +0,0 @@
-package install
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/grafana/grafana-app-sdk/resource"
-	"github.com/stretchr/testify/require"
-	errorsK8s "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-
-	pluginsv0alpha1 "github.com/grafana/grafana/apps/plugins/pkg/apis/plugins/v0alpha1"
-)
-
-func TestPluginInstall_ShouldUpdate(t *testing.T) {
-	baseExisting := &pluginsv0alpha1.Plugin{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: "org-1",
-			Name:      "plugin-1",
-			Annotations: map[string]string{
-				PluginInstallSourceAnnotation: SourcePluginStore,
-			},
-		},
-		Spec: pluginsv0alpha1.PluginSpec{
-			Id:      "plugin-1",
-			Version: "1.0.0",
-			Class:   pluginsv0alpha1.PluginSpecClass(ClassExternal),
-		},
-	}
-
-	baseInstall := PluginInstall{
-		ID:      "plugin-1",
-		Version: "1.0.0",
-		Class:   ClassExternal,
-		Source:  SourcePluginStore,
-	}
-
-	tests := []struct {
-		name           string
-		modifyInstall  func(*PluginInstall)
-		modifyExisting func(*pluginsv0alpha1.Plugin)
-		expectUpdate   bool
-	}{
-		{
-			name:         "no changes",
-			expectUpdate: false,
-		},
-		{
-			name: "version differs",
-			modifyInstall: func(pi *PluginInstall) {
-				pi.Version = "2.0.0"
-			},
-			expectUpdate: true,
-		},
-		{
-			name: "class differs",
-			modifyInstall: func(pi *PluginInstall) {
-				pi.Class = ClassCore
-			},
-			expectUpdate: true,
-		},
-		{
-			name: "url differs",
-			modifyInstall: func(pi *PluginInstall) {
-				pi.URL = "https://example.com/plugin.zip"
-			},
-			expectUpdate: true,
-		},
-		{
-			name: "source differs",
-			modifyExisting: func(existing *pluginsv0alpha1.Plugin) {
-				existing.Annotations[PluginInstallSourceAnnotation] = SourceUnknown
-			},
-			expectUpdate: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			existing := baseExisting.DeepCopy()
-			install := baseInstall
-
-			if tt.modifyExisting != nil {
-				tt.modifyExisting(existing)
-			}
-			if tt.modifyInstall != nil {
-				tt.modifyInstall(&install)
-			}
-
-			require.Equal(t, tt.expectUpdate, install.ShouldUpdate(existing))
-		})
-	}
-}
-
-func TestInstallRegistrar_Register(t *testing.T) {
-	tests := []struct {
-		name            string
-		install         *PluginInstall
-		existing        *pluginsv0alpha1.Plugin
-		existingErr     error
-		expectedCreates int
-		expectedUpdates int
-		expectError     bool
-	}{
-		{
-			name: "creates plugin when not found",
-			install: &PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existingErr:     errorsK8s.NewNotFound(pluginGroupResource(), "plugin-1"),
-			expectedCreates: 1,
-		},
-		{
-			name: "updates plugin when fields change",
-			install: &PluginInstall{
-				ID:      "plugin-1",
-				Version: "2.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existing: &pluginsv0alpha1.Plugin{
-				ObjectMeta: metav1.ObjectMeta{
-					Namespace:       "org-1",
-					Name:            "plugin-1",
-					ResourceVersion: "7",
-					Annotations: map[string]string{
-						PluginInstallSourceAnnotation: SourcePluginStore,
-					},
-				},
-				Spec: pluginsv0alpha1.PluginSpec{
-					Id:      "plugin-1",
-					Version: "1.0.0",
-					Class:   pluginsv0alpha1.PluginSpecClass(ClassExternal),
-				},
-			},
-			expectedUpdates: 1,
-		},
-		{
-			name: "skips create when plugin matches",
-			install: &PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existing: &pluginsv0alpha1.Plugin{
-				ObjectMeta: metav1.ObjectMeta{
-					Namespace:       "org-1",
-					Name:            "plugin-1",
-					ResourceVersion: "9",
-					Annotations: map[string]string{
-						PluginInstallSourceAnnotation: SourcePluginStore,
-					},
-				},
-				Spec: pluginsv0alpha1.PluginSpec{
-					Id:      "plugin-1",
-					Version: "1.0.0",
-					Class:   pluginsv0alpha1.PluginSpecClass(ClassExternal),
-				},
-			},
-		},
-		{
-			name: "returns error on unexpected get failure",
-			install: &PluginInstall{
-				ID:      "plugin-err",
-				Version: "1.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existingErr: errorsK8s.NewInternalError(errors.New("boom")),
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-			createCalls := 0
-			updateCalls := 0
-			var receivedResourceVersions []string
-			var updatedPlugins []*pluginsv0alpha1.Plugin
-
-			fakeClient := &fakePluginInstallClient{
-				getFunc: func(context.Context, resource.Identifier) (*pluginsv0alpha1.Plugin, error) {
-					if tt.existingErr != nil {
-						return nil, tt.existingErr
-					}
-					if tt.existing == nil {
-						return nil, errorsK8s.NewNotFound(pluginGroupResource(), "plugin-1")
-					}
-					return tt.existing.DeepCopy(), nil
-				},
-				createFunc: func(context.Context, *pluginsv0alpha1.Plugin, resource.CreateOptions) (*pluginsv0alpha1.Plugin, error) {
-					createCalls++
-					return tt.install.ToPluginInstallV0Alpha1("org-1"), nil
-				},
-				updateFunc: func(_ context.Context, obj *pluginsv0alpha1.Plugin, opts resource.UpdateOptions) (*pluginsv0alpha1.Plugin, error) {
-					updateCalls++
-					receivedResourceVersions = append(receivedResourceVersions, opts.ResourceVersion)
-					updatedPlugins = append(updatedPlugins, obj)
-					return obj, nil
-				},
-			}
-
-			registrar := NewInstallRegistrar(&fakeClientGenerator{client: fakeClient})
-
-			err := registrar.Register(ctx, "org-1", tt.install)
-			if tt.expectError {
-				require.Error(t, err)
-				return
-			}
-			require.NoError(t, err)
-			require.Equal(t, tt.expectedCreates, createCalls)
-			require.Equal(t, tt.expectedUpdates, updateCalls)
-
-			if tt.expectedUpdates > 0 {
-				require.Equal(t, []string{tt.existing.ResourceVersion}, receivedResourceVersions)
-				require.Len(t, updatedPlugins, 1)
-				require.Equal(t, tt.install.Version, updatedPlugins[0].Spec.Version)
-			}
-		})
-	}
-}
-
-func pluginGroupResource() schema.GroupResource {
-	return schema.GroupResource{Group: pluginsv0alpha1.APIGroup, Resource: "plugininstalls"}
-}
-
-type fakePluginInstallClient struct {
-	listAllFunc func(ctx context.Context, namespace string, opts resource.ListOptions) (*pluginsv0alpha1.PluginList, error)
-	getFunc     func(ctx context.Context, identifier resource.Identifier) (*pluginsv0alpha1.Plugin, error)
-	createFunc  func(ctx context.Context, obj *pluginsv0alpha1.Plugin, opts resource.CreateOptions) (*pluginsv0alpha1.Plugin, error)
-	updateFunc  func(ctx context.Context, obj *pluginsv0alpha1.Plugin, opts resource.UpdateOptions) (*pluginsv0alpha1.Plugin, error)
-	deleteFunc  func(ctx context.Context, identifier resource.Identifier, opts resource.DeleteOptions) error
-}
-
-func (f *fakePluginInstallClient) Get(ctx context.Context, identifier resource.Identifier) (*pluginsv0alpha1.Plugin, error) {
-	if f.getFunc != nil {
-		return f.getFunc(ctx, identifier)
-	}
-	return nil, errorsK8s.NewNotFound(pluginGroupResource(), identifier.Name)
-}
-
-func (f *fakePluginInstallClient) ListAll(ctx context.Context, namespace string, opts resource.ListOptions) (*pluginsv0alpha1.PluginList, error) {
-	if f.listAllFunc != nil {
-		return f.listAllFunc(ctx, namespace, opts)
-	}
-	return &pluginsv0alpha1.PluginList{}, nil
-}
-
-func (f *fakePluginInstallClient) List(ctx context.Context, namespace string, opts resource.ListOptions) (*pluginsv0alpha1.PluginList, error) {
-	return f.ListAll(ctx, namespace, opts)
-}
-
-func (f *fakePluginInstallClient) Create(ctx context.Context, obj *pluginsv0alpha1.Plugin, opts resource.CreateOptions) (*pluginsv0alpha1.Plugin, error) {
-	if f.createFunc != nil {
-		return f.createFunc(ctx, obj, opts)
-	}
-	return obj, nil
-}
-
-func (f *fakePluginInstallClient) Update(ctx context.Context, obj *pluginsv0alpha1.Plugin, opts resource.UpdateOptions) (*pluginsv0alpha1.Plugin, error) {
-	if f.updateFunc != nil {
-		return f.updateFunc(ctx, obj, opts)
-	}
-	return obj, nil
-}
-
-func (f *fakePluginInstallClient) UpdateStatus(ctx context.Context, identifier resource.Identifier, newStatus pluginsv0alpha1.PluginStatus, opts resource.UpdateOptions) (*pluginsv0alpha1.Plugin, error) {
-	return nil, nil
-}
-
-func (f *fakePluginInstallClient) Patch(ctx context.Context, identifier resource.Identifier, req resource.PatchRequest, opts resource.PatchOptions) (*pluginsv0alpha1.Plugin, error) {
-	return nil, nil
-}
-
-func (f *fakePluginInstallClient) Delete(ctx context.Context, identifier resource.Identifier, opts resource.DeleteOptions) error {
-	if f.deleteFunc != nil {
-		return f.deleteFunc(ctx, identifier, opts)
-	}
-	return nil
-}
-
-type fakeClientGenerator struct {
-	client      *fakePluginInstallClient
-	shouldError bool
-}
-
-func (f *fakeClientGenerator) ClientFor(resource.Kind) (resource.Client, error) {
-	if f.shouldError {
-		return nil, errors.New("client generation failed")
-	}
-	return &fakeResourceClient{client: f.client}, nil
-}
-
-type fakeResourceClient struct {
-	client *fakePluginInstallClient
-}
-
-func (f *fakeResourceClient) Get(ctx context.Context, identifier resource.Identifier) (resource.Object, error) {
-	return f.client.Get(ctx, identifier)
-}
-
-func (f *fakeResourceClient) GetInto(ctx context.Context, identifier resource.Identifier, into resource.Object) error {
-	obj, err := f.client.Get(ctx, identifier)
-	if err != nil {
-		return err
-	}
-	if target, ok := into.(*pluginsv0alpha1.Plugin); ok {
-		*target = *obj
-	}
-	return nil
-}
-
-func (f *fakeResourceClient) List(ctx context.Context, namespace string, options resource.ListOptions) (resource.ListObject, error) {
-	return f.client.ListAll(ctx, namespace, options)
-}
-
-func (f *fakeResourceClient) ListInto(ctx context.Context, namespace string, options resource.ListOptions, into resource.ListObject) error {
-	list, err := f.client.ListAll(ctx, namespace, options)
-	if err != nil {
-		return err
-	}
-	if target, ok := into.(*pluginsv0alpha1.PluginList); ok {
-		*target = *list
-	}
-	return nil
-}
-
-func (f *fakeResourceClient) Create(ctx context.Context, identifier resource.Identifier, obj resource.Object, options resource.CreateOptions) (resource.Object, error) {
-	plugin := obj.(*pluginsv0alpha1.Plugin)
-	return f.client.Create(ctx, plugin, options)
-}
-
-func (f *fakeResourceClient) CreateInto(ctx context.Context, identifier resource.Identifier, obj resource.Object, options resource.CreateOptions, into resource.Object) error {
-	created, err := f.Create(ctx, identifier, obj, options)
-	if err != nil {
-		return err
-	}
-	if plugin, ok := created.(*pluginsv0alpha1.Plugin); ok {
-		if target, ok := into.(*pluginsv0alpha1.Plugin); ok {
-			*target = *plugin
-		}
-	}
-	return nil
-}
-
-func (f *fakeResourceClient) Update(ctx context.Context, identifier resource.Identifier, obj resource.Object, options resource.UpdateOptions) (resource.Object, error) {
-	plugin := obj.(*pluginsv0alpha1.Plugin)
-	return f.client.Update(ctx, plugin, options)
-}
-
-func (f *fakeResourceClient) UpdateInto(ctx context.Context, identifier resource.Identifier, obj resource.Object, options resource.UpdateOptions, into resource.Object) error {
-	updated, err := f.Update(ctx, identifier, obj, options)
-	if err != nil {
-		return err
-	}
-	if plugin, ok := updated.(*pluginsv0alpha1.Plugin); ok {
-		if target, ok := into.(*pluginsv0alpha1.Plugin); ok {
-			*target = *plugin
-		}
-	}
-	return nil
-}
-
-func (f *fakeResourceClient) Patch(ctx context.Context, identifier resource.Identifier, patch resource.PatchRequest, options resource.PatchOptions) (resource.Object, error) {
-	return nil, nil
-}
-
-func (f *fakeResourceClient) PatchInto(ctx context.Context, identifier resource.Identifier, patch resource.PatchRequest, options resource.PatchOptions, into resource.Object) error {
-	return nil
-}
-
-func (f *fakeResourceClient) Delete(ctx context.Context, identifier resource.Identifier, options resource.DeleteOptions) error {
-	return f.client.Delete(ctx, identifier, options)
-}
-
-func (f *fakeResourceClient) SubresourceRequest(ctx context.Context, identifier resource.Identifier, req resource.CustomRouteRequestOptions) ([]byte, error) {
-	return []byte{}, nil
-}
-
-func (f *fakeResourceClient) Watch(ctx context.Context, namespace string, options resource.WatchOptions) (resource.WatchResponse, error) {
-	return &fakeWatchResponse{}, nil
-}
-
-type fakeWatchResponse struct{}
-
-func (f *fakeWatchResponse) Stop() {}
-
-func (f *fakeWatchResponse) WatchEvents() <-chan resource.WatchEvent {
-	ch := make(chan resource.WatchEvent)
-	close(ch)
-	return ch
-}
-
-func TestPluginInstall_ToPluginInstallV0Alpha1(t *testing.T) {
-	tests := []struct {
-		name      string
-		install   PluginInstall
-		namespace string
-		validate  func(*testing.T, *pluginsv0alpha1.Plugin)
-	}{
-		{
-			name: "empty URL creates nil pointer",
-			install: PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			namespace: "org-1",
-			validate: func(t *testing.T, p *pluginsv0alpha1.Plugin) {
-				require.Nil(t, p.Spec.Url)
-			},
-		},
-		{
-			name: "non-empty URL creates pointer",
-			install: PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				URL:     "https://example.com/plugin.zip",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			namespace: "org-1",
-			validate: func(t *testing.T, p *pluginsv0alpha1.Plugin) {
-				require.NotNil(t, p.Spec.Url)
-				require.Equal(t, "https://example.com/plugin.zip", *p.Spec.Url)
-			},
-		},
-		{
-			name: "core class is mapped correctly",
-			install: PluginInstall{
-				ID:      "plugin-core",
-				Version: "2.0.0",
-				Class:   ClassCore,
-				Source:  SourcePluginStore,
-			},
-			namespace: "org-2",
-			validate: func(t *testing.T, p *pluginsv0alpha1.Plugin) {
-				require.Equal(t, pluginsv0alpha1.PluginSpecClass(ClassCore), p.Spec.Class)
-			},
-		},
-		{
-			name: "cdn class is mapped correctly",
-			install: PluginInstall{
-				ID:      "plugin-cdn",
-				Version: "3.0.0",
-				Class:   ClassCDN,
-				Source:  SourcePluginStore,
-			},
-			namespace: "org-3",
-			validate: func(t *testing.T, p *pluginsv0alpha1.Plugin) {
-				require.Equal(t, pluginsv0alpha1.PluginSpecClass(ClassCDN), p.Spec.Class)
-			},
-		},
-		{
-			name: "source annotation is set correctly",
-			install: PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				Class:   ClassExternal,
-				Source:  SourceUnknown,
-			},
-			namespace: "org-1",
-			validate: func(t *testing.T, p *pluginsv0alpha1.Plugin) {
-				require.Equal(t, SourceUnknown, p.Annotations[PluginInstallSourceAnnotation])
-			},
-		},
-		{
-			name: "namespace and name are set correctly",
-			install: PluginInstall{
-				ID:      "my-plugin",
-				Version: "1.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			namespace: "my-namespace",
-			validate: func(t *testing.T, p *pluginsv0alpha1.Plugin) {
-				require.Equal(t, "my-namespace", p.Namespace)
-				require.Equal(t, "my-plugin", p.Name)
-				require.Equal(t, "my-plugin", p.Spec.Id)
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := tt.install.ToPluginInstallV0Alpha1(tt.namespace)
-			require.NotNil(t, result)
-			require.Equal(t, tt.namespace, result.Namespace)
-			require.Equal(t, tt.install.ID, result.Name)
-			require.Equal(t, tt.install.ID, result.Spec.Id)
-			require.Equal(t, tt.install.Version, result.Spec.Version)
-			tt.validate(t, result)
-		})
-	}
-}
-
-func TestEqualStringPointers(t *testing.T) {
-	str1 := "value1"
-	str2 := "value2"
-	str3 := "value1"
-
-	tests := []struct {
-		name     string
-		a        *string
-		b        *string
-		expected bool
-	}{
-		{
-			name:     "both nil",
-			a:        nil,
-			b:        nil,
-			expected: true,
-		},
-		{
-			name:     "first nil, second non-nil",
-			a:        nil,
-			b:        &str1,
-			expected: false,
-		},
-		{
-			name:     "first non-nil, second nil",
-			a:        &str1,
-			b:        nil,
-			expected: false,
-		},
-		{
-			name:     "both non-nil with same value",
-			a:        &str1,
-			b:        &str3,
-			expected: true,
-		},
-		{
-			name:     "both non-nil with different values",
-			a:        &str1,
-			b:        &str2,
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := equalStringPointers(tt.a, tt.b)
-			require.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestPluginInstall_ShouldUpdate_URLTransitions(t *testing.T) {
-	existingURL := "https://old.example.com/plugin.zip"
-	newURL := "https://new.example.com/plugin.zip"
-
-	tests := []struct {
-		name         string
-		install      PluginInstall
-		existingURL  *string
-		expectUpdate bool
-	}{
-		{
-			name: "URL transition from nil to non-nil",
-			install: PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				URL:     newURL,
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existingURL:  nil,
-			expectUpdate: true,
-		},
-		{
-			name: "URL transition from non-nil to nil",
-			install: PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				URL:     "",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existingURL:  &existingURL,
-			expectUpdate: true,
-		},
-		{
-			name: "URL stays nil",
-			install: PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				URL:     "",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existingURL:  nil,
-			expectUpdate: false,
-		},
-		{
-			name: "URL stays same non-nil value",
-			install: PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				URL:     existingURL,
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			existingURL:  &existingURL,
-			expectUpdate: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			existing := &pluginsv0alpha1.Plugin{
-				ObjectMeta: metav1.ObjectMeta{
-					Namespace: "org-1",
-					Name:      "plugin-1",
-					Annotations: map[string]string{
-						PluginInstallSourceAnnotation: SourcePluginStore,
-					},
-				},
-				Spec: pluginsv0alpha1.PluginSpec{
-					Id:      "plugin-1",
-					Version: "1.0.0",
-					Url:     tt.existingURL,
-					Class:   pluginsv0alpha1.PluginSpecClass(ClassExternal),
-				},
-			}
-
-			require.Equal(t, tt.expectUpdate, tt.install.ShouldUpdate(existing))
-		})
-	}
-}
-
-func TestInstallRegistrar_GetClient(t *testing.T) {
-	t.Run("successfully creates client on first call", func(t *testing.T) {
-		fakeClient := &fakePluginInstallClient{}
-		generator := &fakeClientGenerator{client: fakeClient}
-		registrar := NewInstallRegistrar(generator)
-
-		client, err := registrar.GetClient()
-		require.NoError(t, err)
-		require.NotNil(t, client)
-	})
-
-	t.Run("returns same client on subsequent calls", func(t *testing.T) {
-		fakeClient := &fakePluginInstallClient{}
-		generator := &fakeClientGenerator{client: fakeClient}
-		registrar := NewInstallRegistrar(generator)
-
-		client1, err1 := registrar.GetClient()
-		require.NoError(t, err1)
-
-		client2, err2 := registrar.GetClient()
-		require.NoError(t, err2)
-
-		require.Equal(t, client1, client2)
-	})
-
-	t.Run("returns error when client generation fails", func(t *testing.T) {
-		generator := &fakeClientGenerator{client: nil, shouldError: true}
-		registrar := NewInstallRegistrar(generator)
-
-		client, err := registrar.GetClient()
-		require.Error(t, err)
-		require.Nil(t, client)
-	})
-}
-
-func TestInstallRegistrar_Register_ErrorCases(t *testing.T) {
-	tests := []struct {
-		name        string
-		install     *PluginInstall
-		setupClient func(*fakePluginInstallClient)
-		expectError bool
-	}{
-		{
-			name: "create fails",
-			install: &PluginInstall{
-				ID:      "plugin-1",
-				Version: "1.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			setupClient: func(fc *fakePluginInstallClient) {
-				fc.getFunc = func(context.Context, resource.Identifier) (*pluginsv0alpha1.Plugin, error) {
-					return nil, errorsK8s.NewNotFound(pluginGroupResource(), "plugin-1")
-				}
-				fc.createFunc = func(context.Context, *pluginsv0alpha1.Plugin, resource.CreateOptions) (*pluginsv0alpha1.Plugin, error) {
-					return nil, errors.New("create failed")
-				}
-			},
-			expectError: true,
-		},
-		{
-			name: "update fails",
-			install: &PluginInstall{
-				ID:      "plugin-1",
-				Version: "2.0.0",
-				Class:   ClassExternal,
-				Source:  SourcePluginStore,
-			},
-			setupClient: func(fc *fakePluginInstallClient) {
-				fc.getFunc = func(context.Context, resource.Identifier) (*pluginsv0alpha1.Plugin, error) {
-					return &pluginsv0alpha1.Plugin{
-						ObjectMeta: metav1.ObjectMeta{
-							Namespace:       "org-1",
-							Name:            "plugin-1",
-							ResourceVersion: "5",
-							Annotations: map[string]string{
-								PluginInstallSourceAnnotation: SourcePluginStore,
-							},
-						},
-						Spec: pluginsv0alpha1.PluginSpec{
-							Id:      "plugin-1",
-							Version: "1.0.0",
-							Class:   pluginsv0alpha1.PluginSpecClass(ClassExternal),
-						},
-					}, nil
-				}
-				fc.updateFunc = func(context.Context, *pluginsv0alpha1.Plugin, resource.UpdateOptions) (*pluginsv0alpha1.Plugin, error) {
-					return nil, errors.New("update failed")
-				}
-			},
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-			fakeClient := &fakePluginInstallClient{}
-			tt.setupClient(fakeClient)
-
-			registrar := NewInstallRegistrar(&fakeClientGenerator{client: fakeClient})
-
-			err := registrar.Register(ctx, "org-1", tt.install)
-			if tt.expectError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
-		})
-	}
-}
-
-func TestInstallRegistrar_Unregister(t *testing.T) {
-	tests := []struct {
-		name          string
-		namespace     string
-		pluginName    string
-		source        Source
-		existing      *pluginsv0alpha1.Plugin
-		existingErr   error
-		expectedCalls int
-		expectError   bool
-	}{
-		{
-			name:       "successfully deletes plugin with matching source",
-			namespace:  "org-1",
-			pluginName: "plugin-1",
-			source:     SourcePluginStore,
-			existing: &pluginsv0alpha1.Plugin{
-				ObjectMeta: metav1.ObjectMeta{
-					Namespace: "org-1",
-					Name:      "plugin-1",
-					Annotations: map[string]string{
-						PluginInstallSourceAnnotation: SourcePluginStore,
-					},
-				},
-			},
-			expectedCalls: 1,
-		},
-		{
-			name:          "plugin not found should not error",
-			namespace:     "org-1",
-			pluginName:    "plugin-nonexistent",
-			source:        SourcePluginStore,
-			existingErr:   errorsK8s.NewNotFound(pluginGroupResource(), "plugin-nonexistent"),
-			expectedCalls: 0,
-			expectError:   false,
-		},
-		{
-			name:       "skips delete when source doesn't match",
-			namespace:  "org-1",
-			pluginName: "plugin-1",
-			source:     SourcePluginStore,
-			existing: &pluginsv0alpha1.Plugin{
-				ObjectMeta: metav1.ObjectMeta{
-					Namespace: "org-1",
-					Name:      "plugin-1",
-					Annotations: map[string]string{
-						PluginInstallSourceAnnotation: SourceUnknown,
-					},
-				},
-			},
-			expectedCalls: 0,
-		},
-		{
-			name:          "returns error on unexpected get failure",
-			namespace:     "org-1",
-			pluginName:    "plugin-err",
-			source:        SourcePluginStore,
-			existingErr:   errorsK8s.NewInternalError(errors.New("get failed")),
-			expectedCalls: 0,
-			expectError:   true,
-		},
-		{
-			name:       "delete failure returns error",
-			namespace:  "org-1",
-			pluginName: "plugin-1",
-			source:     SourcePluginStore,
-			existing: &pluginsv0alpha1.Plugin{
-				ObjectMeta: metav1.ObjectMeta{
-					Namespace: "org-1",
-					Name:      "plugin-1",
-					Annotations: map[string]string{
-						PluginInstallSourceAnnotation: SourcePluginStore,
-					},
-				},
-			},
-			expectedCalls: 1,
-			expectError:   true,
-		},
-		{
-			name:       "handles missing source annotation",
-			namespace:  "org-1",
-			pluginName: "plugin-1",
-			source:     SourcePluginStore,
-			existing: &pluginsv0alpha1.Plugin{
-				ObjectMeta: metav1.ObjectMeta{
-					Namespace:   "org-1",
-					Name:        "plugin-1",
-					Annotations: map[string]string{},
-				},
-			},
-			expectedCalls: 1,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx := context.Background()
-			deleteCalls := 0
-
-			fakeClient := &fakePluginInstallClient{
-				getFunc: func(context.Context, resource.Identifier) (*pluginsv0alpha1.Plugin, error) {
-					if tt.existingErr != nil {
-						return nil, tt.existingErr
-					}
-					if tt.existing == nil {
-						return nil, errorsK8s.NewNotFound(pluginGroupResource(), tt.pluginName)
-					}
-					return tt.existing.DeepCopy(), nil
-				},
-				deleteFunc: func(context.Context, resource.Identifier, resource.DeleteOptions) error {
-					deleteCalls++
-					if tt.name == "delete failure returns error" {
-						return errors.New("delete failed")
-					}
-					return nil
-				},
-			}
-
-			registrar := NewInstallRegistrar(&fakeClientGenerator{client: fakeClient})
-
-			err := registrar.Unregister(ctx, tt.namespace, tt.pluginName, tt.source)
-
-			require.Equal(t, tt.expectedCalls, deleteCalls)
-			if tt.expectError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
-		})
-	}
-}
-
-func TestInstallRegistrar_GetClientError(t *testing.T) {
-	t.Run("Register returns error with nil client", func(t *testing.T) {
-		ctx := context.Background()
-		generator := &fakeClientGenerator{client: nil, shouldError: true}
-		registrar := NewInstallRegistrar(generator)
-
-		install := &PluginInstall{
-			ID:      "plugin-1",
-			Version: "1.0.0",
-			Class:   ClassExternal,
-			Source:  SourcePluginStore,
-		}
-
-		err := registrar.Register(ctx, "org-1", install)
-		require.Error(t, err)
-	})
-
-	t.Run("Unregister returns error with nil client", func(t *testing.T) {
-		ctx := context.Background()
-		generator := &fakeClientGenerator{client: nil, shouldError: true}
-		registrar := NewInstallRegistrar(generator)
-
-		err := registrar.Unregister(ctx, "org-1", "plugin-1", SourcePluginStore)
-		require.Error(t, err)
-	})
-}
--- a/apps/provisioning/go.mod
+++ b/apps/provisioning/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/grafana/grafana-app-sdk/logging v0.48.1
 	github.com/grafana/grafana/apps/secret v0.0.0-20250902093454-b56b7add012f
 	github.com/grafana/grafana/pkg/apimachinery v0.0.0-20250804150913-990f1c69ecc2
-	github.com/grafana/nanogit v0.0.0-20251106115617-c622d3e0fc4b
+	github.com/grafana/nanogit v0.0.0-20250723104447-68f58f5ecec0
 	github.com/migueleliasweb/go-github-mock v1.1.0
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/oauth2 v0.32.0
--- a/apps/provisioning/go.sum
+++ b/apps/provisioning/go.sum
@@ -70,8 +70,8 @@ github.com/grafana/grafana/apps/secret v0.0.0-20250902093454-b56b7add012f h1:f+Z
 github.com/grafana/grafana/apps/secret v0.0.0-20250902093454-b56b7add012f/go.mod h1:RA8mP8KVIwKXBx3Ssqa/uEBABib5LvUWYPVMxrNvnP0=
 github.com/grafana/grafana/pkg/apimachinery v0.0.0-20250804150913-990f1c69ecc2 h1:X0cnaFdR+iz+sDSuoZmkryFSjOirchHe2MdKSRwBWgM=
 github.com/grafana/grafana/pkg/apimachinery v0.0.0-20250804150913-990f1c69ecc2/go.mod h1:RRvSjHH12/PnQaXraMO65jUhVu8n59mzvhfIMBETnV4=
-github.com/grafana/nanogit v0.0.0-20251106115617-c622d3e0fc4b h1:rFjoqJFb2KxJ29K9ltuWRSsdA46SbN0GCxoQc36h5kg=
-github.com/grafana/nanogit v0.0.0-20251106115617-c622d3e0fc4b/go.mod h1:ToqLjIdvV3AZQa3K6e5m9hy/nsGaUByc2dWQlctB9iA=
+github.com/grafana/nanogit v0.0.0-20250723104447-68f58f5ecec0 h1:cS0SlJGIlZbmDLctNj5vIYGemrJDLy25wwoiIyZWVN8=
+github.com/grafana/nanogit v0.0.0-20250723104447-68f58f5ecec0/go.mod h1:ToqLjIdvV3AZQa3K6e5m9hy/nsGaUByc2dWQlctB9iA=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
--- a/apps/provisioning/pkg/jobs/validator.go
+++ b/apps/provisioning/pkg/jobs/validator.go
@@ -1,172 +0,0 @@
-package jobs
-
-import (
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/util/validation/field"
-
-	provisioning "github.com/grafana/grafana/apps/provisioning/pkg/apis/provisioning/v0alpha1"
-	"github.com/grafana/grafana/apps/provisioning/pkg/repository/git"
-	"github.com/grafana/grafana/apps/provisioning/pkg/safepath"
-)
-
-// ValidateJob performs validation on the Job specification and returns an error if validation fails
-func ValidateJob(job *provisioning.Job) error {
-	list := field.ErrorList{}
-
-	// Validate action is specified
-	if job.Spec.Action == "" {
-		list = append(list, field.Required(field.NewPath("spec", "action"), "action must be specified"))
-		return toError(job.Name, list) // Early return since we can't validate further without knowing the action
-	}
-
-	// Validate repository is specified
-	if job.Spec.Repository == "" {
-		list = append(list, field.Required(field.NewPath("spec", "repository"), "repository must be specified"))
-	}
-
-	// Validate action-specific options
-	switch job.Spec.Action {
-	case provisioning.JobActionPull:
-		if job.Spec.Pull == nil {
-			list = append(list, field.Required(field.NewPath("spec", "pull"), "pull options required for pull action"))
-		}
-		// Pull options are simple, just incremental bool - no further validation needed
-
-	case provisioning.JobActionPush:
-		if job.Spec.Push == nil {
-			list = append(list, field.Required(field.NewPath("spec", "push"), "push options required for push action"))
-		} else {
-			list = append(list, validateExportJobOptions(job.Spec.Push)...)
-		}
-
-	case provisioning.JobActionPullRequest:
-		if job.Spec.PullRequest == nil {
-			list = append(list, field.Required(field.NewPath("spec", "pr"), "pull request options required for pr action"))
-		}
-		// PullRequest options are mostly informational - no strict validation needed
-
-	case provisioning.JobActionMigrate:
-		if job.Spec.Migrate == nil {
-			list = append(list, field.Required(field.NewPath("spec", "migrate"), "migrate options required for migrate action"))
-		}
-		// Migrate options are simple - no further validation needed
-
-	case provisioning.JobActionDelete:
-		if job.Spec.Delete == nil {
-			list = append(list, field.Required(field.NewPath("spec", "delete"), "delete options required for delete action"))
-		} else {
-			list = append(list, validateDeleteJobOptions(job.Spec.Delete)...)
-		}
-
-	case provisioning.JobActionMove:
-		if job.Spec.Move == nil {
-			list = append(list, field.Required(field.NewPath("spec", "move"), "move options required for move action"))
-		} else {
-			list = append(list, validateMoveJobOptions(job.Spec.Move)...)
-		}
-	default:
-		list = append(list, field.Invalid(field.NewPath("spec", "action"), job.Spec.Action, "invalid action"))
-	}
-
-	return toError(job.Name, list)
-}
-
-// toError converts a field.ErrorList to an error, returning nil if the list is empty
-func toError(name string, list field.ErrorList) error {
-	if len(list) == 0 {
-		return nil
-	}
-	return apierrors.NewInvalid(
-		provisioning.JobResourceInfo.GroupVersionKind().GroupKind(),
-		name, list)
-}
-
-// validateExportJobOptions validates export (push) job options
-func validateExportJobOptions(opts *provisioning.ExportJobOptions) field.ErrorList {
-	list := field.ErrorList{}
-
-	// Validate branch name if specified
-	if opts.Branch != "" {
-		if !git.IsValidGitBranchName(opts.Branch) {
-			list = append(list, field.Invalid(field.NewPath("spec", "push", "branch"), opts.Branch, "invalid git branch name"))
-		}
-	}
-
-	// Validate path if specified
-	if opts.Path != "" {
-		if err := safepath.IsSafe(opts.Path); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "push", "path"), opts.Path, err.Error()))
-		}
-	}
-
-	return list
-}
-
-// validateDeleteJobOptions validates delete job options
-func validateDeleteJobOptions(opts *provisioning.DeleteJobOptions) field.ErrorList {
-	list := field.ErrorList{}
-
-	// At least one of paths or resources must be specified
-	if len(opts.Paths) == 0 && len(opts.Resources) == 0 {
-		list = append(list, field.Required(field.NewPath("spec", "delete"), "at least one path or resource must be specified"))
-		return list
-	}
-
-	// Validate paths
-	for i, p := range opts.Paths {
-		if err := safepath.IsSafe(p); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "delete", "paths").Index(i), p, err.Error()))
-		}
-	}
-
-	// Validate resources
-	for i, r := range opts.Resources {
-		if r.Name == "" {
-			list = append(list, field.Required(field.NewPath("spec", "delete", "resources").Index(i).Child("name"), "resource name is required"))
-		}
-		if r.Kind == "" {
-			list = append(list, field.Required(field.NewPath("spec", "delete", "resources").Index(i).Child("kind"), "resource kind is required"))
-		}
-	}
-
-	return list
-}
-
-// validateMoveJobOptions validates move job options
-func validateMoveJobOptions(opts *provisioning.MoveJobOptions) field.ErrorList {
-	list := field.ErrorList{}
-
-	// At least one of paths or resources must be specified
-	if len(opts.Paths) == 0 && len(opts.Resources) == 0 {
-		list = append(list, field.Required(field.NewPath("spec", "move"), "at least one path or resource must be specified"))
-		return list
-	}
-
-	// Target path is required
-	if opts.TargetPath == "" {
-		list = append(list, field.Required(field.NewPath("spec", "move", "targetPath"), "target path is required"))
-	} else {
-		if err := safepath.IsSafe(opts.TargetPath); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "move", "targetPath"), opts.TargetPath, err.Error()))
-		}
-	}
-
-	// Validate source paths
-	for i, p := range opts.Paths {
-		if err := safepath.IsSafe(p); err != nil {
-			list = append(list, field.Invalid(field.NewPath("spec", "move", "paths").Index(i), p, err.Error()))
-		}
-	}
-
-	// Validate resources
-	for i, r := range opts.Resources {
-		if r.Name == "" {
-			list = append(list, field.Required(field.NewPath("spec", "move", "resources").Index(i).Child("name"), "resource name is required"))
-		}
-		if r.Kind == "" {
-			list = append(list, field.Required(field.NewPath("spec", "move", "resources").Index(i).Child("kind"), "resource kind is required"))
-		}
-	}
-
-	return list
-}
--- a/Show More
+++ b/Show More