Merge remote-tracking branch 'upstream/main' into task/trusted-devices-ui-update

Author: parkiino

.buildkite/ftr-manifests/ftr_platform_stateful_configs.yml

@@ -234,7 +234,6 @@ enabled:
   - x-pack/platform/test/functional_basic/apps/transform/edit_clone/config.ts
   - x-pack/platform/test/functional_basic/apps/transform/creation/runtime_mappings_saved_search/config.ts
   - x-pack/platform/test/functional_basic/apps/transform/permissions/config.ts
-  - x-pack/platform/test/functional_basic/apps/transform/feature_controls/config.ts
   - x-pack/platform/test/functional_cors/config.ts
   - x-pack/platform/test/functional_embedded/config.ts
   - x-pack/platform/test/functional_execution_context/config.ts
@@ -252,13 +251,11 @@ enabled:
   - x-pack/platform/test/functional/apps/aiops/config.ts
   - x-pack/platform/test/functional/apps/api_keys/config.ts
   - x-pack/platform/test/functional/apps/canvas/config.ts
-  - x-pack/platform/test/functional/apps/cross_cluster_replication/config.ts
   - x-pack/platform/test/functional/apps/dashboard/group1/config.ts
   - x-pack/platform/test/functional/apps/dashboard/group3/config.ts
   - x-pack/platform/test/functional/apps/discover/group1/config.ts
   - x-pack/platform/test/functional/apps/discover/group2/config.ts
   - x-pack/platform/test/functional/apps/discover/group3/config.ts
-  - x-pack/platform/test/functional/apps/index_lifecycle_management/config.ts
   - x-pack/platform/test/functional/apps/index_management/config.ts
   - x-pack/platform/test/functional/apps/lens/group1/config.ts
   - x-pack/platform/test/functional/apps/lens/group2/config.ts
@@ -287,7 +284,6 @@ enabled:
   - x-pack/platform/test/functional/apps/license_management/config.ts
   - x-pack/platform/test/functional/apps/logstash/config.ts
   - x-pack/platform/test/functional/apps/managed_content/config.ts
-  - x-pack/platform/test/functional/apps/management/config.ts
   - x-pack/platform/test/functional/apps/maps/group1/config.ts
   - x-pack/platform/test/functional/apps/maps/group2/config.ts
   - x-pack/platform/test/functional/apps/maps/group3/config.ts
@@ -325,7 +321,6 @@ enabled:
   - x-pack/platform/test/functional/apps/transform/actions/config.ts
   - x-pack/platform/test/functional/apps/transform/edit_clone/config.ts
   - x-pack/platform/test/functional/apps/transform/permissions/config.ts
-  - x-pack/platform/test/functional/apps/transform/feature_controls/config.ts
   - x-pack/platform/test/functional/apps/user_profiles/config.ts
   - x-pack/platform/test/functional/apps/visualize/config.ts
   - x-pack/platform/test/functional/apps/watcher/config.ts

.buildkite/scout_ci_config.yml

@@ -12,10 +12,12 @@ plugins:
     - cloud_security_posture
     - console
     - contentManagementExamples
+    - cross_cluster_replication
     - custom_branding
     - dashboard
     - dashboard_markdown
     - data
+    - data_view_editor
     - data_views
     - data_view_management
     - dev_tools
@@ -31,6 +33,7 @@ plugins:
     - graph
     - grokdebugger
     - home
+    - index_lifecycle_management
     - index_management
     - infra
     - ingest_hub
@@ -39,6 +42,7 @@ plugins:
     - kibana_overview
     - lens
     - logstash
+    - management
     - maps
     - ml
     - monitoring

.buildkite/scripts/steps/kbn_ui_publish.sh

@@ -96,14 +96,11 @@ if [[ "${DRY_RUN:-}" == "1" ]]; then
 fi
 
 report_step "Fetching Artifactory credentials"
-# The secret is stored at `kv/ci-shared/serverless/cloud-ui/kbn-ui-artifactory-registry`,
-# so that engineering orgs and CIs from kibana and cloud-ui can both access it without
-# granting broader vault permissions.
-# Secret layout:
+# Secret layout at `secret/ci/elastic-kibana/kbn-ui-artifactory`:
 #   registry   - full npm registry URL
 #   npm_token  - auth token
-NPM_REGISTRY="$(vault_kv_get kv/ci-shared/serverless/cloud-ui/kbn-ui-artifactory-registry registry_url)"
-NPM_TOKEN="$(vault_kv_get kv/ci-shared/serverless/cloud-ui/kbn-ui-artifactory-registry npm_token)"
+NPM_REGISTRY="$(vault_get kbn-ui-artifactory registry)"
+NPM_TOKEN="$(vault_get kbn-ui-artifactory npm_token)"
 if [[ -z "$NPM_REGISTRY" || -z "$NPM_TOKEN" ]]; then
   echo "ERROR: Artifactory credentials missing from vault." >&2
   exit 1

.eslintrc.js

@@ -3002,8 +3002,8 @@ module.exports = {
               '@kbn/*',
               '!@kbn/i18n',
               '!@kbn/i18n-react',
-              '!@kbn/core-chrome-layout-constants',
-              '!@kbn/core-chrome-layout-utils',
+              '!@kbn/ui-chrome-layout-constants',
+              '!@kbn/ui-chrome-layout-utils',
             ],
           },
         ],

.github/CODEOWNERS

@@ -360,6 +360,8 @@ src/core/packages/user-storage/server-mocks @elastic/appex-sharedux
 src/core/test-helpers/kbn-server @elastic/kibana-core
 src/core/test-helpers/model-versions @elastic/kibana-core
 src/platform/kbn-ui/chrome-layout @elastic/appex-sharedux
+src/platform/kbn-ui/chrome-layout-constants @elastic/appex-sharedux
+src/platform/kbn-ui/chrome-layout-utils @elastic/appex-sharedux
 src/platform/kbn-ui/side-navigation @elastic/appex-sharedux
 src/platform/packages/private/analytics/utils/analytics_collection_utils @elastic/kibana-core
 src/platform/packages/private/dashboard/dashboard-navigation-options-common @elastic/kibana-presentation
@@ -846,6 +848,7 @@ src/platform/plugins/shared/data_view_editor @elastic/kibana-data-discovery
 src/platform/plugins/shared/data_view_field_editor @elastic/kibana-data-discovery
 src/platform/plugins/shared/data_view_management @elastic/kibana-data-discovery
 src/platform/plugins/shared/data_views @elastic/kibana-data-discovery
+src/platform/plugins/shared/data_views_as_code @elastic/kibana-data-discovery
 src/platform/plugins/shared/dev_tools @elastic/kibana-management
 src/platform/plugins/shared/developer_toolbar @elastic/appex-sharedux
 src/platform/plugins/shared/discover @elastic/kibana-data-discovery
@@ -914,7 +917,6 @@ src/platform/test/plugin_functional/plugins/core_plugin_route_timeouts @elastic/
 src/platform/test/plugin_functional/plugins/core_provider_plugin @elastic/kibana-core
 src/platform/test/plugin_functional/plugins/data_search @elastic/kibana-data-discovery
 src/platform/test/plugin_functional/plugins/elasticsearch_client_plugin @elastic/kibana-core
-src/platform/test/plugin_functional/plugins/eui_provider_dev_warning @elastic/appex-sharedux
 src/platform/test/plugin_functional/plugins/hardening @elastic/kibana-security
 src/platform/test/plugin_functional/plugins/index_patterns @elastic/kibana-data-discovery
 src/platform/test/plugin_functional/plugins/kbn_sample_panel_action @elastic/appex-sharedux
@@ -1188,6 +1190,7 @@ x-pack/platform/plugins/shared/inbox @elastic/security-genai-research-and-develo
 x-pack/platform/plugins/shared/index_management @elastic/kibana-management
 x-pack/platform/plugins/shared/inference @elastic/search-kibana
 x-pack/platform/plugins/shared/inference_endpoint @elastic/search-kibana
+x-pack/platform/plugins/shared/inference_workflows @elastic/search-kibana
 x-pack/platform/plugins/shared/ingest_hub @elastic/obs-onboarding-team
 x-pack/platform/plugins/shared/ingest_pipelines @elastic/kibana-management
 x-pack/platform/plugins/shared/lens @elastic/kibana-visualizations
@@ -3404,6 +3407,8 @@ x-pack/solutions/observability/plugins/observability_shared/public/components/pr
 /src/core/packages/chrome @elastic/appex-sharedux
 /src/platform/kbn-ui/_tooling @elastic/appex-sharedux
 /src/platform/kbn-ui/chrome-layout @elastic/appex-sharedux
+/src/platform/kbn-ui/chrome-layout-constants @elastic/appex-sharedux
+/src/platform/kbn-ui/chrome-layout-utils @elastic/appex-sharedux
 /src/platform/kbn-ui/side-navigation @elastic/appex-sharedux
 /x-pack/platform/test/serverless/api_integration/test_suites/favorites @elastic/appex-sharedux # Assigned per https://github.com/elastic/kibana/pull/200985
 /src/platform/test/api_integration/apis/short_url/**/*.ts @elastic/appex-sharedux # Assigned per https://github.com/elastic/kibana/pull/200209/files#r1846654156

docs/extend/plugin-list.md

@@ -32,6 +32,7 @@ mapped_pages:
 | [dataViewFieldEditor](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/data_view_field_editor/README.md) | The reusable field editor across Kibana! |
 | [dataViewManagement](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/data_view_management) | WARNING: Missing or empty README. |
 | [dataViews](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/data_views/README.mdx) | The data views API provides a consistent method of structuring and formatting documents and field lists across the various Kibana apps. It's typically used in conjunction with <DocLink id="kibDevTutorialDataSearchAndSessions" section="high-level-search" text="SearchSource" /> for composing queries. |
+| [dataViewsAsCode](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/data_views_as_code/README.md) | This plugin contains the defined endpoints for data views as code, following the as code standards. |
 | [developerToolbar](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/developer_toolbar/README.md) | Plugin that enables the developer toolbar in Kibana development mode only. Other plugins can register custom items in the toolbar using the plugin contract. |
 | [devTools](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/dev_tools/README.md) | The ui/registry/dev_tools is removed in favor of the devTools plugin which exposes a register method in the setup contract. Registering app works mostly the same as registering apps in core.application.register. Routing will be handled by the id of the dev tool - your dev tool will be mounted when the URL matches /app/dev_tools#/<YOUR ID>. This API doesn't support angular, for registering angular dev tools, bootstrap a local module on mount into the given HTML element. |
 | [discover](https://github.com/elastic/kibana/blob/main/src/platform/plugins/shared/discover/README.md) | Contains the Discover application and the saved search embeddable. |
@@ -172,6 +173,7 @@ mapped_pages:
 | [indicesMetadata](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/private/indices_metadata/README.md) | Plugin for managing and retrieving metadata about indices in Kibana. This plugin collects and processes metadata from Elasticsearch indices, data streams, ILM policies, and index templates. |
 | [inference](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference/README.md) | The inference plugin is a central place to handle all interactions with the Elasticsearch Inference API and external LLM APIs. Its goals are: |
 | [inferenceEndpoint](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference_endpoint/README.md) | A Kibana plugin |
+| [inferenceWorkflows](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference_workflows/README.md) | Registers AI workflow steps (ai.prompt, ai.summarize, ai.classify) that use the inference plugin to power LLM-based automation in Kibana Workflows. |
 | [infra](https://github.com/elastic/kibana/blob/main/x-pack/solutions/observability/plugins/infra/README.md) | This is the home of the infra plugin, which aims to provide a solution for the infrastructure monitoring use-case within Kibana. |
 | [ingestHub](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ingest_hub/README.md) | Cross-solution onboarding page for adding data sources and integrations. Gated behind the ingestHub.enabled feature flag. |
 | [ingestPipelines](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ingest_pipelines/README.md) | The ingest_pipelines plugin provides Kibana support for Elasticsearch's ingest pipelines. |

docs/reference/configuration-reference/internationalization-settings.md

@@ -30,8 +30,40 @@ When a user sets a preferred language, it is stored in their user profile and ta
 
 {{kib}} resolves the display language using the following priority chain:
 
-1. **User profile setting** — The language selected by the user in their profile or the user menu (must be one of `i18n.locales`).
-2. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+1. **User profile setting** — The language selected by the user in their
+   profile or the user menu (must be one of `i18n.locales`).
+2. **`KBN_LOCALE` cookie** — The most recently rendered locale on this
+   browser. {{kib}} writes this cookie on every rendered response, so it
+   tracks profile changes automatically. The cookie is the fallback used
+   on surfaces where the profile isn't available — login pages, error
+   pages, and any browsing the user does after signing out. Only used
+   when the cookie value matches a locale {{kib}} can serve.
+3. **`Accept-Language` header** {applies_to}`serverless: ga` — On
+   serverless deployments, {{kib}} consults the browser's
+   `Accept-Language` preferences when neither the profile setting nor
+   the cookie produces a match. The first weighted preference that's an
+   exact match (region included) for an entry in `i18n.locales` wins.
+   This step is skipped on traditional/self-managed deployments to keep
+   existing users' language stable across upgrades.
+4. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+
+#### About the `KBN_LOCALE` cookie
+
+{{kib}} sets a `KBN_LOCALE` cookie on every rendered response containing
+the resolved locale id (for example, `KBN_LOCALE=ja-JP`). Attributes:
+
+- Path scoped to the {{kib}} `serverBasePath`.
+- `SameSite=Lax`, `Max-Age` of one year, and `Secure` when the response is over HTTPS.
+- `HttpOnly`. The value is a preference, not a secret, but {{kib}} does not need browser-side JavaScript to read it.
+
+Privacy posture: `KBN_LOCALE` is a strictly-necessary preference cookie.
+It does not track the user, store identity, or enable cross-site activity.
+
+To disable the cookie entirely, set `i18n.allowLocaleCookie: false` in
+`kibana.yml`. When disabled, the per-user language selection still works via
+user profiles; however, anonymous pages and pages visited after signing out
+will always fall back to `i18n.defaultLocale` (or `Accept-Language` on
+serverless deployments) rather than remembering the previously resolved locale.
 
 ## Example configurations
 
@@ -51,4 +83,7 @@ i18n.defaultLocale: "en"
 
 # 4. Legacy form — still works, logs a deprecation warning at startup:
 i18n.locale: "ja-JP"
-```
+
+# 5. Disable the KBN_LOCALE cookie:
+i18n.allowLocaleCookie: false
+```

docs/reference/configuration-reference/internationalization-settings.yml

@@ -1,6 +1,6 @@
 ---
 # This file is used to generate "i18n settings" page in the product docs
-# For the schema and an example refer to the automated settings reference: 
+# For the schema and an example refer to the automated settings reference:
 # https://github.com/elastic/docs-builder/blob/main/docs/syntax/automated_settings.md
 
 product: Kibana
@@ -39,6 +39,19 @@ groups:
           ech: ga
           self: ga
 
+      - setting: i18n.allowLocaleCookie
+        description: |
+          When `true` (the default), {{kib}} writes a `KBN_LOCALE` cookie on every
+          rendered response so the browser remembers the resolved locale across
+          page loads, anonymous pages, and post-logout browsing. Set to `false`
+          to disable the cookie.
+        datatype: boolean
+        default: "true"
+        applies_to:
+          stack: ga 9.5+
+          ech: ga
+          self: ga
+
       - setting: i18n.locale
         description: |
           Set the {{kib}} interface language.
@@ -59,4 +72,4 @@ groups:
         applies_to:
           stack: deprecated 9.5+
           ech: ga
-          self: ga
+          self: ga

fleet_packages.json

@@ -30,7 +30,7 @@
   },
   {
     "name": "elastic_agent",
-    "version": "2.9.2"
+    "version": "2.9.3"
   },
   {
     "name": "endpoint",