…e_for_children6

* commit '3402744f63ca1196e97b11ffac4e7f7efab240df': (80 commits)
  [PerUserAuth] Add EARS auth type for Connectors V2 (elastic#253695)
  Fix `@elastic/eui/require-aria-label-for-modals` lint violations across `@elastic/kibana-core` files (elastic#259757)
  [Entity Analytics][Leads generation][4] Add API routes, LeadDataClient, and async generation (elastic#257046)
  [Agent Builder] Agent-centric UX redesign (elastic#258005)
  fix query streams failing test (elastic#260277)
  [Lens as code] Add list layout to the new API (elastic#259967)
  [FTR] Add warning comments to deployment-agnostic FTR base configs (elastic#260018)
  [Discover][Logs profile] Fix missing search highlights (elastic#260056)
  Plugin system: safe deletion (elastic#259038)
  [Infra] Fix Hosts filter options to match selected schema (elastic#259825)
  Manual Entity Resolution and flyout representation (elastic#260162)
  [Cascade] Handle grouping on fields with unset values (elastic#260033)
  [Fleet] generate OTel config for integration packages with otelcol inputs (elastic#259968)
  [Search] Switch over to V2 index management details (elastic#259866)
  [inference] increase timeout for ES inference calls (elastic#260382)
  [ES|QL] Enable subqueries (elastic#257455)
  [ES|QL] Change Point order free options (elastic#260282)
  [Auth] Added authentication strategy for UIAM OAuth (elastic#256182)
  [Security Solution] Add "alerts_candidate_count" rule execution metric (elastic#259917)
  [api-docs] 2026-03-31 Daily api_docs build (elastic#260380)
  ...

Resolve conflicts after PRs elastic#255272 (Foundation), elastic#256156 (Observation
Modules), elastic#256628 (Entity Retrieval), and elastic#257046 (CRUD API Routes)
were merged into main.

Key resolutions:
- Keep main's authoritative versions of observation modules with
  data-driven tier tables and RiskScoreDataClient integration
- Add scheduling-specific weight properties to module configs
- Wire RiskScoreDataClient through RunPipelineParams via dependency
  injection (route uses context, task creates from CoreStart)
- Preserve main's .keyword suffix fixes in lead_data_client ES queries
- Keep scheduling branch's single-file behavioral_analysis_module
  (consolidated from subdirectory structure) and remove stale subdir
- Delete generate_leads.test.ts (coverage moved to run_pipeline.test.ts)
- Preserve Task Manager registration, enable/disable route wiring,
  and run_pipeline shared orchestration from scheduling branch

Note: pre-commit hook bypassed because ESLint failures are from
upstream kbn-evals-suite-significant-events package (pre-existing
in main), not from lead generation changes.

…t, and async generation (elastic#257046)

## Summary

- **LeadDataClient abstraction** : Extracted all Elasticsearch CRUD
operations (create, find, get-by-id, dismiss, bulk-update, status,
delete) into a dedicated `LeadDataClient` with snake_case ↔ camelCase
transform layer between index mappings and API types
- **Async generate endpoint** — Refactored `POST /generate` to return an
`executionUuid` immediately and run the pipeline (entity retrieval ->
observation modules -> scoring -> synthesis -> persistence) in the
background
- **Six new API routes** : Added `GET /{id}`, `GET /status`, `POST
/{id}/_dismiss`, `POST /bulk_update`, `POST /enable`, and `POST
/disable` with Zod-validated schemas, versioned routing, and proper
authorization
- **Shared Zod schemas** : Moved all request/response schemas to common
types (generateLeadsRequestSchema, findLeadsRequestSchema,
getLeadByIdRequestSchema, dismissLeadRequestSchema,
bulkUpdateLeadsRequestSchema, generateLeadsResponseSchema)
- **Refactored GET /leads** : Now delegates to
`LeadDataClient.findLeads` with page/perPage/sortField/sortOrder/status
query params
- **Unit tests** : Added tests for LeadDataClient (createLeads,
findLeads, getLeadById, dismissLead, bulkUpdateLeads, getStatus,
deleteAllLeads) and all route handlers (get_leads, get_lead_by_id,
get_lead_generation_status, dismiss_lead, bulk_update_leads, enable,
disable)

Enable and disable routes are placeholder stubs pending Task Manager
wiring (elastic#15955).

Relates to: elastic/security-team#15953

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Flaky Test Runner was used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the guidelines
- [ ] Review the backport guidelines and apply applicable `backport:*`
labels.


## Testing Steps

**Manual verification** Start Kibana locally and test the API endpoints
below.

## API Examples

### Generate leads (async)
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/generate" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "elastic-api-version: 1" \
  -u <....> \
  -d '{"connectorId": "optional-connector-id"}'
```
Returns: `{ "executionUuid": "abc-123-..." }`

### Find leads
```bash
curl -X GET "http://localhost:5601/internal/entity_analytics/leads?page=1&perPage=10&sortField=priority&sortOrder=desc" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "leads": [...], "total": 42, "page": 1, "perPage": 10 }`

### Get lead by ID
```bash
curl -X GET "http://localhost:5601/internal/entity_analytics/leads/{id}" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: full `leadSchema` object

### Get status
```bash
curl -X GET "http://localhost:5601/internal/entity_analytics/leads/status" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "isEnabled": false, "indexExists": true, "totalLeads": 42,
"lastRun": "..." }`

### Dismiss a lead
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/{id}/_dismiss" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "success": true }`

### Bulk update
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/bulk_update" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "elastic-api-version: 1" \
  -u <....> \
  -d '{"ids": ["id-1", "id-2"], "status": "dismissed"}'
```
Returns: `{ "updated": 2 }`

### Enable scheduled generation
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/enable" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "success": true }`

### Disable scheduled generation
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/disable" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "success": true }`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Jared Burgett <147995946+jaredburgettelastic@users.noreply.github.com>
Co-authored-by: jaredburgettelastic <jared.burgett@elastic.co>

…t, and async generation (elastic#257046)

## Summary

- **LeadDataClient abstraction** : Extracted all Elasticsearch CRUD
operations (create, find, get-by-id, dismiss, bulk-update, status,
delete) into a dedicated `LeadDataClient` with snake_case ↔ camelCase
transform layer between index mappings and API types
- **Async generate endpoint** — Refactored `POST /generate` to return an
`executionUuid` immediately and run the pipeline (entity retrieval ->
observation modules -> scoring -> synthesis -> persistence) in the
background
- **Six new API routes** : Added `GET /{id}`, `GET /status`, `POST
/{id}/_dismiss`, `POST /bulk_update`, `POST /enable`, and `POST
/disable` with Zod-validated schemas, versioned routing, and proper
authorization
- **Shared Zod schemas** : Moved all request/response schemas to common
types (generateLeadsRequestSchema, findLeadsRequestSchema,
getLeadByIdRequestSchema, dismissLeadRequestSchema,
bulkUpdateLeadsRequestSchema, generateLeadsResponseSchema)
- **Refactored GET /leads** : Now delegates to
`LeadDataClient.findLeads` with page/perPage/sortField/sortOrder/status
query params
- **Unit tests** : Added tests for LeadDataClient (createLeads,
findLeads, getLeadById, dismissLead, bulkUpdateLeads, getStatus,
deleteAllLeads) and all route handlers (get_leads, get_lead_by_id,
get_lead_generation_status, dismiss_lead, bulk_update_leads, enable,
disable)

Enable and disable routes are placeholder stubs pending Task Manager
wiring (elastic#15955).

Relates to: elastic/security-team#15953

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [ ] Flaky Test Runner was used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the guidelines
- [ ] Review the backport guidelines and apply applicable `backport:*`
labels.


## Testing Steps

**Manual verification** Start Kibana locally and test the API endpoints
below.

## API Examples

### Generate leads (async)
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/generate" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "elastic-api-version: 1" \
  -u <....> \
  -d '{"connectorId": "optional-connector-id"}'
```
Returns: `{ "executionUuid": "abc-123-..." }`

### Find leads
```bash
curl -X GET "http://localhost:5601/internal/entity_analytics/leads?page=1&perPage=10&sortField=priority&sortOrder=desc" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "leads": [...], "total": 42, "page": 1, "perPage": 10 }`

### Get lead by ID
```bash
curl -X GET "http://localhost:5601/internal/entity_analytics/leads/{id}" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: full `leadSchema` object

### Get status
```bash
curl -X GET "http://localhost:5601/internal/entity_analytics/leads/status" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "isEnabled": false, "indexExists": true, "totalLeads": 42,
"lastRun": "..." }`

### Dismiss a lead
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/{id}/_dismiss" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "success": true }`

### Bulk update
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/bulk_update" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -H "elastic-api-version: 1" \
  -u <....> \
  -d '{"ids": ["id-1", "id-2"], "status": "dismissed"}'
```
Returns: `{ "updated": 2 }`

### Enable scheduled generation
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/enable" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "success": true }`

### Disable scheduled generation
```bash
curl -X POST "http://localhost:5601/internal/entity_analytics/leads/disable" \
  -H "kbn-xsrf: true" \
  -H "elastic-api-version: 1" \
  -u <....>
```
Returns: `{ "success": true }`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Jared Burgett <147995946+jaredburgettelastic@users.noreply.github.com>
Co-authored-by: jaredburgettelastic <jared.burgett@elastic.co>